NEWS IN BRIEF – MIDDLE EAST – CONFLICT

Sponsored by Bertin Exensor

 

www.exensor.com

 

————————————————————————————————————————————————————————————————————————————————————————————————————————————–

Military And Security Developments

Aug 08.

• Israel-Palestinian Territories: Gaza City occupation will drive humanitarian concerns, domestic unrest. Earlier on 8 August, Israel’s security cabinet approved plans to occupy Gaza City (Gaza). The plan, likely to be rolled out over the next two months, will almost certainly involve evacuating Palestinian civilians from the area before launching a full ground offensive.  Evacuation orders will almost certainly drive mass displacement from Gaza City into Rafah’s Al-Mawasi area, exacerbating pressures on limited public services and humanitarian aid. In turn, this will increase the risk of sporadic altercations between individuals seeking access to resources, driving bystander security risks for proximate humanitarian and logistics staff. Militants will almost certainly move to Rafah, elevating the risk of military strikes in the area. Confirmation of the plan will likely trigger mass domestic unrest in Israel in the coming days, particularly in Jerusalem (Jerusalem district) and Tel Aviv (Tel Aviv district), with a realistic possibility of sporadic violent altercations, increasing transport and business disruption. The possible call-up of reservists in Israel will likely limit labour flexibility and undermine socio-economic health. An uptick in protests and pro-Palestine activism is also likely across the region, particularly in Iran, Iraq, Jordan, Turkey and Yemen.

Aug 07.

IRAN

• Concerns over nuclear co-operation between Iran and Russia will increase risks of sanctions targeting firms and individuals that import dual-use technologies into Iran. On 4 August, the Financial Times reported that a five-person Iranian delegation visited production facilities servicing Russia’s nuclear weapons development programme in August 2024. The report alleges that discussions were held on the domestic production of dual-use technologies relevant to nuclear weapons development and that subsequently, in May 2024, Iranian officials attempted to purchase isotopes associated with nuclear weapons development from Russia. Regardless, Iran-Russia co‑operation will likely remain limited to technical advisory, knowledge sharing and high-level diplomatic support in international forums. Russia is unlikely to directly engage in the development of Iran’s nuclear programme or supply critical weapons development technology to Iran due to broader strategic and geopolitical concerns. Even so, Iran’s likely leveraging of domestically produced dual‑use technology to facilitate nuclear development and its broader missile development programme will likely trigger increased international scrutiny. This is most likely to impact firms that frequently import technologies and components associated with medical research, heavy industry and manufacturing, chemical processing and vacuum systems. Such scrutiny will increase risks of targeted sanctions, driving compliance concerns for regionally engaged firms, particularly in the pharmaceutical, engineering, manufacturing and shipping industries.
• Iraq will likely intensify efforts to crack down on Iranian oil smuggling due to risks of US sanctions, increasing operational disruption risks for shipping firms operating in Basra (Basra governorate). On 6 August, the Iraqi authorities in Basra detained a Liberian-flagged oil tanker on suspicion of smuggling oil. The vessel was reportedly carrying 250,000 tonnes of crude oil without documentation; regional media reports indicate that the Iraqi navy seized the vessel as part of broader efforts to crack down on Iranian oil smuggling via Iraqi ports and pipelines. The crackdown comes after the US reportedly threatened to sanction Iraq’s State Organisation for Marketing Oil (SOMO) if it did not take further steps to address widespread Iranian oil smuggling, as part of the US’ ‘maximum pressure’ campaign targeting Iran. The Iraqi authorities will highly likely continue efforts to enforce SOMO directives to identify, detain and disrupt oil smuggling efforts through Iraqi ports in the coming months. As such, oil tankers routinely transiting Iraqi waters and docking at the Khor al-Zubair and Umm Qasr port facilities (both Basra) will likely face increasing regulatory scrutiny in the coming weeks, driving risks of operational delays and staff exposure to petty corruption. While these efforts will possibly limit the volume of Iranian oil smuggled to global markets via Iraqi port facilities, cross‑border smuggling, pipeline tapping and ship-to-ship transfers will likely continue to facilitate partial Iranian access to international oil markets.

ISRAEL 

Significant protests across Israel are likely in the coming days, against the backdrop of a possible decision to militarily occupy Gaza. Later on 7 August, the Israeli security cabinet will meet to discuss the possibility of expanding military operations and occupying Gaza. In response to this proposal, pro-ceasefire and hostage release activities have been planned to significantly increase demonstrations across Israel from 7 August at least through the weekend. The largest protests will likely be in Tel Aviv (Tel Aviv district), where there is an elevated risk of significant disruption. On 5 August, a large protest in Tel Aviv turned violent, with protesters blocking major traffic routes including Ayalon South (Highway 20), burning tires, lighting bonfires and allegedly attacking police officers, resulting in 13 arrests.  As such, there is an elevated risk of violence around large protests in Tel Aviv in the coming days, raising the prospect of police use of excessive force and clashes when dispersing demonstrators. These will elevate security risks near protest locations, including for personnel and assets, as well as travel disruption, particularly close to Kaplan Street, Menachem Begin Road and Aylon South (Highway 20). Protests will likely grow in size and frequency if the Israeli government decides to militarily occupy Gaza, which would compound the above risks.

