Threat Intelligence Briefing

Threat activity decreased significantly, down 77.6% compared to the previous six-hour period. Globally, malware command and control traffic dominates, comprising 93% of observed threats. Most activity originates from datacenters. Within the Nordic region, we observed a single SSH brute-force attempt originating from Sweden. No specific hosting providers stand out, but several top attacking IPs lack reliable country of origin data, indicating potential proxying or anonymization techniques. There were zero Tor exit node connections observed during this period. Given the prevalence of malware C2 activity, monitor networks associated with known botnet infrastructure and ASNs hosting suspicious activity. Focus on identifying and blocking traffic to the top attacking IPs (45.64.246.16, 3.72.132.44, 101.43.58.190, 154.198.50.152, 165.232.168.59). CERT-EU recently released advisories regarding critical vulnerabilities in FortiOS, Veeam Backup, and F5 products; while we haven't directly observed exploitation attempts, ensure systems