Published: Wed, 05 Aug 2026 13:14:10 GMT · Category: Daily Brief

Daily Intelligence Brief — Tuesday, July 21, 2026

Executive Summary

A de facto shutdown of the Strait of Hormuz and direct, reciprocal US–Iran strikes turned 21 July into a structurally different phase of the Gulf crisis. For the first time in the current confrontation, no ships transited Hormuz as of ~09:11–10:00 UTC, while US forces struck Iranian ports and inland military sites from Bandar Abbas and Bushehr to Konarak and Parchin, and Iran answered with ballistic missiles and Shahed/Arash drones on US bases and host‑nation infrastructure in Kuwait, Qatar, Bahrain, Iraq, and Jordan. With confirmed damage to Kuwait’s Mina al‑Ahmadi crude export terminal, US radars in Kuwait, the US Fifth Fleet HQ in Bahrain, and multiple US bases, both Gulf energy architecture and Washington’s regional basing model look more exposed than at any point since 1991.

This hard-power clash is colliding with a simultaneous squeeze on alternative supply corridors. Kazakhstan halted its Black Sea oil pipeline exports after tanker attacks, a Liberian‑flagged LPG carrier bound for Ukraine exploded off Romania’s coast, and Russian forces struck Odesa’s ports and Ukrainian fuel infrastructure while Ukrainian drones and missiles hit Russian energy and logistics nodes, including Crimea’s power network, Lipetsk‑area industrial sites, and the Kursk Khalino airbase. Energy and shipping risks are now stacked across Hormuz, the Black Sea, and the Red Sea/Bab el‑Mandeb, while the US Strategic Petroleum Reserve sits at its lowest level since 1983.

On the European land war, President Volodymyr Zelensky fired Ukraine’s Commander‑in‑Chief Oleksandr Syrskyi and Chief of General Staff Andrii Hnatov, naming Maj. Gen. Mykhailo Drapatyi as the new top commander just as Ukraine’s F‑16s recorded their first confirmed air‑to‑air kill of a Russian Su‑35. The move caps days of visible civil‑military strain and supply complaints and lands amid intensified Russian attacks on Odesa, Sumy, and the Zaporizhzhia axis, as well as sizeable Ukrainian drone strikes into Russia. Kyiv’s strategic choices on defense vs. offensive risk will now be filtered through an untested command team under maximum political scrutiny.

In Asia, the security environment edged closer to open confrontation. A Chinese destroyer conducted live fire in waters claimed by Japan near Okinotori and separate Chinese–Philippine clashes by Second Thomas Shoal turned into physical violence between boarding teams. These actions, paired with a high‑tempo China–Russia live‑fire drill in Japan’s claimed EEZ, test alliance deterrence thresholds without crossing into declared hostilities. Meanwhile, a new ENCFORGE ransomware strain targeting AI model infrastructure and a widely exploitable WordPress “wp2shell” chain signaled that critical digital platforms remain soft targets just as states lean harder on cloud and data assets—now physically targeted in Bahrain by claimed Iranian strikes on Amazon Web Services hubs.

The next 24–48 hours will turn on three decisions: whether Washington and Tehran accept a proposed 10‑day ceasefire that would reopen Hormuz; how Zelensky and Drapatyi signal their operational priorities amid Russia’s pressure on Odesa and the Orikhiv axis; and how far Beijing pushes live‑fire normalization inside Japan‑claimed waters. Any confirmed Iranian casualties at Parchin or additional US fatalities in Jordan/Kuwait, a visible interruption of LNG loadings in Qatar or the UAE, or a Russian move to systematically hit Ukraine’s remaining gas transit nodes would each mark a further step toward a multi‑theater crisis in energy, alliance cohesion, and escalation control.

Top Developments by Theater

CENTCOM

• Zero traffic through Hormuz; vessel hit and tankers U‑turn (09:00–13:30 UTC)

  • Between 09:11 and 10:00 UTC, multiple feeds reported that no vessels had transited the Strait of Hormuz, effectively freezing the chokepoint that carries roughly a fifth of globally traded crude.
  • A vessel east of Dubai in the Hormuz corridor suffered steering damage from an unidentified projectile (around 09:00 UTC), and two Saudi crude tankers reversed course in the Red Sea toward Suez (~13:21 UTC), signaling operator concern across both Hormuz and Bab el‑Mandeb.
  • Houthis warned ships against calling at Saudi ports and touted a “siege” of Bab el‑Mandeb while an oil tanker in the Red Sea off Saudi Arabia was later struck by an unidentified projectile (map event for 22 July).

