Sponsored by Bertin Exensor
www.exensor.com
——————————————————————————————————————————————————————————————————————————————————————————————————————————————–
Military And Security Developments
Nov 21.
- Iran’s adversaries will face heightened security risks from cyber-enhanced kinetic action. On 19 November, the technology company Amazon reported that two Iranian state-sponsored groups (‘Imperial Kitten’ and ‘MuddyWater’) have used cyber operations to support kinetic action since at least January 2024. On 27 January 2024, Imperial Kitten reportedly compromised the automatic identification system (AIS) on a specific ship. The same vessel was then targeted by the Iran-backed Houthis in a missile strike on 1 February 2024, highlighting the potentially premeditated and targeted nature of the initial cyber compromise. Earlier this year in May, MuddyWater set up infrastructure that subsequently enabled the group to infiltrate live closed-circuit television (CCTV) feeds in Jerusalem district (Israel) in June. This preceded a series of Iranian missile strikes on Israel in late June. Israeli officials confirmed that these strikes were fine-tuned using footage from compromised cameras, illustrating how cyber-enabled compromises support physical attacks. We assess that Iran will pose increased security risks to its perceived adversaries amid the continuous evolution of its cyber strategy.
Nov 19.
KEY DEVELOPMENTS
IRAN
* Iran seized a vessel in the Persian Gulf, underscoring the increasing risk of disruption facing commercial shipping amid mounting economic pressure.
* The International Atomic Energy Agency (IAEA) will likely adopt a resolution calling for Iran to improve co-operation with the agency, compounding regional tensions over the status of Tehran’s nuclear programme.
ISRAEL
* Growing radicalisation among the Arab-Israeli community and the possible spillover of terrorism from the West Bank (Palestinian Territories) will elevate the risk of attacks across Israel.
* A delay to Prime Minister Benjamin Netanyahu’s corruption hearing will not drive immediate political risks; however, the postponement will likely extend proceedings, and therefore lead to a period of heightened coalition tensions.
PALESTINIAN TERRITORIES
* GAZA STRIP: A return of a deceased Israeli soldier’s body by Hamas without the reciprocal release of its militants trapped in tunnels under Rafah will elevate tensions and the risk of a ceasefire collapse.
* GAZA STRIP: The reopening of the Zikim border crossing on 12 November to facilitate the passage of aid deliveries is unlikely to alleviate humanitarian risks in Gaza significantly.
* WEST BANK: Escalating Israeli settler violence underscores the elevated ethno-religious tensions across the West Bank, as well as the increased security and compliance risks facing proximate entities.
* WEST BANK: The evacuation of an Israeli settlement outpost will possibly trigger protests in Jerusalem district (Israel), while compounding ethno-religious tensions in the West Bank.
* Saudi Arabia-US: Military deals are unlikely to prompt Riyadh to join Abraham Accords in short term. On 18 November, the US designated Saudi Arabia as a major non-NATO ally during Saudi Crown Prince Mohammed bin Salman’s visit to Washington DC. The designation is part of a defence agreement which will increase bilateral co-operation and the sharing of military technology. US President Donald Trump also confirmed future deliveries of F-35 fighter jets and 300 tanks to Saudi Arabia. Furthermore, the two countries signed a joint declaration on the completion of negotiations on civil nuclear energy co-operation. The new deals will almost certainly strengthen Saudi Arabia’s military capabilities, likely augmenting existing tensions with Iran. The deals are also likely to further fuel regional competition between Saudi Arabia and the UAE in various sectors, particularly in the civil nuclear field and artificial intelligence (AI). Nevertheless, despite the new military deals, we assess that Saudi Arabia is unlikely to join the Abraham Accords in the short term as it still insists on a clear path to Palestinian statehood as the main condition for such a deal.
