Loading story…
Iran imposed a restrictive transit regime in and around the Strait of Hormuz after strikes on key energy sites including South Pars and Asaluyeh, warning Gulf states to evacuate energy installations and signaling that disruption could spread across the wider Gulf system. Reporting indicates Tehran formalized a permit-and-toll structure administered by IRGC-linked authorities and the new Persian Gulf Strait Authority, with some vessels charged up to $2 million per passage and payments accepted in Chinese yuan or cryptocurrency. Israel-linked ships were reportedly barred, U.S.-linked vessels faced severe restrictions, and commercial operators encountered inspections, approval requirements, GPS spoofing, AIS suppression, and growing pressure to navigate under dark or EMCON conditions.
The maritime response turned the waterway into a contested chokepoint rather than a normal trade lane. U.S. forces reportedly began mine clearance, blockade and interdiction operations against Iran-linked shipping, while OFAC sanctions and boarding authorities expanded beyond Hormuz into the Gulf of Oman. At the same time, IRGC-linked attacks, seizures, and gunfire against commercial vessels drove course reversals, traffic collapses, and heavy congestion, even as Iranian crude exports continued through dark fleet tactics, fraudulent flags, offshore transfers, and rerouting toward Chabahar and Asian destinations, especially China. Limited LNG and crude movements resumed under coordinated arrangements during the ceasefire, but Kharg Island throughput remained constrained, dark tanker concentrations persisted near Larak, Qeshm, and Chabahar, and maritime operators faced rising sanctions, physical security, and cyber risk across shipping, ports, and regional energy infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
26 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-25, a strike damaged the Singapore-flagged cargo vessel EVER LOVELY in the Strait of Hormuz. The incident disrupted an IMO evacuation effort for stranded ships, which the report said remained suspended afterward.
On May 16, Iran confirmed it would soon disclose full details of a new Strait of Hormuz transit regime administered by the Persian Gulf Strait Authority. The mechanism requires vessels to submit ownership, insurance, crew, cargo, and routing information to obtain permits.
Iran seized the sanctioned tanker JIN LI in the Gulf of Oman during the ceasefire period. The seizure was cited alongside escalating U.S. action against Iran-linked tankers as evidence of continued coercive maritime enforcement by both sides.
A limited restart of Qatar LNG traffic occurred when AL KHARAITIYAT became the first Qatar LNG cargo to transit Hormuz since the February closure. Reporting said the movement appeared to occur under a Pakistan-mediated U.S.-Iran ceasefire framework.
Five weeks into the ceasefire, reporting said there had been no confirmed crude departures from Kharg Island since May 7. Imagery indicated possible repair activity at damaged loading infrastructure while dark tankers remained staged nearby.
On May 5, 146 of 167 commercial-size vessels in the area around Hormuz were reported to be operating without visible AIS. The data highlighted the extent of dark activity and degraded maritime transparency in the strait.
The United States began Project Freedom on May 4, 2026 to guide 'neutral and innocent' commercial vessels while continuing interdiction of Iran-linked shipping. The initiative reflected a dual-track posture of maritime protection and sanctions enforcement around Hormuz.
OFAC issued guidance on May 1, 2026 warning that payments to Iranian-linked entities for safe passage through Hormuz could create prohibited transaction concerns and secondary sanctions risk. The guidance elevated compliance risk for commercial operators considering transit payments.
Reporting on April 23 said Kharg Island crude exports fell to about 3 million barrels during April 13–19, far below the usual weekly average of roughly 8 million barrels. The decline indicated significant disruption to Iranian maritime oil exports under enforcement pressure.
On April 22, IRGC forces attacked three outbound container vessels and seized at least one of them. The incident marked a major escalation in direct Iranian interdiction of commercial shipping.
By April 20, U.S. enforcement had expanded into the Gulf of Oman with the first confirmed interdiction outside the immediate Hormuz transit zone. The action involved the OFAC-sanctioned, Iran-linked container vessel TOUSKA near Chabahar.