• US conducts 11th night of strikes deep into Iran (throughout window)

  • US Central Command began its 11th consecutive night of air operations against Iranian targets at 19:00 ET (23:00 UTC) on 21 July, including B‑1 bomber sorties from RAF Fairford.
  • Targets included underground IRGC naval tunnels at Konarak (Sistan and Baluchestan), coastal nodes at Bandar Abbas, Bandar Lengeh, Sirik, Qeshm Island, Chabahar, Konarak, Shiraz, Abdanan, Bandar‑e‑Mahshahr, Bushehr (struck more than 15 times by late evening), and communications sites near the Shalamcheh border in Khuzestan, where an Iranian soldier was confirmed killed.
  • Multiple reports indicated repeated US airstrikes on the Parchin nuclear/military complex east of Tehran, with at least nine explosions heard in nearby Pardis around 23:26–23:28 UTC and follow‑on confirmation of “repeated US airstrikes” on the site.

• Iran’s direct attacks on US bases and Gulf infrastructure intensify (09:00–23:40 UTC)

  • From early morning through late evening, Iran’s IRGC launched successive missile and drone waves on US‑linked sites in Jordan, Bahrain, Kuwait, Qatar, Iraq, and the Kurdistan Region. Strikes damaged:
    • An FPS‑117 long‑range radar at Ahmad al‑Jaber Air Base, Kuwait (~12:40 UTC, confirmed destroyed by satellite).
    • A logistics hangar at Al‑Udeid Air Base in Qatar and a helicopter hangar at Prince Hassan Air Base in Jordan (map event ~23:40 UTC), alongside earlier damage to King Faisal Air Base in Jordan, where multiple MQ‑9 Reapers and helicopters were reportedly lost and US casualties incurred (~13:30 UTC).
    • Camp Doha in Kuwait (Iranian‑released footage of drone attacks on ammunition depots and logistics equipment).
    • US Fifth Fleet HQ in Manama, Bahrain, where new imagery shows an impact point and burn mark within the base (map event).
  • Iran claimed Arash drone strikes on US positions at Sheikh Isa Air Base in Bahrain, damage to cloud and air‑defense infrastructure in three Gulf states, and attacks on CIA‑linked facilities in Riyadh and eastern Iraq. Bahrain’s military said it intercepted several aerial threats, but satellite images confirm at least one impact at Fifth Fleet HQ.

• Strikes on Gulf utilities and critical infrastructure (11:00–13:30 UTC and later)

  • Kuwait reported Iranian attacks on multiple power and water desalination plants for a fourth consecutive night, with fires and serious damage, at ~11:20–13:21 UTC. Separately, Kuwait confirmed strikes on power/desalination plants “for the fourth time,” depicting a systematic campaign against civil utilities.
  • Satellite imagery shows extensive damage to Kuwait’s northern crude export terminal at Mina al‑Ahmadi (dated 21 July), indicating that oil export infrastructure has now been directly hit, not just threatened.
  • Iran also claimed to have destroyed US early‑warning radars in Kuwait, assertions partially borne out by the Ahmad al‑Jaber imagery.
  • In Iraqi Kurdistan, Iranian drones hit Sulaymaniyah and Mount Kuwaiza (around 21:11–21:32 UTC), igniting fires near areas critical for Kurdish politics and oil logistics; ShaMaran Petroleum separately suspended production at its Duhok fields due to rising tensions.

• Attacks on Gulf financial/tech hubs and cloud infrastructure (09:20–19:00 UTC)

  • Iranian drones reportedly struck a civilian area in Manama, Bahrain, near Israel’s embassy district around 19:00–19:05 UTC, with explosions in the capital and damage in a key Gulf banking and US‑aligned hub.
  • IRGC‑linked outlets claimed a cruise‑missile strike on an Amazon Web Services data center in Bahrain; Bahraini military statements referenced intercepts of Iranian aerial threats, but at least one impact at US Fifth Fleet HQ is documented.
  • Iranian messaging framed these attacks as part of a campaign against US‑linked commercial assets, implicitly expanding legitimate target categories to cloud and IT infrastructure.

