Threat Intelligence Briefing

Global threat activity spiked +117.0% vs previous period, with 309,964 total threats—far exceeding the 7-day average. The surge is driven by reconnaissance (112,505 events) and malware infrastructure (54,395) campaigns, primarily from US, CN, and DE. Notably, Romanian IPs (<a href="https://ip.wayscloud.services/asn-intelligence/39336" target="_blank">AS39336</a>, <a href="https://ip.wayscloud.services/asn-intelligence/49505" target="_blank">AS49505</a>) are central to SSH brute-force clusters, with <a href="https://ip.wayscloud.services/ip-intelligence/80.94.92.128" target="_blank">80.94.92.128</a> and <a href="https://ip.wayscloud.services/ip-intelligence/2.57.122.177" target="_blank">2.57.122.177</a> showing coordinated behavior. Nordic exposure remains proportionally low but stable, with SE and FI reporting expected levels of known attacker infrastructure. No new multi-week campaigns detected—this spike reflects amplified routine scanning, not novel TTPs. Consider temporary blocking or rate-limiting the /24 ranges containing <a href="https://ip.wayscloud.services/ip-intelligence/80.94.92.128" target="_blank">80.94.92.128</a> (<a href="https://ip.wayscloud.services/country-intelligence/RO" target="_blank">RO</a>) and <a href="https://ip.wayscloud.services/ip-intelligence/195.178.110.30" target="_blank">195.178.110.30</a> (<a href="https://ip.wayscloud.services/country-intelligence/BG" target="_blank">BG</a>), both tied to sustained brute-force operations. Deprioritize isolated residential ISP IPs (e.g., Unmanaged Ltd) showing single-event reports. Focus on Datacenter/Hosting patterns—DigitalOcean and Tencent-linked IPs show repeat malicious behavior. Tor exit nodes (1,462 observed) remain noise; maintain existing filtering policies.