Threat Intelligence Briefing

Global threat activity spiked +105.1% compared to the prior 6-hour period, with reconnaissance and malware infrastructure dominating at over 100,000 events each. This surge is not consistent with the 7-day average and represents a clear deviation from typical background noise. While US and CN remain top source countries, Romania and Bulgaria are emerging as notable origins for brute-force campaigns, with multiple IPs from ASNs in these regions exhibiting coordinated SSH and web-targeted attacks. Nordic exposure remains proportionally low but broad, particularly in SE and FI, where known attacker IPs and malware infrastructure show sustained scanning activity. Consider temporary blocking or rate-limiting the Romanian and Bulgarian CIDR ranges associated with brute-force clusters, especially those tied to Unmanaged Ltd and other low-reputation hosting providers. Deprioritize isolated residential IP reports, as they align with routine background noise. Focus detection logic on patterns involving multi-category IPs—particularly those combining malware infrastructure with SSH or web brute-force—rather than ephemeral single-event sources.