Threat Intelligence Briefing

Global threat activity surged +123.3% compared to the prior 6-hour period, a significant deviation from the 7-day average. The spike is driven primarily by reconnaissance (115k events) and low-reputation traffic, with notable contributions from known malicious infrastructure in Romania and Bulgaria. Nordic countries remain within expected thresholds, though Sweden and Finland show elevated botnet and SSH brute-force activity linked to BG and RO ASNs. The top IPs are clustered in Eastern Europe, operating under Unmanaged Ltd and TechOff Srv—both previously observed in short-lived, high-volume campaigns lasting under 72 hours. Consider temporary blocking or rate-limiting the /24 ranges associated with 91.92.40.0/24 (<a href="https://ip.wayscloud.services/country-intelligence/BG" target="_blank">BG</a>) and 195.178.110.0/24 (<a href="https://ip.wayscloud.services/country-intelligence/BG" target="_blank">BG</a>), especially for SSH and brute-force vectors. Deprioritize isolated events from residential ISPs like Viettel or China Telecom, as they reflect background noise. Focus instead on datacenter-hosted infrastructure with multi-category alerts, particularly those tied to known attacker networks.