• US and Iran casualties, cost figures, and escalation signaling (throughout window)

  • The Pentagon acknowledged that US forces have suffered fatalities in recent Iranian missile strikes, including three service members killed at a Jordanian base and Sgt. Angel S. Rampersad now presumed KIA after an earlier attack in Jordan. President Trump vowed Iran would “pay a big price.”
  • Imagery confirmed the complete destruction of a US Special Operations housing unit at Tower 22 in Jordan by an Iranian ballistic missile (20:38 UTC).
  • US Defense Secretary Pete Hegseth publicly pegged war costs at $37.5 billion to date, while the Pentagon has reportedly requested $80 billion in supplemental funding, reinforcing expectations of a prolonged campaign.
  • Iran’s top command warned it would strike all US and allied interests in the region if nuclear facilities are attacked, explicitly tying nuclear site targeting to a theater‑wide response threshold.

The CENTCOM battlespace has moved beyond “message sending” into sustained air campaigns and reciprocal strikes on high‑value assets, while Hormuz traffic has frozen and Kuwait’s export terminal has been visibly hit. Gulf host nations—especially Kuwait, Bahrain, Qatar, and Jordan—have shifted from passive landlords to active combat theaters, absorbing infrastructure damage and political risk. The addition of cloud/data centers and CIA‑linked sites to the target set widens Washington’s exposure beyond classical military and energy infrastructure and creates a more complex calculus for any ceasefire that focuses narrowly on Hormuz and tankers.

EUCOM

• Russian strikes on Ukrainian ports, energy, and civilian infrastructure (10:00–23:30 UTC)

  • Multiple Kh‑59/69 cruise missile barrages hit Odesa and wider Odesa region starting around 10:00 UTC, with follow‑on “night strike” damage to port infrastructure used for unloading and storing military equipment and fuel (map event ~23:30 UTC).
  • Russia struck Ukrainian port and fuel infrastructure more broadly, including Mykolaiv, where Geran‑4 “jet‑drones” reportedly hit cargo ships at the inactive port and vessels trapped since the war’s outset (21:07 UTC).
  • FPV drone attacks damaged a key gas compressor station in Sumy, part of a critical hub in Ukraine’s gas transmission system (~11:21 UTC), and destroyed Sumy’s largest mall in a separate strike (20:22 UTC).
  • A Geran‑2 drone hit the Pivnichnoukrayinska 750 kV substation near Zaruddya, Sumy Oblast (~23:01 UTC), indicating a deliberate campaign against high‑voltage nodes.

• Ukraine ramps up deep strikes into Russia and Crimea (10:30–19:47 UTC)

  • Around 10:30 UTC, Ukraine launched suspected ballistic missiles at Mariupol, Luhansk, and Lipetsk, reportedly igniting oil bases and depots.
  • Ukraine’s Unmanned Systems Forces announced “Operation Crimean Switch Off,” targeting 13 energy facilities in Russian‑occupied Crimea by 22 July.
  • Medium‑range strike drones hit Russia’s Khalino airfield in Kursk, destroying a satellite communications center, striking Shahed launch sites and air defense systems, and damaging at least one MiG‑29 (map event, dated 21 July).
  • A mass Ukrainian drone attack affected ten Russian municipalities (map event at 19:47 UTC), and overnight strikes ignited industrial and power‑related fires in Lipetsk and damaged an apartment building in Vladimir.

• Ukrainian command shake‑up and F‑16’s first air‑to‑air kill (20:00–21:31 UTC)

  • Between ~20:00–21:10 UTC, President Zelensky dismissed Commander‑in‑Chief Oleksandr Syrskyi and Chief of General Staff Andrii Hnatov, appointing Maj. Gen. Mykhailo Drapatyi as the new top commander and signaling a broader General Staff restructuring.
  • Almost simultaneously, Ukrainian F‑16s achieved their first confirmed shoot‑down of a Russian Su‑35, an event publicly cited by US Joint Chiefs Chairman Gen. Dan Caine and framed in Kyiv as proof of quick combat integration of Western jets.
  • The leadership change followed public friction over logistics shortfalls and an unusual, quickly deleted post by Ukraine’s Logistics Forces Command defending Syrskyi and blaming ministry‑level procurement failures.

