Threat Intelligence Briefing

Global threat activity increased by 14.4% compared to the previous 6-hour period, a clear deviation from the 7-day average that typically shows less than 5% fluctuation. The rise is driven primarily by reconnaissance (81.8% of total events) and malware C2 traffic, with notable clusters in US-hosted infrastructure, particularly Google LLC and Microsoft Corporation, indicating potential abuse of cloud resources. Nordic countries remain within historical norms, with SE and FI reporting expected levels of scanning and brute-force activity; no new or prolonged campaigns were observed in the region. The top individual IPs, including <a href="https://ip.wayscloud.services/ip-intelligence/182.23.2.163" target="_blank">182.23.2.163</a> (<a href="https://ip.wayscloud.services/country-intelligence/ID" target="_blank">ID</a>) and <a href="https://ip.wayscloud.services/ip-intelligence/80.94.92.128" target="_blank">80.94.92.128</a> (<a href="https://ip.wayscloud.services/country-intelligence/RO" target="_blank">RO</a>), are part of short-lived malware C2 and SSH brute-force patterns, active for less than 48 hours. Consider temporary blocking or rate-limiting on inbound connections from suspicious ranges within Google and Microsoft ASNs exhibiting repeated malware C2 behavior. Prioritize monitoring over blocking for IPs in DigitalOcean and Alibaba networks due to their frequent IP recycling. Deprioritize individual IP responses—focus instead on pattern detection around reconnaissance spikes and C2 beaconing. No immediate action is required for Nordic-sourced traffic, as current levels reflect routine background noise.