• Israel’s security cabinet will likely vote in favour of a military occupation of Gaza, significantly increasing security, domestic unrest and international backlash risks. According to local reports, the government favours occupation over proposals favoured by the military to rely on cordons and the intensification of airstrikes. According to reports, the current plan involves the mobilisation of four to six divisions into northern Gaza, including Gaza City and the central camps (including Bureij, Deir al-Balah and Nuseirat) where Israeli hostages are likely held. The plan also involves the mass evacuation of Gaza citizens from northern Gaza to southern Gaza; the Israel Defense Forces (IDF) would likely to take four to five months to complete its manoeuvre and achieve full military control over northern Gaza. Even if the plan is approved in the security cabinet, it is unlikely to be immediately implemented. The mobilisation and recruitment of forces would likely take at least a week, with IDF efforts to address combat fatigue possibly delaying the operation into September or even October.
• Although the IDF engaged in similar activity between November 2024 and January 2025, the current plan likely involves a larger territorial remit in northern Gaza and possibly the large-scale destruction of infrastructure. The plan’s execution will increase local staff exposure to clashes between the IDF and civilians refusing to evacuate, increasing risks to NGOs working among civilian populations. Additionally, militants will almost certainly move to humanitarian areas, particularly al-Mawasi (southern Gaza). This will elevate risks of IDF strikes in these areas, similar to the increase recorded during November 2024 and January 2025, further exacerbating threats to life for local staff.
• Announcement of the plan will likely trigger mass domestic unrest in Israel, increasing risks of violent protests (see above). Furthermore, the mass mobilisation of forces, particularly reserve duty soldiers, will likely impact labour availability in Israel, possibly affecting business operations. An uptick in protests and pro-Palestine activism across the region and worldwide is also likely, particularly in Australia, Greece, Jordan and the US. Additionally, approval of the plan will likely increase reputational risks for companies and businesses operating in Israel or perceived to be supportive of Israel. These will also increase financial risks emanating from possible consumer boycotts and social media campaigns against such businesses. Approval of the plan will also increase risks of sanctions on Israel, elevating operational and compliance risks for companies operating in the country. These risks will significantly increase in the event rapid IDF mobilisation.

PALESTINIAN TERRITORIES 

• West Bank – Nothing significant to report
• Israel will allow private-sector goods to enter Gaza, though humanitarian conditions are unlikely to improve. On 5 August, Israel’s Coordinator of Government Activities in the Territories (COGAT) announced it would begin allowing the entry of goods into Gaza through the private sector in the coming weeks. COGAT characterised the policy as part of broader efforts to increase aid provision into Gaza and decrease dependence on international aid mechanisms. COGAT restricted the entry of private-sector aid into Gaza in October 2024 due to concerns that Hamas was ‘exploiting’ the goods for economic and militant purposes. As private-sector goods will enter Gaza through the same border crossing as NGO aid supplies, the risks of bottlenecks at the Erez West (Zikim) and Kerem Shalom border crossings will increase in the coming weeks. The announcement will also likely trigger an uptick in demonstrations from Israeli anti-aid organisations (such as Tzav 9) targeting the border crossings and the Ashdod port facility (Southern district), which will disrupt broader supply chain continuity within Israel. Within Gaza, private-sector goods convoys will almost certainly face similar security risks to NGO convoys during transit to storage and distribution facilities; risks include looting, shooting incidents and the commandeering of vehicles by militant and organised criminal elements. UN data indicates that, since aid deliveries resumed on 19 May, approximately 90% of UN aid trucks have been looted during transit, while 66% of pallets have failed to reach their destination. Given such significant security concerns, private-sector aid distribution efforts will highly likely face critical risks of disruption and major security incidents impacting staff, vehicles and aid stores. The entry of private-sector goods will also likely contribute to widespread food price inflation within Gaza, compounding socio-economic concerns and food insecurity.

REGIONAL AND GLOBAL DEVELOPMENTS 

• Attempts to enforce the disarmament of all armed factions in Lebanon will increase risks of clashes with Lebanese Hizballah (LH) in the coming weeks. On 5 August, the new Lebanese cabinet tasked the army with drawing up a plan to implement a state monopoly over all arms in the country by the end of 2025. The move primarily targets the arsenals of LH, the largest non-state armed group in the country, as well as other smaller sectarian factions. The government’s unprecedented decision came shortly after a parliamentary session in which LH members and ministers rejected the current disarmament plan. Also, on the same day, LH leader Naim Qassem reiterated his rejection of the US-backed plan in a televised speech, warning that the group will respond if Israel resumes the war in Lebanon. In the coming days, LH will likely organise reactionary protests in the capital Beirut. Most of these protests will be held in the Dahieh district and downtown Beirut, driving localised bystander and travel disruption risks in the city throughout August. There is also a possibility that LH members will attempt a show of force by participating in these protests while carrying small arms. This will elevate the risks of sporadic armed clashes with the security forces and anti-LH factions during the coming weeks. While it is unlikely that the government will back down from its current stance on the disarmament of LH, there is a possibility that Nabih Berri, the leader of the Amal movement, will actively seek mediation efforts between both parties. These efforts could lead to new negotiations, increasing the likelihood of a new, extended timeline for disarmament plans.
• Egypt’s record energy deal with Israel is unlikely to trigger major domestic unrest risks, despite significant anti-Israel sentiment. Earlier on 7 August, the operating partners of Israel’s Leviathan offshore gas field signed the largest export agreement in Israel’s history, worth up to USD 35bn, to supply gas to Egypt. Under the deal, Leviathan will export about 130 bn cubic metres of gas to Egypt from early 2026 until 2040, or until all of the contract quantities are fulfilled. Notably, Egypt already has active import agreements with the Karish and Leviathan fields, which were temporarily halted during the Iran-Israel war but fully resumed following the ceasefire in late June. While the deal is highly likely to draw major criticism from Egyptian pro-Palestine activists, it is unlikely to trigger major domestic unrest in the country. This is primarily due to the active ban on all protests in Egypt and the tight security grip of the authorities, which has continued to detain tens of pro-Palestine activists since the onset of the Israel-Hamas war.
• The uptick in pro-Palestine activity in Europe over recent days will raise physical security risks for Israeli companies and tourists. Earlier on 7 August, an unknown group vandalised the Paris office of Israeli airline El Al. The incident comes amid diplomatic tensions between France and Israel following the French president’s pledge in July to recognise a Palestinian state. The incident also underscores the increasing anti-Israel sentiment across younger generations in France, which is not limited to the Arab and Muslim communities. As such, risks of further copycat attacks, vandalism and protests targeting Israeli companies in France and/or French companies dealing with the Israeli army will highly likely increase in the coming weeks. Notably, the developments in France come amid widespread calls for further pro-Palestine protests in Greece, including in the capital Athens and multiple islands, starting from 10 August. These protests will likely extend through the coming weeks and will likely include attempts to disrupt cruise trips heading to islands including Lesbos (North Aegean), Rhodes (South Aegean) and Zakynthos (Ionian Islands), possibly preventing them from docking. Risks of harassment and direct physical attacks against Israeli tourists will remain likely during the coming days. Furthermore, increasing protest activity will undermine operational continuity for tourism companies, booking platforms, hotels and airlines associated with Israeli tourists in Greece. These risks will likely also extend to similar companies operating in Italy and Spain this summer, while the risk of targeted boycotts and activism will likely also rise.

