BATTLESPACE Updates

   +44 (0)77689 54766
   

NEWS IN BRIEF – MIDDLE EAST – CONFLICT

by

Sponsored by Bertin Exensor

 

www.exensor.com

 

——————————————————————————————————————————————————————————————————————————————————————————————————————————————-

Military And Security Developments

Jul 11.

  • US-Israel: RaaS operation highlights sustained security, disruption risks from Iran-linked groups. On 9 July, international news outlets reported that the Iranian Ransomware-as-a-Service (RaaS) group ‘Pay2Key’ has resumed operations (following a five-year break) in response to the US’ airstrikes against Iran on 22 June. On 23 June, the group reportedly shared a post promising a revenue increase for any affiliates that conduct attacks against Israeli and/or US entities, highlighting the elevated ransomware risks in the short term. Pay2Key is suspected to be affiliated with the Iranian state-sponsored group ‘Pioneer Kitten’, indicating that the Iranian state is possibly leveraging cyber criminal groups to target Israel and the US. Pro-Iran hacktivist groups have also claimed several distributed denial-of-service (DDoS) attacks against the aviation, defence and financial sectors in the US in response to the strikes. We assess this points to sustained security and disruption risks facing Israeli and US entities amid persistent regional hostilities.
  • Iraq-Turkey: Disarmament ceremonies will increase operational disruption, small-scale clashes risks. Later on 11 July, approximately 40 Kurdistan Workers’ Party (PKK) militants will participate in a weapons handover ceremony in Sulaymaniyah (Sulaymaniyah governorate, Iraq), beginning the group’s official disarmament process. The PKK’s imprisoned leader, Abdullah Öcalan, called for disarmament in February, and the PKK’s congress voted to formally dissolve and disarm in May (see Sibylline Situation Update – 11 July 2024). The authorities have adopted a significantly elevated security posture in and around the city, sustaining localised travel and supply chain disruption risks in the coming days. The ceremony will likely involve the symbolic burning of weapons, increasing risks of explosions and misfire. Such incidents will possibly escalate rapidly into small-scale clashes between attendees and the security forces, particularly if hardline PKK elements opposed to disarmament attempt to disrupt the politically sensitive ceremony. In the coming months, further disarmament ceremonies will temporarily drive risks of temporary operational disruption and small-scale clashes in Iraq and Turkey’s Kurdish-majority areas. We assess that risks of hardline PKK elements splintering into disparate factions will sustain potential exposure to separatist violence therein.
  • Syria: Deadlocked integration talks will elevate risks of domestic unrest, security challenges. On 10 July, the US envoy to Syria, Tom Barrack, stated that the Damascus government and the Kurdish-led Syrian Democratic Forces (SDF) remain at odds over merging forces into Syria’s new security institutions. While Damascus is keen to implement the integration plans, there appears to be a degree of reluctance from Kurdish forces who wish to maintain some degree of autonomy. The US will unlikely support the Kurdish pro-federalism stance and will instead continue to support Damascus’ vision of a unified army and police. The current deadlock will likely postpone a new integration deal in the short term. This will elevate domestic unrest within Arabic tribes in the Kurdish regions and the likelihood of mutiny among Arabic elements within the SDF. We assess that the deadlock will also likely impact joint operations against Islamic State (IS), raising the risk of resurgence (see Sibylline Situation Update Brief – 10 July 2025). Nevertheless, the SDF will possibly be put under significant pressure by Washington DC to eventually accept the integration plan in the coming months, contingent upon security and political guarantees.

Jul 10.

KEY DEVELOPMENTS

IRAN

  • Despite US claims that nuclear negotiations with Iran will resume in the coming days, broader incompatibilities will sustain the risk of deadlock in the coming weeks.
  • The US continues to expand sanctions on Iran, sustaining compliance risks for regionally engaged energy and shipping firms.
  • The UK parliament’s Intelligence and Security Committee (ISC) warned of rising hybrid and cyber threats from Iran, underscoring the sustained risks of espionage and cyber attacks.

ISRAEL

  • While Israel has agreed in principle to several Hamas demands, sticking points persist; these will likely delay the finalisation of an agreement.
  • Israel’s possible plans to establish a ‘humanitarian city’ in Gaza are highly likely to compound regional tensions and increase the risk of targeted activism facing Israeli-linked firms worldwide.

PALESTINIAN TERRITORIES

  • An attack in the southern West Bank has underscored the rising security risks therein; the likelihood of localised military operations and armed clashes will increase in the coming days.
  • The Harim Mall attack is likely to prompt retaliatory violence by Israeli settlers and far-right activists against Palestinian communities in the West Bank.
  • A complex Hamas attack in northern Gaza and an attempted kidnapping of an IDF soldier in southern Gaza will likely prompt an intense IDF response; they also signal Hamas’ resilience, despite ongoing military pressure.
  • A meningitis outbreak in Gaza underscores the elevated risks stemming from communicable diseases amid increasing public health concerns.
  • The Gaza Humanitarian Foundation (GHF) announced plans to distribute aid through ‘community leaders’, elevating the risk of intercommunal clashes.

