Daily Intelligence Brief — Thursday, July 9, 2026
Executive Summary
Washington and Tehran crossed a structural threshold today: two nights of large-scale U.S. strikes on Iranian territory have met direct Iranian ballistic salvos on U.S. bases in Jordan, Bahrain, Kuwait, and broader “West Asia,” while commercial traffic through the Strait of Hormuz has effectively stopped. With Iran’s armed forces ordered onto a wartime footing and U.S. F‑35s operating unopposed over central Iran, the contest has moved from coercive signaling into open confrontation over the world’s most important oil chokepoint. Energy markets, Gulf host governments, and U.S. force posture now sit inside the crisis rather than pricing around it.
The shock is amplified by Iran’s internal turmoil. Supreme Leader Ali Khamenei was confirmed killed in the opening strikes of this Iran war and buried today in Mashhad under heavy security. During the burial, unidentified gunmen attacked IRGC and Basij checkpoints near the Imam Reza Shrine, exposing serious regime security vulnerabilities at the moment Tehran is trying to manage both external conflict and succession. Reports that Israel has warned the U.S. of a possible Iranian plot against former President Donald Trump add a volatile personal dimension that could harden decision-making in Washington.
In parallel, Ukraine has opened a sustained second-front campaign against Russia’s energy and logistics system. Over four days, Kyiv’s drones have hit roughly 35 Russian tankers and support vessels in the Sea of Azov, devastated the Kerch oil terminal tank farm, and ignited multiple oil depots from Tver to Stavropol, while a separate strike fully halted Russia’s Saratov refinery (about 2.2% of national capacity). Moscow faces simultaneous pressure on its “shadow fleet,” domestic fuel supply, and refinery network just as NATO leaders lock in multi‑year financing, new Patriot/PAC‑3 flows, and Tomahawk deployments in Germany.
Secondary theaters are not quiet. Sudan’s Rapid Support Forces (RSF) stand formally accused of genocide in El Fasher as they consolidate control over key Darfur localities, while UN investigators warn El Obeid “must not” become the next massacre site. In Syria, the U.S. decision to start removing Damascus from the terrorism list, and Switzerland’s opening of a cooperation office, show an emerging diplomatic lane back for Bashar al‑Assad at the same time Jordan is dragged physically into the U.S.–Iran shooting war. In Asia, severe flooding in southern China that has killed at least 39 people and submerged pig farms foreshadows food and commodity reverberations from climate shocks layered onto geopolitical risk.
Over the next 24–48 hours, the key inflection points will be military and maritime: whether Iran escalates beyond current missile salvos, whether the U.S. extends strikes deeper into Iran’s nuclear and trade infrastructure, and whether any tankers attempt to test the de facto shutdown of Hormuz. In Europe, watch how quickly Russia can restore refining capacity and shadow fleet operations under Ukrainian fire, and how openly NATO capitals discuss Starlink’s vulnerability following reports of a China–Russia plan to degrade it. In the Middle East, any confirmed Iranian plot against Trump or additional internal attacks like Mashhad would sharply constrict diplomatic off‑ramps.
Top Developments by Theater
CENTCOM
-
11:00–13:50 UTC – Iran launches ballistic salvos on U.S. bases in Jordan, Bahrain, and Kuwait.
- IRGC fired multiple ballistic missile waves from western and northwestern Iran toward U.S. bases in Jordan, Iraq, Bahrain, and Kuwait (from around 10:40 UTC onward).
- Iran claims a 10‑missile strike destroyed U.S. command infrastructure at Jordan’s Muwaffaq Salti/Azraq base; Jordan says it intercepted eight missiles with no damage.
- Sirens sounded across Jordan, including at Camp Taji in Iraq and the U.S. embassy, as civilians sheltered in place.
-
~14:18–14:47 UTC – U.S. F‑35s roam over Isfahan; Iran shifts to wartime footing.
