Threat Intelligence Briefing

Global threat activity increased by 5.9% compared to the previous 6-hour period, rising from 125,953 to 133,416 total threats. This deviation from the norm is primarily driven by a sustained rise in reconnaissance and malware C2 traffic, with notable clusters in US-hosted infrastructure operated by Google LLC and Microsoft Corporation. The top malicious IPs are linked to Indonesia, Romania, and the US, many exhibiting persistent C2 behavior over the past 14 days—indicating established campaigns, not ephemeral scans. Nordic countries remain stable, with SE and FI reporting expected levels of brute-force and scanning activity, consistent with their 7-day averages. Consider temporary blocking or rate-limiting traffic from CIDR ranges associated with Google and Microsoft IPs exhibiting C2 patterns, particularly those tied to 182.23.2.163/24 and 31.57.184.0/24. Deprioritize isolated SSH brute-force attempts from residential IPs in RO and ID, as these align with routine background noise. Focus detection rules on domain beaconing and encrypted exfiltration signatures from known malware families, rather than individual IP blocklists.