TLP:CLEAR · Disclosure is not limited.

Iran, Israel: Missile strikes near Hormuz, cyber pressure on Israel, and fraught diplomacy

Time window: Last 1 day · Audience: General analyst · Type: Situation report · DTG: 2026-07-07 12:16Z · Overall confidence: MEDIUM

BLUF

Iranian forces very likely struck commercial vessels near the Strait of Hormuz overnight, including the Qatari LNG carrier Al Rekayyat, while Iran‑linked operators continue targeting Israeli government and IT networks. With US, Iran talks paused and Washington weighing an F‑35 opening to Turkey over Israeli objections, the near‑term escalation risk remains elevated.

Executive summary

Multiple reports indicate Iran or the IRGC fired at least two missiles at commercial vessels exiting the Strait of Hormuz, with one tanker hit about 8 nautical miles east of Limah, Oman, and the Qatari‑owned LNG carrier Al Rekayyat struck in the early hours of 7 July, causing damage and a brief fire but no casualties. The regional maritime threat level in Hormuz remains substantial, and market reactions were mixed, with European gas up around 6 percent and Brent edging higher. In parallel, an Iran‑linked group dubbed Cavern Manticore is actively compromising Israeli government agencies and IT providers using a modular C2 framework and abuse of remote management tools. Diplomacy is fragile: US, Iran talks are suspended amid funeral events in Iran and Tehran conditions further negotiations on an end to American threats, as President Trump heads to a NATO summit where he is expected to discuss allowing Turkey to acquire F‑35s, a move Israel warns would upset the regional balance. Israel is exploring a trilateral energy summit in Abu Dhabi and a renewed water transfer to Jordan, though ambassadorial relations remain strained.

Change from previous assessment

Since the prior brief, Iran very likely resumed direct attacks on commercial shipping near Hormuz, including a confirmed hit on the Qatari LNG carrier Al Rekayyat, and the regional threat level remains substantial. European gas prices spiked on the news while Brent moved only marginally. Concurrently, more detailed reporting emerged on an Iran‑linked cyber group targeting Israeli government and IT providers. Diplomatically, US, Iran talks are suspended during funeral events in Iran, and Washington is expected to discuss allowing Turkey F‑35 access despite Israeli warnings, increasing near‑term friction. Israel is weighing an Abu Dhabi summit with Jordan and the UAE to revive water and energy cooperation, but bilateral ambassadorial gaps persist.

Key judgments

1. Very likely Iran or the IRGC conducted missile strikes on commercial shipping near the Strait of Hormuz on 6-7 July, including a hit on the Qatari LNG carrier Al Rekayyat and a separate strike about 8 nautical miles east of Limah, Oman, causing damage but no casualties and testing an emerging de‑escalation track with Washington. (Confidence: high · REPORTED)

• I&W: Confirm: Additional confirmed missile or drone strikes on laden tankers exiting Hormuz, with UKMTO advisories specifying impacts east of Musandam. (0-14 days)
• I&W: Break: Publicly announced US, Iran maritime deconfliction measures and a downgrade of the Hormuz threat level from SUBSTANTIAL by recognised maritime security centres. (0-1 month)

2. It is likely maritime risk through Hormuz will remain elevated but oil and gas flows will continue at reduced yet workable levels, producing intermittent price spikes rather than a sustained surge. (Confidence: medium · ASSESSED)

• I&W: Confirm: War‑risk insurers widen exclusion zones and raise premia for Hormuz transits, coinciding with further vessel impacts and prolonged owner caution advisories. (1-3 months)
• I&W: Break: A sustained resumption of carrier services on Red Sea, Suez routes and a measurable recovery in inbound tanker traffic to pre‑attack levels. (1-2 months)

3. Very likely an Iran‑linked group known as Cavern Manticore is conducting ongoing intrusions against Israeli government agencies and IT providers, using a modular command‑and‑control framework and abuse of remote management tools to evade detection, aligning with Tehran’s multi‑domain pressure strategy. (Confidence: high · REPORTED)

• I&W: Confirm: Public advisories from Israeli CERT naming Cavern Manticore activity and IOCs linked to supply‑chain compromises at major IT service providers. (0-30 days)
• I&W: Break: A sustained 30‑day lull in vendor‑verified detections tied to the group across Israeli government and IT networks. (0-2 months)

4. Likely the risk of further Iran, Israel escalation will stay elevated in the near term, as US, Iran talks are suspended during Khamenei’s funeral events and Tehran conditions final negotiations on an end to US threats, while an expected US move to reopen F‑35 access for Turkey, opposed by Israel, sharpens regional anxieties. (Confidence: medium · ASSESSED)

