The throughline this cycle is patience. China's Volt and Salt operations are textbook state-actor pre-positioning — no kinetic action, just persistence in the right places, with strategic dormancy timed against a future Taiwan-contingency window. Russia is reactivating its 2024-vintage influence playbook 18 months early, which suggests Moscow is anchoring on the 2026 midterm cycle as its primary asymmetric lever; Sandworm energy targeting and APT28 spear-phishing of campaign infrastructure are the two indicators we'd weight most heavily. Iran remains the wildcard — capability is real, the post-Gaza retaliation rhetoric is real, but signal-to-noise on actual operational planning indicators is poor. We're watching former-official targeting, Iranian-American dissident threats, and Jewish/Israeli facility patterns as the leading edge. DPRK is doing what DPRK does: monetizing the West to fund the regime via crypto theft and IT-worker infiltration — Lazarus alone is a $800M+ trailing-12-month exposure across US victims.

The picture this cycle skews domestic. Among the foreign-designated groups, ISIS-K remains the only one demonstrating both intent and capability to induce CONUS lone-actor attacks — the Moscow Crocus model (Mar 2024) confirms operational viability and inspiration material continues to circulate. Al-Qaeda core has degraded; AQAP is publishing but not operating. Iran-aligned (IRGC + Hezbollah) is the FTO category we'd weight up given DOJ-disclosed plot disruptions and the post-Gaza retaliation cycle. The active concern is REMVE accelerationism converging on the Pride Month + summer event cycle — Patriot Front mobilization, Active Club expansion, and Atomwaffen-derivative messaging are tracking against the same June-September calendar that historically produces lone-actor attacks. The FBI's national soft-target advisory issued 3 days ago raised our internal threshold, and the AGAAVE militia / sovereign-citizen category is independently elevating around 2026 election cycle rhetoric. The convergence section below flags where these domestic threats overlap with state-aligned OT activity — a pattern single-domain feeds miss.

Lebanon's L4 upgrade is the headline of the week. Hezbollah-Israel cross-border tempo has crossed State Department's threshold and personnel posture for anyone with Beirut or eastern Mediterranean presence needs review in the next 72 hours — including departure-route planning given how quickly commercial aviation contracted during the 2024 escalations. The broader pattern in the Sahel — Niger and Burkina Faso both deteriorating, Mali continuing — represents an 18-month sustained regional collapse driven by JNIM and ISIS-Sahel expansion against weakened post-coup state security, and we expect at least one more L3→L4 escalation in the band before Q3. Mexico's six-state L4 designations remain the highest-volume CONUS-adjacent risk given executive travel volume and the cartel-violence overlap with corporate operations across the border. Russia's L4 stands apart: the wrongful-detention pattern is now policy, not anomaly, and any travel for any reason carries documented hostage risk against US persons. We're watching Venezuela and Colombia divergence carefully — Colombia just stepped down from L3 to L2, Venezuela is trending the other direction.

May Day labor mobilization and the campus encampment cycle are the two volume drivers — together pushing the demonstration count above 23 active events with eight more planned in the next 72 hours. SEIU + UAW + AFL-CIO coordination on May 1 will produce 30K-50K turnout in Chicago alone, with smaller equivalents across 14 other metros. Campus encampments are entering their highest-risk window: commencement disruption potential is elevated at Columbia, UCLA, UMich, and Brown, and four sites have confirmed counter-protest, which is the indicator that historically correlates with on-the-ground escalation. Counter-protest indicators around Pride Month are the elevation we're watching most closely — REMVE-affiliated messaging tracks consistently against the June calendar, and six cities are currently flagged for confirmed counter-protest activity. The pattern that should concern physical security teams running venue operations: Patriot Front + Active Club messaging is timing-aligned with parade routes in metros where local law enforcement coordination is variable. Anti-ICE field-office protests will continue their weekly cadence; risk is medium, not elevating.

