Daily Edition No. 12Sunday, July 26, 2026 · Updated 12:00 Gulf · 𝕏 @mefilesnews · Instagram @mefiles.news · Facebook

Seven files · One region · Zero illusions
@mefilesnews @mefiles.news Facebook
Iran File — Lead

The Pause Is About Interceptors, and the Deal on the Table Is About Tolls — Not the Nuclear File

Two nights have passed without a CENTCOM strike announcement, and the best available explanation is not diplomatic but logistical: the Pentagon is running short of Patriot interceptors. In the same window the Houthis struck Saudi oil facilities for the first time since 2022, pulling Riyadh back into a war it had spent four years leaving. Traffic through Hormuz has already fallen to a quarter of what it was a week earlier. And the proposal mediators have put to Tehran is not a nuclear settlement — it is a transit-fee mechanism for the strait.

Hormuz Transits, One Week Apart
Non-Iranian-linked ship transits through the strait, week to 12 July against 13–19 July 2026
Non-Iranian-linked transits10825
Lloyd's List Intelligence, Strait of Hormuz Brief, published 21 July 2026
What Brent Did This Week
Brent crude, the 24 July session and its trailing changes
$100.57
Session open, 24 July
$97.24
Session close, 24 July
+30.30%
Change on the month
+43.75%
Change on the year
Trading Economics (CFD-tracked series) and Forbes Advisor, 24 July 2026

What can be confirmed about the pause is narrow. CNN’s live file, updated at 01:00 EDT on Sunday, records “no reports of attacks from US or Iran after 13 straight nights of US strikes,” and notes that regional US allies had reported nothing fresh over the weekend. That is an absence of announcement, not a verified absence of ordnance: CENTCOM’s nightly readouts have been the public record of this campaign, and a gap in the record is a communications fact. Reuters, carried by the Japan Times, states plainly that Washington “gave no immediate explanation of why it had abruptly halted a streak of 13 nights of escalating strikes.” The explanation now in circulation comes from a New York Times report, relayed by Ynetnews and Indian wires and built on unnamed administration and military officials: that Gen. Dan Caine told the president a wider campaign was feasible but would draw down interceptor stocks CENTCOM cannot spare, after more than 1,200 Patriots were expended by late April at over $4 million each. No official has confirmed on the record that anything was cancelled. Trump himself said Friday afternoon that forces were “locked and loaded.”

While Washington held, the war widened without it. The Washington Post, datelined Beirut on Saturday, reports the Houthis claiming attacks on Saudi oil facilities “in the first such strikes since 2022” — the marker that matters, because it dates the collapse of a four-year de facto truce between Riyadh and Sanaa. The sequence runs backwards from there: a Houthi claim on Thursday to have targeted two Saudi tankers in the Red Sea, Saudi strikes on Hodeidah on Friday, and missiles and drones fired into Jazan and Yanbu in the early hours of Saturday, with emergency shelter warnings issued around 06:10 local time. Brig. Gen. Yahya Saree said in a prerecorded statement that the attack targeted Aramco facilities. The reported fire at the Jizan refinery rests, so far, on Houthi channels and outlets aggregating them; Aramco has said nothing this desk could find. What is not in dispute is that Saudi Arabia is now exchanging fire with the Houthis for the first time since the truce, and that it is doing so while American strikes are paused.

The commercial picture had already moved past the politics. Lloyd’s List Intelligence, in its brief of 21 July covering 13–19 July, records non-Iranian-linked transits of Hormuz falling to 25 from 108 the previous week, inbound tanker transits down to 16, and total traffic down roughly 90 per cent year on year. Statista, using IMF PortWatch data, puts average daily transits at about 25 against roughly 100 a year earlier. Against that, Axios reported on 21 July that mediators — the Qatari prime minister, the Qatari envoy Ali Al-Thawadi, Pakistan’s Field Marshal Asim Munir and Egypt’s foreign minister — have put a ten-day ceasefire to Tehran aimed at reopening the strait, and that one mechanism under discussion is directing transit fees into a joint fund administered with International Maritime Organization involvement. Iran’s foreign ministry spokesman Esmail Baghaei, quoted in the Times of Israel’s Sunday liveblog after talks with Oman, said the discussions were “useful and progress was made” but that “at present, there has been no change in the status of shipping through the Strait of Hormuz.”

Brent has been trading the gap between those two facts. Trading Economics has the benchmark at $98.38 on 24 July, down 2.29 per cent on the day, up 30.30 per cent on the month and 43.75 per cent on the year. Forbes Advisor recorded Brent opening at $100.57 that morning and falling 3.34 per cent within twenty-four hours to $97.24. The $100 line has been tested and rejected inside a single session more than once this week — Bloomberg’s read on 23 July was that oil retreated from three figures because cargo “was still managing to traverse Middle East trade routes despite the recent escalation.” That is a market pricing the strait as open-in-practice while a specialist tracker records it as ninety per cent empty. Both can be true if the residual traffic is Iranian-linked, escorted, or paying to move — which is precisely the arrangement the IMO fund would formalise.

Assessment: The two events of this weekend are usually read as opposites — Washington stepping back, Sanaa stepping up. They are better read as the same event. American strikes were the mechanism holding the war on the nuclear file; without them, the war reverts to what it has actually been about since June, which is who controls passage and who is paid for it. A transit-fee fund with IMO involvement is not a return to the status quo ante. It is the negotiated version of a toll, and once a toll exists somebody owns it. Three things to distrust. The pause: it is an absence of readouts, and no one has confirmed on the record that any operation was shelved. The interceptor explanation: it is one outlet, anonymous officials, and it is convenient for an administration that wants the pause read as prudence rather than restraint. And the Jizan fire: it is attested by the belligerent that claims it. Riyadh’s silence is the most informative thing in the file.

