Threat Intelligence Briefing

Threat activity has decreased significantly, down 88.3% compared to the previous six-hour window. The vast majority of identified threats, 98%, are SSH brute-force attempts originating from diverse global locations. Romania is the top originating country (21%), followed by China (11%) and the United States (9%). No significant activity was observed within Nordic countries during this period. Infrastructure analysis is inconclusive due to limited data, and no notable ISP or hosting provider abuse was detected. Tor exit node activity remains at zero. Given the prevalence of SSH brute-force attacks, prioritize monitoring networks for unusual login attempts and consider implementing multi-factor authentication. Focus monitoring on ASNs associated with Romania, China, and the United States. Though unrelated to observed traffic, note CERT-EU's advisory 2025-037 regarding a nation-state actor breaching F5's systems and potentially accessing vulnerability information; defenders using F5 products should urgently apply patches.