IRAN

  • Despite US claims that nuclear negotiations with Iran will resume in the coming days, broader incompatibilities will sustain the risk of deadlock in the coming weeks. On 7 July, US President Donald Trump stated that Iran had requested further talks on its nuclear programme, with international media subsequently reporting that representatives will participate in talks in Norway in the coming days. However, Iranian officials have claimed that while Iran is open to diplomacy, the US has yet to show ‘genuine readiness for an equitable accord’ and that no such talks have been scheduled. While backchannel negotiations on re-establishing contact between the US and Iran will likely proceed in the coming days, Iran will likely seek assurances that the US will not authorise strikes on its nuclear facilities during formal negotiations before committing to participate. Such conditions will moderate prospects for productive engagement in the coming days and delay potential progress towards a comprehensive nuclear agreement. Even if talks resume, long-standing incompatibilities over whether Iran should maintain its domestic enrichment capabilities will sustain the risk of the talks stalling in the coming months. Failure to secure an agreement will increase the likelihood of further Israeli and/or US strikes targeting Iranian nuclear facilities in the medium-to-long term, particularly if Iran attempts to re-construct and re-develop its nuclear capabilities rapidly.
  • The US continues to expand sanctions on Iran, sustaining compliance risks for regionally engaged energy and shipping firms. On 9 July, the US Treasury sanctioned 22 entities based in Hong Kong, the UAE and Turkey for facilitating the sale and transport of Iranian oil; this allegedly forms part of a broader effort to target Iran’s ‘shadow banking’ infrastructure. This involves numerous front companies and accounts that facilitate the sale of sanctioned oil products and launder the proceeds to finance Iran’s nuclear and missile programmes. The US previously sanctioned 30 similar entities on 6 June, underscoring increased scrutiny of Iranian-linked currency exchanges and associated banking facilities, particularly those based in Hong Kong and the UAE. The US is highly likely to continue expanding sanctions on Iranian and Iranian-linked entities in the coming months, particularly in the energy, shipping and banking sectors, increasing sanction-exposure risks for regionally engaged entities. Firms interacting with Iranian nationals and dual nationals engaged in these sectors will also face increased due diligence requirements, elevating compliance concerns.
  • The UK parliament’s Intelligence and Security Committee (ISC) warned of rising hybrid and cyber threats from Iran, underscoring the sustained risks of espionage and cyber attacks. The ISC’s 10 July report outlines a significant escalation in Iran’s efforts to develop its capacity to conduct hybrid and cyber attacks targeting individuals and entities in the UK since 2021. The report notes that Iran has significantly increased its efforts to identify, monitor and conduct ‘physical hostile activity’, including kidnapping, forced repatriation and assassination attempts targeting high-profile, UK-based anti-(Iranian) government activists, as well as Jewish and Israeli individuals and entities. It also notes that Iranian espionage operations (including cyber espionage) targeting entities in the UK have increased in frequency and intensity in recent years, particularly those targeting universities, media entities, advocacy NGOs, public sector bodies, travel companies and IT service providers. Although evidence collection ended in August 2023, the report underscores Iran’s increasing capacity to conduct hybrid and cyber threat activity targeting jurisdictions such as the UK, the US and various EU member states. In the coming months, elevated regional tensions will sustain the likelihood of further targeting. This risk will be particularly acute for entities based in France and the UK if either state attempts to re-impose UN sanctions on Iran by triggering the snapback clause under the 2015 Joint Comprehensive Plan of Action

ISRAEL 

  • While Israel has agreed in principle to several Hamas demands, sticking points persist; these will likely delay the finalisation of an agreement. On 10 July, local news reported that Israel had agreed in principle to Hamas’ demands to allow Qatar to provide reconstruction support in Gaza during the ceasefire period; this likely reflects an attempted confidence-building measure by Israel. The developments follow a meeting between US President Donald Trump and Israeli Prime Minister Benjamin Netanyahu earlier this week, during which the former likely exerted pressure on Israel to demonstrate greater flexibility. However, sticking points in negotiations remain; the latest hurdles concern the presence of the Israel Defense Forces (IDF) in the Morag Corridor between Khan Yunis and Rafah in southern Gaza and the prospects for the creation of a humanitarian city (see below). Additionally, there has recently been an escalation in far-right ministers’ opposition to a ceasefire deal, as well as a notable shift towards criticism of Netanyahu. This will likely continue to add pressure on Israeli decision makers involved in the ceasefire negotiations, extending the timeline in which a ceasefire can be agreed. As such, while a ceasefire agreement remains a realistic possibility in the coming three weeks, we assess it is unlikely in the coming days.
  • Israel’s possible plans to establish a ‘humanitarian city’ in Gaza are highly likely to compound regional tensions and increase the risk of targeted activism facing Israeli-linked firms worldwide. On 8 July, Israeli Defence Minister Israel Katz announced that he had ordered the IDF to advance plans for a ‘humanitarian city’ to house approximately 600,000 displaced civilians in the Rafah area. Katz stated that the development would provide accommodation and access to humanitarian aid; he also stated that it would (eventually) expand to accommodate over 2 million civilians. Katz also indicated that civilians would need to pass ‘screening’ to access the facility but would not be able to leave following their admission. The announcement has triggered significant international criticism. Hamas will almost certainly oppose efforts to advance the construction of such a facility, elevating the risk of deadlock in ceasefire negotiations (see above). However, efforts to develop a ‘humanitarian city’ in Rafah are highly unlikely to progress substantially in the short term given broader logistical and security constraints. Even so, firms associated with efforts to develop this proposal and/or those tendering contracts to this end (such as consultancies, business service providers and/or construction firms) will face significantly elevated reputational and corporate governance risks, as well as targeted activism by pro-Palestine groups and individuals.