• Black Sea maritime security deteriorates (11:30–23:30 UTC)

  • The Liberian‑flagged LPG tanker Gas Lisbon, carrying ~3.7 tonnes of propane to Ukraine’s port of Reni, exploded ~37 km off Romania at 11:30 UTC; all crew were evacuated, three injured, and Romania’s president pointed to likely Russian responsibility.
  • Kazakhstan halted an oil pipeline route to the Black Sea after tanker attacks (10:55 UTC) and suspended oil transportation via the Black Sea generally (~12:01–13:01 UTC), removing a key stream of CPC‑blend crude from Mediterranean supply chains.
  • Russian forces struck a dry cargo vessel and a bulk carrier operating in the Black Sea in support of Ukrainian interests (map event), while Ukraine announced it had hit a Russian “shadow fleet” tanker operating in the Black and Azov Seas (map event, 23:30 UTC).

• NATO‑adjacent energy and trade tensions

  • Canada protested new US 50% tariffs as violating trade agreements (~09:20 UTC), signaling a widening North American trade clash with implications for autos, steel, and agriculture.
  • The US Trade Representative announced broad forced‑labor tariffs on 60 countries (13:21 UTC), adding to global trade friction and potential retaliation that could impact European supply chains and currencies.

EUCOM is now managing layered crises: an intensifying deep‑strike duel between Russia and Ukraine that is chipping away at ports, power, and gas infrastructure on both sides; escalating risk to Black Sea shipping and European energy inputs; and a politically fraught overhauling of Ukraine’s wartime command. Drapatyi’s appointment coinciding with the first F‑16 air victory offers Kyiv a narrative of renewal, but it also raises stakes for near‑term performance as Russia pushes offensives near Orikhiv and closes in on logistical nodes like Odesa and Sumy.

INDOPACOM

• Chinese live fire in Japan‑claimed waters (throughout window)

  • A Chinese destroyer conducted live‑fire exercises in waters claimed by Japan near Okinotori, with rounds fired inside Japan’s declared EEZ. Tokyo lodged a formal protest while conceding the drills were technically legal under international law (multiple analysis pieces around 06:20–10:08 UTC).
  • Separately, a Chinese destroyer fired in disputed waters in the East China Sea, described as “guns hot” in seas claimed by Japan; open reporting suggested no damage but increased navigation and miscalculation risk.

• China–Philippines clash at Second Thomas Shoal

  • In the South China Sea, Chinese and Philippine crews around Second Thomas Shoal engaged in a close‑quarters confrontation, reportedly resorting to sticks and oars on small boats rather than firearms. The skirmish followed Chinese efforts to block Philippine resupply to the grounded BRP Sierra Madre and is being read as a test of Manila’s and Washington’s red lines below the threshold of lethal force.

• China–Russia joint drill pressures Japan’s maritime posture

  • Chinese warships, joined by at least one Russian vessel, carried out a live‑fire drill within waters near Okinotori that Japan claims as its EEZ. Japan labeled it a navigation hazard and a challenge to its maritime boundaries, while carefully avoiding overt escalation language.

INDOPACOM’s maritime flashpoints are inching toward routinized coercive presence: Beijing is now prepared to conduct live fire inside Japan‑claimed waters and tolerate direct physical clashes with Philippine sailors. The pattern—especially when combined with Sino‑Russian drills—erodes the psychological barrier between “exercise” and “engagement” and forces Tokyo and Manila to either accept a new normal or harden their own rules of engagement, with US alliance credibility in the balance.

AFRICOM

• Nigeria–Morocco Atlantic Gas Pipeline gains formal regional backing (06:20–06:31 UTC)

  • West African leaders formally endorsed the $25 billion, 6,000‑km Nigeria–Morocco Atlantic Gas Pipeline, designed to route Nigerian gas along the coasts of 14 countries before linking into Europe via Spain.
  • Companion analyses stressed that the project, if built, would shift parts of Europe’s gas dependency to politically fragile Sahel and Gulf of Guinea littoral states, tying European energy security to maritime stability and governance from Nigeria through Senegal to Morocco.

