TLP:CLEAR · Disclosure is not limited.

Red Sea: Attack near Hodeidah tests cautious return of liner transits via Suez

Time window: Last 7 days · Audience: General analyst · Type: Situation report · DTG: 2026-07-08 01:13Z · Overall confidence: LOW

BLUF

An armed attack on a cargo ship 30 nautical miles southwest of Hodeidah on 5 July, with no group claiming responsibility, shows the threat to commercial vessels off Yemen remains active even as Maersk and Hapag-Lloyd announced a limited Suez, Red Sea restart on 7 July. Houthi intent to target Israel-linked ships and a lethal Houthi land attack near Hodeidah suggest any reopening will be tentative.

Executive summary

Within the past week, a cargo ship issued a distress call reporting fire from an unidentified boat about 55 kilometres southwest of Hodeidah; UKMTO relayed the alert, the ship’s security team returned fire and the attackers withdrew, and no actor has claimed responsibility. On 7 July, Maersk and Hapag-Lloyd said they would begin sailing via the Suez Canal again, consistent with trade reporting that frames the move as a trial on one route after earlier suspensions tied to regional hostilities. Houthi authorities have signalled intent to resume attacks on Israel-linked vessels and announced a ban on Israeli ships, while Houthi forces also killed 14 Yemeni government troops south of Hodeidah this week and Houthi, Saudi relations have deteriorated. Separately, NASA recorded 11 low-confidence thermal detections in the Red Sea over two days, which by themselves do not confirm attacks. The IMO is backing a National Maritime Information Sharing Centre in Aden and the UK has supported Yemeni Coastguard patrol craft at Perim Island, steps that could improve reporting around Bab-el-Mandeb but will take time to mature.

Change from previous assessment

Since the 6 July brief, a cargo ship was attacked about 55 kilometres southwest of Hodeidah with no claim of responsibility, and Houthi forces killed 14 Yemeni government troops south of Hodeidah, reinforcing a still-active local threat. Maersk and Hapag-Lloyd moved from internal planning to public announcements of a limited Suez, Red Sea restart. NASA thermal detections in the Red Sea rose to 11 over two days but remain low confidence as indicators. We frame the liner return as tentative and lower confidence around near-term normalisation compared with the prior assessment’s more optimistic tone.

Key judgments

1. The maritime threat to commercial shipping within 30-60 kilometres southwest of Hodeidah is likely active and unattributed, as evidenced by the 5 July small-boat attack and absence of a claim of responsibility. (Confidence: medium · ASSESSED)

• I&W: Additional UKMTO alerts of small-boat approaches or firing within 20-35 nautical miles southwest of Hodeidah. (0-14 days)
• I&W: Sustained absence of further incidents in this box and a public attribution for the 5 July attack. (1-3 months)

2. Maersk and Hapag-Lloyd’s 7 July statements mark a cautious, limited return to Suez, Red Sea transit rather than full normalisation of liner traffic. (Confidence: medium · ASSESSED)

• I&W: AIS-confirmed transits of Maersk or Hapag-Lloyd vessels through Bab-el-Mandeb on the declared route. (0-14 days)
• I&W: Corporate advisories deferring or cancelling the Suez route restart. (0-14 days)

3. Given declared intent to target Israel-linked shipping, an announced ban on Israeli vessels, and active Houthi ground operations near Hodeidah, attacks on Israel-linked ships in the Red Sea are likely to resume in the near term. (Confidence: medium · ASSESSED)

• I&W: Houthi media or spokesmen claim or attempt an attack against a named Israel-linked vessel transiting the Red Sea. (0-14 days)
• I&W: Public evidence of renewed Houthi, Saudi de-escalation talks with confidence-building measures affecting the Red Sea. (1-3 months)

4. Planned maritime security capacity building, including an IMO-backed information-sharing centre in Aden and UK-supported Yemeni Coastguard patrol craft at Perim Island, will likely improve reporting and coordination around Bab-el-Mandeb within months but is unlikely to deter small-boat attacks immediately. (Confidence: medium · ASSESSED)

• I&W: Government of Yemen announces activation milestones for the National Maritime Information Sharing Centre in Aden. (1-3 months)
• I&W: Yemeni Coastguard Aden or Mayun patrol craft publish patrol or interception reports around Perim/Bab-el-Mandeb. (1-3 months)