• I&W: Confirm: New Iran, Israel cross‑border strikes or explicit threats during the NATO summit window or around the 9 July funeral. (0-14 days)
• I&W: Break: Public announcement of resumed Doha‑style indirect talks or an extension of the 60‑day negotiating period beyond its current window. (0-1 month)

5. There is a roughly even chance Israel will push a near‑term stabilisation track with Jordan and the UAE on water and energy to offset strategic pressures, though strained ambassadorial ties and an unrenewed water addendum complicate progress. (Confidence: medium · ASSESSED)

• I&W: Confirm: Announcement of an Abu Dhabi trilateral meeting date or a public renewal of Israel’s additional 50 mcm water transfer to Jordan. (0-2 months)
• I&W: Break: Public shelving of the proposed summit or formal statements from Amman rejecting water deal renewal. (0-2 months)

Outlook & scenarios

Managed escalation at sea and in cyberspace (60%)

Iran continues sporadic strikes on commercial traffic exiting Hormuz while Cavern Manticore sustains network intrusions against Israeli targets. Maritime traffic persists at reduced levels, insurers harden terms, and prices oscillate without a sustained oil spike. Back‑channels remain quiet until mid‑July.

Diplomatic pause gives way to a limited de‑escalation (35%)

After funeral events conclude, indirect US, Iran contacts resume. Attacks on shipping ebb, carriers cautiously expand trans‑Suez services, and Israel advances an Abu Dhabi energy‑water track with Jordan and the UAE to lower regional temperature.

Retaliatory cycle triggers a sharp spike (20%)

A further vessel strike prompts US retaliatory action on Iranian assets, eliciting additional Iranian attacks across the Gulf. Israel raises readiness against Iranian proxies. Maritime flows dip, gas jumps again, and Brent climbs materially for several weeks.

F‑35 opening to Turkey deepens Israeli insecurity (35%)

Washington signals a pathway for Ankara to rejoin F‑35 procurement. Jerusalem publicly objects and accelerates regional defence coordination, while Tehran amplifies pressure to test perceived fissures among US partners.

Recommendations

1. Task persistent collection on IRGC coastal launch sites and maritime patrol patterns along the Musandam, Hormuz axis, and fuse with UKMTO incident reports to refine warning for laden LNG and crude traffic.
2. Direct Israel‑facing network defenders to prioritise detection of remote monitoring and management software abuse, deploy allow‑listing, and hunt for modular.NET‑based C2 artefacts associated with Cavern Manticore.
3. Engage interagency to preserve a diplomatic off‑ramp: encourage reactivation of indirect US, Iran contacts after funeral events and avoid public rhetoric Tehran cites as a precondition to stall talks.
4. Coordinate with major liners and underwriters on contingency routing and risk pricing; model exposure to a $5 oil move using established macro cost estimates, and brief senior stakeholders on hedging and inventory posture.
5. Prepare policy and messaging options around a prospective US decision to reopen F‑35 access for Turkey, including reassurance measures for Israel and channels to Ankara to manage expectations at the NATO summit.
6. Support Oman‑ and Qatar‑facilitated deconfliction mechanisms for Hormuz transits and encourage adherence to Best Management Practices among shipowners before routing through the chokepoint.
7. Back discreet facilitation of an Abu Dhabi trilateral on water and energy and identify practical steps to restart Israel’s additional water transfer to Jordan, given Amman’s chronic deficit.

Confidence & uncertainty

Maritime strike reporting around Hormuz is corroborated by multiple independent sources that align on timing, location near Limah, Oman, vessel identity, damage and absence of casualties, and by standing security advisories, which supports higher confidence on kinetic events. The cyber assessment rests on several converging reports from cyber researchers detailing tactics, infrastructure and targeting, which is strong. Market and diplomatic trajectories are less certain: shipping and price data show mixed signals, and forward‑looking elements on talks and prospective F‑35 decisions are inherently contingent and partly single‑sourced. On balance this yields a medium overall confidence level.

Alternative analysis (red cell)

The maritime strike reporting is internally inconsistent on location and attribution and lacks forensic corroboration; attribution to the IRGC and political intent as a de‑escalation test is therefore not established. Market and shipping indicators in the dataset are mixed, leaving open plausible outcomes from manageable disruption to substantial flow interruptions. Cyber reporting on ‘Cavern Manticore’ shows concerning capability but relies heavily on vendor observations without robust cross-victim or intelligence linkage to Tehran, making state attribution provisional. Diplomatic stabilization prospects with Jordan and the UAE are undercut by unresolved frictions in the claims, so an optimistic near‑term outcome is not the only reasonable estimate.