- Open-source imagery shows U.S. F‑35A fighters flying apparently unopposed over Isfahan, deep inside Iran.
- IRGC‑linked media say Iran placed all armed forces on maximum readiness under “wartime conditions,” issuing scatter orders to units.
- Syria and Jordan closed airspace; regional reporting describes shipping through Hormuz as temporarily halted.
-
Previous 48 hours – U.S. strikes at scale on Iranian targets and infrastructure.
- CENTCOM reports roughly 170 Iranian targets hit in two nights, including 80–90 the night of 9 July, with Iran acknowledging at least 14 dead and 78 wounded across five provinces.
- Targets include coastal IRGC infrastructure, ports and islands tied to Hormuz, a railway bridge on the North–South corridor in Golestan, and the Aq‑Teke‑Khan rail bridge, as well as Chabahar airport’s control tower and boats at a southern fishing pier.
- Iranian sources also report U.S. strikes near Bushehr (including Asaluyeh) and along the southern coast.
-
12:06–12:46 UTC – U.S. strikes near Bushehr nuclear facility; Iran answers with missiles.
- U.S. air and cruise‑missile strikes hit near the Bushehr nuclear plant and in Shiraz, plus coastal assets and boats near Banood.
- In the same window, Jordan intercepted eight Iranian ballistic missiles launched toward U.S.-linked targets; blasts were heard in Amman.
-
19:06–23:00 UTC – Third consecutive night of explosions in southern Iran; new strike near Bushehr military site.
- From 18:10–18:25 UTC, multiple reports logged explosions and alleged U.S. strikes in Chabahar, Bushehr, and Bandar Abbas, extending a port‑focused campaign.
- Around 22:57 UTC, officials in Bushehr reported a loud explosion linked to air-defense activity and a U.S.–Israeli missile hitting a military site near the city; IRNA later called it air-defense engagement near the province hosting Iran’s sole nuclear power plant.
-
Hormuz shipping reportedly fully stalled; U.S. challenges Iran’s control claims.
- Bloomberg-cited traffic data indicate commercial vessel traffic through the Strait of Hormuz has “effectively” come to a complete standstill.
- CENTCOM publicly rejected Tehran’s claim to control the strait, stating U.S. forces have supported more than 800 ships transiting since May.
-
Internal and political shocks inside Iran.
- Khamenei was killed in opening strikes of the war and buried today in Mashhad.
- Around 21:18 UTC, unidentified gunmen attacked IRGC and Basij checkpoints near the Imam Reza Shrine during the burial, reportedly killing at least four.
- Israel has reportedly shared intelligence suggesting Tehran is weighing a plot to assassinate former U.S. President Trump; Trump has publicly claimed Iran wants to “take out” the U.S. leader.
-
Regional realignments and Syria policy shift.
- The U.S. has begun the process of removing Syria from the State Sponsors of Terrorism list; Saudi Arabia welcomed the move.
- Damascus says it has arrested the entire cell behind recent bombings in the capital.
- Syria officially condemned Iranian missile attacks on Jordan as a breach of sovereignty—an unusual public rebuke of its long‑time ally.
- Trump formally signed off on removing Syria from the terror list; Switzerland opened a cooperation office in Damascus, signaling early normalization.
Synthesis – CENTCOM:
The Iran–U.S. confrontation has become a genuine regional warfighting environment. U.S. forces are now striking not only coastal launch infrastructure, but bridges and airports integral to Iran’s North–South trade architecture with Russia and China—explicitly linking this campaign to broader great‑power competition. Iran’s ballistic retaliation on Jordan, Bahrain, and Kuwait drags normally quiet host nations directly into the firing envelope and forces them to weigh basing rights against domestic risk. Hormuz’s effective closure is the most acute single-day shock to global energy transit since at least 1980. The concurrent death and contested burial of Khamenei create a succession crisis under fire, raising the risk that Iran’s military posture and internal security response will be driven as much by factional calculation as by coherent strategy.
