Threat Intelligence Briefing

Threat activity has surged, with overall reports increasing 43.9% compared to the previous six-hour window. The vast majority of global malicious activity (99%) is related to SSH brute-force attempts. Within the Nordic region, Sweden (5 reports) and Finland (3 reports) experienced minor SSH brute-force activity. The top attacking IPs originate primarily from Russia and Romania. No significant Tor exit node activity was observed. We have not identified any specific datacenter or residential infrastructure patterns. Given the elevated SSH brute-force activity, we recommend defenders closely monitor network traffic for suspicious login attempts and strengthen SSH access controls. Prioritize monitoring networks originating from Russia (RU) and Romania (RO). Continue tracking global trends for any emerging threats beyond SSH attacks. No CERT-EU advisories are applicable to these observations.