The Cartoon — July 26
HORMUZ
The ceasefire runs ten days. The booth is being built to last.”
MEFILES · the cartoon · Mediators float an IMO-administered fund for Hormuz transit fees, Axios reported on 21 July
25
Non-Iranian-linked ship transits of Hormuz in the week to 19 July, down from 108 the week before
Lloyd’s List Intelligence, Strait of Hormuz Brief, 21 July 2026
$4m
Unit cost of a Patriot interceptor; more than 1,200 had been fired by late April, the reported reason for the pause
New York Times, citing internal Pentagon estimates and congressional officials, via Ynetnews
63
Fatalities recorded in Tina, Karnoi and Um Baru localities of North Darfur since June, as the RSF burns the Zaghawa border belt
ACLED expert comment, Ali Mahmoud Ali, 23 July 2026
21
Of 87 Palestinians killed by Israelis in the West Bank since 1 January, the number shot by settlers rather than soldiers
Palestinian Health Ministry, via Al Jazeera, 24 July 2026
3
PLC manufacturers now named in CISA’s Iranian critical-infrastructure advisory, up from one in April — Rockwell, Schneider, Siemens
CISA joint advisory AA26-097A, updated 22 July 2026

Iran File

The regime, the IRGC, the proxies, the strait — read from the Gulf, not from Washington.
An Absence, Not an Event

Two Nights Now Without a CENTCOM Readout — and That Is All Anyone Can Confirm

After thirteen consecutive nights of announced US strikes on Iran, the nightly Central Command releases stopped. What stopped with them is a communications practice, not necessarily a war.

CNN’s live file, updated at 01:00 EDT on Sunday, records “No reports of attacks from US or Iran after 13 straight nights of US strikes,” and notes that regional US allies had reported no fresh attacks across the weekend as of that update. The distinction the copy does not make, and that matters, is that CENTCOM’s nightly readouts have been the primary public record of this campaign. A gap in the readout establishes that nothing was announced. It does not establish that nothing was fired. Around the pause, CNN reports — attributed to unnamed sources — that Vice President JD Vance and the chairman of the Joint Chiefs, Gen. Dan Caine, raised concerns about escalating the war as Donald Trump weighed his options at the White House, and that Trump met senior advisers and Cabinet officials on Friday to discuss escalation should negotiations fail. Both claims rest on anonymous sourcing in a single outlet.

On the record, Trump said Friday of the Iranians: “We are talking to them. I think they’re getting more and more serious as the days go by, for maybe the obvious reason…” An Iranian official, unnamed in the same CNN file, dismissed the remark and called the war “one that will not end.” What is actually on the table has been reported by Reuters, which said on 20 July that mediators had passed Tehran a proposal for a ten-day ceasefire intended to buy time to revive the interim deal struck the previous month — sourced to one senior Iranian official, an interested party. Axios, citing two regional sources with direct knowledge, describes a binary: the ten-day pause aimed at reopening Hormuz, or a joint campaign with Israel. Named in the mediation are Qatari Prime Minister Mohammed bin Abdulrahman Al Thani, Qatari envoy Ali Al-Thawadi, and Pakistani army chief Field Marshal Asim Munir. Axios: “Trump hasn’t made a decision yet.”

Assessment: The buried detail in the Axios account is the mechanism, not the timeline: transit fees at Hormuz directed into a joint fund with International Maritime Organization involvement. That is not a return to the status quo ante. It is a negotiated toll regime, which concedes in structure what fourteen nights of strikes were meant to deny — that passage through the strait is now something to be priced rather than assumed. Watch whether the ten days are ever formally accepted. A pause nobody announces ending is cheaper for both capitals than a ceasefire either has to sign, and the absence of a readout is a form neither side has to defend.

Four Years, Undone

The Houthis Hit Saudi Oil for the First Time Since 2022, and Riyadh Is Back in a War It Left

A three-day exchange — tanker claims, Saudi strikes on Hodeidah, missiles at Jazan and Yanbu — has ended the de facto truce between Riyadh and Sanaa that had held since 2022.

The sequence is short and each step is attributable. On Thursday 23 July the Houthis claimed their first attack on commercial shipping in months, saying they had targeted two Saudi oil tankers in the Red Sea with missiles and drones; Bloomberg carried the claim, not an independent verification of a hit. On Friday the Saudi-led coalition struck Houthi targets in Hodeidah, confirmed in CNN’s file. Early Saturday, Saudi authorities issued emergency warnings for Jazan and Yanbu provinces at around 06:10 local time, telling residents to shelter, as Houthi missiles and drones came in. Brig. Gen. Yahya Saree, the Houthi military spokesman, said in a prerecorded statement that the attack targeted Aramco facilities, and the group framed it as retaliation for Hodeidah. The Washington Post, filing from Beirut, dated the significance precisely: these were the first such strikes on Saudi oil facilities since 2022.

Beyond that spine, the reporting thins fast. A fire at the Aramco refinery at Jizan is carried by Militarnyi, a Ukrainian defence outlet aggregating Ansarallah media and a Houthi video — partisan-sourced and single-sourced. TechTimes adds a start time, a casualty on Kamaran Island, and a Houthi foreign ministry line about “escalation for escalation,” sourcing Al-Masirah, the Houthis' own channel; none of it is independently corroborated. The same outlet claims Brent “surged above $100 per barrel in early Saturday trading,” which cannot be true as stated: Brent futures do not trade on Saturday. What the market actually did was test the line and reject it. Forbes Advisor has Brent opening 24 July at $100.57 and falling 3.34% over twenty-four hours to $97.24; Trading Economics has it at $98.38, down 2.29% on the day but up 30.3% on the month and 43.75% year-on-year.

Assessment: Riyadh spent four years buying quiet on its southern border and has now paid for it twice — once in the original truce, and again in the strikes that ended it. The question is not whether the Houthis can burn a refinery but whether Saudi Arabia can fight in Yemen and shelter Yanbu at the same time while its export routes at Hormuz and Bab al-Mandeb are both contested. On the numbers, distrust anything sourced only to Al-Masirah or to aggregators of it, and distrust weekend Brent prints entirely. The market’s own verdict is more instructive than the claims: oil tested $100 and came back down, because cargo is still moving. That is the assumption the next escalation is aimed at.

The Strait, Counted

Twenty-Five Non-Iranian Transits in a Week, Down From 108 — Hormuz Is Already Closed in Practice

Lloyd’s List Intelligence puts non-Iranian-linked transits at 25 for 13–19 July, against 108 the week before. Whatever the ceasefire talks are for, they are not reopening a strait that is still open.