EUCOM
-
All day – Ukrainian drone campaign against Russian oil logistics and shadow fleet intensifies.
- Ukraine reports striking 35 Russian tankers, cargo ships, and support vessels in the Sea of Azov over four days, including 12 tankers overnight; subsequent footage shows additional hits in the same basin.
- Satellite imagery indicates the central tank farm at the Kerch oil terminal has been “completely destroyed,” causing substantial infrastructure damage.
- Ukrainian drones also hit an oil depot and the Azov Optical‑Mechanical Plant in the city of Azov (Rostov region) overnight.
-
16:01–18:02 UTC – Saratov refinery shut down; Russian fuel prices spike.
- A Ukrainian drone strike disabled Russia’s Saratov refinery, halting crude processing at a plant accounting for about 2.2% of national capacity.
- The refinery stopped offering fuel on the St. Petersburg exchange, and regional gasoline reportedly rose to 200–300 rubles per liter.
- By 10 July, other major refineries (NORSI and Omsk) were also offline due to prior Ukrainian attacks, substantially reducing Russian gasoline production.
-
11:07–12:46 UTC – Multiple deep strikes on Russian oil depots and logistics nodes.
- Ukrainian UAVs hit the Lukoil‑Yugnefteprodukt depot in Mikhaylovsk (Stavropol Krai) and Rosneft’s Tvernefteprodukt near the Moscow–St. Petersburg corridor, causing large fires.
- Additional attacks targeted fuel storage, an oil pumping station, and depots near Bataysk and Ufa, extending the geographic spread.
-
NATO Ankara summit – €140–80 billion pledges and Tomahawks for Germany.
- Allies committed roughly €140 billion in military aid for Ukraine for 2026–27, aligning with reports of $80 billion annually.
- Germany secured U.S. approval to buy and base Tomahawk cruise missiles, closing what Berlin brands a “strategic gap” in long‑range strike capacity.
- NATO leaders backed deepened Patriot/PAC‑3 support and a Europe‑led “Freya” ballistic defense project for Ukraine.
-
Ukraine’s air‑defense reinforcement and “MiGs for drones” talks.
- Zelensky said Ukraine will receive a U.S. PAC‑3 package “in the coming days” and announced intent to co‑produce Patriot missiles domestically under an agreement with Trump.
- A European “Freya” ABM system is being scoped to complement Patriots as Russia’s ballistic salvos strain interceptor stocks.
- Poland confirmed talks over a swap: transferring MiG‑29 fighters to Ukraine in exchange for Ukrainian drone technology.
-
Russian information and electronic war on Starlink and rear areas.
- Russian sources claim new capabilities to jam Starlink and disable Ukrainian drones; in parallel, leaked documents describe a China‑backed program to help Russia jam, hack, or destroy Starlink satellites and field‑test advanced loitering munitions and AI systems in Ukraine.
- Russia’s FSB says it foiled Ukrainian‑linked plots targeting senior Defense Ministry officials and military sites, underscoring a broader sabotage and assassination track.
Synthesis – EUCOM:
Ukraine is methodically shifting the war’s center of gravity toward Russia’s rear energy and logistics systems. By hitting refineries, depots, and the shadow fleet, Kyiv is creating a rolling domestic fuel crunch and forcing Moscow to confront the political cost of sustaining the war while Russian civilians queue at pumps and watch fires in major industrial hubs. NATO’s Ankara pledges and Tomahawk basing decision codify a long war assumption and extend alliance reach deep into Russia’s periphery. In response, Moscow is leaning harder into non‑kinetic options—Starlink disruption, internal security crackdowns—to blunt Ukraine’s drone and command‑and‑control edge. The front line is no longer just Donbas; it is Russia’s refinery network, tanker routes, and orbital communications layer.
INDOPACOM
-
19:36 UTC & earlier – Leaked China–Russia Starlink disruption plan surfaces.
