Threat Intelligence Briefing

Global threat activity decreased by 4.0% compared to the previous 6-hour period, with 122,541 total threats—consistent with the 7-day average. Reconnaissance remains dominant (89% of events), primarily from known IP clusters in the US, CN, and DE. No emerging campaigns detected; observed patterns align with routine background noise. Nordic regions show stable activity, with Sweden and Finland reporting expected levels of brute-force and SSH attacks. The Romanian IP cluster 80.94.92.0/24 (Unmanaged Ltd) persists as a recurring source of SSH bruteforce attempts, indicating an ongoing but non-escalating campaign. Consider temporary blocking or rate-limiting the 80.94.92.0/24 and 2.57.122.177/32 ranges due to repeated malicious activity. Deprioritize individual IPs from Microsoft and Scaleway, as their volumes remain low and within typical cloud-hosted noise. Focus on ASN-level patterns—particularly Unmanaged Ltd and TechOff Srv—rather than ephemeral IPs. No immediate action required for Nordic-originated traffic, as no deviations from baseline were observed.