* Syria: Memorandum of understanding will reduce energy security risks; drive investment opportunities. On 18 November, Syria’s state-owned Syrian Petroleum Company (SPC) signed a memorandum of understanding (MoU) with US-based hydrocarbons and energy firms ConocoPhillips and Novaterra. The MoU outlines the exploration and development of new and existing gas fields; domestic gas output is expected to increase by between 4 and 5 m cubic metres per day within a year, rising more than 50% from current levels. In the long term, the deal will reduce critical energy security risks nationwide, with increased supply possibly coming into effect in the next 12 to 24 months. We assess that this will moderate business operational risks, especially in energy-intensive sectors like manufacturing, which will almost certainly play a significant role in Syria’s reconstruction. Additionally, a decrease in blackouts will ease operational risks for NGOs providing humanitarian and medical assistance, alleviating broader socio-economic health risks. Consequently, domestic unrest and anti-government sentiment will likely subside, moderating government instability. Syria will likely pursue further such agreements to support long-term redevelopment, driving investment opportunities in energy and related industries in the coming months.
Nov 18.
* Palestinian Territories: New international force will elevate risks of re-escalation in Gaza. On 17 November, the UN Security Council (UNSC) approved a resolution mandating a transitional administration (known as the Board of Peace) and an International Stabilisation Force (ISF) in Gaza. The Board of Peace will oversee the reconstruction and economic recovery of Gaza, while the ISF will secure borders and humanitarian aid as well as the demilitarisation of Gaza by decommissioning weapons and destroying military infrastructure. While Hamas has rejected the resolution, claiming that it would impose an international trusteeship on Gaza and an un-neutral ISF, the creation and implementation of these bodies will proceed over the coming months. The ISF is unlikely to deploy to Gaza in December, as uncertainty regarding its composition will likely delay its formation until the first quarter of 2026. Even upon its deployment, we assess that the ISF will likely face substantial co-ordination issues in the first weeks. This will sustain critical security risks across Gaza, particularly as Hamas and allied militias are highly likely to resist forced disarmament attempts, possibly triggering clashes with ISF units. This will also compound pressure on the broader peace process in Gaza, sustaining risks of conflict re-escalation in the first half of 2026.
* Turkey: Gülenist crackdown will sustain labour flexibility, operational risks for affected businesses. Earlier on 18 November, the capital Ankara’s Chief Prosecutor issued arrest warrants for 22 individuals accused of ties to the outlawed Gülen movement (FETÖ), targeting what the authorities have described as the group’s secret ‘mahrem’ network within the Turkish Land Forces. The move comes after the security forces detained 71 people during simultaneous raids across 27 provinces on 17 November, including both public and private sector workers accused of previous ties to FETÖ-linked companies. These operations broadly follow an established trend and are unlikely to signal an immediate escalation in wider security crackdowns. However, as early elections are possible within the next 18 months, we assess that the frequency of such raids will increase as the authorities use national security narratives as a political tool and exploit the presence of clandestine networks to justify crackdowns on the political opposition. The ongoing operations against FETÖ will continue to pose detention and legal risks for personnel in Turkey, while driving limited labour flexibility risks and operational disruption for affected businesses.
* Israel: Iranian threat actors pose long-term cyber espionage risks to high-value targets. On 17 November, international news outlets reported that an Iranian state-sponsored group (‘APT42’) is targeting senior defence and government officials in Israel in an ongoing cyber espionage operation. The group typically uses social engineering attacks to infiltrate targeted systems. It reportedly spends weeks prior to the attacks gathering intelligence on and building relationships with the intended victims, highlighting the highly targeted and long-term nature of this operation. Victims are tricked into opening a malicious document that purports to provide information on upcoming conferences but covertly downloads a backdoor (‘TameCat’) onto compromised systems. TameCat enables APT42 to establish communication with command-and-control (C2) infrastructure, perform system reconnaissance, exfiltrate data and execute additional malicious payloads. The payload also displays multiple sophisticated detection evasion mechanisms, showcasing the operation’s stealth. We assess that Iranian state-sponsored groups will continue to pose significant cyber espionage risks to high-value targets in Israel amid long-term geopolitical hostilities.
