Threat Intelligence Briefing

Global threat activity spiked +114.9% compared to the prior 6-hour period, a significant deviation from the 7-day average. The surge is driven primarily by reconnaissance and malware infrastructure campaigns, with notable contributions from known attacker IPs. Activity from Bulgaria (<a href="https://ip.wayscloud.services/country-intelligence/BG" target="_blank">BG</a>) stands out, particularly two IPs from the 195.178.110.0/24 range linked to brute-force and malware operations. Nordic countries remain within expected thresholds, with SE and FI showing typical patterns; NO and DK volumes are low but stable. This is not background noise—campaigns show coordinated targeting. Consider temporary blocking or rate-limiting the 195.178.110.0/24 range and monitor for lateral movement. Deprioritize isolated events from residential ISPs unless tied to known attacker infrastructure. Focus detection rules on SSH brute-force and web attack patterns from datacenter-hosted IPs, especially those with multi-category alerts. No evidence suggests novel TTPs—this aligns with ongoing automated scanning campaigns.