The Lloyd’s List Intelligence Strait of Hormuz Brief, published 21 July for the 13–19 July sample period, records non-Iranian-linked transits falling to 25 from 108 the previous week, inbound traffic down to 8 vessels, total inbound tanker transits at 16, non-Iran-linked inbound movements at 6, and total traffic down roughly 90% year-on-year. The apparent tension between 8 inbound vessels and 16 inbound tanker transits is almost certainly a difference of denominator — all inbound movements against inbound tankers — but the published summary does not say so, and the figures should be read with that caveat. Statista, working from IMF PortWatch data, arrives at the same order of magnitude by a different route: roughly 25 ships a day between late June and early July, against around 100 a day a year earlier. NBC’s running tracker, last updated 21 July, records traffic “back down following a brief pick-up.”

The human ledger is thinner but not empty. UN News reported on 9 July that renewed hostilities had “reportedly brought shipping to a near-standstill” in the strait, leaving around 6,000 seafarers stranded — the hedge is the UN’s own. Al Jazeera, citing Lloyd’s List, reported on 10 July that no large vessel had crossed via the US-coordinated route while broadcasting its position since the preceding Tuesday, with traceable crossings on the Oman-hugging lane effectively halted. Statista notes Iran struck two tankers attempting a mined route, killing one crew member; the date is not given in the material available. Casualty tallies circulating on Wikipedia’s crisis page — seventeen merchant ships damaged, seven abandoned, two captured — carry the site’s own “failed verification” tags and should not be repeated.

Assessment: This is the number that disciplines everything else on the desk. A ten-day ceasefire framed as reopening Hormuz is being negotiated over a waterway already running at roughly a tenth of its normal volume, and the traffic that remains is disproportionately Iranian-linked — which is its own quiet statement about who currently sets terms in the channel. Note also what the transit data does not show: a collapse. Bloomberg’s read that Brent retreated from $100 because oil “was still managing to traverse Middle East trade routes” is consistent with 25 transits a week. The strait is throttled, not shut, and the difference between those two words is the whole negotiation.

Sahel Monitor

Mali, Burkina, Niger, the AES bloc, JNIM, and the Russian bargain — security as economics.
Two Fronts, One Captain

Traoré Warns the Ulema “We Will Fight It” — and Tells His Own Officers There Is Only One Captain

In the space of a week Burkina Faso’s transitional president opened a public confrontation with Muslim scholars who once backed him and moved to shut down talk of a power struggle inside his junta.

Al Jazeera reported on 22 July, in a piece by Mehdi al-Zaghdidi, that Capt. Ibrahim Traoré has escalated a confrontation with influential Muslim scholars in Burkina Faso, saying “radical Islam” has no place in the country and that “the battle has begun” against those he accuses of promoting extremism. Addressing clerics he charged with spreading extremist ideas, Traoré said: “If this is your Islam, we will fight it.” Al Jazeera frames the rift as a break with a constituency that once supported him, driven by arrests and by new legislation regulating religious practice introduced this year. Traoré has also announced plans to bring home Burkinabè students studying Islamic law in Arab countries. A separate report by Starconnect Media, a small Nigerian outlet, has him vowing never to implement Sharia and pledging to protect the secular state; that account is single-sourced, undated as to venue, and carries no quotation of usable length.

The second front is internal. AFP, carried by Vanguard in Lagos and by allAfrica on 22 July, reported that Traoré, 38, moved to kill speculation of a power struggle at the top of the junta after the prolonged absence of two influential figures within it. Speaking to community leaders in Ouahigouya, in the north, on Thursday 16 July, he said: “There can’t be two captains on one ship,” and added: “If anyone screws up, I’ll take you down without a second thought. There are no strongmen around me.” The Vanguard text refers to reported tensions dating to 2023 with a named officer; the passage available is truncated and the identity and current post could not be confirmed, so this desk is not repeating the name. The junta announced a foiled coup plot on 5 January 2026.

Assessment: Traoré's authority has rested on holding together three constituencies at once: sovereigntist youth, the officer corps, and a religious establishment willing to read anti-French politics as its own. Disciplining the clergy and the officers in the same week is what a ruler does when he suspects those constituencies of converging. Two cautions. The succession story rests on absences and on an AFP account whose key name this desk could not verify; treat it as a signal, not a plot. And a state that legislates religious practice while fighting an insurgency that recruits on grievance is widening, not narrowing, the ground JNIM works — the military problem in the countryside now has a doctrinal companion in the capital.

Documents Before Elections

Niger’s Self-Declared Three-Year Transition Runs Out While the AES Issues Its Own Passports

The junta in Niamey promised a maximum three-year transition after the July 2023 coup. That deadline is passing this week with no electoral calendar — and with the Alliance of Sahel States building the paperwork of a new sovereignty instead.

The aggregator themunicheye.com marked the three-year point on 25 July, noting that Gen. Abdourahamane Tchiani’s transitional government had pledged a transition of no more than three years after the July 2023 coup. The piece carries no original reporting, but the expiry of a self-imposed deadline is a dateable fact, and no successor calendar has been published. What the bloc has produced instead is documentation. The Agence Nigérienne de Presse, the state agency, reported that Prime Minister Ali Mahaman Lamine Zeine had his biometric data registered on 23 July and received an AES biometric passport, issued in five categories — official, diplomatic, civilian, pilgrim and refugee. “I believe that all the precautions taken will prevent any attempts at fraud,” Zeine said of the fingerprint-based enrolment. This desk could reach the ANP report only through news-pravda.com, a Russian-aligned aggregator network; it is a state announcement relayed by a partisan intermediary.

The rest of the apparatus is moving on the same track. APA news reported that the directors general of police of Burkina Faso, Mali and Niger opened a second coordination meeting in Ouagadougou, covering intelligence-sharing, a technical arrangement on roadside inspections and a draft internal-security protocol, following a first police-chiefs meeting in Bamako in early 2025. The three states' withdrawals from the Rome Statute take effect on 18 June 2027 for Niger and 24 June 2027 for Mali and Burkina Faso; the ICC has expressed regret and urged reconsideration. On the economics, the ECOWAS Bank for Investment and Development’s annual report put combined AES growth at 5.5 percent in 2025 and Niger’s at 6.9 percent, down from 10.3 percent in 2024 and third-fastest of fifteen West African economies — figures also reached here only via a Russian-aligned aggregator.

