Threat Intelligence Briefing

Global threat activity remained stable compared to the previous 6-hour period, with a negligible -0.1% change in total events. The volume aligns closely with the 7-day average, dominated by reconnaissance (92% of all threats), primarily originating from the US, China, and Germany. Activity across Nordic regions is consistent with baseline patterns—Sweden and Finland report expected levels of brute-force and scanning behavior. No new or emerging campaigns were identified; observed IPs from Romania, Luxembourg, and Bulgaria are part of long-standing automated scanning networks, active for over three weeks without escalation. The top infrastructure contributors are residential ISPs and small hosting providers, with Unmanaged Ltd generating the highest report density per IP. Consider temporary blocking or rate-limiting for the /27 subnet associated with Unmanaged Ltd, given its disproportionate output relative to IP count. Focus on ASN-level patterns rather than individual IPs, as threat sources are widely distributed and ephemeral. Routine reconnaissance from major data centers (e.g., DigitalOcean, OVH) should be deprioritized unless targeting specific services. No immediate policy changes are warranted due to lack of deviation.