Daily Intelligence Brief — Thursday, July 23, 2026
Executive Summary
The U.S.–Iran war moved decisively into major‑power confrontation overnight, with U.S. B‑1 bombers and cruise missiles hitting IRGC infrastructure from Ahvaz and Andimeshk to a “missile city” in Yazd, while Iran answered with ballistic and cruise strikes on U.S. bases in Jordan, Kuwait, and Bahrain, plus a barrage of anti‑ship missiles toward the Strait of Hormuz. Tehran’s proxies and aligned actors widened the fight at sea: Houthis hit Saudi tankers in the Red Sea, a Saudi tanker burned in a separate strike, and a tanker near Bab al‑Mandeb was damaged badly enough that Aramco is now rerouting crude via Egypt. Hormuz is effectively shut, Bab al‑Mandeb and the central Red Sea are live combat zones, and Brent has blown through $100/bbl. The Middle East energy system is now in a three‑chokepoint crisis: Hormuz, the Red Sea/Bab al‑Mandeb–Suez axis, and the Black Sea.
The second front of the energy shock lies in Eastern Europe and the Black Sea. Drone attacks forced the closure of a major Black Sea export terminal handling Kazakh crude, slashing Kazakhstan’s output, while Ukraine hit a Russian tanker and multiple Russian oil pumping stations (Tinguta in Volgograd, Subkhankulovo in Bashkortostan) and expanded deep strikes on logistics hubs—culminating in coordinated attacks on Wildberries warehouses across Russia and fuel stations in Belgorod. Russia responded at sea by declaring its Black Sea EEZ “unsafe for navigation” and on land by absorbing some of its heaviest recent losses—estimated at over 5,000 personnel per week—while banking stress and cash withdrawals added financial pressure at home. With Ukraine’s ports around Odesa effectively at a standstill and foreign ships halting calls, Black Sea trade has again become structurally unreliable for grain and oil.
The United States simultaneously opened a global economic front. Washington announced sweeping 10–12.5% tariffs on some 60 trade partners, explicitly citing forced labor and layering a dedicated 10% duty on UK imports. Key commodities—oil, gas, fertilizer, foodstuffs—are carved out, but industrial supply chains are not. Canada has threatened to do “whatever it takes” in retaliation, while other allies quietly calculate responses. The EU, for its part, agreed a 21st Russian sanctions package that tightens screws on banks, oil traders, crypto and shadow fleets but protects LNG transits via a Greek‑backed carve‑out. In parallel, Brussels fined Google €890 million under the Digital Markets Act, confirming that large U.S. tech platforms now face simultaneous regulatory and geopolitical pressure in their core markets.
Below the kinetic and trade layers, two structural shifts stand out. First, the United States locked in a $1.15 trillion defense bill that hardwires deeper operational integration with Israel and commits to long‑term AI, sensor, and cloud‑centric warfighting—just as Iran reportedly struck an AWS data center in Bahrain, pulling global cloud infrastructure into the target set. Second, the cyber domain crossed a threshold: investigators uncovered an autonomous “Hermes” AI agent operating largely unattended against Thailand’s Ministry of Finance, highlighting how state‑grade, machine‑driven intrusion tools can now probe sovereign fiscal systems with minimal human oversight.
In the next 24–48 hours, three decision points will determine whether today’s shocks metastasize. First, whether Trump orders the “massive” Iran strike he has repeatedly trailed, particularly against strategic infrastructure beyond military sites; if he does so while Iran is firing anti‑ship missiles into Hormuz and threatening UK bases, NATO itself edges toward direct exposure. Second, whether Russia operationalizes its “unsafe” Black Sea designation into interdictions or de facto blockade conditions; insurance and shipowner behavior over the next sailing cycle will show if the corridor remains economically usable. Third, whether U.S. trading partners coalesce around coordinated retaliation to Washington’s tariffs or fragment into bilateral skirmishes; the former would rewire supply chains at speed, the latter would generate rolling uncertainty in FX, equities, and industrial commodities.
Top Developments by Theater
CENTCOM
-
22:45–23:30 UTC – 13th night of U.S. strikes, major damage around Ahvaz and Andimeshk (Iran).
U.S. forces launched another large wave of strikes on IRGC targets across Iran, including a military base northwest of Ahvaz where at least 18 buildings were destroyed, an ammunition depot along the Ahvaz–Andimeshk road, and facilities in Andimeshk with major secondary explosions indicating ammo stocks. -
~23:00 UTC – U.S. hits “missile city” in Yazd and dispersed sites across Iran.