Aug 06.

• Israel: Co-ordination efforts between Iranian cyber threat actors will elevate security risks. On 5 August, the security company Security Scorecard reported that Iran-linked threat groups displayed a higher level of co-ordination with the Islamic Revolutionary Guard Corps (IRGC) than expected during the twelve-day Iran-Israel war in June. The report analysed approximately 250,000 messages on the platform Telegram concerning cyber attacks against Iran’s adversaries. The messages made reference to operations aimed at disrupting and manipulating the information environment rather than directly supplementing kinetic efforts. These efforts included the distribution of pro-Iran propaganda, as well as data-leak, distributed denial-of-service (DDoS) and web defacement attacks by pro-Iran and/or anti-Israel hacktivist groups, highlighting their involvement in Iran’s cyber strategy despite the attacks’ more opportunistic nature. Iranian state-sponsored groups also purchased several conflict-related domains in the days following the outbreak of the war to conduct cyber espionage and surveillance operations, showcasing their reactive nature. This underscores the likely ongoing consolidation of Iran’s cyber strategy, elevating security risks to its adversaries amid long-term regional hostilities.
• Israel-Palestinian Territories: Gaza occupation would drive humanitarian concerns, reputational risks. On 5 August, Israeli media reported that Prime Minister Benjamin Netanyahu and senior security officials are considering full military occupation of the Gaza Strip. Reports indicated that operations could also occur in areas in which the Israel Defense Forces (IDF) believes hostages to be held. However, the proposal reportedly faces opposition from the IDF’s chief of staff, moderating conflict escalation risks in the immediate term. Full Israeli occupation of Gaza would significantly increase risks to life for on-the-ground personnel, elevate severe disruption to NGO operations and exacerbate already-critical humanitarian conditions. This would likely elicit a significant response from the international community, possibly including sanctions on Israeli entities, which would drive compliance risks for businesses operating in the country. Businesses with operations in Israel would likely face reputational damage, driving a negative consumer response, including boycotts and associated financial risks. Furthermore, there would likely be protests in major regional cities, including the Jordanian capital Amman and the Egyptian capital Cairo, elevating regional domestic unrest and security risks.
• Lebanon: Calls for disarmament will increase security risks, unrest in coming days. On 5 August, the Lebanese government tasked the army with drawing up a plan to implement a state monopoly over all arms in the country by the end of 2025. The move primarily targets the arsenal of Lebanese Hizballah (LH), the largest non-state armed group in the country. The government’s unprecedented decision came shortly after a tense parliamentary session on the issue, during which LH members rejected the current disarmament plan. Also, on the same day, LH leader Naim Qassem reiterated his rejection of the US-backed plan in a televised speech, warning that the group will respond if Israel resumes the war in Lebanon. In the coming days, LH will likely organise reactionary protests in the capital Beirut. Most of these protests will to be held in Dahieh district and downtown Beirut, driving localised bystander and travel disruption risks in the city throughout August. There is also a possibility that LH members will attempt a show of force, participating in these protests while carrying small arms. This will elevate risks of sporadic armed clashes with the security forces and anti-LH factions.

Aug 05.

Key points

• The likely risk of cyber espionage and surveillance operations will be sustained amid current geopolitical tensions and unstable nuclear negotiations. Low-level disruptive attacks from pro-Iran hacktivist groups are also likely in this geopolitical climate, given the longevity of hacktivist attack patterns.
• We assess that high-impact disruptive and destructive cyber attacks against US and Israel-based operational technology (OT) and critical national infrastructure (CNI) will remain unlikely as actors seek to avoid a potential ceasefire breakdown and additional geopolitical escalation.
• Potential future geopolitical escalation, incited by stalling nuclear negotiations, will likely increase the risk of reactive distributed data-leak, denial-of-service (DDoS) and influence operations.

Context

On 30 June, US security agencies released a joint report warning US-based organisations and critical national infrastructure (CNI) sectors regarding potential cyber attacks from Iranian-linked actors in the wake of US strikes on several Iranian nuclear facilities on 21 June. The report suggested that pro-Iran hacktivist and Iranian state-sponsored groups could use cyber operations to retaliate against the US, regardless of the current ceasefire between Iran and Israel. We assess that this development highlights heightened security, disruption and reputational risks to the aforementioned sectors. Escalation in the Iran-Israel war between 13 and 24 June also engendered a wave of high-profile cyber attacks against Israeli and Iranian national infrastructure, substantiating concerns of increased cyber activity and spillover impact amid ongoing geopolitical tensions. The possibility of further escalation will also raise the risk of cyber attacks if nuclear negotiations continue to stall, exacerbating existing risks.

