Threat Intelligence Briefing

Global threat activity increased by 23.7% compared to the previous 6-hour period, marking a clear deviation from the 7-day average. The rise is driven primarily by reconnaissance (109k events) and attacks, with malware C2 infrastructure concentrated in the US (<a href="https://ip.wayscloud.services/ip-intelligence/147.93.191.75" target="_blank">147.93.191.75</a>, <a href="https://ip.wayscloud.services/ip-intelligence/31.57.184.154" target="_blank">31.57.184.154</a>) and Indonesia (<a href="https://ip.wayscloud.services/ip-intelligence/182.23.2.163" target="_blank">182.23.2.163</a>). Nordic countries remain stable, with SE and FI showing typical abuse patterns including SSH brute force and botnet activity. No new persistent campaigns detected—most IPs have been active for over two weeks, indicating sustained infrastructure rather than ephemeral bursts. Consider temporary blocking or rate-limiting the US-based malware C2 clusters and associated ASNs, particularly those tied to Google and Microsoft hosting. Deprioritize individual residential IPs from China and Brazil, as their volume aligns with routine background noise. Focus monitoring on recurring C2 patterns instead of isolated IPs, given their persistence and multi-category targeting.