The Evolving Threat

Memorandum

Subject: The Evolving Threat
To: All Readers and Interested Parties
From: Greg Smith, Author
Date:  10 OCT 2026

BACKGROUND:

According to the Federal Bureau of Investigation (FBI), internet crime spiked in 2025, reaching over 1 million reports to the FBI Internet Crime Complaint Center (IC3) for the first time. For 2025, the US reported losses of $20.9 billion due to cyber-attacks, fraud, and scams, a 26% increase over 2024. Although actual numbers have not yet been tabulated for the current year, reports from independent sources seem to indicate that internet-based crimes are on track to register an increase of around 30% in 2026. Some estimates for 2026 forecast upwards of $10 trillion in losses world-wide due to cybercrime activity.

Prior to 2026, most of the IC3 reported crimes were targeted at scams, phishing, and ransomware attacks for the purpose of financial gains. Although these sorts of attacks continue to be prevalent in 2026, there have also been significant instances of cyber-attacks against infrastructure, municipal systems, and supply chains, particularly in North America. On May 7, 2021, a ransomware attack originating from a group in Russia affected the Colonial Pipeline, shutting the system down for five days. The Colonial Pipeline runs from the Texas Gulf Coast to New Jersey and supplies approximately 45% of all fuel to states in the eastern US. It was the first significant successful attack against US infrastructure in recent times.

Between July 26 and 27, 2026, a coordinated cyber-attack in Minnesota impacted more than 30 wastewater and municipal water systems across the state. A few days later, similar attacks were reported in Georgia, Alabama, New Jersey, and several other states. Although none of these resulted in major disruptions, boil water notices were issued in several jurisdictions. In September 2026, similar attacks targeted pumps, alarms, and remote access infrastructure of several Colorado water utilities. So far in 2026, more than 100 drinking water and wastewater facilities in twelve states have been targets. The Cybersecurity and Infrastructure Security Agency (CISA) issued warnings and alerts in both July and August warning critical infrastructure operators of the ongoing threat posed by cyber-attacks.

The main difference in the threat profile from past years to 2026 is the increase in threats posed by nation-state and state-sponsored threat actors. The 2026 threat assessment posted by the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) specifically calls out several groups linked to the People’s Republic of China (PRC), the Russian Federation, the Islamic Republic of Iran, and the Democratic People’s Republic of North Korea (DPRK). Although sources are reluctant to name the threat actors responsible for recent infrastructure attacks, some news reports indicate that most infrastructure attacks, especially those targeting municipal water systems in 2026, were launched by Iranian Republican Guard Corps (IRGC) aligned groups.

INTELLIGENCE ASSESSMENTS:

Cybercrime has historically been associated with scams focused on stealing money from vulnerable people. Although these sorts of scams and electronic thefts still occur daily, the threat landscape for cyber-attacks is evolving rapidly. Nation-state threats against western interests have increased exponentially in the last five years, driven by new technology and the advent of artificial intelligence (AI). The cybersecurity firm Total Assure reports that AI-driven cyber-attacks are now the largest cyber threat they report. They estimate the number in 2026 will reach at least 947.5 million incidents worldwide, an 18% increase over 2025. This is also a 50% increase over the 600 million attacks they report in 2023.  Of the events they tracked, 57% were targeting North America, with 29% targeting the manufacturing sector, specifically against supply chains. Significantly, AI-enabled adversaries increased by 89% YoY, demonstrating the impact of new technology.

Critical infrastructure, including electrical and communications networks, are likely targets, but other utilities, such as water treatment and distribution networks are also vulnerable. The disruption of critical infrastructure is a major threat to the stability of any country. A shutdown of municipal drinking water systems or electrical power grids could theoretically destabilize population centers. A two-day blackout in New York City at the start of a heat wave in 1977 led to looting, arson, and resulted in more than 550 injured and 4500 arrests.  Both LaGuardia and Kennedy airports were closed due to lack of ventilation, and some 4000 people had to be evacuated from the subway system. Total losses amounted to more than $300 million (approximately $1.5 billion in 2026).

The electrical grid and power generation infrastructure of the US is known to have vulnerabilities. In 2022, gunmen shot into a substation and transformer that controlled the keystone pipeline in North Dakota, shutting down the pipeline and causing $1.7 million damage. In 2023, shots were fired into a substation in North Carolina, causing the system to overheat, shutting off power to 40,000 people. In January 2026, shots were fired into three substations in Maine, causing extensive damage. Both electrical networks and communications nodes are visible, open to attack and normally unguarded except for chain link or barbed wire fencing. A concerted attack on strategically important electrical power delivery systems could cause widespread outages and spark dangerous wildfires.

The New York City example involved only a two-day blackout that affected most, but not all the five Burroughs in the city. A longer-term and more widespread blackout could lead to larger issues, including food insecurity, transportation disruptions, or more widespread anarchy. A cascading blackout affecting a wider area, region, state would most certainly have far greater impact. If such a blackout were tied to (as in 1977) significant weather events (heat or cold) and included disruptions of other critical infrastructure such as drinking water, wastewater, or supply chain disruption, widespread chaos could result. The President signed Executive Order 14421 in August, which is a first step to address the evolving threat to the nation’s critical infrastructure, but does little to address the current vulnerabilities.

Nation-states no longer must fight the US on an equal footing. No nation can match the capabilities and professionalism of the US military. Therefore, few, if any, are likely to challenge the US militarily or directly. However, as the NJCCIC reflects in their threat assessment, nation states continue to pose a tremendous threat to the US through indirect means. Adversaries will always seek to find and exploit security gaps and loopholes to gain advantage over the US. The World Economic Forum Global Cybersecurity Outlook for 2026 (published January 2026) reports that geopolitics is by far the main concern for cybersecurity, citing geopolitics as the driving concern for cybersecurity programs. Wars in Israel, Ukraine, and Iran lead to emerging threats in the cyber realm.

