MEFILES — Daily Intelligence on the Region's Hard Questions

Iran File — Lead

The Air Campaign Paused and the Blockade Hardened: American Disabling Fire on a Tanker, One Ship Through Hormuz

For a third night the United States announced no strikes on Iran, and on Sunday its ambassador to the United Nations put a word to the silence: Trump is giving talks “some space.” The space is being given four days after Tehran, according to the operational trackers, turned down the ceasefire paper an Iraqi prime minister carried to it. What stopped was the bombing. On the water, the campaign moved a rung up: US forces used disabling fire on a sanctioned LPG tanker in the Gulf of Oman on 24 July, and in the following twenty-four hours a single vessel crossed the Strait of Hormuz.

MEfiles · Iran File · July 27, 2026

Hormuz in twenty-four hours

Transits, tankers and holding traffic in the 24 hours to 25 July 2026

Vessels transiting the strait

Tankers crossing, either direction

High-risk tankers holding 50–60nm off

2.4m bbl

Iranian crude on two of them

Windward Daily Intelligence, commercial maritime-risk tracker

The pause is an absence, not an announcement. CNN’s 25 July file recorded that the US military “did not announce new strikes against Iran for the first time in two weeks” and that regional allies had reported no fresh attacks; by Sunday the same live coverage carried US Ambassador to the UN Mike Waltz saying Trump was giving diplomacy “some space,” a phrase Times of Israel logged independently. Nobody has declared a ceasefire or a stand-down, and no readout has explained what ended the run of thirteen consecutive nights. The sequencing is what makes the phrase awkward. GlobalSecurity’s daily operational summary, which aggregates rather than reports, dates Tehran’s rejection of the American ceasefire proposal — carried by Iraqi Prime Minister Ali al-Zaidi — to 23 July, the day before the strikes stopped being announced. Trump, speaking on the record at the White House Correspondents' Dinner on 24 July, said the war was “going extremely well,” that Iran had “very few drones left, despite what you see,” and that Tehran would “love to make a deal” but that he did not “think they’re ready to.”

The maritime picture is where the week actually moved. Windward, a commercial maritime-risk tracker, counted one transit of the Strait of Hormuz in the twenty-four hours to 25 July — an outbound general cargo ship — and zero tankers in either direction. Three high-risk tankers were holding position fifty to sixty nautical miles from the blockade line west of the strait, two of them carrying a combined 2.4 million-plus barrels of Iranian crude. On 24 July, Windward reports, US forces used disabling fire against a fraudulently flagged, sanctioned LPG tanker in the Gulf of Oman after four attempts to run the blockade, and describes it as the first confirmed action of its kind. GlobalSecurity separately logs the 25–26 July window as the first two-day interval without an Iranian attack on shipping since the interdiction campaign began. Against a normal throughput of roughly 20 million barrels a day and, per NBC’s tracker, a hundred-plus ships daily, the strait is quiet in the way a closed road is quiet. UN News put the number of seafarers stranded by the near-standstill at around 6,000 on 9 July.

What is on the table is not the nuclear file. Axios reported on 21 July, sourcing two regional officials with direct knowledge, that Trump faces a binary: a fresh ten-day ceasefire aimed at reopening Hormuz, or a joint campaign with Israel intended to force capitulation. Reuters, via a senior Iranian official, had described the ten-day paper on 20 July as a bridge back to an interim deal reached the previous month. The mediation names are Qatari Prime Minister Mohammed bin Abdulrahman Al Thani, the Qatari envoy Ali Al-Thawadi and Pakistan’s Field Marshal Asim Munir; one live mechanism routes Hormuz transit fees into a joint fund with International Maritime Organization involvement, and the interim shape reported by GlobalSecurity has Iran forgoing those fees for sixty days while retaining its asserted control of the corridor. A senior Gulf official told MS NOW that “expectations should remain limited,” and that Washington and its Gulf partners will not accept an arrangement letting Tehran set routes, restrictions or payments unilaterally. Netanyahu, in Times of Israel’s liveblog, says the war ends when the regime falls or surrenders its nuclear programme. Israel votes on 27 October.