Security in Niger has not tracked the institutional confidence. A Hudson Institute study by Pawel Wojcik and Lucas Webber, published in early July, records an Islamic State Sahel Province attack on Diori Hamani International Airport in Niamey in January 2026 using armed drones, with the authors citing fighters' accents in the official IS video as evidence of cross-affiliate coordination with ISWAP; the same authors note ISSP is not, as of 2026, an international threat on the scale of the Islamic State’s peak. Hudson is a Washington think tank with a stated orientation and should be read as such. A timeline compilation, whose underlying citations are RFI and Africanews, records a JNIM ambush on a military engineer camp at Garbougna, in Tillabéri, on 14 May 2026 that killed 67 including civilians and destroyed the camp — figures this desk has not independently verified.

Assessment: Passports, police protocols and a shared exit from the ICC are the cheapest form of sovereignty available: they cost little, photograph well, and are entirely within the juntas' control. Elections and territorial security are not. The interesting tell is where the growth numbers come from — an ECOWAS institution the three governments walked out of is now the certifier of their economic credentials, which suggests the rupture with Abuja and Accra is political rather than financial. Distrust the chain of custody on almost everything here: two of the four documentary claims reached this desk only through a Russian-aligned aggregator relaying a state agency, which is a provenance problem even when the underlying facts hold.

Sudan Crisis Monitor

SAF versus RSF, the sieges and the famine, the gold economy, and the diplomacy of press releases.
Kordofan And Darfur, By Number
Fatalities, displacement and disease recorded across June and July 2026
63
ACLED fatalities in Tina, Karnoi and Um Baru since June
11,000
People who fled fighting near El Obeid in a fortnight
39
Dengue deaths recorded in Blue Nile
350
Confirmed dengue cases tracked in Blue Nile
ACLED (23 July); Save the Children via Al Jazeera (7 July); Sudan Doctors Union via Sudan Tribune (24 July)
The Frontline Moves West

ACLED Counts 63 Dead Along the Chad Border as the RSF Burns North Darfur’s Zaghawa Belt

A named researcher has put the first hard number on an offensive that has emptied villages on the Sudan–Chad frontier and pulled the Darfur Joint Forces into a new front.

In an expert comment dated 23 July and headlined “Where is Sudan’s frontline moving next?”, ACLED Sudan researcher Ali Mahmoud Ali writes that “ACLED records 63 fatalities across Tina, Karnoi, and Um Baru localities in North Darfur since June 2026.” The commentary describes Rapid Support Forces attacks on roughly ten Zaghawa villages and towns along the western border with Chad, several of them burned, with mass civilian displacement following; the offensive then expanded into Um Baru locality, which RSF forces attacked and seized, drawing in the Darfur Joint Forces backed by the Sudanese Armed Forces. The sequence tracks earlier reporting from Sudan Tribune, which on 5 July described ethnically motivated attacks on six villages near Tine that pushed thousands across the border into Chad, days after Joint Force advances. Middle East Monitor reported similar destruction on 7 July, sourced to survivors rather than independent verification.

The border districts are also where the war’s pattern of striking water has recurred. Sudan Tribune reported on 21 July that at least 21 civilians were killed and dozens injured in a drone strike on a vital water source in the Tina region — an attack the paper said was “likely” carried out by the RSF, a hedge worth keeping. Its correspondent described recent weeks of escalating drone attacks on Tina that have burned markets and civilian vehicles. Some 700 kilometres east, UNFPA’s flash update of 2 July found that near-daily drone strikes on El Obeid have systematically targeted power substations, fuel stations, water facilities and healthcare infrastructure. CNN reported on 20 July that El Obeid, a city of half a million hosting nearly 100,000 displaced people, has faced its most intense RSF attacks yet; Save the Children counted more than 11,000 people, including over 5,500 children, fleeing the surrounding area in a fortnight.

Assessment: ACLED’s figure is the most defensible number on this desk: named researcher, three named localities, an explicit start date. Almost everything else circulating from the border this week is not. The SAF’s own claims — 205 vehicles and four Chinese-made FH-95 drones destroyed in a fortnight, a third FH-95 downed near El Obeid on 20 July — are belligerent battle-damage arithmetic, and the most recent of them reached us only through an unbylined aggregator feed. What the ACLED reading changes is the map: the RSF is now working a Zaghawa constituency whose displacement flows land inside Chad, which makes this a cross-border political problem for N’Djamena, not only a Darfur one.

The Other Air Force

A Sudanese Army Drone Is Said to Have Hit Displaced Civilians in Blue Nile as Dengue Kills 39

The alleged perpetrator this time is the SAF, not the RSF — and the claim rests on one rights group reaching us through a digest, not a wire.

The Africa Center for Strategic Studies, in its Africa Media Review for 24 July, reported that a Sudanese army drone strike on Thursday 23 July killed several people after targeting a gathering of displaced civilians in Blue Nile, according to the rights group Emergency Lawyers. No casualty figure was given beyond “several.” The sourcing is thin and should be read as such: a single Sudanese legal-rights group, relayed through a media digest rather than the originating wire copy, which we have not seen. Blue Nile has had months of fighting between the army and an RSF alliance with Abdel Aziz al-Hilu’s SPLM-N, pushing displacement toward Ed Damazin. On 16 July Sudan Tribune carried the army’s own account of that campaign — the recapture of Kurmuk, and some 205 combat and supply vehicles plus four FH-95 drones destroyed. That is a belligerent’s claim, independently unverified.

The state’s confirmed emergency is biological. Sudan Tribune reported on 24 July that a dengue outbreak across Blue Nile has killed 39 people, citing the Preliminary Committee of the Sudan Doctors Union; committee member Adeeba Ibrahim Al-Sayyid told the paper the committee has tracked 350 confirmed cases across the state, including 76 in Ed Damazin. The report’s own figures sit awkwardly — “more than 300 infected” in one line, 350 confirmed in another. Elsewhere, a finding that complicates the standard reading of the war: Yale’s Humanitarian Research Lab reported in January that it had identified new earthworks and embankments along key exit routes from El Obeid and around critical infrastructure, and assessed them as possible siege preparations by the Sudanese Armed Forces and allied groups. The lab withheld operational detail, citing civilian safety.

