Threat Intelligence Briefing

The threat landscape has receded, with overall threat reports down 16.1% compared to the previous six-hour window. SSH brute-force attacks continue to dominate, accounting for 98.7% of all observed activity. One Swedish IP address was observed conducting SSH brute-force attempts. Romanian IPs are the most active, comprising 18.7% of global attacks, followed by China, US, and Russia. No specific hosting providers are significantly targeted, and no Tor exit node activity was detected. Given the concentration on SSH brute-forcing, defenders should prioritize hardening SSH configurations. Monitor networks originating from Romania (ASNs likely starting with AS30722, AS61280, AS51771), as they represent a disproportionate share of malicious activity. Track any changes in attack patterns involving the top attacking IPs, specifically 2.57.121.112 (Romania), 192.154.248.9 (US), and 161.35.80.235 (Netherlands).