PALESTINIAN TERRITORIES 

  • An attack in the southern West Bank has underscored the rising security risks therein; the likelihood of localised military operations and armed clashes will increase in the coming days. On 10 July, two Palestinians killed an Israeli security guard outside the Harim Mall in Gush Etzion Junction (Hebron governorate). According to initial reports, the assailants stabbed the guard before shooting him with his own firearm, highlighting the elevated risks facing personnel carrying weapons in the West Bank. Following the attack, the IDF established checkpoints at the entrances to Bethlehem, Teqoa (both Bethlehem governorate), Halhul and Hebron (both Hebron governorate). The incident has further underscored the increasing militant presence in the southern West Bank (see Sibylline Middle East Crisis Update – 3 July 2025). In the coming hours and days, the IDF is likely to intensify its military operations in the southern West Bank, particularly in Bethlehem and Hebron. Such operations will exacerbate travel disruption and the risk of armed clashes in the area. Further operations in the northern West Bank are also likely.
  • The Harim Mall attack is likely to prompt retaliatory violence by Israeli settlers and far-right activists against Palestinian communities in the West Bank. The risk will be particularly acute around the Gush Etzion settlement bloc (Bethlehem and Hebron) and in the vicinity of Salfit and Silwad Palestinian population centres (Salfit, Ramallah and al-Bireh governorates). IDF operations and attacks by settlers are likely to exacerbate radicalisation risks among the Palestinian population in the West Bank. This will increase the likelihood of sole-perpetrator and militant attacks against Israeli targets in the coming weeks, particularly along key roads, near checkpoints and in the vicinity of settlements.
  • A complex Hamas attack in northern Gaza and an attempted kidnapping of an IDF soldier in southern Gaza will likely prompt an intense IDF response; they also signal Hamas’ resilience, despite ongoing military pressure. On 7 July, Hamas operatives killed five IDF soldiers and injured 14 others in a complex attack in Beit Hanoun (northern Gaza) that involved manually triggered roadside bombs. The attack was reportedly the culmination of extensive reconnaissance by Hamas forces to identify the best routes. The operation consisted of a phased attack in which Hamas fighters detonated consecutive explosives, before then launching a small arms assault on rescue forces. In a separate incident on 9 July, Hamas fighters launched a rocket-propelled grenade (RPG) on IDF troops in Khan Yunis (southern Gaza), before then launching a surprise operation from a concealed tunnel in a failed attempt to kidnap a soldier (who died in the attempt). The two incidents signal an intensification of Hamas attacks on IDF troops in Gaza and demonstrate the group’s sustained capacity to plan and launch complex operations. This underlines the group’s persistent resilience despite reports that Israel’s targeting of commanders is presenting substantial leadership challenges. In response to these increasing attacks, Israel is likely to intensify its operations in Gaza, starting with airstrikes and followed by the deployment of armoured units and infantry. Furthermore, due to the intensification of attacks, there will be an elevated risk of misidentification and misfire in Gaza, as IDF troops are likely to be on heightened alert, elevating security risks for personnel throughout the strip.
  • A meningitis outbreak in Gaza has underscored the elevated risks stemming from communicable diseases amid increasing public health concerns. On 9 July, the UN Office for the Coordination of Humanitarian Affairs (OCHA) released a report indicating that there was a substantial uptick in meningitis cases in Gaza in June, primarily among children. Although Gaza typically experiences an uptick in meningitis cases between June and August, the OCHA reported a total of 484 suspected meningitis cases in June (primarily at the al-Rantisi children’s hospital in Gaza City), compared to pre-conflict averages of between 60 and 200 cases per year. As such, this spike underscores the elevated risk of communicable disease outbreaks within Gaza driven by limited access to sanitation and healthcare facilities, as well as widespread food insecurity and significant disruption to routine vaccination services. Ongoing restrictions to fuel deliveries, which have not resumed since they were suspended in March, will likely continue undermining access to medical and emergency services in the coming months, particularly given healthcare facilities’ reliance on generators due to a lack of electricity.  Although the EU’s foreign policy chief, Kaja Kallas, announced on 10 July that the EU and Israel had reached an agreement to increase the provision of humanitarian aid into Gaza and resume fuel deliveries in the coming days, the risk of operational and supply chain disruption will likely sustain pressure on public health facilities in the short term. Amid repeated civilian displacement due to ongoing IDF ground operations and airstrikes, further outbreaks of communicable diseases would increase the risk of exposure and infection for locally engaged staff, particularly NGO personnel who are in frequent contact with vulnerable populations, including children and the elderly.
  • The Gaza Humanitarian Foundation (GHF) announced plans to distribute aid through ‘community leaders’, elevating the risk of intercommunal clashes. Currently, the GHF distributes food packages (which are supposed to feed approximately five people for three days) to family unit representatives. The GHF has stated that the shift to distribution through ‘community leaders’ would allow the agency to scale up its operations and distribute around 20,000 boxes (1.2 million meals) per day, compared to a reported current average of roughly 2,000 boxes (120,000 meals) per day. A shift to a community-based distribution model would almost certainly empower selected distributors, elevating the risk of disrupted aid access for civilians and increasing intercommunal tensions, likely along ethno-religious lines. The decentralisation of aid distribution to informal and community-based mechanisms would compound the risk of crowd-management issues around distribution points, as well as widespread violent clashes involving organised and opportunistic criminal elements. This model would also highly likely disrupt operational continuity for locally engaged NGOs, sustaining wider food insecurity and socio-economic concerns within Gaza.

RED SEA 

  • The sinking of a second commercial vessel in a Houthi attack reflects a resumption in threats to maritime shipping. On 7 July, the Iranian-backed Houthis attacked the Liberian-flagged and Greek-operated bulk carrier Eternity C approximately 51 nautical miles (94.5km) to the west of al-Hudaydah (Yemen). The attack reportedly comprised unmanned surface vehicles (USVs) and rocket-propelled grenades; it killed four mariners and caused the ship to sink on 9 July. At the time of writing, maritime response teams have rescued ten crew members, while 11 others are still missing (the Houthis claim to have captured an unspecified number of crew members). This was the second Houthi attack on a commercial ship within a 24-hour period, following the sinking of Magic Seas on 6 July (see Sibylline Middle East Crisis Update – 7 July 2025). These are the first such attacks since November 2024, highlighting a resumption in Houthi operations against commercial shipping in the Red Sea. Further attacks are likely in the coming weeks, substantially elevating security risks for vessels navigating the Red Sea. This risk is particularly acute for vessels with demonstrable links to Israel. However, given that the Houthis’ justifications for the recent attacks were based on the targeted ships having made port calls to Israel, there is a realistic possibility that attacks are largely opportunistic and that justification is found after the incident, underlining a latent risk facing all Western ships.
  • The Houthis’ claims to have taken crew members captive suggest that the group possibly intends to take hostages during further such maritime attacks. This would heighten reputational and compliance risks for companies whose vessels are successfully boarded, particularly given the likely need to negotiate with the group or to make payments to secure releases. There is also a realistic possibility that the hostages will be used as leverage against Israeli or US strikes on Houthi infrastructure, with the group possibly seeking to attribute any deaths to all such strikes in an effort to generate international pressure on both countries. A resumption in US strikes against Houthi targets remains unlikely due to the May ceasefire agreement. However, if the Houthis escalate the frequency of their attacks in the coming month, this would put pressure on the US to secure freedom of navigation, elevating the likelihood of the US resuming strikes on Houthi targets, even if the Houthis continue to avoid targeting US vessels.

REGIONAL DEVELOPMENTS 

  • The IDF’s recent incursions into southern Lebanon are unlikely to prompt retaliation from Lebanese Hizballah (LH). On 8 July, the IDF announced that its 91st Division had conducted simultaneous ground incursions into southern Lebanon, targeting LH’s weapons stores, infrastructure and underground facilities. We assess that similar Israeli incursions along the border with southern Lebanon are likely in the coming weeks, sustaining security risks. The frequency and scope of such targeted operations are likely to increase if LH continues to postpone handing over its heavy weapons to the Lebanese government (see Sibylline Middle East Crisis Update – 7 July 2025). However, despite such incursions, LH remains unlikely to retaliate due to the significant degradation of its military capabilities and its intent to avoid undermining the fragile ceasefire. Nevertheless, these Israeli operations will possibly elevate the risks of misfire and sporadic clashes between the IDF and Lebanese army units stationed in the region (though we assess these risks remain very low at present).

