Attackers Without Borders: The Italian View Of Global Malicious Traffic

Summary: GreyNoise Labs analyzed 30 days of malicious traffic between late September and late October 2023, observing 44,700 malicious exploitation attempts against Italian IP address space and 7,937 attacks originating from Italy against other countries' networks. SSH bruteforcing held the top tag spot for Italian IP space in this period, with the Mirai botnet close behind, and 487 of the inbound attempts (1.1%) were directed only at Italy.
What's compelling: Mobile networks ranked fourth among sources of malicious connection attempts, and blocking them is hard when mobile traffic is roughly 40-50% of all benign traffic to most websites - so defenders face a tradeoff between noise and access. The source also notes that a default or misconfigured system left exposed for less than an hour can be absorbed into the adversarial inventory used for later targeted attacks.

Read the original at GreyNoise Blog ↗