Maritime conditions deteriorated sharply on April 17–18 as a brief reopening signal was overtaken by renewed Iranian closure messaging. Over 36 hours, 35 outbound vessels reversed course as operators reacted to the renewed threat environment.
On April 19, vessel traffic through the Strait of Hormuz dropped to just three transits, the lowest level since the blockade began. Reporting linked the collapse in traffic directly to the attacks carried out on April 18.
By April 19, the United States had expanded enforcement authorities to board, search, and seize Iran-linked vessels globally and to treat certain dual-use goods tied to Iran as contraband. This marked a significant escalation in the legal and operational scope of maritime enforcement.
On April 18, direct gunfire was reported against the India-flagged VLCC SANMAR HERALD. The attack demonstrated that kinetic threats were materially influencing commercial shipping decisions in and around Hormuz.
Satellite imagery identified a major fire at a Siri Island storage tank on April 16. The incident pointed to additional disruption risk for Iranian energy infrastructure amid the broader maritime conflict.
By April 16, new OFAC sanctions had been imposed on an Iranian oil shipping network and related shadow fleet infrastructure. The sanctions expanded pressure beyond maritime interdiction to the financial and logistical structures supporting Iranian exports.
By April 13, reporting described an actively enforced U.S. maritime blockade on traffic entering and exiting Iranian ports, with vessels reversing course after interception orders. The blockade was paired with continued mine clearance and sharply constrained traffic through Hormuz.
By April 12, U.S. forces had begun mine clearance operations in the Arabian Gulf as Hormuz remained unstable and dependent on selective permissions. The move signaled a more active U.S. operational role after failed negotiations.
By April 8, a newly announced two-week ceasefire between the United States and Iran had not reopened the Strait of Hormuz, which remained effectively closed under Iranian supervision. Transit was still limited to selective, coordinated movements and mainstream commercial operators largely stayed away.
Iran formally codified its transit toll arrangement through the Strait of Hormuz Management Plan approved on March 30–31, 2026. The plan underpinned the toll system with legislation and supporting financial infrastructure, including a conversion window on Qeshm Island.
Iran began accepting cryptocurrency in mid-March 2026 as payment for Strait of Hormuz transit tolls administered by the IRGC, alongside yuan-based payment options. The mechanism was described as a new sovereign revenue channel tied to maritime transit through the chokepoint.
On April 7, the Marshall Islands-flagged container ship Qingdao Star was struck south of Kish Island. The IRGC claimed it had targeted an alleged Israeli-linked vessel, underscoring continued danger to commercial shipping during the ceasefire period.
A Pakistan-brokered ceasefire between the United States and Iran took effect on April 7, 2026. Subsequent reporting said the ceasefire did not normalize Hormuz traffic and that Iran's toll regime was likely to persist despite the truce.
Reuters reported on March 19 that Iran warned Gulf states to evacuate gas and energy installations after attacks on Iran's South Pars and Asaluyeh energy sites. The warning widened concern from damage inside Iran to possible disruption across the broader Gulf energy system.
By April 22, reporting stated that 34 vessels had been struck or fired upon since February 28, indicating a sustained pattern of attacks on commercial shipping linked to the crisis. This establishes February 28 as the start date for the attack count cited in the reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
17 references tracked. Mallory keeps watching after this page renders.
