Threat Intelligence Briefing

Global threat activity spiked +97.7% compared to the prior 6-hour period, a significant deviation from the 7-day average. This surge is driven by coordinated reconnaissance and malware infrastructure campaigns, primarily from IP clusters in Romania (<a href="https://ip.wayscloud.services/country-intelligence/RO" target="_blank">RO</a>), the US, and Bulgaria, linked to known brute-force operations. Nordic regions remained relatively stable, with Sweden and Finland reporting expected levels of known attacker activity. The ASNs tied to Unmanaged Ltd and TechOff Srv Limited show concentrated malicious behavior, differing from routine background noise due to multi-category targeting and repeated SSH brute-force patterns. Activity from these providers has persisted for over two weeks, indicating established infrastructure. Consider temporary blocking or rate-limiting the Romanian /26 and Bulgarian /28 CIDR ranges associated with the top brute-force IPs. Focus on ASN-level enforcement for Unmanaged Ltd and TechOff Srv Limited rather than individual IPs. Deprioritize isolated events from residential ISPs and Google/Microsoft IPs, as these align with low-level background noise and are likely compromised endpoints rather than coordinated threats.