5. Satellite thermal detections in the Red Sea almost certainly cannot verify an attack without corroborating maritime reporting, as the detections record heat sources rather than causes. (Confidence: high · REPORTED)

• I&W: Thermal detections coincide in time and position with UKMTO alerts, damage reports, and crew statements. (0-14 days)
• I&W: Repeated thermal detections occur without any corroborating maritime alerts or distress calls. (0-14 days)

6. Piracy and armed robbery risks off Puntland and in Yemeni waters likely add a concurrent non-Houthi hazard to shipping on the Red Sea, Gulf of Aden corridor. (Confidence: medium · ASSESSED)

• I&W: UKMTO or other maritime reporting centres issue new alerts of boardings or hostage-taking off Puntland or southwest of Balhaf. (1-3 months)
• I&W: Release of the 44 sailors held off Puntland or a sustained drop in attack reports along the Gulf of Aden corridor. (1-3 months)

Outlook & scenarios

Cautious liner return via Suez holds under heightened security (40%)

Maersk and Hapag-Lloyd successfully operate a limited service through Suez and Bab-el-Mandeb, with tight routing and advisories, while most other services remain on alternate routes. No further high-profile Red Sea attacks occur, though warnings persist. Trade and industry reporting continues to characterise the move as a trial, reflecting lingering risk perceptions.

Houthi maritime campaign resumes against Israel-linked shipping (50%)

Following repeated intent statements and a declared ban on Israeli vessels, Houthi units attempt or claim strikes against Israel-linked ships in the Red Sea, prompting liner operators to revert recent Suez restarts and widen detours. Ground clashes near Hodeidah continue, keeping the threat environment elevated and discouraging routine transits.

Piracy flare-up complicates Bab-el-Mandeb transits (25%)

Pirate or armed robbery activity off Puntland and southwest of Balhaf increases, adding to security burdens as naval and coastguard capacity is still ramping up. While not linked to Houthi operations, the added risk prompts some owners to delay Suez, Red Sea returns despite company announcements and planned security enhancements.

Recommendations

1. Maintain continuous watch on UKMTO advisories and crew distress reports within 20-35 nautical miles southwest of Hodeidah; fuse with AIS patterns to flag small-boat approaches and repeat contact points for route guidance.
2. Track Maersk and Hapag-Lloyd service advisories and AIS movements to verify the scope and cadence of the Suez, Red Sea restart; prepare an updated transit outlook for the next 14 days.
3. Prioritise monitoring of Houthi official channels for references to Israeli vessel bans and target lists; compile an exposure register of vessels with apparent Israel-linked ownership or cargo to inform risk communications.
4. Engage with the IMO team and Yemeni counterparts on the Aden information-sharing centre to request interim reporting protocols and contact points; establish a two-way OSINT feed of incident data relevant to Bab-el-Mandeb.
5. Treat satellite thermal detections as supporting, not leading, indicators; require corroboration from maritime alerts, crew reporting, or verifiable damage imagery before using them to characterise attacks.
6. Include piracy tripwires in daily watch products for the Gulf of Aden corridor, noting hostage status off Puntland and any boarding attempts southwest of Balhaf; brief owners and insurers who may assume only Houthi-linked risks.

Confidence & uncertainty

The assessment draws on multiple major-media and trade reports, UKMTO relays, and multilateral statements, but key elements rely on single-incident reporting, unattributed attacks, and intent statements rather than confirmed operational claims. There are also inconsistencies between company announcements and trade reporting on the scope of the Suez, Red Sea restart, and satellite thermal detections are non-diagnostic without corroboration. These factors, plus mixed source reliability across items ranging from high to medium, justify an overall low confidence rating even though several underlying claims are high confidence.

Alternative analysis (red cell)

While the reporting shows elevated maritime risk, several judgments conflate absence of a public claim with unattribution and read declared intent as immediate operational timelines. The July 5 attack is plausibly Houthi-linked but could also reflect opportunistic or non-state maritime actors, and company statements about Red Sea transits (2d3210dc vs bb7adaa0) permit multiple operational interpretations. Additional ISR, AIS/port logs, intercepts, and forensic shipboard analysis are necessary before treating unattribution, limited resumption, or near-term resumed targeting as the most likely outcomes.

