Threat Intelligence Briefing

Global threat activity increased significantly, with 156,586 total threats recorded—33.0% higher than the previous 6-hour period. This rise is driven primarily by reconnaissance (109,578 events) and attacks (14,672), concentrated in US, China, and Brazil. Notably, Google LLC and Microsoft infrastructure show elevated reporting, indicating potential abuse of cloud resources. Nordic countries remain within expected ranges, with Sweden and Norway showing typical patterns of brute_force and malware_c2 activity. The increase aligns with broader trends in automated scanning, not a novel campaign. Consider temporary blocking or rate-limiting IPs from Google and Microsoft ASNs exhibiting malware_c2 behavior, especially <a href="https://ip.wayscloud.services/ip-intelligence/182.23.2.163" target="_blank">182.23.2.163</a> (<a href="https://ip.wayscloud.services/country-intelligence/ID" target="_blank">ID</a>) and <a href="https://ip.wayscloud.services/ip-intelligence/147.93.191.75" target="_blank">147.93.191.75</a> (<a href="https://ip.wayscloud.services/country-intelligence/US" target="_blank">US</a>). Focus on clusters in datacenter ranges rather than individual IPs. Deprioritize isolated spam or scanning events from residential ISPs unless part of larger patterns—this volume is consistent with routine background noise.