Key points

  • The Kurdistan Workers’ Party (PKK)’s disarmament ceremony will drive operational and physical safety risks due to a heightened security posture and threats of misfire.
  • Dissident threat actors will possibly target the ceremony, driving reprisal risks and threatening the overall process.
  • PKK activity will likely continue to decrease as the disarmament process continues, though splinter cell activity is possible, sustaining threats to regional security.

Context

On 9 July, the imprisoned leader of the PKK, Abdullah Öcalan, announced that his group has officially abandoned its separatist agenda and ended its goal of establishing a Kurdish nation state; he claimed the group’s core demands have been fulfilled. This comes after Turkey’s pro-Kurdish Peoples’ Equality and Democracy Party (DEM) sent a delegation to the capital Ankara on 7 July to discuss the PKK’s upcoming disarmament process with President Recep Tayyip Erdoğan. The development comes ahead of a planned weapons handover ceremony, scheduled for 11 July in Sulaymaniyah (Sulaymaniyah governorate, Iraq). This has been co-ordinated by the Iraqi and Turkish authorities. However, regional media reports suggest that the PKK will destroy weapons instead of handing them over to the authorities. The full disarmament process is likely to be a long-term and heavily monitored procedure, for which there is no clear set end date.

Forecast

The disarmament ceremony will likely involve the symbolic destruction of weapons, which will exacerbate operational and security risks The possible destruction of weapons supplies by PKK fighters on 11 July, while largely symbolic, will elevate the risks stemming from accidental misfires and/or confrontations with the security forces, especially given the ceremony’s likely tense and heavily monitored environment. This will drive the threat of small-scale clashes, particularly if hardline elements within the PKK seek to utilise the event to disrupt the politically sensitive peace process. In such a context, minor incidents are likely to escalate rapidly. As such, there is likely to be a significantly heightened security posture in and around the event’s location, which will possibly be held at Sulaymaniyah International Airport (ISU). The police and security forces are likely to utilise arbitrary stop-and-search and detention practices throughout Sulaymaniyah. This will increase travel disruption risks in the vicinity of the airport and possibly lead to flight delays, driving moderate localised supply chain and operational disruption. The handover ceremony will likely present an attack target for terror and/or splinter groups, regardless of whether the PKK transfers or destroys its weapons The planned disarmament ceremony on 11 July in Sulaymaniyah will likely act as a symbolic and strategic target for dissident actors, including hardline PKK splinter groups and regional jihadist elements who oppose the peace process. The risk of a terror attack will be compounded by the density of small-arms weaponry; in turn, this will increase the risks arising from crossfire and panic caused by false alarms. A sudden incident, including a false alarm, would possibly cause mass panic, resulting in injuries and fatalities due to crushes in crowded areas. This risk would be exacerbated by poor crowd-control measures and inadequate evacuation protocols; however, tight security is almost certain at the event’s location. This will moderate the number of attendees and, as such, minimise the risk of sporadic attacks.

Any attack would likely involve small arms and IEDs, driving a substantial threat of physical harm and collateral risks for bystanders and proximate assets. In the event that Turkish intelligence or other security force members are harmed in such an attack, the Turkish government would likely undertake large-scale air operations targeting PKK splinter sites in the Qandil Mountains (Erbil governorate, Iraq) near the Iran-Iraq border. The authorities in Turkey would possibly engage in the detention of Kurds throughout the country on terror and corruption charges, possibly fearing further attacks within the country. This would exacerbate ethno-religious tensions and elevate the risk of the ceasefire process breaking down. The disarmament process is unlikely to impact Öcalan’s imprisonment under the ‘Right to Hope’ principle, driving the risk of future unrest There is currently no indication that the disarmament process will lead to Öcalan’s release or sentence revision, especially after Turkey reaffirmed its position on 27 June that life sentences without parole for Öcalan and other high-security inmates will remain unchanged. Although the current disarmament process is not contingent on Öcalan’s release, it is likely that many Kurds who support the peace process expect his release as part of a broader deconfliction strategy.

As the peace process continues, frustration will possibly grow among Kurdish communities, PKK sympathisers and former members of the group over Öcalan’s sustained imprisonment. Without a tangible political or judicial pathway leading to his release, his incarceration will possibly drive regular outbreaks of protests calling for his release in the long term and undermine confidence in the process. Protesters are likely seeking to congregate in public squares and outside municipal buildings in south-eastern Turkey, driving localised and temporary transport and supply chain disruption risks while elevating staff exposure to clashes between demonstrators and the security forces. The process is likely to curb the majority of PKK insurgency activity successfully, though limited splinter violence is likely to persist

The peace process will likely result in a drawdown of most of the PKK’s organised insurgency, particularly among Öcalan loyalists. However, dissident elements, including splinter cells in areas such as the Qandil Mountains and the semi-autonomous Rojava region of north-eastern Syria, are likely to continue rejecting the process, sustaining the overall threat to regional security (see Sibylline Special Report – 11 February 2025). The continuation of Turkish military operations against PKK splinter positions and assets in these areas will elevate the risk of the dissolution process stalling, increasing the risk of fracturing and the revival of insurgency operations. This would drive attack risks in Turkey, especially near government buildings and infrastructure, while maintaining security risks for on-the-ground NGO and business personnel in northern Iraq and north-eastern Syria.

Key points 

  • The partial US drawdown from Syria in the coming months will increase risks of Islamic State (IS) resurgence and the resumption of attacks targeting minorities and security forces nationwide.
  • Persistent rifts between Damascus and the Kurdish-led Syrian Democratic Forces (SDF) will likely hinder intelligence sharing and joint counter-terrorism operations, facilitating IS reconstitution.
  • Despite the ostensible integration of several Islamist militias into the newly formed security forces, many still pursue an extremist agenda, increasing risks of radicalisation and the emergence of rogue jihadist organisations in the coming months.

