Threat Intelligence Briefing

Global threat activity increased by 2.4% compared to the previous 6-hour period, consistent with the 7-day average and within normal fluctuation range. Reconnaissance remains dominant (92.6% of all threats), primarily from known scanning patterns in US, CN, and DE. No new campaigns detected; top IPs originate from Vietnam and Romania, linked to SSH brute-force clusters under Viettel Corporation and <a href="https://ip.wayscloud.services/asn-intelligence/207737" target="_blank">AS207737</a>. Nordic activity is stable, with SE and FI showing expected background noise from residential ISPs. No deviation in DK or NO, where volumes remain low but consistent. The 744 Tor exit node sightings align with baseline, indicating no surge in anonymized attacks. Consider temporary blocking or rate-limiting the /24 subnets associated with 116.99.168.0/24 (Viettel) and 80.94.92.0/24 (RCS Communications). Focus on infrastructure patterns rather than individual IPs, as threats are clustered within specific ASNs. Deprioritize isolated events from Microsoft and TechTies, which show low volume and no escalation. No immediate action needed for Nordic-sourced traffic, as no anomalous behavior is present.