Threat Intelligence Briefing

Global threat activity increased by 11.4% compared to the prior 6-hour period, with reconnaissance remaining the dominant category at 114,950 events. This rise is consistent with the 7-day average trend and reflects typical background noise rather than a novel campaign. No Nordic country showed deviation from baseline; SE and FI reported expected levels of abuseIPDB-listed IPs and brute-force activity. The top individual IPs are ephemeral and tied to known malware C2 and SSH brute-force patterns, primarily from residential and datacenter networks in Indonesia, Romania, and the US. Notably, Google LLC and Microsoft infrastructure each contributed over 7,000 unique malicious IPs, indicating abuse of cloud perimeters. Consider temporary blocking or rate-limiting at the subnet level for repeated offenders within Google and Microsoft ASNs, particularly those associated with malware C2. Focus on patterns rather than single IPs, as the majority of threats originate from distributed residential and hosting infrastructure. Deprioritize isolated SSH brute-force attempts from short-lived IPs unless part of a larger cluster. No immediate escalation needed, as this aligns with routine adversarial scanning behavior.