Context

On 22 June, at least one perpetrator opened fire and detonated an explosive device inside the Mar Elias Greek Orthodox Church in the capital Damascus, killing at least 25 civilians and injuring 63 others. The Syrian Ministry of Interior said that the Islamic State (IS) group was responsible for the suicide attack, though a new jihadist group calling itself Saraya Ansar al-Sunnah (SAS) claimed responsibility. There is a realistic possibility that SAS has ties with local IS cells, as the attack comes amid a broader uptick in IS attempts to regroup and revive its local networks across the country.

The Ministry of Interior stated that it has foiled at least nine IS plots to conduct mass casualty attacks in Damascus alone since January 2025, including an attack against the Sayyida Zaynab shrine, a prominent Shia religious site. Despite these efforts, IS has conducted over 96 small-scale attacks in Syria since 1 January, primarily in the eastern Euphrates region. However, increasingly throughout Q2, the group has also targeted the government security forces west of the Euphrates River, underscoring the group’s expanding operational scope and local networks.

Forecast

The US drawdown from Syria will increase risks of a resurgence in jihadist activity through 2025 and 2026 due to the limited counter-insurgency capabilities of the new government. In the coming year, the US will likely continue scaling down its military presence in Syria, consolidating its eight local bases into one singular base and reducing the number of stationed troops from 2,000 to 500. By mid-June, the US had already withdrawn from the Al-Wazir and Tel Baydar bases (both Hasaka governorate), bringing the number of its active bases in Syria to four. Further reductions will be highly likely in the coming months. Further withdrawals from central, north-eastern and southern Syria will highly likely create a wider security vacuum in the Badiya desert and rural areas in the Deir ez-Zor, Homs, Rif Dimashq and Suwayda governorates, which are hot spots for the remaining IS cells. This will likely facilitate an uptick in IS activity, recruitment and training, particularly in the Badiya desert. The desert will highly likely continue serving as an operating base and de facto shelter for IS cells due to its remoteness and strategic location bordering several governorates, as well as because of government control over the territory.

  • Jordan: Legal action against Islamist-affiliated NGOs will drive compliance risks, political instability. On 9 July, local news reported that the authorities had taken legal action against organisations allegedly linked to the Muslim Brotherhood (MB), including several non-governmental organisations (NGOs) accused of financial misconduct. This comes two months after the government banned the group, whose political arm, the Islamic Action Front (IAF), is the largest opposition party in parliament. The legal action underscores increased compliance and regulatory risks for NGOs operating in Jordan, particularly those affiliated with or linked to Islamist movements such as MB, or those receiving non-secular foreign funding. It also possibly highlights the government’s increasing oversight over civil society organisations, driving broader risks of democratic backsliding and political repression in 2025. We assess that further targeting of IAF, MB and other affiliated individuals and NGOs will increase domestic unrest risks in H2 2025, elevating the risk of clashes between Islamist and pro-monarchy groups. As such, there is a realistic possibility that King Abdullah II will dissolve the parliament in the coming months, increasing government instability and policy risks throughout 2025.
  • Libya: Belligerent rhetoric increases risk of resumed armed conflict in Tripoli, western cities. On 9 July, the UN Support Mission in Libya (UNSMIL) expressed concern over reports of militia mobilisation in the capital Tripoli and urged all parties to refrain from the use of force and belligerent rhetoric. This comes days after Prime Minister Abdul Hamid Dbeibeh demanded that the Special Deterrence Forces (RADA) hand over Tripoli’s Mitiga International Airport (MJI) and Mitiga prison to the state authorities. Dbeibeh also accused RADA of harbouring 125 persons wanted by the Attorney General. In response, the RADA-aligned militia Souq al Jum’aa Movement rejected negotiations, declaring a readiness to fight. We assess that the resumption of armed conflict in July remains a realistic possibility, elevating bystander and security risks across the city in the coming weeks. Furthermore, resumption of conflict will elevate spillover risks beyond Tripoli, with militias likely seeking support from nearby cities in the west, such as Misrata (Misrata district), Zawiya (Zawiya district) and Zintan (Jabal al Gharbi district). However, at the time of writing, there are no indications of significant mobilisation in the city by RADA or government-aligned militias (such as the 444 brigade).

Jul 09.

  • Iraq: Clashes between tribe, security forces will raise conflict risks near Erbil over next 48 hours. On 8 July, heavy clashes erupted between members of the Herki tribe and the Kurdish security forces in the Khabat district (Erbil governorate), following the attempted arrest of a prominent tribal figure, Khurshid Al-Harki. Khurshid’s supporters fired at the advancing security forces and cut off the Erbil-Mosul Road. The attempted arrest came amid a land dispute between the Guran and Herki tribes, which recently escalated into small-scale armed confrontations. There is a possibility that sporadic clashes in the Khabat district will resume in the next 48 hours (albeit with a reduced frequency and scope), sustaining armed conflict risks in the area. Travel disruption and elevated bystander risks along the Erbil-Mosul Road will be likely. Nevertheless, given the Herki tribe’s political influence in Kurdish politics, we assess that the government will likely seek to mediate with tribal leaders to reach a settlement in the coming days and offset wider conflict risk.

Jul 08.

  • Yemen-Region: Resumption of Houthi attacks will drive security, global supply chain risks. On 7 July, the Iran-backed Houthi militia conducted a small arms and drone attack on the Liberian-flagged, Greek-operated Eternity C in the Red Sea. The attack seriously injured two crew members, with two others missing. It comes a day after the Houthis sank another ship in the Red Sea, the first such attack since December 2024 (see Sibylline Middle East Crisis Update – 7 July 2025). The Houthis almost certainly targeted the vessels because they belong to a company that continues making port calls to Israel. These incidents signal a resumption of Houthis’ attacks on Red Sea commercial shipping, particularly Israeli-affiliated vessels. We assess that these attacks will likely increase in the coming weeks, especially near the Bab-el-Mandeb Strait, exacerbating disruption to key shipping routes, increasing operational and financial risks for businesses and straining global supply chains.
  • Iraq-Uzbekistan: Iranian actors pose security, cyber espionage risks to government sector. On 5 June, the cyber security company ESET reported that the Iranian state-sponsored group ‘BladedFeline’ has been conducting a long-term cyber espionage campaign against government entities in Iraq and the Kurdistan Regional Government (KRG) since at least 2017. The campaign also targeted a telecommunications provider in Uzbekistan, likely highlighting the group’s broader strategic intent to infiltrate critical national infrastructure (CNI) in the region. BladedFeline reportedly developed and used two new custom backdoor variants (‘Whisper’ and ‘PrimeCache’) throughout the intrusion to maintain prolonged persistence within compromised systems and enable remote command execution alongside stealthy data exfiltration via email attachments. The new tools share technical similarities with another Iranian state-sponsored group (‘OilRig’), suggesting that the groups may be connected. The latest BladedFeline activity was detected in 2024, further showcasing the long-term nature and continued development of this operation. We assess that this highlights long-term security and cyber espionage risks to CNI sectors amid ongoing regional hostilities.