The 14-day window shows a tempo elevated by pattern-driven advisories rather than singular kinetic events. The USMS courthouse threat pattern is the operational concern: VoIP-spoofed bomb threats against western district federal buildings have now produced six incidents in trailing 30 days using consistent TTPs — this is a coordinated harassment campaign, not isolated callers, and we expect it to continue. The FBI national soft-target advisory issued three days ago is the broader threshold-setter: lone-actor accelerationist chatter is trending up against summer event cycles, with houses of worship and LGBTQ+ venues specifically flagged. Transit incidents in NYC MTA and Chicago CTA share TTP profile and are under joint investigation — this is the kind of pattern that often resolves as a single actor traveling. The Phoenix workplace shooting was non-pattern (former employee, no ideological nexus) and should not influence broader posture assessments. Pacific NW wildfire mobilization is the operational sleeper: Red Flag Warnings across CA / OR / WA combined with mass-evacuation pre-staging at three county OES centers suggests the season is opening earlier and harder than 2025 — physical-security teams with facilities in those AORs should validate continuity plans now, not after first deployment.

The PRC pair — Volt Typhoon and Salt Typhoon — are the operational dominant concern. Volt's living-off-the-land tradecraft in grid and water OT is purpose-built for dormancy through a US response cycle; we have no high-confidence kinetic timeline, which is precisely the point — pre-positioning is the operation, not a prelude to one. Salt Typhoon has now reached nine named US carriers and the lawful-intercept system access is the troubling vector: it provides counterintelligence value (who is being monitored by whom) far beyond a typical telecom compromise. MuddyWater's tempo is the Iran retaliation barometer — operations up 40% post-Gaza, and any rapid escalation in MuddyWater spear-phishing against US-Israel-aligned targets would correlate strongly with a kinetic Iran decision. Scattered Spider remains the most operationally damaging non-state actor in CONUS by dollar impact — help-desk social engineering and MFA-fatigue work because they exploit human and process gaps that no amount of EDR tuning fixes. MITRE ATT&CK technique IDs below each card are clickable in the production product; map to your detection coverage and prioritize gaps against your sector exposure.

Eight CVEs sit on CISA's Known Exploited Vulnerabilities list with critical-infrastructure exposure in the current cycle — but the headline isn't the count, it's the vendor concentration. Cisco IOS XE, Schneider Modicon, Citrix NetScaler, Ivanti Connect Secure, and Fortinet FortiOS together account for five of the eight — all are edge-network or OT vendors with deployment density across federal, energy, water, and finance sectors. That concentration is structural, not coincidental: state-aligned actors aggressively pursue widely-deployed appliance vulnerabilities because patching cadence in these categories is poor and exposure persists for months after disclosure. CVE-2026-0817 in Schneider Modicon is the one we'd patch first — water and energy ICS exposure, CVSS 9.4, observed in active state-aligned exploitation by both Sandworm and Volt Typhoon clusters per CISA AA bulletins. The two-day gap between KEV add date and now means most organizations are still vulnerable: BOD 22-01 federal patch deadlines are 14 days for KEV criticals, but commercial cadence trails federal by 3-6 weeks on average. Schneider, Citrix, and Ivanti exposures correlate with the Volt Typhoon and MuddyWater operations called out above — patching these is convergence response, not just hygiene.

Convergence findings are where federal and commercial threat products almost always miss the story. Adversaries don't respect the physical/cyber boundary, but our entire intelligence apparatus is organized by it — CISA does cyber, FBI does FBI, NCTC does terrorism, fusion centers do geography. When a DVE accelerationist target set overlaps with a Volt Typhoon OT pre-positioning target set in the same utility scope, that overlap is the operative concern, and neither single-domain feed will surface it. Election infrastructure is the canonical example: polling-place physical security and voter-registration database integrity are two different vendors, two different posture reviews, and two different incident-response paths — but adversaries treat them as one attack surface. The Salt Typhoon + telecom POP convergence we flag below is the kind of finding that wouldn't exist in any single-source TI feed — it requires cyber attribution from CISA, physical-access risk modeling from carrier security teams, and an analyst willing to connect them. This is the section federal customers ask us about first. A senior CISO running pure-cyber and a senior PSD running pure-physical, even at the same organization, would each miss what this section surfaces when read alone.