Intelligence gaps

• [EEI 1.2 · PARTIAL] Public Houthi claims of attacks or warnings tied to specific dates/routes, including social-media posts, official statements, and timing relative to merchant transits. Recommended collection: open-source/social_media
• [EEI 1.3 · UNCOVERED] Unusual Houthi force posture indicators along Yemen’s Red Sea coast: movement or concentration of small boats, visible coastal missile/rocket emplacements, or logistics buildup at known launch sites (locations, timestamps). Recommended collection: imagery/satellite
• [EEI 1.4 · PARTIAL] Intercepts or communications indicating orders, targeting lists, or intent to strike merchant shipping (messages referencing specific vessel classes, companies, or chokepoints). Recommended collection: signals/communications
• [EEI 2.1 · UNCOVERED] Reports or visual confirmation of floating or moored mines and debris fields in shipping lanes or approaches to Bab-el-Mandeb, with geolocation and time. Recommended collection: imagery/satellite
• [EEI 2.2 · UNCOVERED] Detection of mine-laying activity: small vessels loitering in lane approaches, unexpected AIS track patterns consistent with mine deployment, or salvage/mining vessels operating in the area. Recommended collection: maritime/AIS
• [EEI 2.3 · UNCOVERED] Hydrographic notices, naval warnings, or port authority advisories closing lanes or imposing route restrictions (text of Notice to Mariners, issuing agency, effective times/areas). Recommended collection: naval/port_authority
• [EEI 2.4 · UNCOVERED] Naval or commercial reports of mine-countermeasure operations or confirmed mine removal events (location, time, platforms involved). Recommended collection: naval/intelligence
• [EEI 3.4 · UNCOVERED] Planned or ongoing multinational exercises, air ISR sorties, or logistics moves that increase or decrease naval capacity in the area (exercise name, participating units, dates, locations). Recommended collection: open-source/military_reporting
• [EEI 4.2 · UNCOVERED] War-risk and hull insurance coverage changes: issuance refusals, premium increases for Red Sea transits, or explicit route exclusions by underwriters (policy notices or market rate data with dates). Recommended collection: commercial/insurance_data
• [EEI 4.3 · PARTIAL] Freight and charter market signals tied to the corridor: spot rates for container, tanker, and dry bulk routes affected by Red Sea disruptions, and reported port congestion or turnaround-time increases at nearby hubs. Recommended collection: commercial/market_data
• [EEI 4.4 · PARTIAL] Incidents of cargo denial or diversion for critical goods (crude oil, refined products, LNG, high-value container cargo) including vessel IDs, cargo type, reroute/turnback actions, and economic impact estimates where available. Recommended collection: maritime/AIS

Cited sources

[1] Sputnik Армения · Грузовое судно подверглось нападению у побережья Йемена (B) · sha256:af11fd66d3e4 [2] inform.kz · Сухогруз подвергся атаке в Красном море — UKMTO (B) · sha256:61ac38c930f2 [3] RBC · У берегов Йемена судно подало сигнал бедствия из-за нападения (B) · sha256:362933f020d8 [4] finance.mail.ru · Грузовое судно подверглось атаке в Красном море на фоне перемирия США и Ирана (B) · sha256:33a46e1442e4 [5] news.israelinfo.co.il · Неизвестные обстреляли грузовое судно у берегов Йемена (B) · sha256:6cbc00336b00 [6] Al Jazeera · After Iran war upheaval, global shipping eyes return to status quo (A) · sha256:0fac49841a92 [7] maritime-executive.com · Maersk and Hapag to Shift One Route to Suez-Red Sea Transit (C) · sha256:aa2170c58755 [8] marinelink.com · Gulf-Europe Oil Pipeline Could Minimize Red Sea Dependency (B) · sha256:674ef597c622 [9] blockchain.news · Yemen clash dents Hormuz outlook as Polymarket puts July normalcy at 16% (B) · sha256:a658d7bff678 [10] maritime-executive.com · IMO Trying to Improve Safety of Navigation off Yemen (A) · sha256:f12992d96651 [11] firms.modaps.eosdis.nasa.gov · NASA FIRMS thermal detections — Red Sea (2d) (F) · sha256:74925f8fcc16

Source content hashes were computed at collection time; the cited text is preserved unmodified for the life of this product.

Red cell review: PARTIAL DISSENT

TLP:CLEAR