Threat Intelligence Briefing

Observed threat activity increased 22.3% compared to the previous six-hour window, with SSH brute-force attacks comprising 100% of reported incidents. The majority of attacks originated from Romania, the US, China and Russia. While no Nordic-specific activity was observed, infrastructure analysis indicates a broad campaign targeting exposed SSH services across various regions. We have not detected any significant malicious traffic originating from Tor exit nodes, nor have we found any specific ISPs or hosting providers being disproportionately targeted. Given the surge in SSH brute-force attempts, prioritize monitoring networks originating from RO, US, CN, and RU. Analyze traffic patterns targeting SSH ports (22) for anomalous login attempts or credential stuffing. Consider implementing rate limiting and multi-factor authentication to mitigate potential compromises. Continue monitoring for emerging threats targeting other protocols and services, as threat actors may shift tactics.