Threat Intelligence Briefing

Global threat activity surged +109.9% compared to the prior 6-hour period, a significant deviation from typical levels, with reconnaissance and malware infrastructure dominating. The spike is concentrated in known malicious patterns, particularly from Vietnam-based Viettel Group IPs like <a href="https://ip.wayscloud.services/ip-intelligence/171.231.180.249" target="_blank">171.231.180.249</a> and <a href="https://ip.wayscloud.services/ip-intelligence/171.231.188.166" target="_blank">171.231.188.166</a>, both engaged in SSH brute-force campaigns. Nordic countries remain below global thresholds, with Sweden and Finland reporting expected background noise; no unusual regional deviations observed. Most activity aligns with persistent scanning and credential-stuffing infrastructure rather than novel campaigns. Consider temporary blocking or rate-limiting the /24 CIDR ranges of recurring malicious IPs from Viettel Group and NL-based <a href="https://ip.wayscloud.services/ip-intelligence/185.242.3.195" target="_blank">185.242.3.195</a>, which is tied to known attacker infrastructure. Deprioritize isolated events from residential ISPs and Google/Microsoft cloud IPs with single-digit reports, as these reflect routine background noise. Focus on ASN-level patterns in Vietnam and Bulgaria, where coordinated brute-force operations show sustained activity over multiple cycles.