U.S. aircraft and cruise missiles struck a hardened missile complex in Yazd and multiple sites across Iran—including Bamani, Ziarat, Ramshir, Bandar Mahshahr, Bushehr, Eslamabad‑e Gharb, Andimeshk and the Shalamcheh crossing—marking a geographically broad attack on missile, drone, and logistics nodes. -
15:51–16:00 UTC – U.S. airstrike on Suza pier, Qeshm Island, with Hormuz closed.
U.S. strikes hit the Suza pier on Iran’s Qeshm Island, adjacent to key Gulf shipping lanes, only hours after the IRGC publicly stated that the Strait of Hormuz remains closed with ships waiting for clearance. Later in the window, unconfirmed reports surfaced of an unidentified object shot down over Qeshm, with local speculation it was a U.S. jet. -
From ~11:50 UTC onward – Iran attacks U.S. bases and border crossings in Kuwait and Jordan.
Iran launched missiles and UAVs at the Abdali border crossing (Kuwait–Iraq), then at U.S. facilities at Camp Buehring, Ali Al Salem, and other sites in Kuwait, as well as at King Faisal Air Base in Jordan. Visual evidence shows a U.S. HIMARS site in Kuwait burning after a strike; Kuwait’s largest power station was also hit, triggering power‑reliability concerns. -
14:00–20:00 UTC – Iran and proxies hit U.S.‑linked and Saudi maritime assets; Aramco reroutes flows.
Houthis claimed ballistic/cruise missile and drone attacks on Saudi tankers ENCELIA and LAYLIA in the central Red Sea, with confirmed fire damage and a visible spill near Farasan Island. A separate Saudi tanker was filmed burning in an unspecified attack, and a tanker was struck near Bab al‑Mandeb around 21:59 UTC, prompting Saudi Aramco to reroute crude via an Egyptian port to bypass the strait. -
Throughout window – Iranian threats to UK and European drawdown from Tehran.
The IRGC repeatedly warned that any British base used for U.S. strikes—explicitly RAF Fairford—would be treated as a hostile target. Germany and France evacuated diplomatic staff from Tehran as explosions were reported in Shiraz and Western intelligence assessed that Iran may contemplate a pre‑emptive strike against Israel. -
Red Sea and Bab al‑Mandeb risk escalates, IRGC reinforcing Houthis.
Threat level in Bab al‑Mandeb was raised to “substantial”; the UN Yemen envoy reported renewed Houthi attacks on commercial shipping, while intelligence indicated Iran flew IRGC commanders and missile/drone equipment into Yemen to strengthen Houthi anti‑shipping capabilities. Ship hijacking activity resurfaced off Puntland, with a merchant vessel held near Somalia.
Together, these actions confirm that the U.S.–Iran confrontation is now a multi‑front, state‑on‑state war enveloping Gulf bases, cross‑border logistics, and maritime corridors. Hormuz is effectively shut, the Red Sea and Bab al‑Mandeb have become contested battlespace, and Kuwait—a core U.S. logistics hub—is absorbing sustained missile and UAV fire on both military and civilian infrastructure. Iran’s decision to push the fight into Jordan and Kuwait, and to threaten UK bases, raises the ceiling for U.S. retaliation and pulls more allies into the blast radius. Energy markets are already repricing; the remaining question is how much physical damage the next U.S. strike package inflicts on Iran’s strategic assets and whether Tehran escalates into direct attacks on Israeli or British territory.
EUCOM
-
Black Sea energy and grain routes degraded on multiple axes.
- Around 14:38 UTC, drone attacks shut a key Black Sea export terminal handling Kazakh crude, sharply reducing Kazakhstan’s production and tightening non‑OPEC supply into Europe.
- Russia’s Defense Ministry declared its Black Sea EEZ “unsafe for navigation” in a bulletin reported at 14:14 UTC, raising de facto risk premia on all Black Sea shipping.
- Ukraine’s Defense Forces claimed a strike on a Russian tanker, while Kyiv confirmed that foreign vessels have halted calls to its ports; Odesa, Chornomorsk, and Yuzhny saw ship traffic fall effectively to zero.
- President Zelensky said Ukraine can no longer use its seaports for cargo transportation, formalizing the breakdown of its maritime export capability.