Jul 07.

IRAN

  • Iran’s nuclear programme will operate without international monitoring following the withdrawal of all remaining International Atomic Energy Agency (IAEA) staff, compounding oversight concerns.
  • Iran continues to target foreign nationals and ethno-religious minorities amid its security forces’ ongoing crackdown on potential sources of anti-government sentiment and activity, underscoring increasing threats to locally engaged staff.

ISRAEL

  • Conscription orders for ultra-Orthodox communities will likely increase domestic unrest and travel disruption across Israel in the coming weeks.
  • Mortar fire targeting Nirim (Southern district) highlights the sustained security risks facing Gaza Envelope population centres, despite the government’s decision to allow the return of residents.

PALESTINIAN TERRITORIES

  • Despite the resumption of indirect negotiations, major sticking points will sustain the risk of delays in implementing an Israel-Hamas ceasefire agreement.
  • Violence in proximity to Gaza Humanitarian Foundation (GHF) aid distribution sites will sustain critical threats to life for locally engaged staff and compound broader reputational concerns for associated entities.

RED SEA

  • Overnight on 6-7 July, Israel conducted intense airstrikes against Houthi targets in Yemen.
  • A Houthi attack against the Liberian-flagged, Greek-operated bulk carrier Magic Seas underscores the sustained elevated security risks in the Red Sea area.

IRAN

  • Iran’s nuclear programme will operate without international monitoring following the withdrawal of all remaining International Atomic Energy Agency (IAEA) staff, compounding oversight concerns. On 4 July, the IAEA announced it had withdrawn all observers from Iran due to significant safety concerns; the announcement comes after Iran adopted a law restricting formal co-operation with the agency and preventing monitors from entering the country without explicit permission from the Supreme National Security Council (SNSC). Although the IAEA will retain access to regional facilities allowing for the detection of broader radiological changes (such as those emitted from nuclear weapons testing), the agency will be broadly unable to monitor Iranian nuclear activity such as facility development, uranium enrichment and stockpile enlargement. This will significantly restrict the IAEA’s capacity to monitor developments in Iran’s nuclear programme, compounding oversight concerns regarding the operational status of Iran’s nuclear facilities and the location of its enriched uranium stockpiles. Reduced official oversight will likely increase international parties’ reliance on covert surveillance and espionage to monitor nuclear activity, increasing verification and misidentification risks. Monitoring restrictions will highly likely compound regional tensions, particularly with the US amid stalled nuclear negotiations, sustaining the risk of Israel engaging in further limited strike action against Iranian nuclear facilities in the coming months, particularly if Iran attempts to re-develop its nuclear capabilities rapidly. Oversight restrictions will also increase the risk of France and/or the UK initiating measures to trigger the 2015 Joint Comprehensive Plan of Action (JCPOA)’s snapback clause before the agreement expires in October. This clause would then trigger a simple majority vote in the UN Security Council to reimpose UN sanctions on Iran. If actioned, such sanctions would significantly increase socio-economic risks within Iran and compound compliance concerns for regionally engaged firms.
  • Iran continues to target foreign nationals and ethno-religious minorities amid its security forces’ ongoing crackdown on potential sources of anti-government sentiment and activity, underscoring increasing threats to locally engaged staff. On 7 July, the French authorities confirmed that a French-German dual national travelling through Iran has been missing since mid-June, citing concerns that the Iranian authorities apprehended the individual. The Iranian security forces frequently detain foreign nationals on suspicion of espionage and subsequently leverage their detention to gain diplomatic and financial concessions from target countries. In the coming months, foreign nationals within Iran will almost certainly continue to face elevated risks of targeted surveillance, harassment and detention from the security forces, increasing the threats to locally engaged personnel. Further detentions are also highly likely to sustain elevated bilateral and regional tensions amid wider human rights concerns. More broadly, Iran has continued to target ethno-religious minorities disproportionately amid its efforts to identify and penalise possible anti-government activity (particularly activity linked to Israel, the US and/or other ‘hostile entities’). On 6 July, UK media sources reported that the Iranian authorities have intensified their repression of Bahai communities nationwide via frequent raids, arrests and asset seizures. Additionally, Tehran’s governor recently stated the city has increased deportations of undocumented Afghan migrants from the city ‘four times over’ compared to pre-war levels, citing the risk of espionage and broader national security concerns. The authorities are highly likely to continue intensifying repression and deportation campaigns in the coming months, increasing threats to local staff and their associates.

ISRAEL

  • Conscription orders for ultra-Orthodox communities will likely increase domestic unrest and travel disruption across Israel in the coming weeks. On 6 July, the Israel Defense Forces (IDF) confirmed it had officially begun to issue the first draft orders to Yeshiva members of the ultra-Orthodox community. The IDF plans to issue approximately 54,000 draft orders to Yeshiva members by the end of the summer. This community is known to be highly resistant to the notion of being drafted, raising the spectre of arrests in the event that such orders are repeatedly ignored. The move will increase the risk of domestic unrest emanating from the ultra-Orthodox community; protests are likely to target key thoroughfares in Israel, mainly around the Coca-Cola Junction along Highway 4 and the Chords Bridge junction at the entrance to Jerusalem (Jerusalem district). Other hotspots for unrest and travel disruption include IDF recruitment centres, particularly the Tel HaShomer Recruitment Centre (Tel Aviv district), which will likely disrupt the passage of emergency medical vehicles servicing the nearby Sheba Medical Center. Arrests of ultra-Orthodox draft dodgers in the coming weeks are likely to act as a trigger for large and potentially violent protests around these locations.
  • Mortar fire targeting Nirim (Southern district) highlights the sustained security risks facing Gaza Envelope population centres, despite the government’s decision to allow the return of residents. On 6 July, a mortar shell fired from southern Gaza hit Nirim, causing light material damage; no casualties were reported. The IDF claims that the shell was not intercepted due to human error, highlighting the sustained risks to population centres in the Gaza Envelope. The incident comes a week after the government approved the return of Gaza Envelope residents to their homes by 31 July. Residents are likely to challenge the government’s decision, particularly following the above-mentioned interception failure. This will elevate the risk of domestic unrest, possibly prompting small-scale demonstrations in front of the Israeli Knesset in Jerusalem district in the coming days.