• Coordinated terror attacks in Niger and Mali (21:56 UTC)

  • The African Union condemned coordinated terrorist attacks in Niger and Mali that caused heavy casualties among security forces and civilians across the Sahel, though specific casualty figures were not yet detailed.
  • Russia’s Africa Corps separately accused Azawad Liberation Front (FLA) militiamen of racially motivated torture of civilians in northern Mali, circulating imagery of alleged abuses.

• Heavy artillery barrages in Ethiopia’s Gojjam region (18:44 UTC)

  • Over 275 artillery strikes—including BM rocket and ZU‑23 anti‑aircraft fire and mortars—hit civilian villages across Gojjam in Ethiopia, causing unspecified civilian deaths and deepening the humanitarian and security crisis in a country already strained by previous conflicts.

Africa’s headline energy project and its worst security zones intersect uncomfortably: the Nigeria–Morocco pipeline vision depends on coastal and Sahel stability at a time when Niger and Mali face worsening insurgent violence and Ethiopia continues to absorb indiscriminate artillery fire against civilians. European planners looking to West Africa as an alternative to Russian gas are implicitly betting on security and governance improvements that current trends do not support.

SOUTHCOM

• La Guaira port damage from double earthquake (23:35 UTC)
  • Venezuela’s Port of La Guaira resumed operations after about 40% of its commercial and business area was damaged by a recent double earthquake. Although activity has restarted, the scale of damage will constrain capacity and increase operational risk in a key outlet for Venezuela’s residual legal trade.

South America saw no major kinetic conflict activity, but La Guaira’s partial impairment reinforces how fragile port infrastructure can be in politically and economically brittle states; any overlay of sanctions shifts or internal unrest could rapidly turn physical damage into a broader logistics chokepoint.

NORTHCOM

• US energy and trade policy harden into structural shocks (06:20–13:21 UTC)
  • America’s Strategic Petroleum Reserve dropped to its lowest level since 1983, reducing Washington’s ability to cushion global supply shocks just as Hormuz, Black Sea, and Red Sea risks converge.
  • President Trump prepared a new wave of tariffs on dozens of countries as the temporary 10% global tariff nears expiry; some measures, including 50% tariffs on specific Canadian goods, have already triggered formal protests from Ottawa.
  • The US Trade Representative’s forced‑labor tariff package on 60 countries introduces wider trade friction and compliance costs for import‑dependent sectors from electronics to apparel and autos.

NORTHCOM’s domestic picture—thin emergency oil stocks and an aggressive tariff posture—feeds back into every external theater. A weaker SPR complicates US signaling in the Iran confrontation and Black Sea disruptions, while new tariffs risk retaliation that may amplify supply‑chain stresses already emerging from maritime insecurity.

Analytical Takeaways

• Gulf conflict has crossed the line from deterrence signaling to infrastructure warfare.
  Direct hits on Kuwait’s Mina al‑Ahmadi export terminal, Kuwait’s power/desalination plants, US early‑warning radar and hangars, the US Fifth Fleet HQ, and claimed strikes on CIA and AWS infrastructure show both sides treating critical military and dual‑use assets as fair game. For Gulf monarchies, the war is no longer something hosted on remote bases; it is burning through their utilities, export terminals, and digital backbones, raising domestic legitimacy and continuity‑of‑governance risks.

• A three‑front maritime risk cluster is forming: Hormuz, Black Sea, and Red Sea/Bab el‑Mandeb.
  Zero ship transits through Hormuz on 21 July, tanker and LPG explosions in the Black Sea, Kazakhstan’s pipeline and export halt, Saudi tankers reversing in the Red Sea, and projectile damage to a tanker off Saudi shores collectively erode redundancy in global seaborne energy routes. For energy planners, this reduces the margin for error: disruption at any one chokepoint now lands on an already stressed system, with the US SPR unusually thin and Gulf allies actively under fire.

