Threat Intelligence Briefing

Global threat activity increased by 26.6% compared to the previous 6-hour period, with reconnaissance dominating at 108,557 events—consistent with recent trends but notably above the 7-day average. The rise is primarily driven by infrastructure in the US, China, and Romania, with clusters tied to Google LLC and DigitalOcean showing elevated malware C2 and brute-force activity. Nordic countries remain stable, with Sweden and Finland reporting expected levels of abuse and scanning; no new campaigns or prolonged threats were observed in the region. Activity aligns with ongoing automated scanning, not a novel campaign. Consider temporary blocking or rate-limiting for CIDR ranges under Google and DigitalOcean associated with repeated malware C2 IPs, particularly 103.11.41.0/24 (<a href="https://ip.wayscloud.services/country-intelligence/PH" target="_blank">PH</a>) and 182.23.2.0/24 (<a href="https://ip.wayscloud.services/country-intelligence/ID" target="_blank">ID</a>). Deprioritize isolated SSH brute-force attempts from single IPs in residential ASNs, as these reflect routine background noise. Focus detection logic on persistent patterns across datacenter-hosted infrastructure rather than ephemeral IP spikes.