PALESTINIAN TERRITORIES 

  • Despite the resumption of indirect negotiations, major sticking points will sustain the risk of delays in implementing an Israel-Hamas ceasefire agreement. On 4 July, Hamas indicated it had responded in a ‘positive spirit’ to the US-proposed framework for a 60-day ceasefire agreement in exchange for the release of at least ten living and 18 deceased Israeli hostages (see Sibylline Middle East Crisis Update – 3 July 2025). Although Israeli Prime Minister Benjamin Netanyahu characterised Hamas’ response as ‘unacceptable’, indirect negotiations resumed in Qatar on 6 July. While the first round of talks reportedly ended inconclusively, a second round continues at the time of writing. Despite resumed diplomatic contact, major sticking points mean that negotiations will remain highly sensitive to deadlock. Hamas has repeatedly called for Israel to agree to a permanent ceasefire and to allow UN and Red Crescent aid deliveries to resume, while Israel has repeatedly stated it will only agree to a temporary ceasefire (which would allow for the possible resumption of IDF operations thereafter). Despite increasing pressure from the US, the possible adoption of maximalist negotiating positions will elevate the risk of deadlock in the coming days, moderating prospects for the implementation of a comprehensive ceasefire and hostage-release agreement.
  • Violence in proximity to Gaza Humanitarian Foundation (GHF) aid distribution sites will sustain critical threats to life for locally engaged staff and compound broader reputational concerns for associated entities. On 4 July, the UN’s Office of the High Commissioner for Human Rights stated that it had recorded at least 509 casualties resulting from gunfire near the GHF’s four aid distribution sites since the agency began operating in late May. On 5 July, GHF also reported that Hamas militants had conducted a grenade attack targeting an aid distribution site in the Rafah area in southern Gaza; the incident injured two GHF staff members. Although Hamas has denied conducting the attack, continued clashes in and around GHF facilities highlight the critical threats to life for civilians and locally engaged NGO staff. In the coming days, clashes and incidents involving small arms, grenades and physical altercations are highly likely to persist in proximity to GHF facilities, further disrupting aid distribution efforts and exposing bystanders to critical threats to life. More broadly, such incidents will also highly likely compound reputational and governance concerns for Israeli-linked firms, particularly firms associated with GHF, including donors and service providers (such as insurance, banking and property management entities).

RED SEA 

  • Overnight on 6-7 July, Israel conducted intense airstrikes against Houthi targets in Yemen. The IDF targeted the three ports of as-Salif, Hudaydah and Ras Isa (all al-Hudaydah governorate), as well as the captured cargo ship Galaxy Leader and the Ras Kanatib power plant (al-Hudaydah). According to the IDF, the Houthis installed radar systems on the Galaxy Leader, which they used to monitor ship movement across the Red Sea. Over the coming weeks, Israel will likely continue to carry out sporadic strikes against Houthi targets in Yemen, including dual-use infrastructure, increasing energy and food security risks throughout Houthi-controlled territory. In response, the Houthis will likely continue drone and missile strikes against Israel; the IDF intercepted a Houthi missile targeting Ben Gurion International Airport (TLV), also on the night of 6-7 July.
  • A Houthi attack against the Liberian-flagged, Greek-operated bulk carrier Magic Seas has underscored the sustained elevated security risks in the Red Sea area. Magic Seas was attacked on 6 July around 51 nautical miles (94.5km) from Hudaydah port. According to reports, an unknown group opened fire on the ship, using small arms and self-propelled grenades. The ship was later targeted by at least four unmanned surface vehicles (USVs) and missiles, which caused a fire on the deck and prompted the crew to abandon ship as it took on water. On 7 July, the Houthis’ spokesperson, Brig Gen Yahya Saree, confirmed the group conducted the attack, claiming the vessel belonged to a company that continues making port calls to Israel. Although the Houthis have agreed to a ceasefire with the US, they vowed to continue targeting Israel and Israeli-affiliated ships. According to its operator, Magic Seas was carrying steel products and fertilisers from China to Turkey and was not affiliated with Israel in any way. The incident highlights the elevated security risks facing vessels in the Red Sea area stemming from misidentification, misfire and perceived Israeli links. These risks will remain elevated in the coming weeks.

REGIONAL DEVELOPMENTS

 • Israel-Lebanon: Disarmament issues will continue to trigger tensions between the Lebanese government and Lebanese Hizballah (LH) through H2 2025. On 4 June, tens of LH members conducted a small-scale military parade in the Zuqaq al-Blat neighbourhood of the capital Beirut. The parade sparked widespread backlash among government officials, MPs and the public. Shortly after, Lebanese Prime Minister Nawaf Sallam urged the authorities to arrest the participants. The incident comes amid notable uncertainty regarding LH’s disarmament, a critical demand from the US (which has recently called for the government to implement a political-security roadmap within five months). The roadmap primarily stipulates that Beirut should monopolise all arms in the country, including LH’s arsenal. In the coming days, we assess that LH will permit the detention of several members who participated in the controversial parade, mitigating against the risk of domestic unrest. Nevertheless, tensions between both parties will likely persist as LH is unlikely to disarm fully in the coming months. We assess that LH will possibly seek to implement a ‘phased disarmament’ process that likely focuses on either its small or heavy weapons, but not both. However, it is increasingly evident that LH will possibly seek to turn over several heavy weapon depots in southern Lebanon as a gesture of goodwill, while keeping its small arms to protect its day-to-day operations and members. Further LH disarmament is highly likely to be contingent on demands for international guarantees of Israel’s full withdrawal from southern Lebanon and possibly a halt to Israeli attacks targeting the organisation. However, such demands will likely face challenges from Israel, delaying disarmament, increasing rifts within the parliament and sustaining tensions between LH, the Lebanese government and the army. This will drive the risk of the government unilaterally deciding to conduct disarmament campaigns, raising the risk of unrest from LH and its Shia supporters (while driving policy stagnation within the parliament).