- Leaked documents describe Chinese offers to help Russia jam, hack, and potentially destroy parts of SpaceX’s Starlink network via electronic warfare and anti‑satellite (ASAT) options.
- A related report says China has drawn Russia into a broader anti‑Starlink program that combines legal, diplomatic challenges with direct physical disruption tools, explicitly tied to the Ukraine battlefield.
-
16:01 UTC – China offers new weapons and AI for testing in Ukraine.
- Beijing has reportedly offered Russia loitering munitions, air/missile‑defense assets, and AI technologies for combat testing in Ukraine, positioning the conflict as a live laboratory for PLA‑relevant systems.
-
Southern China floods – deaths and agricultural impact.
- By late 9 July, southern China reported at least 39 deaths from flooding linked to a tropical storm.
- In Guangxi, floods submerged entire pig farms; authorities deployed drones for rescue and supply delivery.
- A dam collapse in Hengzhou added to casualties and infrastructure damage.
-
Strategic politics: Europe’s industrial fears, Pacific pacts.
- Greek PM Mitsotakis publicly warned that China’s 30% share of global manufacturing “tests the survival” of Europe’s factories, implicitly calling for tougher EU defensive measures.
- New Zealand is weighing whether to join the “Ocean of Peace Alliance,” a new mutual-defense pact between Australia and Fiji portrayed as a counter to China’s expansion in the Pacific—forcing Wellington to balance China trade dependence against its security alignment with Canberra.
Synthesis – INDOPACOM:
Even as U.S. attention centers on Hormuz, Beijing is shaping a parallel battlefield in space and cyberspace. A coordinated China–Russia effort against Starlink would directly affect U.S. and allied military operations well beyond Ukraine, potentially setting a precedent for targeting commercial constellations in any theater. The reported offer to test loitering munitions and AI in Ukraine deepens the PLA’s learning curve without formal intervention. Domestically, China’s floods and agricultural losses offer an early test of how climate shocks can ripple into food imports and internal stability. Regionally, smaller states such as New Zealand are being forced into sharper choices as Beijing’s reach prompts counter‑pacts like the Ocean of Peace Alliance.
AFRICOM
-
Darfur – UN concludes genocide in El Fasher; RSF advances elsewhere.
- A UN Fact‑Finding Mission determined the RSF committed acts amounting to genocide in El Fasher, documenting mass killings, systematic rape, abductions, and starvation as tools of war.
- By 10 July, RSF forces had recaptured Kulbus and Abu Suruj near Al‑Genina and repositioned units across the border zone, consolidating control in parts of Darfur.
-
El Obeid atrocity risk.
- UN investigators warned that El Obeid “must not” become the next crime scene as fighting between the Sudanese Armed Forces (SAF) and RSF edges closer to the city.
- Civilians in contested urban centers are already under severe strain from displacement, hunger, and lack of services.
-
Ethiopia’s cross‑border power grid push.
- Ethiopia announced completion of infrastructure needed for cross‑border electricity trade via the Eastern Africa Power Pool.
- The move promises relief for energy‑short neighbors but also increases their dependence on Addis Ababa at a time of unresolved disputes over the Grand Ethiopian Renaissance Dam and internal Ethiopian tensions.
-
Africa’s upstream energy: ExxonMobil’s $1bn Nigeria bet.
- ExxonMobil and partners committed $1 billion to the Usan Infill Project offshore Nigeria, targeting an additional 40,000 b/d of oil.
- The investment signals renewed confidence in Nigeria’s deepwater sector, even as onshore theft, sabotage, and regulatory uncertainties persist.
Synthesis – AFRICOM:
Africa sits at the intersection of hard security crises and strategic economic plays. In Sudan, a formal genocide determination in El Fasher and warnings about El Obeid sharpen pressure on external patrons of both the RSF and SAF, including Gulf states and Russia, to curb atrocities or risk complicity. In East Africa, Ethiopia’s power-export ambitions will reorder regional leverage, giving Addis economic influence over neighbors that increasingly rely on its grid while exposing Ethiopia’s own infrastructure to political risk. Nigeria’s offshore investment uptick contrasts with onshore insecurity, showing that majors will still commit capital to African hydrocarbon plays if they can ring‑fence operations from domestic instability.
