Threat Intelligence Briefing

Global threat activity surged significantly, with a +119.5% increase compared to the prior 6-hour period, far exceeding the 7-day average. This deviation is driven primarily by reconnaissance and low-reputation traffic, concentrated in known malicious patterns from Vietnam, Romania, and Bulgaria. Nordic countries remain stable, with SE and FI showing typical multi-category activity consistent with regional baselines. The top individual IPs are tied to brute force and malware infrastructure, but no new campaigns or zero-day indicators were observed—most sources have been active for weeks. Consider temporary blocking or rate-limiting the CIDR ranges associated with Viettel Group and Unmanaged Ltd, where repeated malicious behavior clusters. Deprioritize isolated residential IP reports, as they reflect background noise. Focus detection rules on SSH and web-based brute force patterns from ASNs in RO, VN, and BG, which show coordinated increases. No immediate policy changes needed for Nordic-originated traffic.