windward.ai
Open sourcewindward.ai
Open sourcewindward.ai
Open sourcewindward.ai
Open sourcewindward.ai
Open sourcetrmlabs.com
Open sourcewindward.ai
Open sourcecyberwarzone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Treasury sanctioned two Iranian firms—**HormuzSafe Marine Services Authority** and **Persian Gulf Marine Insurance Company**—for allegedly supporting an IRGC-backed extortion scheme targeting commercial shipping in the Strait of Hormuz. Treasury said the companies sold maritime insurance that benefited or was approved by the Islamic Revolutionary Guard Corps, including coverage against vessel seizure risks created by Iran itself, and accepted digital assets such as **Bitcoin** to help evade sanctions. The action was issued under **Executive Order 13902** as part of broader pressure on Iran’s petroleum, petrochemical, and financial sectors. OFAC also sanctioned eight shipping companies in China, Hong Kong, and the Marshall Islands and blocked eight vessels tied to Iran’s shadow fleet for transporting Iranian crude and petroleum products, largely to China and in some cases the UAE. Treasury said more than 100 vessels linked to Iran’s shadow fleet have been sanctioned since the start of the year, while maritime risk reporting separately described heightened regional tensions, including increased IRGC small-boat activity in Hormuz and signs of disrupted export operations around key Iranian and regional energy shipping routes.
Jul 30, 2026
Iran-linked threats and attacks expanded from shipping lanes to digital infrastructure across the Gulf, with reports naming **Google, Amazon, Oracle, IBM, and Nvidia** facilities in the Middle East as potential targets and describing earlier drone strikes that disrupted **AWS** operations in the UAE and Bahrain. Regional authorities later denied an IRGC claim that Oracle’s Dubai data center had been hit, but multiple reports said missile and drone attacks had already affected energy, desalination, and industrial sites in Kuwait and the UAE while raising fears for data centers and telecom assets tied to U.S. firms. The conflict’s cyber dimension also spilled into enterprise systems, with analysts warning that retaliation was increasingly aimed at civilian-adjacent technology, logistics, finance, and cloud dependencies rather than a single decisive cyberattack. At the same time, the Strait of Hormuz became a pressure point for both maritime traffic and internet connectivity. Large-scale **GPS/GNSS spoofing**, AIS suppression, dark vessel activity, and selective transit controls disrupted hundreds of ships, while repair and construction work on subsea cables slowed or stopped as security conditions deteriorated. Meta’s **2Africa/Africa2** cable project was delayed after Alcatel Submarine Networks declared force majeure, and Iran-linked media proposed licensing, taxing, and controlling undersea cable operations in the strait, with some outlets openly discussing cable disruption as leverage. Analysts warned that at least six major fiber systems crossing Hormuz underpin Gulf cloud services, finance, and trade, meaning prolonged interference or damage could delay repairs, force traffic onto riskier overland alternatives, and threaten the region’s broader digital-economy ambitions.
Jun 29, 2026
Regional conflict following **U.S.–Israeli strikes on Iran** has been accompanied by heightened cyber and electronic-warfare activity affecting both military operations and civilian infrastructure. U.S. officials publicly acknowledged that **U.S. Cyber Command**, alongside space capabilities, conducted “non-kinetic” operations to **disrupt Iranian communications and sensor networks** in support of *Operation Epic Fury*, describing effects intended to degrade Iran’s ability to coordinate and respond; reporting also noted follow-on hack-and-leak style activity against Iranian-facing online properties (e.g., news sites and an app) and warned of potential retaliatory cyber activity by Iranian-aligned actors. In parallel, maritime intelligence reporting described a sharp increase in **GPS/AIS disruption (jamming/spoofing)** impacting shipping around the Strait of Hormuz, with vessels appearing in false locations and maritime authorities warning of elevated risk to navigation and safety. Iran’s domestic crypto ecosystem also showed signs of stress consistent with conflict conditions and connectivity constraints: observers reported **internet outages**, exchanges moving into risk-containment modes (e.g., batching/suspending withdrawals), and temporary restrictions on the **USDT–toman** trading pair under central bank direction—collectively reducing liquidity and market activity rather than clearly indicating capital flight. Separate reporting on Pakistan’s TV broadcast hijacks and a DDoS incident affecting Russian government sites appear unrelated to the Iran conflict-driven activity described above.
Jun 29, 2026