Nov 17.
Key points
* The Lebanese Hizballah (LH) disarmament process remains in a precarious position; the deadline for its implementation is 31 December.
* Israeli and US pressure will likely compel the Lebanese government to accelerate disarmament efforts cautiously in the coming weeks, raising the risk of localised clashes and further Israeli intervention.
* Israel will likely intensify military operations against LH targets in the coming weeks; however, we assess that the ceasefire is likely to hold in the short term.
* New anti-money-laundering (AML) sanctions are likely in the coming weeks; any such initiatives are liable to include new US Treasury and EU designations against LH-associated banks and hawala networks.
Context
On 6 November, Israel launched a wave of airstrikes against southern Lebanon. It targeted LH infrastructure in towns such as Ayta al-Jabal, Taybeh (both Nabatieh governorate) and Tayr Debba (South governorate). Overnight on 6 November, the Israel Defense Forces (IDF) conducted ground raids into Houla (South), demolishing several buildings used by LH. On 7 November, Israeli drones struck multiple vehicles in southern Lebanon. In the ensuing days, Israel pressed the Lebanese Armed Forces (LAF) to conduct house-to-house searches of private homes; however, the LAF refused, citing domestic unrest risks.
These developments unfolded after Lebanese President Joseph Aoun instructed the LAF on 30 October to confront any future Israeli incursion into southern Lebanon following an Israeli operation in Blida (Nabatieh) in which a municipal worker was killed. The order marks a notable shift in posture since the Israel-LH ceasefire took effect on 27 November 2024. It also comes amid increasing Israeli and US pressure on Lebanon to uphold its commitment to disarm LH fully by 31 December (2025), as agreed under the US-mediated LH disarmament roadmap. On 6 November, the US imposed new sanctions against LH-linked financiers moving funds from Iran into Lebanon.
The Lebanese government has achieved only limited progress on the ground, though it has taken formal steps towards compliance. These steps include endorsing a phased LAF plan to consolidate state control over weapons stocks and instructing the central bank (BDL) to block transactions involving LH-linked hawala networks and development banks. Nevertheless, Israeli airstrikes and cross-border raids continue to target LH assets in southern Lebanon, undermining confidence in the ceasefire?s durability (and signalling Israel?s impatience with Lebanon?s slow implementation of the disarmament process with less than two months to go until the deadline.
Forecast
The Lebanese government will likely cautiously accelerate its disarmament efforts in the coming months, raising the risk of localised clashes and increased external intervention
Israeli military pressure and US diplomatic pressure will likely compel the Lebanese government to accelerate its disarmament efforts in the coming weeks, even if only symbolically. Economic incentives will play a central role in driving the government’s cautious acceleration of disarmament. A substantial US economic assistance package reportedly worth several hundred m USD is contingent on demonstrable progress under the roadmap, while a Saudi- and Qatari-backed investment initiative exceeding USD 10 bn is also conditional on Lebanese compliance. If secured, these funds would likely help to stabilise Lebanon’s deteriorating socio-economic environment; they would also ease energy security challenges and foster more favourable conditions for investment. US assistance would also likely improve the LAF’s capabilities, reinforcing the state?s claim to a monopoly on the legitimate use of force and moderately reducing the long-term risk of an LH resurgence.
Despite these pressures and incentives, LH remains firmly opposed to disarmament and, while Israeli forces operate in Lebanese territory, will likely frame this opposition as a means of defending Lebanese sovereignty. Consequently, a forceful state-led push is likely to provoke resistance and trigger a broader Shia backlash, raising the risk of protests and militia mobilisation (while also heightening ethno-religious tensions and domestic unrest risks). External state actors such as Iran will possibly also seek to influence the outcome of the process, increasing the risk of indirect or proxy-driven escalation involving Israeli or LAF units. Consequently, the Lebanese government is likely only to pursue a gradual approach towards disarmament in the coming weeks; it will likely seek to signal compliance through symbolic LAF deployments and selective enforcement actions without provoking confrontations with LH. We assess that the government and the LAF will likely seek to extend the disarmament timeline over the next 12 months to mitigate against broader conflict risks.
