Threat Intelligence Briefing

Global threat activity spiked +122.8% compared to the prior 6-hour period, with reconnaissance and malware infrastructure campaigns driving the surge. This represents a significant deviation from typical behavior, as volumes are well above the 7-day average. The US, China, and Germany contributed 45% of total events, with notable clusters in RO and BG tied to sustained SSH brute-force operations. Nordic regions remained proportionally stable, though Sweden and Finland saw elevated malware infrastructure activity linked to known attacker groups. The top IPs are part of long-standing malicious patterns, active for over three weeks, rather than ephemeral scans. Consider temporary blocking or rate-limiting the CIDR ranges associated with Unmanaged Ltd and OVH SAS, where multiple high-frequency IPs are clustered. Deprioritize isolated residential ISP IPs with single reports, as these align with routine background noise. Focus detection rules on recurring patterns in ASNs tied to known malware delivery, particularly those with cross-regional reconnaissance and brute-force overlap.