The US military is heavily dependent upon a secure and consistent supply chain. Advanced weapons, munitions, and equipment require regular resupply, maintenance, and rearming. Likewise, the troops need consistent, stable and secure sources of food, water, clothing, and medical supplies to remain combat effective. Disruptions in any supply chain can degrade combat effectiveness and potentially negate the military advantage of US forces. The supply chain that supports the US military extends all the way back to the manufacturer in the US; thus, a major disruption of the supply chain does not require an attack against a hardened military target, base, or ship. For many of our adversaries, the goal is not to defeat the US militarily, it is to disrupt the social fabric, sew chaos, and to control the internal working through economic or cultural means. They win by creating their own battlefield where they can defeat our will or ability to fight on their terms.

In 2026, the threats are legion and far different than even a few years ago. At the start of this century, an attack by a terrorist required extensive preparation, personal contact, and a willing martyr to hijack an airplane, carry a bomb or some other weapon into the fight. That is no longer the case, the new face of war includes drones, autonomous vehicles and boats, remote controls and over-the-horizon weapons. In 2025, Ukraine successfully launched a deep-interdiction drone attack into Russia, Operation Spiderweb. Ukraine disguised drone launchers as common commercial trucks and leveraged the Russian cellular networks to manage the attack and guide the drones. The attack involved well over 100 drones and destroyed dozens of Russian strategic bombers and transport aircraft at their bases, many located hundreds of miles from the battlefield.

Electronic communication systems are vital to the US economy and society. Most people carry at least one cellular phone and everything from refrigerators to vehicles is connected to the internet. Operation Spiderweb shows how that dependence on electronic communications can be turned against a host country. Adversaries seeking to sow chaos or instability can use automated bots and server farms to overwhelm communications networks. In August 2025, the Secret Service and Homeland Security located and seized over 200,000 active SIM cards from covert server farms in and around New York City. These sorts of automated bot servers can be used to overwhelm emergency networks and communication systems without having to hack directly into the networks. Similarly, in August 2026, the US Department of Justice, working with X, identified and closed over 200,000 accounts tied to Chinese bot farms being used to push coordinated messaging in attempts to influence political decision making.  

Other technological changes further amplify the threat. Advances in 3D printing technology mean that weapons and drones can be mass produced at the local level. The US Army is already developing containerized systems for rapid deployment of drone swarms, as well as other containerized, portable systems that include 3D printing technology and other items to enable battlefield level production of drones rather than waiting for supply chains to fulfill immediate needs.

AI has also increased the threat envelope. AI in and of itself does not enable a threat actor to develop and deploy advanced weapons, but the capability AI provides enables faster coding, analysis of vulnerabilities, and development of more effective and reliable weapons or explosives. AI enables threat actors, or those disposed, to dramatically accelerate their weapons development programs or to build more effective delivery systems. Research that might have required years of design work, trial and error, and testing can now be accomplished in minutes or days. Explosive compounds that required careful mixing and combining of ingredients can now be enhanced and reliably reproduced in minutes. Like all positive advancements in technology, there will be unforeseen and incalculable negative impacts to technological advancements.

The US and Western countries seek to control the development of AI, or to establish limits, guardrails, or provide for “off” switches. However, the US has no exclusivity over the development of AI systems. Other nations have no such compulsion to control the development that might negatively impact the US. Threat actors, in cooperation with countries adversarial to the US are likely to push ahead in pursuit of their own goals and agendas. Russia, Iran, China and North Korea have repeatedly provided financial, training, or equipment support to terror groups seeking to target the US. During the early 2000’s, al Qaeda researched and experimented with radiological and chemical weapons. Ultimately, they determined that they did not have the expertise to manufacture and distribute them effectively. They sought to destroy the US economy through such means, but with new technologies, such drastic weapons may not be necessary to severely disrupt the US economy or social construct.

COMMUNICATIONS UPDATE:

The manuscript for Killer’s Reign is complete! It has been a long road, but with the help of a dedicated editor, I have a final version. The manuscript is in the submission process (another lengthy process that new authors learn the hard way). The good news is that it is getting attention and an agent recently requested the full manuscript. With a little luck, I hope to have more good news to report soon.

My wife and I recently travelled to Italy, Germany, and Austria on vacation. However, for me the trip also included research for my World War II thriller, tentatively titled Tommy’s War. We explored areas where the hero of my story operated in 1944 and 45, as an operative from the Special Operations Executive (SOE). He fought the Germans and the Communists backed by Tito, while also trying to keep a fragile alliance of resistance fighters together. By walking the ground where he walked, and seeing the places that he fought, I will be better able to bring his war to life on the page. I look forward to sharing the story and more updates in coming months.

There is no shortage of story ideas. A reread of the above newsletter provides several potential story lines for upcoming thrillers, some of which I have already added to my list! Although my thrillers are works of fiction, I strive to ensure that the events and characters are plausible and representative of real word events and scenarios.

The Success Playbook, the fifth in the series and the second volume that I have contributed to, is now available on Amazon. Signed versions of paperback and hardcover versions are for order by contacting me through my website. The book includes chapters from business leaders and coaches and quickly became the #1 new release and #1 in Business Education. This book joins the previous release, The Coach’s Playbook, which also achieved best seller status in July 2025.

Check my website regularly for more information about my books and stories, updates on current events, links to other works, and interesting tidbits of intelligence.  

https://gregsmithonline.com/
www.linkedin.com/in/gregmsmith17
https://amazon.com/author/gregmsmith

Stay Alert. Stay Informed. Stay Aware.