However, even a gradual approach to disarmament is liable to raise the risk of clashes in southern Lebanon. The Lebanese government’s signalling to Israel and the US is likely to include expanding the LAF’s presence in areas traditionally dominated by LH, particularly south of the Litani River, as well as in the Beqaa Valley (Baalbek-Hermel and Beqaa governorates) and the capital Beirut’s Dahieh suburb. This will heighten the risk of violent clashes with LH members and limited skirmishes with Israeli forces stationed in southern Lebanon, driving staff exposure to crossfire. Structural LAF weaknesses including limited air and naval capabilities, personnel constraints and political divisions within the LAFwill likely further constrain the disarmament’s implementation, raising the risk of further Israeli military activity targeting LH assets in the coming months.
The ceasefire is likely to hold over the coming weeks; however, Israel will likely continue to intensify military pressure on LH as the disarmament deadline approaches
Israel will likely increase its rate of targeted airstrikes and limited cross-border incursions into southern Lebanon in the coming weeks, focusing on LH logistics routes, weapons sites and command infrastructure. Recent intensified operations indicate that Israel is likely shifting towards a routine tactical enforcement of the ceasefire rather than occasional deterrent strikes. As such, the ceasefire is more vulnerable to short-term destabilisation even if its outright collapse remains unlikely, raising conflict escalation risks in the coming weeks. President Aoun’s 30 October directive instructing the LAF to confront any Israeli incursion has increased the prospect of sporadic ? though likely limited armed clashes between the IDF and LAF, particularly in towns such as Aitaroun, Blida (both Nabatieh) and Marwahin (South) along the Israel-Lebanon border. Any miscalculation during encounters involving both sides would possibly trigger short but intense flare-ups, elevating crossfire and misidentification risks for NGO personnel and civilians operating near the border.
Despite the recent escalation in kinetic activity, we assess that a return to full-scale conflict before the end of 2025 remains unlikely. Israel continues to apply measured tactical pressure to accelerate the disarmament process, but is not seeking to initiate a broader confrontation. LH lacks both the political will and military capacity for a sustained escalation with Israel. LH?s operational capacity is already severely depleted; as such, the group will likely continue to respond in a limited and controlled manner, moderating the risk of significant rocket fire into northern Israel in the coming weeks. Amid such a pattern of low-intensity confrontation, businesses and NGOs with exposure in southern Lebanon are likely to face periodic disruption to overland movement; this would in turn drive temporary interruptions vis-a-vis logistics and staffing, as well as short-term suspensions of field activity during localised escalations.
LH’s ongoing refusal to disarm, coupled with intensifying US pressure and financial scrutiny, has increased the likelihood of further AML sanctions in the coming weeks
LH’s ongoing refusal to comply with the US-brokered disarmament roadmap, combined with the Lebanese government’s cautious approach to asserting control over LH-linked institutions, has heightened US and European scrutiny of Lebanon?s financial sector. Recent US sanctions on 6 November targeting LH-linked financiers highlight Washington DC?s readiness to escalate parallel financial pressure alongside Israel?s tactical military enforcement of the ceasefire. Western governments continue to express frustration with Beirut?s limited enforcement of AML and counter-terrorist financing (CTF) standards; these governments are likely to respond with further targeted sanctions in the next six to eight weeks. These will possibly include the application of new US Treasury and EU designations to LH-associated banks, hawala networks and NGOs, alongside domestic enforcement by BDL through licence suspensions, account freezes and tighter controls on high-risk transactions. These measures will increase compliance and operational risks for Lebanese banks and international organisations operating in the country.
