Threat Intelligence Briefing

Global threat activity increased significantly, with 159,796 total threats recorded—40.2% higher than the previous 6-hour period. This surge is primarily driven by reconnaissance (103,829 events) and malware C2 traffic, concentrated in US, China, and India. The rise is not isolated to one region or infrastructure type, with both residential/ISP and datacenter sources contributing. Notably, multiple IPs from DigitalOcean and Alibaba show persistent malware C2 behavior, indicating potential compromised cloud instances. Nordic countries remain within expected thresholds, though SE and FI report broad attack categories including SSH brute force and botnet activity—consistent with baseline. Consider temporary blocking or rate-limiting /24 ranges associated with repeat malicious cloud-hosted IPs, particularly from DigitalOcean (<a href="https://ip.wayscloud.services/asn-intelligence/14061" target="_blank">AS14061</a>) and Alibaba (<a href="https://ip.wayscloud.services/asn-intelligence/45102" target="_blank">AS45102</a>). Focus on patterns: malware C2 clusters in PH and ID with ties to known botnets are more actionable than individual IPs. Deprioritize isolated spam or single-event reconnaissance, as these align with routine background noise. No new campaigns detected—current activity reflects escalation of existing threats.