Forecast

Ongoing regional tensions will likely sustain cyber espionage, low-level disruption and surveillance risks from Iranian-linked groups

In July, the cyber security company Nozomi Networks disclosed that it detected approximately 28 cyber espionage and surveillance operations from various Iranian state-sponsored actors against its customers between May and June. This constituted a 133% rise compared to the preceding two-month period, likely as a result of escalating geopolitical tensions that culminated in the outbreak of the Iran-Israel war. The attacks primarily targeted the transportation and manufacturing sectors and were carried out by multiple well-known advanced persistent threat (APT) groups including ‘MuddyWater’, ‘APT33’, ‘OilRig’, ‘CyberAv3ngers’, ‘FoxKitten’ and ‘Homeland Justice’.

Later in July, MuddyWater reportedly conducted a surveillance operation against English and Farsi speakers. The group began distributing a new version of the ‘DHCSpy’ Android spyware after the onset of the Iran-Israel war (alongside its increased usage of other malware variants), highlighting the evolution of Iran’s cyber tactics to respond to recent events. We assess that additional cyber espionage and surveillance operations are likely amid current regional tensions and unstable nuclear negotiations.

In June, a joint report by the cyber security organisations Financial Services Information Sharing and Analysis Center (FS-ISAC) and Akamai also indicated that the volume of DDoS attacks targeting the financial sector has increased significantly between 2014 and 2024. The report also highlighted that the majority of these attacks are typically carried out by politically motivated hacktivist groups, including pro-Iran and pro-Palestine organisations. Low-level disruptive cyber attacks from pro-Iran hacktivist groups are therefore likely, especially given the longevity of these attack patterns. Furthermore, in July, an Iranian Ransomware-as-a-Service (RaaS) operation (‘Pay2Key.I2P’) offered larger profit shares to affiliates who would target Israeli and US companies. While these attacks remain a possibility in the short term, we have not identified any reports concerning such attacks as of the date of writing, indicating a somewhat mitigated threat.

Destructive cyber operations against US and Israel-based CNI will remain unlikely; this is likely in a bid from cyber actors to avoid a ceasefire breakdown and further escalation

The joint warning published by US security agencies in June outlined a cyber attack against an Israeli-made programmable logic controller (PLC) within the Municipal Water Authority in Aliquippa (Pennsylvania) in November 2023. The Iranian state-sponsored group Cyber Av3ngers displayed an anti-Israeli message on the compromised PLC, warning that it would attempt to target other Israeli-made equipment in retaliation to the outbreak of the Israel-Hamas war on 7 October 2023. While the attack did not cause any significant disruption and/or destruction to targeted systems, it highlighted the actors’ ability to infiltrate operational technology (OT) environments for potential disruption and/or destruction.

Furthermore, in May 2024, another Iranian state-sponsored group (‘Void Manticore’) targeted over 40 Israeli organisations under the guise of an online hacktivist group (‘Karma’). During the attack, the group used a sophisticated version of the ‘Bibi’ wiper to delete key functions from a system’s disk and to inhibit data  restoration, showcasing destructive capabilities vis-à-vis IT environments.

However, we have not detected any instances of similar disruptive and/or destructive cyber attacks in the context of the Iran-Israel war and subsequent regional hostilities. The Aliquippa attack is reportedly an isolated instance of Iranian state-sponsored cyber attacks that have directly targeted US-based OT infrastructure since the Israel-Hamas war. We therefore assess that high-impact disruptive and destructive cyber attacks against US and Israel-based OT and CNI will remain unlikely in a bid to avoid a potential ceasefire breakdown and additional geopolitical escalation.

Future geopolitical escalation will likely increase data-leak, disinformation and disruption risks from varying Iran-linked groups

Iran remains vulnerable to a possible resumption of Israeli airstrikes in the coming months despite claims that it has restored its air defence capabilities; this indicates increasing pressure regarding nuclear negotiations with the US. If nuclear negotiations with the US do not progress by mid-to-late August, the France, Germany and Italy (also known as the E3) will also possibly trigger the Joint Comprehensive Plan of Action (JCPOA)’s snapback clause. This would reimpose UN sanctions on Iran which coupled with latent progress in the negotiation and current restrictions to nuclear monitoring within Iran will continuously elevate the risk of resumption of Israeli strikes and maintain high regional hostilities. In turn, this would likely engender an increase in reactive DDoS, data-leak and influence operations by both Iranian state-sponsored and pro-Iran hacktivist groups.

Several pro-Iran hacktivist groups claimed responsibility for DDoS attacks against multiple critical sectors in the US (including aviation, defence and financial sectors) in the days following the US airstrikes on Iran. The hacktivist group ‘Mr Hamza’ claimed to have conducted DDoS attacks against several websites of the US Air Force and US aerospace and defence companies, causing operational downtime for over ten hours on 22 June. Similarly, another group (‘Keymous+’) claimed in an online post to have targeted several US financial entities, where it showcased website disruption for over an hour also on 22 June. Larger-scale DDoS attacks will, therefore, likely spike in the event of future escalation given the reactionary nature of these attacks.

On 1 July, an unnamed Iran-linked threat group also threatened to release several emails it had stolen from personnel involved in the 2024 election campaign for US President Donald Trump. Iran-linked groups (such as ‘Cyber Toufan’ and ‘Cotton Sandstorm’) frequently conduct data-leak operations to respond to geopolitical escalation. As such, data-leak operations are likely if nuclear negotiations continue to stall and geopolitical tensions subsequently increase. Any attacks would likely be opportunity-based and seek to cause indiscriminate reputational damage, as well as operational downtime of public and/or internal websites.

