Loading story…
The U.S. Treasury sanctioned two Iranian firms—HormuzSafe Marine Services Authority and Persian Gulf Marine Insurance Company—for allegedly supporting an IRGC-backed extortion scheme targeting commercial shipping in the Strait of Hormuz. Treasury said the companies sold maritime insurance that benefited or was approved by the Islamic Revolutionary Guard Corps, including coverage against vessel seizure risks created by Iran itself, and accepted digital assets such as Bitcoin to help evade sanctions. The action was issued under Executive Order 13902 as part of broader pressure on Iran’s petroleum, petrochemical, and financial sectors.
OFAC also sanctioned eight shipping companies in China, Hong Kong, and the Marshall Islands and blocked eight vessels tied to Iran’s shadow fleet for transporting Iranian crude and petroleum products, largely to China and in some cases the UAE. Treasury said more than 100 vessels linked to Iran’s shadow fleet have been sanctioned since the start of the year, while maritime risk reporting separately described heightened regional tensions, including increased IRGC small-boat activity in Hormuz and signs of disrupted export operations around key Iranian and regional energy shipping routes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On July 29, 2026, a drone strike hit the LNG floating storage unit ENERGOS WINTER at Damietta, Egypt, and the resulting fire spread to the LNG tanker GASLOG SALEM. The incident was assessed in the report as likely Iranian-directed retaliation rather than part of the Houthi campaign.
The U.S. Treasury's Office of Foreign Assets Control announced sanctions against Persian Gulf Marine Insurance Company and HormuzSafe Marine Services Authority for supporting an IRGC-backed maritime extortion and insurance scheme in the Strait of Hormuz, including accepting digital assets such as Bitcoin. In the same action, OFAC also sanctioned related companies and identified or blocked vessels tied to Iran's shadow fleet transporting Iranian petroleum products.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thedefiant.io
Open sourcewindward.ai
Open sourcehome.treasury.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran imposed a restrictive transit regime in and around the Strait of Hormuz after strikes on key energy sites including South Pars and Asaluyeh, warning Gulf states to evacuate energy installations and signaling that disruption could spread across the wider Gulf system. Reporting indicates Tehran formalized a permit-and-toll structure administered by IRGC-linked authorities and the new Persian Gulf Strait Authority, with some vessels charged up to **$2 million** per passage and payments accepted in Chinese yuan or cryptocurrency. Israel-linked ships were reportedly barred, U.S.-linked vessels faced severe restrictions, and commercial operators encountered inspections, approval requirements, GPS spoofing, AIS suppression, and growing pressure to navigate under dark or EMCON conditions. The maritime response turned the waterway into a contested chokepoint rather than a normal trade lane. U.S. forces reportedly began mine clearance, blockade and interdiction operations against Iran-linked shipping, while OFAC sanctions and boarding authorities expanded beyond Hormuz into the Gulf of Oman. At the same time, IRGC-linked attacks, seizures, and gunfire against commercial vessels drove course reversals, traffic collapses, and heavy congestion, even as Iranian crude exports continued through dark fleet tactics, fraudulent flags, offshore transfers, and rerouting toward Chabahar and Asian destinations, especially China. Limited LNG and crude movements resumed under coordinated arrangements during the ceasefire, but Kharg Island throughput remained constrained, dark tanker concentrations persisted near Larak, Qeshm, and Chabahar, and maritime operators faced rising sanctions, physical security, and cyber risk across shipping, ports, and regional energy infrastructure.
Jun 29, 2026
The U.S. Treasury's Office of Foreign Assets Control (**OFAC**) sanctioned four Tehran-based cryptocurrency exchanges—**Nobitex, Wallex, Bitpin, and Ramzinex**—along with several executives and founders, alleging they helped Iran evade sanctions and move regime funds through digital assets. Treasury said **Nobitex**, Iran's largest exchange, processed more than half of Iranian digital-asset inflows in 2025, enabled the Central Bank of Iran to access hundreds of millions of dollars in stablecoins, and facilitated transactions tied to the **Islamic Revolutionary Guard Corps (IRGC)**, including IRGC-affiliated ransomware operators and other illicit finance activity. The designations, issued under the Trump administration's **Economic Fury** campaign, freeze any sanctioned assets under U.S. jurisdiction and bar U.S. persons from dealing with the listed entities and individuals. Treasury described the move as the first time OFAC has individually placed an Iran-incorporated digital-asset exchange on the **SDN** list, while reporting that **Ramzinex** alone processed more than **$2.45 billion** in transactions and that Iran's crypto ecosystem received nearly **$7.8 billion** in 2025. The action expands U.S. pressure on Iranian financial networks that officials say support sanctions evasion, terrorism-linked finance, and ransomware-related transactions.
Jun 29, 2026
The U.S. Treasury expanded sanctions against Iranian businessman **Babak Morteza Zanjani** and a broader commercial network accused of helping **Zedcex Exchange Ltd.** and **Zedxion Exchange Ltd.** evade sanctions and move funds for Iran’s **Islamic Revolutionary Guard Corps**. The action designated four individuals and nine entities, including **Bahareh Morteza Zanjani**, **Solmaz Bani**, **Mehdi Rezazadeh**, **Sukhrob Oimakhmadov**, **ZEDX DMCC**, **ZedPay**, **BZ Diamond DMCC**, and multiple **Dot One** companies operating across the UAE, Turkey, and Iran. Treasury said the measures extend beyond the exchanges themselves to target a vertically integrated ecosystem spanning digital assets, payments, gold, transportation, aviation, rail, and travel. Reporting on the sanctions says the network used shared leadership, rotating corporate entities, and persistent digital infrastructure to support the exchanges and related commercial operations. TRM Labs previously said Zedcex and Zedxion processed **tens of billions of dollars** in cryptocurrency transactions, while separate reporting linked the exchanges to more than **$10 million** in transfers to **Sa’id Ahmad Muhammad al-Jamal**, a senior Houthi financial official. The sanctions freeze U.S.-based property and interests of the designated parties, prohibit U.S. persons from dealing with them, and expose foreign firms that continue assisting the network to secondary sanctions risk.
Jul 27, 2026