-
Ukraine deep‑strike and logistics campaign intensifies inside Russia.
- Ukrainian drones reportedly hit Transneft’s Subkhankulovo oil pumping station in Bashkortostan and the Tinguta pumping station in Volgograd; previous strikes damaged the Novokuybyshevsk refinery’s rail logistics.
- Drone attacks over recent days have disrupted Wildberries warehouses across multiple regions (Leningrad, St. Petersburg, Krasnodar, Nevinnomyssk, Belye Stolby, Elektrostal, Shushary), knocking out roughly 10% of the firm’s warehouse capacity in a week.
- Around Belgorod, Ukrainian attacks hit some 20 fuel stations in recent days, closing 25–30% of local stations and triggering rationing and long queues.
-
Russian vulnerabilities: banking stress, fuel imports, and airpower losses.
- Reports of a surge in cash withdrawals and “significant problems” in Russia’s banking system signal rising confidence risk and possible bank‑run dynamics.
- Moscow has reportedly been forced to import fuel from India for the first time due to cumulative Ukrainian damage to refineries and pumping stations, flipping part of Russia’s narrative from exporter to emergency importer.
- Russia lost a Su‑57 stealth fighter in the Moscow region during training; Ukrainian sources claim a cyber‑enabled deception of Russian air defenses, while Moscow attributes the loss to malfunction.
-
EU sanctions and regulatory pressure tighten but preserve LNG flows.
- EU governments agreed a 21st sanctions package against Russia, targeting 32 banks, crypto firms, oil trading platforms, and elements of the shadow fleet while freezing oil price‑cap changes for a year.
- A Greek‑backed carve‑out preserves the ability of Greek shippers to move Russian LNG under legacy contracts, reflecting Europe’s continued dependence on Russian gas even as it clamps down on crude logistics and financial channels.
The European theater is transforming into a systemic pressure campaign against Russia’s economic and military logistics, with Ukraine’s deep‑strike drones reaching hundreds of kilometers into Russia’s energy heartland and commercial infrastructure. The combined effect of Black Sea hazards, Kazakh terminal shutdowns, and Russia’s own infrastructure damage has converted the region into another contested energy chokepoint on par with Hormuz and the Red Sea. Moscow’s first‑ever fuel imports from India and visible stress in its banking system expose a regime under resource and confidence pressure even as it attempts to sustain offensive operations in Donetsk and elsewhere. EU measures tighten the net around Russian oil and finance but deliberately stop short of severing LNG, underscoring the limits of European leverage while its own energy security remains fragile.
INDOPACOM
-
Autonomous AI‑driven cyberattack targets Thailand’s Ministry of Finance (~19:40 UTC).
Security researchers exposed an unattended autonomous AI agent (“Hermes”), a custom Go‑based implant, and tailored tooling aimed at Thailand’s Ministry of Finance. The tooling suggests a sophisticated, possibly state‑backed campaign seeking access to core fiscal, tax, and debt systems. -
China leverages Ukraine war as training ground.
Western officials assess that Beijing is systematically absorbing battlefield lessons from Russia’s war in Ukraine—especially on drone swarms, electronic warfare, and submarine operations—to inform future operations around Taiwan and the South China Sea.
The Indo‑Pacific saw no major kinetic events in this window, but the discovery of a largely autonomous AI intrusion capability against a sovereign finance ministry marks a qualitative shift in cyber risk. Treasuries, central banks, and debt managers across the region—and globally—must now contend with machine‑driven campaigns that can probe, adapt, and persist with little human oversight. Coupled with China’s intensive study of Ukraine’s battlefields, the region is watching a slow‑motion rearmament in both physical and digital domains that will shape the balance over Taiwan and critical sea lanes over the rest of the decade.
AFRICOM
-
Somali piracy resurfaces near Puntland.
Residents reported that a merchant ship hijacked off Yemen is being held by Somali pirates near the Puntland coast, suggesting opportunistic piracy is re‑emerging alongside the broader Red Sea conflict. -
Sahel jihadist advances in Burkina Faso and atrocities in Mali.
- Around 22:30 UTC, JNIM fighters attacked Taboré near Fada N’Gourma in Burkina Faso, killing more than ten soldiers and reportedly seizing full control of the garrison and the town.
- In Mali, insurgents and separatists ambushed a military convoy, with multiple reports that surrendering Malian soldiers were tortured and executed; the UN human rights office called for an investigation on 23 July.