The war between Iran and Israel provoked an uptick in the distribution of artificial intelligence (AI)-generated mis- and disinformation on social media platforms. Namely, pro-Iran accounts increasingly shared fake media that exaggerated the aftermath of Iranian strikes against Israel. Similarly, pro-Israel accounts increased the dissemination of old videos depicting civil unrest in Iran to feign local Iranian support for Israel’s military campaign. These posts amassed over 100 m views between 13 and 19 June, highlighting their rapid propagation. It is unknown whether the accounts in question are linked to the Iranian and/or Israeli states. However, we assess that these developments underscore the mis- and disinformation risks stemming from AI-generated content in the event of future escalation.

• Israel-Yemen: Persistent Houthi targeting underscores security concerns, growing retaliation risks. On 3 August, the Israel Defense Forces (IDF) intercepted a Houthi drone in Bnei Netzarim (Southern district). While the IDF successfully intercepts Houthi ordnance on a near-daily basis, this usually occurs outside Israel’s airspace; as such, the successful incursion underscores the Houthis’ increasing capabilities to avoid detection, sustaining elevated security risks for personnel and civilians across Israel. Furthermore, the drone route, which likely passes above Egypt, highlights the elevated security risks of Houthi ordnance impacting that country (particularly the Sinai Peninsula) stemming from failure or interception. Repeated Houthi attacks and efforts to reconstruct port infrastructure that was previously damaged by Israel (see Sibylline Middle East Crisis Update – 4 August 2025) will elevate the risk of Israeli airstrikes targeting Houthi sites in the coming weeks. We assess that any such strikes will drive security risks for personnel and exacerbate energy, food and socio-economic health risks within Houthi-controlled territory, elevating operational risks for NGOs and humanitarian concerns for civilians.
• Syria: Resumption of ethnic clashes underscores fragility of ceasefire. On 4 August, new clashes erupted in the towns of Atil, al-Ariqah, Ira and Rasas (all Suwayda governorate) between government forces and local Druze fighters. This comes a day after Druze militia affiliated with the religious figure Hikmat al-Hirji killed at least three soldiers in an attack on the government-controlled Tal al-Hadid area (Suwayda). While the clashes have since ceased, the recent violence underscores the significant fragility of the ceasefire in southern Syria, increasing the likelihood of its total collapse in the coming weeks. Furthermore, there is also a realistic possibility of intra-Druze fighting across Suwayda between al-Hijri militias and government-aligned units, compounding crossfire and movement disruption risks. In the coming days, ongoing tensions and sporadic clashes are likely to disrupt operators using humanitarian routes, including the Bosra al-Sham corridor. We assess that the closure of such corridors will exacerbate food security and public health risks in Suwayda city.

Aug 04.

KEY DEVELOPMENTS

IRAN

• Despite the re-organisation of its security governance structures, Iran will likely maintain a hawkish posture regarding its regional security policy and nuclear negotiations.
• The US continues to expand sanctions on Iran’s drone manufacturing programme, while oil smuggling activity in the Strait of Malacca will sustain sanction-exposure risks for regionally engaged shipping firms.
• Despite international condemnation, Iran will likely continue with its efforts to identify, harass and abduct anti-government activists overseas, increasing the threats to Iranian nationals, particularly in Europe and North America.

ISRAEL

• The release of hostage footage amid stalled negotiations has increased the risk of domestic unrest.

PALESTINIAN TERRITORIES

• Ethno-religious tensions, domestic unrest and the risk of attacks will be elevated in the coming months after the Israeli national security minister delivered a prayer in the al-Aqsa mosque compound.
• Despite a visit by US Special Envoy Steve Witkoff, humanitarian conditions within Gaza are unlikely to improve in the immediate term, sustaining critical threats to life therein.
• There is an increasing risk that the Israel Defense Forces (IDF) will intensify its military operations in Gaza if Israel’s possible offer to withdraw its forces fully in return for the release of all hostages is refused.