Assessment: Two things are being tested here. One is whether an allegation against the army travels as far as an allegation against the RSF: on the evidence of this week, it does not — the RSF’s border offensive has a specialist tracker, named villages and a fatality count, while a strike attributed to the SAF has one advocacy group and a paragraph in a digest. The other is what the dengue number measures. Thirty-nine deaths in a state with no functioning cordon is a siege statistic as much as a medical one. Treat the Yale earthworks finding as the corrective it is: both armies have shaped the ground around El Obeid, and the city’s suffering has more than one author.

The Brotherhood Brief

The organization as structure — designations, networks, finances, legal battles. Structure over slogans.
Silence in Whitehall

Three Days On, Britain Has Not Said Whether It Will Freeze a Pound of al-Abyari’s Money

The US Treasury says the man it calls the Muslim Brotherhood’s Secretary General lives in the United Kingdom. Mirroring an American asset freeze is discretionary, and no British department has publicly said what it intends to do.

The Office of Foreign Assets Control’s 23 July action named seven targets — four individuals and three entities — under Executive Order 13224, as amended, for material support to Hamas. The individual carrying the title is Mahmoud al-Abyari, described by Treasury as a United Kingdom-based senior leader of the Egyptian Muslim Brotherhood and “Secretary General of the Muslim Brotherhood General Secretariat,” designated for having acted “for or on behalf of, directly or indirectly, the Egyptian Muslim Brotherhood.” Treasury says he supported fundraising for Filistin Vakfi and Hayat Yolu, two entities OFAC had previously sanctioned over Hamas ties. State Department spokesperson Thomas Pigott said the action “exposes the Muslim Brotherhood affiliates and Hamas-directed front organizations that use charitable facades and underground networks to disguise and move funds in support of terrorism.” State said all seven targets reside outside Egypt.

Britain has not proscribed the Muslim Brotherhood, and the 2014 government review of the organisation has never been reopened. The House of Lords debated the Brotherhood on 5 January 2026; Reform UK’s foreign policy plan, reported by The National on 7 February, named the movement a “terror group”; the New Statesman published a long read on the Brotherhood’s British networks in early July, before the designation. In the material The Files reviewed, no Foreign Office, Home Office or Office of Financial Sanctions Implementation response to the 23 July action had appeared by Sunday, and no public response from al-Abyari or from the Brotherhood itself. Two cautions travel with the name. The title is Treasury’s characterisation, not an independently verified organisational fact — the Brotherhood’s own account of its post-2021 leadership is contested. The transliteration varies: al-Abyari in Treasury’s text, Al-Ebiary and Al-Abyari in secondary pickup.

Assessment: OFSI mirroring is a choice, not a consequence, and the choice is political before it is legal. Washington has handed London a document asserting that the Brotherhood’s most senior claimed office-holder banks in Britain; every day Whitehall does not answer is a day the answer is supplied by others. Watch for the transmission mechanism rather than the statement: US designations function best as evidentiary scaffolding inside European administrative proceedings, which is how a Treasury press release becomes a French préfecture order or a British charity investigation. And treat the count of seven as a jurisdictional fact, not a scale of one. Four OFAC actions since January is the trendline; the number of names in each is not.

Two Translations, Two Days

Filistin Vakfi Becomes “Yolo Life” as the Designation Is Rewritten Twice in Forty-Eight Hours

A seven-name sanctions action passed through Arabic rewrites and partisan amplification within two days, acquiring a fabricated quotation and a geography Treasury never described.

Treasury’s 23 July release names Filistin Vakfi and Hayat Yolu as previously sanctioned entities al-Abyari allegedly helped raise funds for. By 24 and 25 July, in pickups by Vanguard in Nigeria and Fingerlakes1 in the United States — both apparently working from an Arabic rewrite rather than the English original — Filistin Vakfi had become “Palestine Foundation” and Hayat Yolu “Yolo Life” or “Life Path.” Fingerlakes1 additionally placed quotation marks around a paraphrase of Treasury Secretary Scott Bessent, rendering him as saying the administration “is continuing to pursue anyone who participates in financing terrorism.” What Bessent actually published was: “The Trump Administration will relentlessly pursue terrorists and those who finance them,” and that those enabling Hamas “will be exposed, sanctioned, and held accountable.”

The geography drifted too. The RAIR Foundation, a partisan US outlet, characterised the action on 24–25 July as striking “Turkish and British-based” networks — a frame apparently back-filled from the two previously designated Turkish-registered entities. The one further target legible in the mirrored Treasury text is Indonesia-based: “Tujah Bulah Globa,” using the alias “Seven Spikes Global.” RAIR also appended, sourcing it to the Daily Wire, claims about six Gaza front groups posing as medical clinics including the Waed and Al-Nur societies, and about sanctions on the Popular Conference for Palestinians Abroad and the UK organiser Zaher Birawi. None of that appears in the 23 July Treasury or State texts. One operational detail in the actual release has gone almost entirely unreported: Treasury credited the FBI, the Drug Enforcement Administration and Customs and Border Protection with illuminating “key nodes.”

Assessment: A designation is an information product before it is an enforcement action, and the SDN changes file is the only text with legal force. Everything downstream is reconstruction. The pattern here is not deliberate falsification so much as compression: an English list becomes an Arabic summary becomes an English rewrite, and by the third pass a Treasury paraphrase is wearing quotation marks. The tell worth keeping is the DEA and CBP credit. Narcotics and border enforcement do not illuminate wire transfers; they illuminate bulk cash and trade-based value transfer. That, not the count of names, is where the next action will come from — and it is the line no rewrite carried.

Western Media Watch

How NYT, WaPo, FT, BBC and the wires frame the region — what is emphasized, what is omitted, and what the gap reveals.
One Night, Three Detention Counts
Palestinians detained across the West Bank, night of 24–25 July 2026, by reporting source
Al Jazeera ("nearly 50")~50IDF statement ("over 70")70+Palestinian Prisoners Club ("at least 80")80+
IDF via Times of Israel and Jerusalem Post; Al Jazeera; Palestinian Prisoners Club via CGTN
Six Subjects, One Shooting

Reuters Says the Settlers Were “Involved.” AFP Says They Killed Four People

The same shooting near Nablus on 24 July produced at least six different grammatical arrangements of who did what to whom. The variation is not random: it tracks whose account each desk treated as the default.