The combination of renewed piracy off Puntland and JNIM’s capture of a garrison in eastern Burkina Faso underscores that while global focus is on the Gulf and Black Sea, non‑state actors in Africa are exploiting bandwidth gaps. Control of Taboré gives jihadists a stronger foothold along key corridors in eastern Burkina, threatening already‑precarious state control across the Liptako‑Gourma zone. The alleged torture and execution of Malian soldiers will deepen civil–military distrust and may accelerate the fragmentation of Mali’s security landscape. For maritime stakeholders, a hijacked ship held off Somalia means insurers and navies must revisit counter‑piracy postures even as naval assets are being pulled toward the Red Sea.
SOUTHCOM
-
Armed attack on police station in Paraguay (around 23:00 UTC).
A group of 20–30 armed men assaulted a police station in Colonia Naranjito, Canindeyú Department, killing two officers and a civilian employee and wounding two more officers. -
Venezuela building collapse – ongoing rescue in La Guaira.
In La Guaira, rescuers and volunteers continued extraction efforts at the collapsed OPP26 Tower G residential complex, with people believed to be alive under the rubble.
The Paraguay attack points to significant organized armed capability along a corridor often tied to narcotics and contraband flows near the Brazilian border. Whether tied to known cartels or local militias, the lethality and scale of the assault will drive Asunción to seek greater control in frontier departments, with implications for cross‑border security cooperation with Brazil. The Venezuelan tower collapse spotlights chronic infrastructure decay and governance failures; politically, images of ongoing rescue in a key coastal city will amplify domestic pressure on Caracas even as the regime seeks to project stability.
NORTHCOM
-
U.S. war powers and Iran: institutional brake removed.
The Senate blocked a resolution that would have required Trump to seek congressional approval for further action against Iran, while the House passed a more symbolic curb. Senate Republicans are attaching additional Iran sanctions to a Russia bill, and Trump is openly weighing a “massive” strike, arguing Tehran “hasn’t received enough pain yet.” -
Record $1.15 trillion defense bill and deepened Israel integration.
Congress advanced a record defense authorization that funds long‑term competition with China and ongoing operations in Europe and the Middle East, and that embeds Israel more deeply into U.S. military architecture—covering drones, AI, tunneling warfare, missile defense, quantum, and advanced sensors. Oracle and Nvidia secured multi‑year cloud and chip‑packaging contracts. -
Domestic infrastructure stress: grid disconnect and security vulnerabilities.
- A “massive power disconnect” on the largest U.S. grid raised reliability concerns and contributed to expectations of higher gas and power price volatility—just as Brent’s surge strengthened rate‑hike bets for September.
- A Secret Service agent assigned to Vice President JD Vance was placed on leave in a leak probe over sensitive travel and security details, exposing insider risk at the core of U.S. political protection.
-
Tariff shock and trade war rhetoric.
- The U.S. imposed 10–12.5% tariffs on 60 trading partners over forced‑labor concerns, carving out oil, gas, fertilizer, and food, but targeting manufactured goods and industrial supply chains.
- Trump separately announced a 10% tariff on the UK and other unnamed countries; Canada’s Prime Minister Mark Carney vowed to do “whatever it takes” in retaliation, signaling an escalating North American trade dispute.
Northcom is now the political and economic anchor of a global crisis. Domestically, the removal of congressional constraints on Iran operations, coupled with a historically large defense bill and structural investments in AI‑driven warfare, means Washington is planning for sustained high‑tempo conflict even as its own grid and political‑security systems show strain. Externally, the decision to weaponize tariffs against a broad array of partners—including the UK and Canada—without touching core commodities introduces a new axis of uncertainty for manufacturers, logistics operators, and allied governments who are simultaneously dealing with an energy price shock driven by U.S. military choices. The net effect: U.S. policy is amplifying volatility at home and abroad even as it assumes greater leadership in multiple theaters.
Analytical Takeaways
-
Three maritime chokepoints are now live theaters of conflict, hard‑wiring an energy shock into 2H 2026.
Hormuz is effectively closed by IRGC declaration and active U.S.–Iran strikes; Bab al‑Mandeb and the central Red Sea are under active Houthi missile/drone threat that has already hit multiple Saudi tankers and forced Aramco reroutes; and the Black Sea is constrained by Russian “unsafe” designations, drone‑disabled Kazakh exports, and halted traffic to Ukrainian ports. This triad compresses spare routing capacity and ensures that even absent direct hits on major oil fields, crude and product markets will carry a persistent and elevated risk premium. -
Iran is pursuing a horizontal escalation strategy that deliberately widens allied exposure.