IRAN

• Despite the re-organisation of its security governance structures, Iran will likely maintain a hawkish posture regarding its regional security policy and nuclear negotiations. On 3 August, local media reported that Ali Larijani, a senior advisor to Supreme Leader Ali Khamenei, will replace Ali Akbar Ahmadian as the head of the Supreme National Security Council (SNSC) in the coming days. This reflects a continued hardline approach to domestic dissent, security and nuclear policy. Larijani’s appointment possibly also indicates efforts to bolster his domestic political profile ahead of the 2028 presidential election and to underscore his status as a senior regime figure in the event of Khamenei’s death. Also on 3 August, the SNSC approved the formation of the National Defence Council (NDC), which will assume responsibility for ‘overseeing national defense policies’. The announcement comes amid a broader re-organisation of Iran’s security and defence governance structures following numerous strategic failures during the Iran-Israel war (see Sibylline Situation Update Brief – 15 July 2025). However, the NDC will almost certainly remain under the direct influence of Supreme Leader Khamenei; its remit will likely remain highly fluid, with the SNSC and alternative councils likely re-assuming and delegating various competencies as per the preferences of Supreme Leader Khamenei. Even so, recommendations from the NDC regarding the mid-level re-structuring of the security forces will possibly trigger personnel changes in the coming months. Recommendations to increase defence spending substantially will likely sustain pressure on Iran’s socio-economic health and foment wider anti-government sentiment.
• The US continues to expand sanctions on Iran’s drone manufacturing programme, while oil smuggling activity in the Strait of Malacca will sustain sanction-exposure risks for regionally engaged shipping firms. On 1 August, the US State Department sanctioned five entities and one individual associated with the state-owned Iran Aircraft Manufacturing Industrial Company, which facilitates the production of military aircraft and drones. The sanctions underscore continued US scrutiny of Iranian-linked entities as part of the ‘Maximum Pressure’ campaign, particularly those based in China, Hong Kong and Taiwan. In the coming weeks, the US will highly likely continue to try to expand and enforce sanctions targeting entities associated with Iran’s drone programme, as well as those linked to Iran’s oil exports, missile production and ‘shadow banking’ network. Further sanction notices will increase compliance risks for firms engaged in the manufacturing, shipping, defence, energy and banking sectors worldwide, as well as those employing Iranian nationals. Additionally, on 31 July, the US-based CBS news outlet alleged that, over a single day, its staff witnessed at least 12 ship-to-ship transfers of oil from Iranian-registered vessels to Chinese-registered vessels in Malaysian waters near the Riau archipelago (Indonesia). The claim underscores continued fuel smuggling activity facilitating the transfer of Iranian crude to China, despite numerous rounds of US sanctions targeting associated entities, individuals and vessels. Reports of continued oil smuggling will likely trigger further US sanctions targeting associated entities and vessels, particularly those frequently transiting from the Persian Gulf to China via the Strait of Malacca; this will compound sanction-exposure risks for locally engaged shipping and energy firms.
• Despite international condemnation, Iran will likely continue with its efforts to identify, harass and abduct anti-government activists overseas, increasing the threats to Iranian nationals, particularly in Europe and North America. On 3 August, Canada, the UK, the US and several EU member states (including France, Germany and Spain) issued a joint statement condemning the Iranian intelligence services’ escalating efforts to ‘kill, kidnap and harass people’ overseas. The condemnation noted Iran’s increasing collaboration with irregular and organised criminal entities to conduct harassment campaigns, abductions and targeted killings of regime dissidents and anti-government activists (see Sibylline Situation Update Brief – 27 June 2025). Despite the statement, Iran will highly likely continue funding, co-ordinating and initiating such harassment and abduction efforts targeting individuals associated with anti-government and opposition movements. The risk will be particularly acute for individuals and entities associated with banned groups and movements, such as the People’s Mojahedin Organization of Iran (MEK) and the Women, Life, Freedom movement. We assess that Iranian nationals and dual nationals across the world will almost certainly continue to face elevated risks of harassment, extortion, abduction and detention, as will their associates and family members. The risk of Iranian espionage and cyber attacks targeting those who possess personal information regarding anti-government activists will also remain elevated, sustaining operational disruption and cyber-exposure risks for associated firms.

ISRAEL 

• The release of hostage footage amid stalled negotiations has increased the risk of domestic unrest. On 31 July, Palestinian Islamic Jihad (PIJ) published video footage of the Israeli hostage Rom Braslavski. On 1 August, Hamas published video footage of the hostage Evyatar David. The publication of the videos has prompted pro-ceasefire protests in Israel. Against the backdrop of stalled negotiations, these protests are likely to grow in size and frequency in the coming week. This will elevate travel disruption risks near protest hotspots, particularly in Tel Aviv (Tel Aviv district). While such protests are typically largely peaceful, there is a realistic possibility of protest action becoming more disruptive in the coming days (including through the erection of roadblocks along key highways), which would in turn increase the risk of clashes with the security forces. Under such conditions, the use of excessive force by the police is a realistic possibility; this would elevate bystanders’ exposure to tear gas and other such crowd-control techniques. Nonetheless, we assess that vandalism is unlikely, moderating the risks facing assets.

PALESTINIAN TERRITORIES 

• Ethno-religious tensions, domestic unrest and the risk of attacks will be elevated in the coming months after the Israeli national security minister delivered a prayer in the al-Aqsa mosque compound. On 3 August, Israeli Minister of National Security Itamar Ben Gvir led a prayer in the al-Aqsa mosque compound in Jerusalem (Jerusalem governorate, West Bank). Under the status quo agreed between the Jerusalem Waqf (an Islamic council appointed by Jordan) and Israel, Jews are allowed to enter the compound, which also serves as the holiest site in Judaism, but are forbidden from praying in it. Gvir’s act of prayer has provoked condemnation from both Jordan and Saudi Arabia. Commenting after the incident, Israeli Prime Minister Benjamin Netanyahu stated that Israel’s policy remains the maintenance of the status quo at the compound. Even so, in recent years, there has been growing pressure stemming from this issue, with numerous Knesset members and ministers calling for (and leading) prayers in the compound. Further such incidents are likely in the coming months, elevating ethno-religious tensions and the risk of radicalisation among Jewish and Muslim populations. This will elevate the risk of clashes between Jewish and Muslim worshippers, as well as between worshippers and the Israeli security forces throughout the Jerusalem area in the coming months. Furthermore, these trends will compound the risk of attacks stemming from both communities (particularly around Jerusalem’s Old City and religious sites therein) against both the civilian population as well as the Israeli security forces. The continued violation of the status quo will also elevate the risk of domestic unrest in Jordan, as well as attacks at border crossings between the two countries; this will in turn drive the risk of sporadic border closures, prompting temporary movement disruption for goods and personnel.
• Despite a visit by US Special Envoy Steve Witkoff, humanitarian conditions within Gaza are unlikely to improve in the immediate term, sustaining critical threats to life therein. On 1 August, Witkoff visited a Gaza Humanitarian Foundation (GHF) aid distribution point in Gaza and later stated during a meeting with family members of Israeli hostages that Hamas had indicated it would be willing to disarm in exchange for a ceasefire. Hamas subsequently issued a statement indicating that it would only be willing to disarm following the formation of an independent Palestinian state with Jerusalem as its capital. The statements underscore the persistent deadlock in ceasefire negotiations, moderating the prospects for the rapid implementation of an agreement in the coming days (see below). As IDF operations continue in Gaza, humanitarian conditions are highly unlikely to improve significantly, sustaining widespread food insecurity and humanitarian concerns. Such conditions will sustain the risk of clashes, shooting incidents and fatal crushes in proximity to GHF and UN agency aid distribution points; they will also sustain significant threats to life for civilians and locally engaged staff. More broadly, stalling ceasefire negotiations will sustain the risk of further large-scale pro-Palestine demonstrations in protest hotspots across the world, particularly in Australia, North America and Europe (see below). Deteriorating conditions within Gaza will also likely trigger further scrutiny of Israeli-linked firms by pro-Palestine activists, driving the risk of targeted activism, protests and vandalism in the coming weeks. Such risks will be particularly acute for firms associated with the GHF, such as donors, service providers and consultancy firms.
• There is an increasing risk that the Israel Defense Forces (IDF) will intensify its military operations in Gaza if Israel’s possible offer to withdraw its forces fully in return for the release of all hostages is refused. In recent days, sources within the Israeli government have indicated that Israel, with the support of the US, is considering a shift in its negotiation strategy from pursuing partial hostage release deals to securing a full hostage release agreement. In exchange, Israel would possibly offer a full withdrawal of its forces from Gaza, a key Hamas demand. This development underscores possible Israeli efforts to overcome the ongoing deadlock in talks, with Hamas hardening its position in response to perceptions that Israel is becoming increasingly isolated internationally. However, such an offer would likely include further conditions, such as the complete disarmament of Hamas. We assess that Hamas is unlikely to accept any kind of agreement outright, but that it will likely try to secure further concessions. Regardless, if Hamas refuses to agree to such a deal, Israeli officials are likely to argue that this refusal would legitimise the intensification of military operations in Gaza, raising the prospects of Israel disengaging from talks (though international condemnation of such action remains likely). Military intensification would likely manifest through an escalation in airstrikes and a tightened cordon around militant-controlled parts of the strip.