• Iran is testing a new category of targets: cloud, IT, and covert infrastructure.
  Claimed strikes on Amazon data facilities in Bahrain, confirmed damage at Fifth Fleet HQ, and precision hits on CIA‑linked sites in Riyadh and eastern Iraq reveal a campaign that explicitly integrates physical attacks on digital and clandestine assets. This aligns uncomfortably with live cyber threats (ENCFORGE ransomware against AI models, WordPress wp2shell exploits) and should shift corporate and government risk models: cloud regions and data centers are no longer only cyber targets—they are on physical kill chains in war plans.

• Ukraine’s new command team inherits a war that is expanding deeper into both homelands and the Black Sea.
  Drapatyi’s elevation and F‑16’s first kill coincide with intensified Russian strikes on Odesa’s port and Ukraine’s gas/power grid, while Ukraine expands attacks on Crimea’s energy system, Russian airbases, and shadow fleet tankers. This creates a strategic fork: double‑down on deep strikes to offset manpower and ammunition shortages, or prioritize territorial defense and economic nodes. The leadership shake‑up narrows the political space for incrementalism; early battlefield results will heavily shape Western support and Russia’s calculus.

• Trade and tariff shocks risk compounding security‑driven supply disruptions.
  New US tariff rounds—including potential 50% measures on Canadian goods and forced‑labor duties against 60 countries—arrive as shipping and energy infrastructure are already under pressure. For allies like Canada and the EU, supply diversification away from Russia is colliding with US trade assertiveness, raising the prospect that key sectors (autos, steel, agriculture, consumer goods) face simultaneous cost and risk escalations driven by both policy and conflict.

Watchlist (Next 24–48 Hours)

• US–Iran decision on 10‑day ceasefire and Hormuz reopening.
  If Washington and Tehran agree, even tacitly, to the proposed 10‑day truce to restore Hormuz shipping by 23 July, expect rapid repricing lower of crude risk premia and a pause in deep‑strike activity against coastal infrastructure. If Iran continues missile launches toward Qatar, Bahrain, and Jordan after formal presentation of the proposal, it signals Tehran is prioritizing coercive leverage over economic relief, raising odds of expanded US strikes on strategic sites like Parchin or Pickaxe Mountain.

• Follow‑on strikes around Parchin and Bushehr.
  If credible imagery or Iranian admissions confirm material damage to Parchin’s facilities or Bushehr‑adjacent military infrastructure in the next 24 hours, expect Tehran to activate its declared threshold: attacks on a wider range of US and allied interests, possibly including more direct shots at Israeli or European‑flagged assets. Absence of such confirmation may give both sides room to climb down while claiming success.

• Behavior of Qatar and UAE export flows under zero‑Hormuz conditions.
  If LNG and crude loadings in Qatar fall materially or if the UAE accelerates operational steps toward its announced “zero Hormuz reliance” goal by year‑end (e.g., rerouting volumes via alternative pipelines/ports within 48 hours), it will indicate producers are planning for a prolonged disruption rather than a short shock, embedding higher freight and risk premiums into forward curves.

• Zelensky–Drapatyi’s first operational moves and Russian response.
  If Ukraine’s new command immediately reallocates F‑16s and long‑range strike assets toward Crimea’s power grid and Russian logistics hubs—while Russia intensifies attacks on Odesa and gas nodes like Sumy—expect a further tilt toward infrastructure‑on‑infrastructure warfare with elevated civilian and European energy spillover. A visible Ukrainian pause or defensive consolidation, by contrast, would hint at prioritizing internal stabilization over short‑term escalation.

• Kazakhstan’s Black Sea export posture and insurance pricing.
  If Astana keeps its Black Sea oil pipeline and exports offline beyond 48 hours or ties resumption explicitly to improved tanker security guarantees, it signals a readiness to accept revenue losses to avoid entanglement in maritime conflict. Watch for parallel shifts in war‑risk premiums and routing behavior of other Caspian and Russian‑adjacent exporters.

• China and Japan’s handling of live‑fire incidents in disputed waters.
  If the PLA Navy repeats live‑fire drills inside Japan‑claimed EEZs or conducts a follow‑on exercise within 24–48 hours, and Tokyo responds with expanded JMSDF patrols or joint exercises with US forces, the pattern will mark a deliberate normalization of combat‑ready presence in disputed seas. A Japanese decision to adjust rules of engagement—or public mention of such a review—would indicate movement toward a more brittle deterrence posture in the East China Sea.