Threat Intelligence Briefing

Global threat activity increased by 12.5% compared to the prior 6-hour period, with reconnaissance dominating at 112,776 events—consistent with typical patterns but elevated in volume. The rise is primarily driven by infrastructure in the US, China, and Germany, with Google LLC and Microsoft Corporation contributing significant shares of observed activity. Nordic regions remain stable, with Sweden and Finland reporting expected levels of scanning and brute-force activity; Norway and Denmark show no deviation from baseline. Most threats align with persistent campaigns leveraging known malware C2 and SSH brute-force tactics, rather than novel infrastructure. The top malware C2 IPs, including <a href="https://ip.wayscloud.services/ip-intelligence/182.23.2.163" target="_blank">182.23.2.163</a> (Indonesia) and <a href="https://ip.wayscloud.services/ip-intelligence/31.57.184.154" target="_blank">31.57.184.154</a> (<a href="https://ip.wayscloud.services/country-intelligence/US" target="_blank">US</a>), are part of long-standing malicious networks active for over three weeks. Consider temporary blocking or rate-limiting traffic from high-reporting ASNs, particularly Google and Microsoft-hosted IPs exhibiting malware C2 behavior, as these may indicate compromised cloud assets. Focus on patterns over individual IPs—especially recurring C2 callbacks and coordinated SSH brute-force clusters—rather than isolated events. Deprioritize routine scanning from residential IPs unless tied to broader campaigns, as this remains background noise. No immediate action is needed for Nordic-sourced traffic, as no anomalous behavior was detected.