RED SEA 

• The Yemen-based Houthis’ reconstitution and rearmament efforts highlight rising tensions in the Red Sea, as well as increased risks of Israeli airstrikes. On 1 August, local news claimed the Iranian-backed Houthis have escalated their recruitment, training and mobilisation efforts. Further reports claim the Houthis are conducting rapid restoration operations at the ports of as-Salif, Hudaydah and Ras Isa (all al-Hudaydah governorate), which were recently damaged in Israeli airstrikes. This comes after at least six ships carrying unidentified cargo loads arrived in Hudaydah and two others arrived in as-Salif. These activities reflect the group’s ongoing rearmament and reconstitution efforts, underscoring the elevated security risks facing maritime vessels operating in Yemeni waters. Such activities, together with continued and sporadic Houthi missile and drone strikes against Israel, will elevate the risk of Israeli airstrikes against Houthi positions and infrastructure (particularly in the three aforementioned ports and coastal areas) in the coming weeks. Such strikes would exacerbate energy, food security and socio-economic health risks within Houthi-held territory.

REGIONAL AND GLOBAL DEVELOPMENTS  Developments

• Continued IDF raids against armed smugglers in southern Syria underscore the volatile security environment therein; they will likely persist over the coming months. On 2 August, an IDF unit conducted simultaneous raids at four sites in the Druze town of Hader (Quneitra governorate, Syria), near the Israeli-Syrian border. The troops confiscated caches of weapons and conducted on-site interrogations of several suspects. While the IDF disclosed no further details, the operation highly likely targeted emerging arms smuggling networks. Since the fall of the former Syrian president, Bashar al-Assad, in December 2024, these networks have attempted to exploit the security vacuum near the border. As such, similar Israeli raids targeting intricate networks deeper into Syrian territory are highly likely in the coming weeks, increasing the risk of clashes with rogue local fighters and smugglers. This will further compound instability across Syria’s southern regions, which has already been exacerbated by recent ethno-religious tensions in Suywada governorate (Syria) and Israeli airstrikes against government-affiliated forces in support of the Druze. Nevertheless, recent Israeli raids against smugglers are unlikely to impact ongoing talks with Damascus significantly over long-term security arrangements along the border, though we assess that the prospects for a deal will remain highly dependent on preserving the ceasefire in Suwayda.
• The Israeli embassy in the UAE evacuated most of its staff following a travel warning citing the risk of a terrorist attack, partially elevating operational disruption risks for hospitality firms in the UAE dealing with Jewish and Israeli travellers in the coming weeks. On 31 July, Israel evacuated most of its diplomatic mission staff in the UAE, including its ambassador, hours after a travel warning issued by Israel’s National Security Council (NSC). The NSC stated that the latest warning was based on intelligence indicating that terrorist operatives in the UAE are planning attacks against high-profile Israeli individuals around the Jewish holidays and Shabbat. The council also urged Israeli citizens in the UAE to take steps to minimise their visibility, including by avoiding public displays of Israeli or Jewish identity. While operations at the Israeli embassy in the capital Abu Dhabi remain active, as does air travel between Israel and the UAE, the warning will partially elevate the risk of operational disruption for the Emirati hospitality sector dealing with Israeli tourists in the coming weeks. Furthermore, security and bystander risks will remain elevated in the coming days around synagogues in Abu Dhabi and Dubai (Dubai emirate), especially as the security forces will likely augment their posture around these facilities.
• Tens of thousands of pro-Palestine protesters marched in Australia, increasing the risk of harassment facing Israeli and Jewish visitors during these events. On 3 August, more than 90,000 people attended the pro-Palestine ‘March for Humanity’ across Sydney Harbour Bridge (New South Wales state). On the same day, around 25,000 people participated in a similar march in Melbourne (Victoria state), during which riot police blocked participants from marching along King Street Bridge in the central business district (CBD). Local media captured several chants and signs calling for the destruction of Israel, as well as pictures of Supreme Leader Khamenei. The unprecedentedly large protests indicate significant pro-Palestine sentiment in Australia, partially increasing the risks of harassment facing Israeli and Jewish visitors and residents during similar events in the coming weeks. These risks will be particularly elevated around 24 August, as the local branch of Palestine Action Group has called for other protests on that date. Furthermore, we assess that pro-Palestine activists in the country will attempt to put pressure on the government to commit to recognising Palestinian statehood through further protests and possible strikes throughout August.