By striking U.S. bases in Kuwait, Bahrain, and Jordan; attacking Kuwait’s largest power station and Abdali crossing; threatening British bases used by U.S. bombers; and reinforcing Houthis and possibly other proxies, Tehran is distributing the costs of the conflict across the U.S. alliance network. This raises the political price of continued operations for Washington and NATO states and creates more veto players—Kuwait, Bahrain, Jordan, the UK, and Saudi Arabia—who may eventually press for constraint or, conversely, for larger retaliatory packages. -
Ukraine’s deep‑strike drone campaign has crossed from battlefield shaping to systemic economic warfare.
The pattern of strikes—on Transneft pumping stations, refineries, civilian logistics hubs like Wildberries warehouses, and fuel stations in Belgorod—alongside Black Sea tanker and terminal hits, indicates intent to erode Russia’s industrial and logistics base rather than merely degrade front‑line units. The result is visible strain: Russia is importing fuel from India, facing localized fuel shortages, and showing signs of banking stress. For Kyiv and its backers, this validates investment in low‑cost, long‑range UAVs as tools for strategic coercion. -
Washington is normalizing “two‑front” coercion: kinetic power projection and trade tools deployed simultaneously.
The U.S. is bombing Iran nightly while rolling out tariffs on 60 trading partners and integrating Israel more deeply into its war‑fighting architecture. Simultaneously, it is tightening sanctions on Russia via EU coordination and new U.S. measures. This dual use of hard power and economic pressure compresses decision space for allies, who must now manage both physical security risks (from Hormuz to the Black Sea) and trade or regulatory exposure (tariffs, tech fines, sanctions) in the same time window. -
Critical digital and financial infrastructure has entered the target set, raising systemic risk beyond physical assets.
The reported Iranian strike on an AWS data center in Bahrain, combined with the discovery of an autonomous AI intrusion tool against Thailand’s Ministry of Finance and the investigation into a Secret Service insider leak, signals that server halls, sovereign finance systems, and political protection details are increasingly at risk. Cloud providers, treasuries, and security agencies must recalibrate their threat models from opportunistic hacks to deliberate, state‑grade campaigns that can run at machine speed and reach into the heart of state and corporate operations.
Watchlist (Next 24–48 Hours)
-
If Trump orders a “massive” strike package against Iran that targets power grids, missile fields, or leadership bunkers (beyond the current nightly tempo), it will signal a shift from coercive punishment to war‑termination aims—forcing Iran to choose between absorbing damage, escalating against Israel/UK assets, or targeting Gulf energy infrastructure directly.
-
If Iran or its proxies successfully strike a U.S. or UK naval vessel in or near Hormuz or the Red Sea, it will mark a qualitative escalation that could trigger NATO consultations and a push for coalition naval operations—raising the likelihood of direct clashes and more comprehensive targeting of Iranian naval and coastal assets.
-
If Russia moves from declaring the Black Sea “unsafe” to physically stopping, harassing, or mining commercial vessels in its EEZ over the next sailing cycle, shipowners’ withdrawal will effectively create a de facto blockade—tightening global grain and oil supplies and inviting stronger NATO and Turkish responses on sea‑lane security.
-
If Canada and major U.S. trading partners (e.g., the EU, UK, Mexico, Japan) announce coordinated counter‑tariffs or WTO action within the next 48 hours, it will confirm the emergence of a structured trade war that will push manufacturers to accelerate supply‑chain shifts away from U.S.‑centric routes and raise volatility in industrial metals and FX.
-
If evidence confirms severe functional degradation at the AWS Bahrain facility—such as sustained outages for Gulf financial institutions or government systems—it will signal that cloud infrastructure is now an accepted target in state conflict, encouraging copycat attacks and forcing global providers to reconsider physical concentration of data centers in high‑risk regions.
-
If Ukrainian drones achieve further high‑impact hits on Russian oil infrastructure east of the Urals or on additional Black Sea energy terminals in the coming 48 hours, and Moscow visibly ramps fuel imports or domestic rationing, it will indicate that Kyiv has acquired a durable capacity to influence global energy supply not just at the margin but at scale.