On the morning of 24 July a group of Israeli settlers entered the Palestinian town of Tell, southwest of Nablus, near the settlement of Havat Gilad. Four Palestinians and two Israelis were killed. The Israeli military’s first account, relayed by Reuters and Al Jazeera, said a Palestinian seized a weapon from local security personnel and opened fire. That account then moved. Reuters reported on 25 July that “the Israeli military initially described the Israeli civilians involved in the incident as hikers, but later acknowledged some were armed and said both sides had opened fire before troops intervened.” Essam Saifi, a local Fatah figure, told Reuters by phone that “about 25 to 30 Israeli settlers initially attacked the eastern area of the town and tried to break into two houses there. The residents came out to confront them, and the settlers opened fire.” The mayor, surnamed Zidan, told Reuters: “The settlers were not following a route or trail, as they claim. They intended to attack the homes.” Who fired the shots that killed the four Palestinians — settlers or soldiers — remains unresolved on the wires; the Palestinian Health Ministry says soldiers.

That unresolved core produced a ladder of subjects. AP’s main line removed the agent entirely: “Northern West Bank in lockdown as clashes rock villages and Israel deploys troops in Nablus.” Reuters made Israel the responder: “Israel Launches Military Operation After Deadly Clash Near Palestinian Village.” Al Jazeera did the same: “Israel launches clampdown after deadly violence in occupied West Bank.” Reuters' second-day headline made Israeli troops the agent of the arrests and demoted the settlers into a prepositional phrase — “after shootout involving settlers.” An earlier AP variant kept the causal order the military supplied: “Israeli military kills 4 Palestinians after settler killed in West Bank.” AFP and Middle East Eye put the settlers in the subject slot: “Palestinians bury four killed in West Bank during Israeli settler attack”; “Israeli settlers kill four Palestinians in West Bank attack.” The Jerusalem Post ran the inverse: “IDF kills terrorist who fatally shot two Israelis, wounded three others in West Bank.”

The load-bearing word is Reuters' “involving.” By every available account, including the Israeli military’s revised one, the settlers walked into Tell first; the syntax makes them bystanders to an event they initiated. AP’s own lead sentence, carried by PBS, is worth reading in full because it broke under the strain: “Israel widely deployed troops in the West Bank after clashes broke out Friday across the occupied territory following the killing of an Israeli settler triggered violence that left two Israeli soldiers and four Palestinian villagers dead.” Two verbs compete for one clause. The causal sequence survives the wreck intact: settler killed, then violence. One further artifact, which The Files has not independently verified and does not assert: Al Jazeera’s own URL slug for its 24 July piece reads “four-palestinians-killed-as-israeli-settlers-raid-occupied-west-bank-town” — more agentive than the headline it published.

Assessment: Wire desks will say, correctly, that they cannot name a shooter no one has confirmed, and that the passive voice is the price of attribution discipline. That defence covers “four Palestinians were killed.” It does not cover “involving,” which is not a hedge about who fired but a demotion of who arrived. Nor does it explain why the military’s sequencing survived intact into headlines after the military itself had revised the story underneath it. The tell is asymmetry: uncertainty about Palestinian deaths becomes grammatical vagueness, uncertainty about the trigger becomes the Israeli version by default. Watch whether Reuters' second-day language shifts now that the hikers claim has been withdrawn.

Paragraph Fourteen

Fifty Soldiers Entered a Nablus Hospital and Not One Western Headline Said So

The director of Nablus Specialty Hospital went on the record about a raid on his wards. His account ran inside the body copy, under photo captions, and nowhere above the fold.

Dr Ghassan Barkat, director of Nablus Specialty Hospital, told journalists that on 24 July “more than 50 armed soldiers and officers stormed the hospital, terrifying the patients.” He said soldiers detained, bound and insulted staff and patients. The quote appears in AP’s 25 July story as carried by the Washington Times. Al Jazeera placed the raid in a photo caption — “Israeli soldiers surround a hospital in Nablus where they allegedly arrested a wounded man and his brother from inside” — and Middle East Eye reported soldiers “stormed the emergency department and assaulting medical staff.” The New Arab used it as a lead image caption. A named hospital director, a stated troop count, and detentions from inside a ward is a standalone story by the standards these outlets apply elsewhere. On 24 and 25 July it was a paragraph.

What ran on top instead was the arrest tally, and the noun attached to it came from the party doing the arresting. AP’s 25 July headline: “Israel detains over 70 suspects following deadly violence in the West Bank.” Nothing in the copy establishes what the seventy-plus are suspected of, and none of the reporting places them at Tell. The figure itself splits three ways: the Israeli military’s “over 70” via AP, Al Jazeera’s “nearly 50” arrested on Saturday morning alone, and Reuters' “dozens” — the vaguest of the three, and Reuters' own headline word. The only precise number in circulation is the one supplied by the military, and it arrived with a category attached that no outlet unpacked.

Assessment: Headline selection is where wire neutrality quietly stops being neutral. A detention figure from a military spokesman is cheap, instant and defensible; a hospital director’s account requires the desk to decide he is credible. The first gets the headline, the second gets paragraph fourteen — and the difference compounds, because aggregators, broadcast rundowns and search results read the headline only. Note also what “suspects” does: it converts seventy-odd unidentified people into a lawful category before anyone has said what the suspicion is. Distrust any tally you cannot trace to a document. Watch whether Barkat’s account is followed up or quietly dropped once the arrest numbers stop moving.

Israel Press Review

Reading Haaretz, Times of Israel, Ynet and the Hebrew press — what Israeli media and officials are actually saying.
If The Opposition Misses 61
What opposition voters say they would prefer if their bloc falls short of a Knesset majority
Government with outside Arab-party support44%Another election28%Unity government with Likud13%Don't know9%Government with a haredi party6%
Channel 12 / Midgam Institute, released 20 July 2026; house spec 504 respondents, ±4.4 points
Pause and Counter-Briefing

Trump Stops the Nightly Strikes Over Missing Interceptors — and Jerusalem Briefs Against the Pause

The New York Times reports the president shelved a wider Iran campaign after being warned about Patriot stocks. By Sunday morning, unnamed Israeli sources were telling the Hebrew press diplomacy is certain to fail.