Consequently, international firms and NGOs will possibly experience payment delays, increased due diligence requirements and stricter transaction monitoring, especially in LH-administered municipalities or when partnering with local NGOs. Non-compliance with sanctions will possibly drive legal exposure, including licence revocations, asset freezes and account suspensions, raising regulatory and reputational risks for firms operating in the country. While expanded AML and CTF enforcement is likely to limit LH’s access to funds over time, it is unlikely to reduce short-term conflict escalation risks significantly given ongoing Israeli operations. Despite recent US sanctions on Iranian-linked laundering networks, LH retains access to regional financial channels, and domestic enforcement remains politically constrained. Nevertheless, credible progress by Lebanon regarding disarmament benchmarks and financial transparency would likely encourage renewed international engagement with Lebanese markets and a gradual restoration of investor confidence over the next 12 to 24 months.
* Iran-UAE: Threat of vessel seizure in Persian Gulf, proximate waters will likely rise in coming months. On 14 November, Iran’s Islamic Revolutionary Guard Corps (IRGC) seized the Singapore-bound, Marshall Islands-flagged oil tanker MV Talara, approximately 22 nautical miles (approximately 41km) off the coast of Khor Fakkan (UAE), before redirecting it to Iranian territorial waters. The IRGC claimed that the tanker was carrying unauthorised cargo. While this incident possibly relates to a commercial dispute, we assess that such seizures are increasingly likely over the coming months, as the reimplementation of pre-2015 UN sanctions increases strains on the Iranian economy, driving seizures as a form of sanctions relief and revenue generation (see Sibylline Sanctions Watch ? 31 October 2025). This will drive threats to commercial shipping and supply chains utilising the Gulf of Oman, the Persian Gulf and the Strait of Hormuz, particularly for vessels associated with states implementing sanctions. It will also drive security risks associated with aggressive boarding operations and prolonged detentions within Iran, including threats to crew welfare and psychological harm. As diplomatic tensions between Iran and the West escalate amid stalled nuclear negotiations, the likelihood of further Iranian vessel seizures will increase, along with the risk of retaliatory Western sanctions targeting Iranian shipping entities, related logistics networks, insurers and associated operators servicing the region.
* Syria: Rocket attack on capital Damascus underscores sustained security gaps, instability. On 14 November, two Katyusha rockets struck a residential building in the capital Damascus? Mezzeh district, injuring one civilian. The rockets were launched from Damascus outskirts; no group has claimed responsibility so far. The Syrian security authorities have stated that they are still investigating the incident. While no further details have been disclosed, there is a possibility that the perpetrators aimed the rockets at a governmental or military target; the projectiles possibly deviated and hit a residential building. The attack underscores the sustained physical security threats across Damascus, despite the augmented presence of the General Security Service (GSS) and the relative stability compared to other parts of Syria. However, this augmented presence by the authorities is largely concentrated in the central Damascus districts and not in the peripheries. As such, these security gaps will continue to leave the capital vulnerable to such attacks by several rogue groups, including organised crime elements, Assadists and Iran-backed cells throughout the first half of 2026. (Source: Sibylline)
—————————————————————————————————————————————————————————————————————————————————————————————————————————————
Founded in 1987, Exensor Technology is a world leading supplier of Networked Unattended Ground Sensor (UGS) Systems providing tailored sensor solutions to customers all over the world. From our Headquarters in Lund Sweden, our centre of expertise in Network Communications at Communications Research Lab in Kalmar Sweden and our Production site outside of Basingstoke UK, we design, develop and produce latest state of the art rugged UGS solutions at the highest quality to meet the most stringent demands of our customers. Our systems are in operation and used in a wide number of Military as well as Home land Security applications worldwide. The modular nature of the system ensures any external sensor can be integrated, providing the user with a fully meshed ‘silent’ network capable of self-healing. Exensor Technology will continue to lead the field in UGS technology, provide our customers with excellent customer service and a bespoke package able to meet every need.
A CNIM Group Company
—————————————————————————————————————————————————————————————————————————————————————————————————————————————–