Aug 01.

• Israel-Slovenia: Arms embargo will partially raise compliance risks for European defence companies. On 31 July, the Slovenian government imposed an embargo on the export, import and transit of arms to Israel. This comes two weeks after it declared that Israeli ministers are banned from entering Slovenia. This marks the first time an EU member state has taken such a step. However, the move is unlikely to impact Israeli military operations; Slovenia is not a major arms exporter to Israel and bilateral relations have been tense since the onset of the Israel-Hamas war in 2023. Nonetheless, the embargo will partially increase compliance risks for European defence companies dealing with both governments. Additionally, and following the Slovenian move, we assess that boycott campaigns and protests against defence companies in the EU are likely to increase in scope in the coming weeks, exacerbating the already-heightened reputational risks facing the sector.
• Iran: Companies, staff are likely to face difficulty accessing water, driving health, operational risks. On 31 July, Iranian President Masoud Pezeshkian warned that the country is facing an impending water crisis, calling on citizens to moderate their consumption as dams supplying the capital Tehran near depletion. The announcement underscores the significant impact of heatwaves on Iran’s ageing infrastructure, which has been exacerbated by decades of government mismanagement. Water pressure will likely continue to drop in the coming days, rendering it challenging to access water, especially for businesses and personnel situated on floors above ground level. Unstable water supplies will also likely impact sanitary conditions, driving an increased prevalence of infectious diseases. Water stockpiling is likely, especially vis-à-vis bottled water, exacerbating socio-economic health risks arising from disparities in purchasing power. Public offices, banks, schools and most businesses in Tehran will likely close (intermittently) in the coming weeks to conserve water, disrupting supply chains and business operations throughout the city. We assess that Iran’s ongoing energy shortage will likely exacerbate the crisis, driving anti-government sentiment and increasing incidents of small-scale protests in the capital.
• UK: Plan to undermine proscription of pro-Palestine group will possibly fuel renewed activism. On 3 August, The Telegraph newspaper reported on a plan by pro-Palestine activists to undermine police enforcement of the proscription of the radical Palestine Action (PA) group under the Terrorism Act 2000. According to the newspaper, groups such as Cage International and Defend Our Juries are urging activists to openly express support for PA en masse at a protest in Westminster in the capital London on 9 August. Smaller actions will also be held across the country. The organisers reportedly believe that the police will be incapable of arresting all those who express support for the PA and will face reputational damage if they do so, which will in turn create pressure for the ban to be lifted. We assess that the police will almost certainly face difficulty enforcing the ban if the organisers manage to mobilise sufficient support. If the plan is perceived to be successful, we assess that it will possibly fuel a spike in activist targeting of businesses following a lull in the wake of the ban on PA in July.
• Israel: Further Jewish prayers at al-Aqsa mosque will be likely, exacerbating ethno-religious tensions. On 3 August, Israel’s far-right National Security Minister Itamar Ben-Gvir led a group of worshippers in a Jewish prayer at the al-Aqsa Mosque compound in Jerusalem (Jerusalem district). Under the ‘status quo’ agreed between Israel and the Muslim authorities, Jews can visit the compound but not pray there. The move is likely to encourage other incidents of Jewish prayer in the compound in the coming weeks and months, exacerbating ethno-religious tensions and the risk of domestic unrest in the Jerusalem area, specifically the Old City (Jerusalem governorate, Palestinian Territories). This will elevate the risk of localised clashes between Jewish and Muslim groups, increasing personnel exposure to attacks targeting the security forces and crossfire in crowded public spaces and religious sites in Jerusalem. We assess that escalating tensions will likely drive a heightened security presence throughout the city, elevating travel disruption and supply chain risks.
• Syria: Clashes in north will sustain political, security instability. On 2 August, Syria’s Ministry of Defence (MoD) accused the Kurdish-led Syrian Democratic Forces (SDF) of launching a rocket barrage on one of the army’s outposts in Aleppo governorate, injuring four soldiers and three civilians. In response, the SDF claimed that the barrage was a retaliation for an unprovoked artillery assault by factions within the Syrian army targeting civilian-populated areas and called for the government to control ‘undisciplined’ elements. While the mutual hostilities ceased shortly after, tensions along the line of control in northern Syria remain elevated. As such, we assess that there is a realistic possibility of armed conflict resumption between the Kurds and several Turkish-backed factions within the army in the coming weeks. The clashes are also likely to augment the ongoing rifts in talks between the SDF and Damascus over the integration of the Kurdish forces into the new Syrian army, deepening political and security instability in the country. (Source: Sibylline)

—————————————————————————————————————————————————————————————————————————————————————————————————————————————–

Founded in 1987, Exensor Technology is a world leading supplier of Networked Unattended Ground Sensor (UGS) Systems providing tailored sensor solutions to customers all over the world. From our Headquarters in Lund Sweden, our centre of expertise in Network Communications at Communications Research Lab in Kalmar Sweden and our Production site outside of Basingstoke UK, we design, develop and produce latest state of the art rugged UGS solutions at the highest quality to meet the most stringent demands of our customers. Our systems are in operation and used in a wide number of Military as well as Home land Security applications worldwide. The modular nature of the system ensures any external sensor can be integrated, providing the user with a fully meshed “silent” network capable of self-healing. Exensor Technology will continue to lead the field in UGS technology, provide our customers with excellent customer service and a bespoke package able to meet every need.

A CNIM Group Company

——————————————————————————————————————————————————————————————————————————————————————————————————————————————————