The New York Times reported late Saturday that Donald Trump set aside plans for a broader offensive against Iran after a Friday strategy session, on grounds of materiel rather than politics. Gen. Dan Caine, chairman of the Joint Chiefs, privately advised that renewed large-scale combat was feasible but could dangerously deplete the interceptors available to CENTCOM; a spokesman for Caine declined to comment on his advice to the president. The US had fired more than 1,200 Patriot interceptors by late April, at over $4 million apiece, according to internal Pentagon estimates and congressional officials cited by the Times, and stocks have worsened since. Planners had drawn up a multi-stage campaign against Iranian coastal radars, anti-ship missile sites and naval patrol craft tied to the Hormuz disruption. Trump had said Friday that forces were “locked and loaded.” Haaretz’s day-count series records thirteen consecutive nights of US strikes through 24 July, then nothing on the 25th or 26th.

The Israeli read arrived almost simultaneously. The Times of Israel’s Sunday liveblog carried as a standing top line: “After first day of calm in some 2 weeks, Jerusalem sources tell Hebrew media that diplomacy is sure to fail, leaving US president no choice but to order major attack.” No name, no ministry, no record. Ynet’s version of the NYT story adds that advisers weighed a wider regional war, damage to exposed Gulf allies and pressure on the global economy, and that “only a small number of people in Trump’s inner circle, if any” favoured a significantly larger campaign — attributed to two people briefed on the discussion. White House communications director Steven Cheung offered the on-record line: “It would be wise for Iran to work towards a negotiated deal; otherwise, they know what will happen.” Iranian foreign ministry spokesman Esmail Baghaei said talks with Oman on the Strait were “useful and progress was made,” while “at present, there has been no change in the status of shipping.”

Assessment: Two anonymous briefing operations are running against each other in public, and neither has been confirmed on the record by anyone in a position to know. Washington’s leak explains restraint as an inventory problem, which flatters everyone: the president is not backing down, he is husbanding missiles. Jerusalem’s leak pre-emptively assigns blame for a diplomatic failure that has not yet happened. Note what the Israeli line does not say — it does not oppose talks, it declares them doomed, which is the cheaper position. Netanyahu lands in Washington on Monday. Read the Hebrew briefings as an opening bid in that meeting rather than as reporting on it.

From Hikers to Armed

The Army Revises Its Own Account of the Tell Killings as Two Mosques Burn Near Nablus and Tulkarm

Six died Friday near Havat Gilad. The IDF first called the Israelis involved hikers, then acknowledged some were armed — and by Sunday was measuring Palestinian homes for demolition.

Four Palestinians and two Israelis were killed Friday morning near Havat Gilad and the village of Tell, southwest of Nablus. The IDF named the Israeli dead as Master Sgt. (res.) Benayahu Mellet, 32, of a civil defence squad, and Maj. Yuval Ezra, 27, and said the Palestinian shooter used a weapon snatched from an Israeli security officer before being killed. The initiation is contested, and the army’s own version moved: AP reported that the military “initially described the Israeli civilians involved in the incident as hikers, but later acknowledged some were armed and said both sides had opened fire before troops intervened.” The Times of Israel notes the army says the Israelis did not coordinate before entering an area off-limits to Israelis. Netanyahu and Defence Minister Israel Katz ordered a wide-scale operation in Palestinian villages. Arrest counts diverge by publisher: the IDF says over 70 wanted detained overnight with hundreds questioned and 300-plus sites scanned around Jenin; Al Jazeera counted nearly 50 in Tal with roughly 70 homes raided; the Palestinian Prisoners Club says at least 80, and more than 3,600 in the West Bank this year.

Overnight Saturday, Haaretz’s Jack Khoury reported settlers set fire to mosques in Qusra, south of Nablus, and Kafr Sur, southeast of Tulkarm, citing Palestinian accounts and footage from the scene; the Kafr Sur wall carried the slogan “Jewish blood is not abandoned.” The Jerusalem Post reported the Qusra fire separately as a suspected nationalist crime, with “Revenge for Benayahu” — naming one of Friday’s Israeli dead — sprayed at the entrance beside a Star of David. Palestinian reports described cars and farmland burned in Beitillu and property vandalised in Beit Furik. One week earlier, in Al-Tuwani in the South Hebron Hills, village council head Mohammed Rabie told AFP that more than two dozen settlers, some masked, torched the Al-Taqwa mosque along with two houses and a women-run dairy factory; police said an investigation into the cause was ongoing. On Sunday the IDF said it had measured the homes of two Palestinians involved in the Tell shooting ahead of demolition, and published a photograph of soldiers doing so.

Walid Zidan, the mayor of Tell, told the Times of Israel that around 70 villagers were detained and questioned at a field interrogation centre set up inside a house in the village. Hebrew media, via ToI, reported settlers established four illegal outposts near the site of the clash. Funerals for the four Palestinian men killed were held in the early hours of Saturday under heavy army restriction.

Assessment: The citable fact here is not the body count but the correction. An army that revises armed men into the record after first calling them hikers has told you how the initial account was produced and for whom. Watch the asymmetry of state response in the same 72 hours: measured homes and a demolition file for the Palestinian shooters, an open investigation and no reported arrests for three burned mosques. The Post’s own reporting of the “Revenge for Benayahu” graffiti matters because it removes the incidents from partisan dispute — this is not being contested inside the Israeli press, only inside the Israeli enforcement system. Treat every arrest figure as a publisher’s figure.

Digital Front Monitor

Cyber operations, information warfare and the infrastructure of control across the region.
Scope Creep in the Grid

CISA Widens Its Iranian PLC Warning to Siemens and Schneider, and Names Safety Logic as the Target

An advisory first published in April was updated on 22 July to cover three controller manufacturers instead of one. The technique it describes involves no vulnerability and no patch.

