Threat Intelligence Briefing

The current threat landscape indicates a significant escalation, with overall threat reports surging 70% compared to the previous six-hour window. Globally, malware command and control (C2) activity dominates, accounting for 54% of observed threats, followed by SSH brute-force attempts. Limited Nordic activity was observed, with Sweden reporting two unique IPs involved in SSH brute-force attacks and Finland reporting one. No specific infrastructure patterns were identified, and Tor exit node activity remains negligible. Focus should be directed towards monitoring ASNs hosting IPs 45.135.232.0/24 (Russia) due to persistent SSH brute-force activity. The surge in malware C2 traffic warrants increased vigilance for related network indicators and endpoint compromises. Closely track emerging botnet C2 infrastructure, which represents 8% of the threat landscape, to proactively mitigate potential botnet infections.