Assessment: Read the pause as a change of instrument, not of intent. The nights without a strike announcement coincide with the first confirmed American disabling fire on a tanker and with an interdiction line being enforced fifty miles offshore — cheaper than sorties, and it does not consume the interceptor and munition stocks Waltz is reported to have acknowledged are depleted. That munitions element reached us only through an aggregator we could not corroborate, and it should not be treated as established; the “some space” quote is separately carried and safe. Distrust three things today. Windward sells risk intelligence to the shipping trade and has a commercial interest in a strait that looks dangerous; its counts are the best available, not audited. The 23 July rejection rests on a specialist tracker’s summary, not on primary reporting. And the CNN account of Vance and Gen. Caine warning against escalation is one outlet, anonymous. What would falsify the diplomatic reading is simple: a transit fee actually collected, or a fourth night with no readout and no ship.

Sources: CNN — Iran war live file, 26 July: Waltz says Trump giving talks ‘some space' · CNN — Iran war live file, 25 July: first night in two weeks with no announced strikes · Times of Israel — ‘Trump giving Iran talks some space,' America’s UN envoy says · Windward Daily Intelligence — one transit, no tankers, disabling fire in the Gulf of Oman · Axios — Trump weighs a ten-day ceasefire against a joint campaign · Reuters via US News — Mediators propose 10-day ceasefire to revive interim deal · GlobalSecurity — Iran war operational summary, Day 149 · MS NOW — Gulf official: ‘Expectations should remain limited'

The Cartoon — July 27

“The guns went quiet. The gate did not go up.”

MEFILES · the cartoon · Windward counts one vessel and no tankers through the Strait in the 24 hours to 25 July

Vessels that transited the Strait of Hormuz in the 24 hours to 25 July — an outbound general cargo ship, and no tankers in either direction

Windward Daily Intelligence, 24 hours to 25 July 2026

RSF combat vehicles the Sudanese army says it destroyed taking Bara and four other North Kordofan locations — a belligerent’s own claim, repeated identically by QNA and Sudan Tribune

SAF General Command statement, 25 July 2026

50+

Malian soldiers killed in a single ambush on 22 July; the army confirmed the assault but not the toll

Al Jazeera, 22 July 2026

Individuals and entities designated by OFAC in one 23 July action, including the Brotherhood General Secretariat’s UK-based Secretary General

US Treasury press release sb0572, 23 July 2026

PLC manufacturers now named in the joint US advisory on Iranian-affiliated targeting — Rockwell, Schneider Electric and Siemens, up from one in April

CISA advisory AA26-097A, updated 22 July 2026

Iran File

The regime, the IRGC, the proxies, the strait — read from the Gulf, not from Washington.

A hundred ships a day, then one

Daily vessel transits of Hormuz: normal throughput against the 24 hours to 25 July

NBC News tracker (normal baseline, 21 July); Windward Daily Intelligence (25 July)

Diplomacy by Absence

Waltz Puts a Name on the Pause, Four Days After Tehran Turned Down the Paper

The US ambassador to the UN says Trump is giving talks “some space” — the first on-record American characterisation of two nights without strike announcements. The proposal that space is meant to serve was rejected on 23 July.

Mike Waltz, the US ambassador to the United Nations, said on Sunday 26 July that President Trump is giving diplomatic talks “some space” to develop, a formulation carried by both CNN’s live file and a Times of Israel liveblog entry. CNN’s Middle East index summarised the same message as the administration signalling “that pause in Iran strikes will allow talks to progress.” What is confirmed remains narrower than the framing: CNN reported that on Friday 24 July the US military did not announce new strikes on Iran for the first time in two weeks, and that regional US allies had not reported fresh attacks over the weekend. That is an absence of announcements, not a declared stand-down. Neither government has announced a ceasefire. Waltz is also reported to have acknowledged depleted American munitions stockpiles in the same appearance; the fullest version of that claim sits on an aggregator this desk could not corroborate, and the same page asserts that strikes reached Kuwait, which we could verify nowhere else.

The space is being extended to a document its recipient has already refused. GlobalSecurity’s daily operational summary for Day 149 records that Iraqi Prime Minister Ali al-Zaidi carried a US ceasefire proposal that Tehran rejected on 23 July; Iraq had put its own war losses at up to $45 billion a week earlier. That tracker aggregates rather than reports, and should be read as a pointer. Reuters, on 20 July, reported that mediators had passed Iran a 10-day ceasefire proposal aimed at reviving the previous month’s interim deal — sourced to a single senior Iranian official, meaning one belligerent, one voice. Axios reported on 21 July, citing two regional sources with direct knowledge, that Trump faces a binary: the 10-day ceasefire built around reopening Hormuz, or a joint campaign with Israel. It named Qatari Prime Minister Mohammed bin Abdulrahman Al Thani, Qatari envoy Ali Al-Thawadi and Pakistani army chief Field Marshal Asim Munir among the mediators, with one live mechanism routing Hormuz transit fees into a joint fund involving the IMO.