SOUTHCOM
-
10 July (forward‑announced) – UN and Venezuela launch La Guaira reconstruction plan.
- Caracas and the UN announced a reconstruction plan for La Guaira after earthquake damage, identifying nine priority areas for phased rebuilding.
- The plan embeds UN agencies deeply in Venezuela’s coastal infrastructure recovery amid ongoing economic and political turmoil.
-
Uruguay – family massacre in Montevideo.
- A massacre in Villa García, Montevideo, left four people dead and two injured, including a 14‑year‑old girl.
- While local in scale, it adds to regional concerns over violent crime and the spread of organized criminal tactics into previously lower‑risk urban neighborhoods.
Synthesis – SOUTHCOM:
Latin America continues to juggle chronic security challenges with acute disaster recovery. Venezuela’s decision to lean on the UN for La Guaira’s reconstruction is notable: it reflects both fiscal incapacity and a willingness to accept external oversight in a critical port city. Uruguay’s rare mass killing in Montevideo is another data point in the slow erosion of public security even in relatively stable Southern Cone states, feeding arguments for tougher internal security laws that may have civil liberties implications.
NORTHCOM
-
U.S. domestic terrorism and drone threat – UFC event plot.
- Eight men were indicted in the U.S. on murder and terrorism conspiracy charges over a plan to launch a drone attack on a UFC event at or near the White House.
- The alleged plot relied on commercially available drones, exploiting the difficulty of securing mass sporting events in dense urban environments.
-
Alleged Iranian plot against former President Trump.
- Israeli intelligence reportedly warned Washington that Iran may be considering an assassination attempt on former President Trump; Trump publicly claimed Tehran wants to “take out” the U.S. leader.
- In the context of an ongoing shooting war with Iran, this raises the stakes for U.S. protective measures and narrows political space for any de‑escalation.
-
Cyber insecurity – “GigaWiper” and Friendly Fire AI exploits.
- Security researchers detailed GigaWiper, a Windows backdoor capable of espionage and irreversible data destruction, including faux ransomware operations that offer no decryption key.
- Separate “Friendly Fire” research showed how AI code‑review assistants can be tricked into executing malicious commands embedded in README files, converting defensive tools into infection vectors.
-
Trump’s NATO and trade brinkmanship – trade freeze with Spain.
- A Latin American outlet reported that President Trump has frozen trade with Spain over Madrid’s defense spending, leveraging economic tools to coerce an ally on NATO commitments.
- Such a move, if sustained, would disrupt bilateral investment and test alliance solidarity at a moment of high external threat.
Synthesis – NORTHCOM:
The homeland is simultaneously exposed to kinetic blowback from Middle East decisions and to quieter cyber and terrorism risks. A credible Iranian plot against a former president would move U.S.–Iran hostility into deeply personal terrain and likely trigger bipartisan support for further retaliation. Domestically, the UFC drone plot illustrates how mass‑event security remains behind the curve on cheap, agile UAV threats. On the cyber side, tools like GigaWiper and AI‑driven “Friendly Fire” exploits probe systemic weaknesses in critical infrastructure and software‑supply chains. Trump’s reported trade freeze with Spain weaponizes economic interdependence within NATO itself, signaling to other low‑spending allies that defense commitments are no longer a diplomatic abstraction but a trade‑linked requirement.
Analytical Takeaways
-
The Hormuz showdown has shifted from deterrence to contest of control, with global energy and allied basing at direct risk.
