Threat Intelligence Briefing

Global threat activity increased by 15.0% compared to the previous 6-hour period, with reconnaissance dominating at 119k events—consistent with typical patterns but above average volume. The US, China, and Germany remain top source countries. Notably, Sweden and Finland show elevated activity across botnet C2 and malware C2 categories, with SE hosting <a href="https://ip.wayscloud.services/ip-intelligence/62.60.159.184" target="_blank">62.60.159.184</a>, a persistent malware command-and-control node. This rise is not isolated to one IP or ASN; multiple IPs from residential and datacenter networks in SE, FI, and RO indicate coordinated scanning and brute-force campaigns. The increase is above the 7-day moving average, suggesting a short-term surge rather than background noise. Consider temporary blocking or rate-limiting traffic from suspicious CIDR ranges within ASNs linked to DigitalOcean, OVH, and Chinanet, particularly those exhibiting botnet_c2 or malware_c2 behavior. Deprioritize individual IP blocking—focus instead on pattern-based detection of C2 protocols and SSH brute-force clusters. The presence of known malicious infrastructure in Sweden and Romania warrants closer inspection of inbound connections on ports 22 and 443.