  • Israel-Syria: A new IDF operation targeting an Iranian-operated cell underscores the persistent security threats in southern Syria. Earlier on 7 July, IDF troops conducted a special operation in Syria’s Tel Kudna area (Quneitra governorate) and apprehended an Iranian Quds Force-operated cell. This is the second ground operation within a week targeting Iranian-backed cells in southern Syria (see Sibylline Middle East Crisis Update – 3 July 2025). The IDF is likely to sustain special operations and strikes targeting Iranian-backed cells, Palestinian militias and rogue jihadists in southern Syria throughout H2 2025. While the scope of these operations will continue to focus on Daraa, Quneitra and Suwayda governorates (all Syria), there is a realistic possibility that the IDF will expand its operations to Syria’s western Latakia and Tartus governorates, as well as areas around the capital Damascus. Nevertheless, we assess that the Syrian government is unlikely to retaliate against the IDF, mitigating against the risk of armed conflict and reducing the likelihood of such operations undermining ongoing bilateral security talks.

ADDITIONAL MAPPING

  • Turkey: Opposition arrests underscore ongoing democratic backsliding, human rights risks. On 5 July, the Turkish authorities arrested the Republican People’s Party (CHP) opposition mayors of Adana (Adana province), Adıyaman (Adıyaman province) and Antalya (Antalya province) on extortion charges. The CHP denies the allegations, claiming the arrests are politically motivated. It comes a day after prosecutors additionally charged the jailed mayor of Istanbul, Ekrem İmamoğlu, with falsifying his university diploma. The latest moves underscore significant ongoing democratic backsliding and deteriorating human rights conditions in Turkey. We assess that the arrests will likely exacerbate anti-government sentiment, driving protests in Adana, Adıyaman, Antalya and Istanbul (Istanbul province) and elevating domestic unrest risks. This will elevate the risk of arbitrary detentions and sporadic clashes between demonstrators and the authorities. Further detentions of opposition figures will be highly likely in the coming months as President Recep Tayyip Erdoğan seeks to consolidate his power (see Sibylline Special Report – 2 June 2025). This will likely drive augmented restrictions on expression and the free press while elevating political repression, increasing operational and regulatory risks for companies operating in Turkey.
  • Lebanon: Disarmament issues will sustain tensions between government, Hizballah. On 4 June, members of Lebanese Hizballah (LH) conducted a small-scale parade in the Zuqaq al-Blat area of the capital Beirut while armed with rifles. The parade sparked widespread backlash among government officials and the public. Shortly after, the prime minister urged the security authorities to arrest the gunmen. The incident comes amid uncertainty regarding LH disarmament, a critical US demand from the new government. In the coming days, we assess that LH will co-ordinate with the government to detain some of the members who participated in this parade, without triggering clashes or security threats. However, tensions between both parties will likely persist as LH will unlikely fully disarm in the coming months. LH will possibly seek to implement a phased disarmament of a portion of its arms, likely focusing on either its small or heavy weapons, but not both. Further LH agreements of disarmament will likely include demands for international guarantees of full Israeli withdrawal from southern Lebanon and possibly a halt to Israeli attacks against the organisation. Such demands, however, will likely face challenges from Israel, delaying further disarmament.

Jul 04.

  • Iraq: Drone attacks underscore persistent security threat near airports, military facilities. On 3 July, the security authorities in Iraq’s Kurdistan region shot down an explosive-laden drone near Erbil International Airport (EBL); no damage was reported. The incident caused a temporary delay in the landing of one aircraft, but operations at the airport resumed shortly. This is the second aerial attack targeting Erbil Airport in one week. It comes after a series of similar drone attacks in the past days which targeted the Baiji oil refinery (Saladin governorate), Darkar refugee camp (Duhok governorate), Kirkuk city (Kirkuk governorate) and Kirkuk International Airport (KIK). No group has officially claimed responsibility yet. However, we assess that there is a possibility that rogue Shia Islamist groups in the country conducted these small-scale attempts to attack Kurdish military installations and US troops stationed in the region. As such, security and bystander risks will remain elevated around airports, government facilities, military bases and refineries all over the Kurdistan region over the next two weeks. Travel disruption at Erbil Airport and Kirkuk Airport will also remain possible during this period. (Source: Sibylline)

 

09 Jul 25. Update: air strikes against Daesh. The RAF are continuing to take the fight to Daesh in Iraq and Syria. Royal Air Force aircraft continue to conduct armed reconnaissance patrols over Syria to counter Daesh terrorism threats, ready to strike such targets should they be identified.  On Tuesday 10 June, the crew of a Royal Air Force Reaper remotely piloted aircraft, armed with Hellfire missiles, identified a known Daesh terrorist riding a motorcycle in the area of Sarmada, in north-western Syria.  The Reaper’s crew carefully tracked the terrorist on his motorcycle, and, having checked that there were no signs of civilians nearby who might be placed at risk, then conducted a successful engagement, striking the motorcycle and eliminating the terrorist. (Source: https://www.gov.uk/)

———————————————————————————————————————————————————————————————————————————————————————————————————————————-

Founded in 1987, Exensor Technology is a world leading supplier of Networked Unattended Ground Sensor (UGS) Systems providing tailored sensor solutions to customers all over the world. From our Headquarters in Lund Sweden, our centre of expertise in Network Communications at Communications Research Lab in Kalmar Sweden and our Production site outside of Basingstoke UK, we design, develop and produce latest state of the art rugged UGS solutions at the highest quality to meet the most stringent demands of our customers. Our systems are in operation and used in a wide number of Military as well as Home land Security applications worldwide. The modular nature of the system ensures any external sensor can be integrated, providing the user with a fully meshed “silent” network capable of self-healing. Exensor Technology will continue to lead the field in UGS technology, provide our customers with excellent customer service and a bespoke package able to meet every need.

A CNIM Group Company

 

—————————————————————————————————————————————————————————————————————————————————————————————————————————————