Threat Intelligence Briefing

Global threat activity increased by 10.4% compared to the prior 6-hour period, primarily driven by reconnaissance (91% of total events) and sustained malware C2 traffic. This rise is above the 7-day average, indicating a deviation from typical background noise. Notably, DigitalOcean and Google-hosted infrastructure show elevated malicious activity, with multiple IPs from these providers involved in coordinated scanning and C2 operations. Nordic countries remain stable, with SE and FI reporting expected levels of abuse and brute-force attempts, consistent with regional baselines. Consider temporary blocking or rate-limiting traffic from suspicious CIDR blocks within DigitalOcean (<a href="https://ip.wayscloud.services/asn-intelligence/14061" target="_blank">AS14061</a>) and Google (<a href="https://ip.wayscloud.services/asn-intelligence/15169" target="_blank">AS15169</a>), particularly those exhibiting malware C2 patterns. Focus on clusters rather than individual IPs like <a href="https://ip.wayscloud.services/ip-intelligence/182.23.2.163" target="_blank">182.23.2.163</a> (<a href="https://ip.wayscloud.services/country-intelligence/ID" target="_blank">ID</a>), which has been active for over two weeks and is likely part of a persistent botnet. Deprioritize isolated SSH brute-force attempts from residential IPs, as they reflect routine scanning behavior.