GLOBAL INCIDENT & THREAT INTELLIGENCE BRIEF

Reporting Window: 24 Hours Ending 20 February 2026

BOTTOM LINE UP FRONT (BLUF)

The primary threat vector remains persistent state-sponsored cyber penetration of Western Critical Infrastructure (CI) and escalating kinetic/digital conflict in geopolitically tense regions. Chinese state-backed actors (Volt Typhoon) are confirmed to be actively embedded within U.S. utility systems, confirming pre-positioning for potential disruptive action. Concurrently, terrorist and extremist groups in the Sahel are demonstrating advanced, low-cost drone capabilities, signaling a dangerous tactical shift. Maritime security focused on counter-narcotics has seen recent high-volume interdictions in the Eastern Pacific.

⚡ Critical Infrastructure & Geopolitical Cyber

Active Penetration: Volt Typhoon in U.S. Utilities

Date: Ongoing (Reported 19 February 2026)
Location: United States CI (Water, Power) and NATO Allies
Key Actors: Volt Typhoon (China-backed state actors)
Key Facts: Operational technology firm Dragos confirmed that Volt Typhoon remains active in embedding in U.S. infrastructure through 2025 and 2026. The objective is to pre-position capabilities on operational technology (OT) networks to slow U.S. military mobilization if needed. Analysts warn some compromises may never be fully discovered.
Geolocation Context: Nationwide vulnerability, focused on strategically important sectors like water and power companies.
Tactical Recommendations:
- Mandate immediate, dedicated threat hunting focused on OT networks, specifically searching for low-visibility, long-term access persistence mechanisms.
- Accelerate adoption of Zero Trust Architecture principles, per recent NSA guidelines, across all CI network segments.
- Increase budget allocation for compliance with future government regulations concerning deep OT network visibility and segmentation.
Source Link: [Link]

Geopolitical Hacktivism Targets Winter Olympics

Date: Ongoing since 06 February 2026
Location: Milan and Cortina d’Ampezzo (Italy)
Key Actors: NoName057(16) (Pro-Russian Hacktivist group)
Key Facts: Pro-Russian hacktivist groups have escalated DDoS attacks against infrastructure supporting the 2026 Winter Olympics, linked to Russia’s exclusion from the Games. This follows a pattern observed in previous Olympics after similar exclusions.
Geolocation Context: Digital attacks targeting European hosting infrastructure supporting the Olympic organizing committee and related services.
Tactical Recommendations:
- Implement advanced volumetric and application-layer DDoS protection, capable of handling rapid surges in malicious traffic.
- Review and enforce geo-fencing policies for mission-critical web services originating from known hostile IP ranges.
Source Link: [Link]

💣 Activism / Terrorism / DVE / EVE

Extremist Drone Adoption in the Sahel

Date: Ongoing (Reported 13 February 2026)
Location: Sahel Region (Africa), specifically involving JNIM activity
Key Actors: Jama’a Nusrat ul-Islam wa al-Muslimin (JNIM), an Al-Qaeda affiliate
Key Facts: JNIM and other violent non-state actors are increasingly utilizing repurposed, low-cost drones for tactical surveillance and kinetic attacks. JNIM has launched nearly 100 drone attacks since 2023, showcasing an evolving operational capability. This trend is predicted to migrate to Western countries in 2026.
Geolocation Context: Conflict zones across the Sahel, leveraging ungoverned spaces for training and deployment.
Tactical Recommendations:
- Intelligence assets must prioritize tracking the technical supply chain for commercial off-the-shelf (COTS) drone components used by extremist groups.
- Security teams guarding soft targets or large gatherings in high-risk zones should evaluate Counter-UAS (C-UAS) technology implementation and protocols.
Source Link: [Link]

U.S. Federal Investigation of Environmental Group

Date: Visits reported on 18 February 2026
Location: United States
Key Actors: Extinction Rebellion (XR) members, U.S. FBI Joint Terrorism Task Force (JTTF)
Key Facts: Environmental activist group Extinction Rebellion reported that the FBI is conducting a federal investigation into the group, with JTTF agents visiting current and former members. XR maintains it is non-partisan and uses non-violent direct action.
Geolocation Context: Former member visited 200 miles outside New York City.
Tactical Recommendations:
- Monitor social media platforms for escalation of rhetoric or organizational shifts within EVE groups following this increased federal scrutiny.
Source Link: [Link]

⚓ Maritime Events & Crime

International Drug Interdiction in Pacific

Date: 12 February 2026
Location: Eastern Pacific Ocean
Key Actors: U.S. and Mexican Law Enforcement/Military
Key Facts: Coordinated international operation resulted in the seizure of several tons of cocaine. This reflects continuous high-volume maritime drug trafficking targeting North American markets.
Geolocation Context: Open ocean transit routes connecting South American production points with distribution hubs.
Tactical Recommendations:
- Maintain heightened surveillance and information sharing between regional maritime patrols (e.g., U.S. Southern Command, Mexican Navy) to disrupt organized crime networks’ transport logistics.

Fatal Engine Fire on Bulk Carrier

Date: 17 February 2026
Location: Off the coast of China (en route to Yantai Port)
Key Actors: Crew of Singapore-registered bulk carrier MANDY, Maritime and Port Authority of Singapore (MPA)
Key Facts: A fire in the engine room of the bulk carrier MANDY resulted in two crew member fatalities. The fire was extinguished by the crew, and the vessel is being towed to Yantai Port. No pollution was reported.
Geolocation Context: High-traffic commercial shipping lanes off the Chinese coastline.
Tactical Recommendations:
- Maritime operators should conduct immediate safety reviews of engine room protocols, focusing on early detection and containment systems for machinery fires, particularly on older bulk carrier models.
Source Link: [Link]