Threat Intelligence Briefing

Global threat activity increased by 7.6% compared to the prior 6-hour period, driven primarily by reconnaissance (90% of total events), consistent with the 7-day average in both volume and distribution. No new campaigns or infrastructure clusters emerged; top IPs originate from known Romanian and Chinese ASNs linked to persistent SSH brute-force operations. Nordic regions remain stable, with Sweden and Finland reporting expected levels of botnet and brute-force activity. The observed rise is within normal fluctuation range and not indicative of a novel threat wave. Consider temporary blocking or rate-limiting for the /27 subnet containing <a href="https://ip.wayscloud.services/ip-intelligence/80.94.92.128" target="_blank">80.94.92.128</a> and <a href="https://ip.wayscloud.services/ip-intelligence/2.57.122.177" target="_blank">2.57.122.177</a> (<a href="https://ip.wayscloud.services/country-intelligence/RO" target="_blank">RO</a>), given their recurring role in coordinated SSH attacks. Deprioritize individual IP blocking outside this cluster, as most activity stems from ephemeral residential IPs. Focus monitoring on Unmanaged Ltd and TechOff Srv Limited, which show concentrated malicious reporting despite low IP diversity.