Threat Intelligence Briefing

Global threat activity increased by +16.2% compared to the previous 6-hour period, rising from 114,358 to 132,901 total threats. This deviation from the recent baseline is primarily driven by a surge in reconnaissance activity (108,640 events), consistent with broad scanning campaigns. The US, China, and Germany remain dominant sources, but Vietnamese IPs—particularly from Viettel Group—show elevated brute-force activity targeting SSH. Nordic regions remain stable, with Sweden and Finland reporting expected levels of attacks and reconnaissance; Norway and Denmark show no anomalous patterns. The top individual IP (<a href="https://ip.wayscloud.services/ip-intelligence/80.94.92.128" target="_blank">80.94.92.128</a>, Romania) is linked to sustained SSH brute-forcing, though no new infrastructure or campaigns emerged. Consider temporary blocking or rate-limiting CIDR ranges associated with Viettel Group in Vietnam and Unmanaged Ltd in Romania, where clustered brute-force behavior persists. Focus on patterns rather than single IPs, as most are ephemeral. Routine reconnaissance from datacenter and residential ISPs remains within expected thresholds and should be deprioritized unless tied to repeated targeting. No immediate action is required for Nordic-originating traffic, as no deviation from baseline was observed.