U.S. strikes on Iranian coastal infrastructure and trade arteries, combined with Iran’s ballistic hits on U.S. hubs in Jordan, Bahrain, and Kuwait, signal both sides are prepared to absorb the consequences of a prolonged clash. Effective suspension of Hormuz traffic moves from a theoretical worst case to an operational fact; key importers in Asia and Europe must now consider alternative sourcing, strategic reserve releases, and rerouting of LNG cargoes as base‑case planning, not contingency. -
Iran’s succession crisis collides with external war, raising miscalculation risks and empowering hard‑liners.
Khamenei’s death under fire, a wartime alert order, and gunfire at his burial compress regime bandwidth. The IRGC and security apparatus may over‑correct against perceived domestic enemies while also pressing for maximalist responses abroad—especially if an assassination plot against Trump is real. Western policymakers should assume that institutional checks on escalation inside Tehran are weaker today than they were a week ago. -
Ukraine is weaponizing energy and maritime logistics as strategic levers, accelerating pressure on Russia’s war economy and insurers.
By turning the Sea of Azov, Russian depots, and refineries into front‑line targets, Kyiv is raising the cost—and internal visibility—of the war to Russian society. This maritime and infrastructure campaign complicates Russian fuel supply, elevates insurance and freight rates for any ship tied to Russian cargoes, and may, over time, constrain Russia’s ability to sustain high‑tempo operations despite ongoing crude export volumes. -
Great‑power competition is migrating into commercial space and AI infrastructure, with civilian platforms now explicit targets.
The reported China–Russia plan against Starlink, combined with domestic “Friendly Fire” AI exploits and GigaWiper, shows how dual‑use commercial systems (satellites, cloud‑based code tools) are becoming priority attack surfaces. This blurs civilian–military lines: disabling a commercial constellation or AI tool in Ukraine or the Gulf would simultaneously disrupt global communications and supply chains. National security planning must start treating these platforms as strategic critical infrastructure. -
Legal and diplomatic frameworks are straining under atrocity findings and sanction re‑engineering.
The UN’s genocide determination in El Fasher and ICC evidence against RSF leadership sharpen calls for targeted sanctions and potential prosecutions, at the same time the U.S. dismantles Syria’s “terror sponsor” label and the EU weighs trade bans on Israeli settlement goods. The effect is a fragmented, more transactional sanctions landscape where designations can be removed for geopolitical expediency while new legal landmines appear for actors tied to militias like RSF.
Watchlist (Next 24–48 Hours)
-
If any laden crude or LNG tanker attempts a Hormuz transit and is attacked or turned back, that will confirm a de facto blockade and likely trigger emergency consultations on strategic reserve releases and naval escort missions among IEA members and key Asian importers.
-
If Iran expands its missile and drone strikes beyond current U.S. bases to include Gulf export terminals or desalination plants, Washington and Gulf monarchies will face a decision on whether to pursue regime‑level targets inside Iran rather than limited military infrastructure strikes.
-
If the U.S. conducts an acknowledged strike on a clearly identified Iranian nuclear facility (beyond near‑Bushehr operations), expect Russia and China to move quickly at the UN Security Council to constrain U.S. action, while Iran may step away from remaining JCPOA‑era safeguards and accelerate enrichment and missile deployment.
-
If Ukrainian drones disable an additional major Russian refinery (comparable to Saratov, NORSI, or Omsk) or significantly escalate the Azov tanker campaign, watch for Moscow to retaliate by intensifying attacks on Ukrainian energy infrastructure and potentially by cyber operations against European energy grids or ports.
-
If credible U.S. intelligence publicly confirms an Iranian plot against former President Trump, the administration will come under intense bipartisan pressure to escalate beyond current strike patterns—potentially including cyber/offshore financial warfare, IRGC leadership targeting, or expanded naval interdiction.
-
If China or Russia visibly test kinetic or high‑power jamming capabilities against Starlink or other commercial constellations over Ukraine or another theater, that will mark a new red line for space norms and force rapid reassessment of satellite redundancy, hardening, and allied response options in both NATO and Indo‑Pacific councils.