Intelligence gaps

• [EEI 1.1 · UNCOVERED] Unusual long-range missile/rocket transporter-launcher (TEL) movements, storage activation, or assembly activity at known IRGC missile sites or forward staging areas. Recommended collection: satellite/imagery
• [EEI 1.2 · PARTIAL] Orders, threat-alert messages, or changes in posture from IRGC, Quds Force, or senior Iranian military leadership indicating attack timelines or rules of engagement changes. Recommended collection: signals/ELINT and HUMINT
• [EEI 1.3 · UNCOVERED] Large-scale transfers, deliveries, or convoy movements of armed UAVs/drones, guided munitions, or spare parts from Iran into Lebanon (Hezbollah), Iraq, Syria, or Gaza. Recommended collection: air/aviation track and HUMINT
• [EEI 1.4 · PARTIAL] Sustained changes in Israeli air-defense usage (SAM launches, radar activations), wide-area alerts, or NOTAMs indicating elevated imminent strike response. Recommended collection: air/aviation/NOTAMs and signals
• [EEI 2.3 · PARTIAL] Insurance market indicators: sudden spikes in war-risk or hull insurance premiums for routes through the Red Sea, Suez corridor, or Persian Gulf, and major carriers announcing route changes. Recommended collection: financial/market and commercial shipping notices
• [EEI 2.4 · PARTIAL] Port closures, naval escorts requested by commercial operators, or formal rerouting advisories issued by major shippers (e.g., Maersk, Hapag-Lloyd) for regional transits. Recommended collection: commercial/OSINT
• [EEI 3.1 · UNCOVERED] Deployment of foreign military assets to the region (carrier strike groups, amphibious ships, combat aircraft deployments, or additional bases activated) from the US, UK, France, Russia, or GCC states. Recommended collection: maritime/AIS and air/aviation and satellite/imagery
• [EEI 3.2 · PARTIAL] Formal diplomatic actions: emergency UNSC votes, sanctions announcements, high-level ministerial visits, or public mediation offers by external powers or regional actors. Recommended collection: diplomatic/OSINT
• [EEI 3.3 · UNCOVERED] Confirmed arms transfers, expedited weapons shipments, or transfer authorizations to Israel, Iran, or their proxies (aircraft parts, munitions, air defenses). Recommended collection: customs/INTEL and HUMINT
• [EEI 3.4 · UNCOVERED] Issuance of travel warnings, embassy evacuations or reductions, and closure of diplomatic missions by major capitals indicating escalation risk or shifted threat assessments. Recommended collection: OSINT/diplomatic

Cited sources

[1] The Jerusalem Post · Live Updates: Latest from Israel, Iran, and Middle East | The Jerusalem Post (A) · sha256:84d26cb8fc56 [2] insurancejournal.com · Iran Missiles Reportedly Hit Ships in Hormuz, Testing US Talks (B) · sha256:462ed56b9a4d [3] cryptobriefing.com · Iran fires missiles at ships in Strait of Hormuz, escalating tensions (B) · sha256:d8312f8608b5 [4] gcaptain.com · Qatari LNG Ship Struck in Strait of Hormuz, Testing US Talks (A) · sha256:3113a0e31733 [5] gcaptain.com · Tanker Struck by Projectile Near Hormuz, Sparking Fire (B) · sha256:684afa21259d [6] maritime-executive.com · Iran Resumes Attacks on Merchant Shipping With Strike on LNG Carrier (A) · sha256:e822179d55b8 [7] gcaptain.com · Japan's Mideast Crude Supply to Rebound in July as Stranded Vessels Exit Hormuz (A) · sha256:8cfdacfbb5a7 [8] gcaptain.com · Maersk and Hapag-Lloyd Expand Suez Canal Return With AE15 Service (C) · sha256:ebb8715fca94 [9] Jerusalem Post · Iran-linked hackers used Israeli IT providers to target government bodies (A) · sha256:9ade8d0105d7 [10] News.az · New Iran-linked hacker group targets Israeli government agencies | News.az (B) · sha256:282de1aaba8e [11] infosecurity-magazine.com · New Iran-Nexus Hacking Group Targets Israel Government and IT Sectors (B) · sha256:e674f59b5f2a [12] dailybeirut.com · Иран требует прекратить угрозы для начала финальных переговоров с США (B) · sha256:7c7e60293fc6 [13] jpost.com · Erdogan wants America's F-35s, Israel has every reason to worry - editorial (B) · sha256:693e6224f313 [14] haaretz.com · Trump to reportedly allow Turkey to purchase U.S. F-35 planes despite Netanyahu's pleas (A) · sha256:f248366b86c5 [15] ynetnews.com · Israel weighs Abu Dhabi summit to revive Jordan water deal (B) · sha256:287f9263fe01

Source content hashes were computed at collection time; the cited text is preserved unmodified for the life of this product.

Red cell review: PARTIAL DISSENT

TLP:CLEAR