Joint advisory AA26-097A, “Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure,” was updated on 22 July, expanding its scope from Rockwell Automation equipment to include Schneider Electric, Siemens “and potentially other branded/manufactured PLCs.” The models named, per SecurityWeek’s reading of the document, are the Rockwell CompactLogix and Micro850, the Schneider Modicon M340 (BMX P34) and the Siemens S7-1200 series. The sectors listed as having suffered operational disruption and financial loss are Government Services and Facilities, Water and Wastewater Systems, and Energy. The most specific line in the document concerns an FBI investigation at an unnamed US critical-infrastructure victim, where an actor used legitimate vendor configuration software to push a malicious project file to a controller. The file, in CISA’s own wording, “retained ladder logic for downstream function” while adding logic that “overrode specific instruction sets responsible for maintaining safe operating parameters.”

The technical framing matters more than the vendor list. Burns & McDonnell’s 1898 & Co. notes the activity maps to ICS ATT&CK techniques for internet-accessible devices and commonly used ports — exposure and legitimate tooling, not a software flaw — and OffSeq’s summary is explicit that the advisory specifies no patch. WaterISAC’s member notice says the update adds Exfiltration Over C2 Channel (T1041), describing vendor configuration software run from leased infrastructure to pull project files out. CISA names no group for the 2026 activity, noting only its resemblance to a campaign begun in November 2023 by CyberAv3ngers, described as affiliated with the IRGC Cyber Electronic Command and tracked elsewhere as Hydro Kitten, Storm-0784 and Bauxite. The Register places the current phase as running since March.

Assessment: Read the calendar before the content. This is an update to an April document, itself building on advisories dating to late 2023, and much of the 23–25 July coverage — including CISA’s own freshness stamp — will read as a fresh warning about a fresh campaign. It is neither. What is new is the manufacturer scope, and that is the part with implications outside the United States: Siemens and Schneider controllers are deployed far more widely in Europe and the Gulf than Rockwell. No ENISA, NCSC, UAE or Saudi parallel advisory had appeared as of Sunday. Two things to watch: whether the unnamed victim surfaces through a utility disclosure, and whether Treasury’s reported addition as co-author — a department that does not normally co-sign detection guidance — precedes designations.

Claims Without Owners

A Breach Framed as a Threat to Sources, and a Victim List That Two Vendors Appear to Claim

The persona Handala says it took IranWire’s correspondence and handed it to Iranian intelligence. SOCRadar marks the claim unverified — and a separate report circulating this week has an attribution problem.

SOCRadar’s Iran–Israel cyber conflict dashboard, refreshed inside the window, carries a claim by Handala — linked in open sources to Iran’s Ministry of Intelligence — of a full breach of IranWire, the independent Persian-language outlet. The persona alleges it extracted correspondence and affiliate lists, says the material was passed to Iranian intelligence, and states that everyone identified as having been in contact with the outlet is under surveillance. SOCRadar labels the entry unverified and, in what this desk retrieved, undated; it cannot be placed inside the past 72 hours. The dashboard carries a second undated entry, a 3.2GB leak published by a pro-Israel actor from a Khamenei-linked educational institution, including staff names, national ID numbers and scanned certificates. Neither is an established event. The IranWire claim is the one that matters, because its payload is not the data but the warning attached to it.

Separately, Cyber Security News published on 22 July a write-up of research it attributes to SentinelOne, arguing that Iran-linked operators are currently building quiet, durable access — stolen credentials, remote management tools, recruitment-themed phishing, exposed industrial systems — rather than pursuing immediate destruction. It calls this “access optionality”: a foothold held for espionage that converts to disruption when the politics change. The same article links Seedworm, which CISA describes as a subordinate element of Iran’s Ministry of Intelligence and Security, to intrusions at a US bank, an airport, nonprofits and the Israeli operation of a US software supplier. That victim list is the headline of a published Symantec/Broadcom investigation. One of the two attributions is wrong, or two vendors' research has been blended without disclosure.

Assessment: Both items illustrate how the information layer of this conflict launders itself. A persona claim on a vendor dashboard, unverified and undated, is not a breach; but if IranWire’s correspondence is genuinely in Iranian hands, the harm lands on sources who never chose to be in the story, and it lands whether or not the claim is true — the announcement alone does the intimidation. Withhold judgement until IranWire speaks. The attribution muddle is more mundane and more instructive: a distinctive victim list, once misassigned, propagates. The underlying concept is still worth keeping. “Access optionality” is exactly what CISA describes in the PLC advisory, expressed in operational technology rather than email.

Watch Tomorrow — The Files' Forward Radar
  1. Iran File: Whether CENTCOM resumes its nightly readout on Monday, and whether Aramco or the Saudi energy ministry says anything at all about damage at Jizan, which so far is attested only by Houthi-run media.
  2. Sahel Monitor: Whether Bamako publishes any FAMa casualty figure for the 18 July Anefis ambush, against the rebel-derived “at least 50” that wires have been repeating for a week.
  3. Sudan Crisis Monitor: Whether the FCDO or OFSI publishes the Sudanese gold-network designations that Liveuamap dated 25 July, and whether Britain formally asks the Security Council to bring El Obeid inside the 1591 arms embargo.
  4. The Brotherhood Brief: Whether OFSI mirrors the US asset freeze on Mahmoud al-Abyari, and whether the Home Office answers a direct question on reopening the 2014 Jenkins review.
  5. Western Media Watch: Whether any Western outlet moves the Nablus Specialty Hospital raid — 50-plus soldiers, a named director on the record — from paragraph nine into a headline.
  6. Israel Press Review: Whether Netanyahu’s Monday meeting with Trump produces an on-record American line about the strike pause, and whether the anonymous Jerusalem briefings against it continue in the Hebrew press afterwards.
  7. Digital Front Monitor: Whether Treasury’s appearance as a co-author of advisory AA26-097A is followed by OFAC designations tied to the IRGC Cyber Electronic Command, and whether ENISA or the UK NCSC issues a Siemens/Schneider parallel.
The Files in your inbox

Get every morning's edition — free

Seven files, one region, zero illusions. The full daily edition, delivered at dawn Gulf time. No noise. Unsubscribe anytime.

We use MailerLite to send the edition. Confirm via the email you'll receive.  ·  Browse past editions