Trump’s own account, delivered on the record at Friday’s White House Correspondents' Dinner and quoted by CNN, does not describe a negotiation in progress. “It’s all going extremely well. Don’t believe the fake news,” he said, adding that the US had “hit Iran very hard,” that Tehran no longer has Navy or Air Force capabilities, and that “they have very few drones left, despite what you see.” Iran would “love to make a deal,” he said, but he does not “think they’re ready to.” CNN, citing unnamed sources, reported that Vice President JD Vance and Joint Chiefs chairman Gen. Dan Caine raised concerns about escalation at a Friday White House meeting — anonymous, single outlet. A senior Gulf government official told MS NOW that “expectations should remain limited.” An Iranian official, unnamed, told CNN the war is “one that will not end.”

Assessment: The new fact is not the quiet — it is that Washington now wants credit for it. A pause nobody claims is deniable; a pause an ambassador names on Sunday television is a pause with an owner, an expiry and a purpose it can be said to have failed. Note the sequencing: the refusal came on 23 July, the space was announced on 26 July. Either the Iraqi channel has been retired in favour of the Qatari one, or the same paper is being re-tabled with the strike calendar as the argument. Watch for the first US official who attaches a date to “space.” That number, not the word, is the deadline.

Sources: CNN — live file: Waltz says Trump giving talks ‘some space' · CNN — first night in two weeks without a US strike announcement · Times of Israel — “Trump giving Iran talks ‘some space,' America’s UN envoy says” · Reuters via US News — mediators propose 10-day ceasefire, per senior Iranian official · Axios — two options on Trump’s desk: ceasefire or joint campaign · MS NOW — senior Gulf official: “Expectations should remain limited”

Interdiction Both Ways

One Ship, No Tankers, and American Disabling Fire in the Gulf of Oman

Windward counted a single transit of Hormuz in the 24 hours to 25 July and zero tankers in either direction. The one confirmed act of force that week was American, against a ship running the US blockade.

Windward, a commercial maritime-risk tracker, recorded one vessel transiting the Strait of Hormuz in the 24 hours to 25 July — an outbound general cargo ship — and no tankers crossing in either direction. Three high-risk tankers were holding position roughly 50 to 60 nautical miles from the blockade line west of Hormuz, two of them carrying a combined 2.4 million-plus barrels of Iranian crude. On 24 July, Windward reports, US forces used disabling fire against a fraudulently flagged, sanctioned LPG tanker in the Gulf of Oman after four attempts to run the blockade, described as the first confirmed action of its kind. The same daily notes Saudi Arabia has begun offering crude from an Egyptian port; the excerpt available to this desk truncates before naming it. Windward is a commercial vendor, not a wire, and its counts should be read as one methodology among several.

The other half of the picture is what did not happen. GlobalSecurity’s Day 149 summary records no Iranian attack on shipping in Hormuz across the 25–26 July window — the first two-day interval without one since the interdiction campaign began. That is the strait’s quietest stretch of the war, and it moved no oil. Against a normal throughput of roughly 20 million barrels a day, NBC News’s running tracker, last updated 21 July, found traffic at a near-standstill for weeks and “nowhere near the hundred-plus ships a day” of ordinary times. Al Jazeera reported on 10 July that no large vessel had crossed the US-coordinated route while broadcasting its position since that Tuesday, with traceable crossings confined to an Oman-hugging track. UN News, citing the IMO on 9 July, put the number of seafarers stranded by the shutdown at around 6,000.

Assessment: The direction of enforcement has reversed, and that is what the transit counts conceal. The barrels loitering off the line are Iranian; the ship taken under fire was running an American blockade, not an Iranian one. A corridor closed by two navies cannot be reopened by one decision, which is the structural problem with any ceasefire clause priced as “reopening Hormuz” — Tehran can concede transit fees and the strait stays shut. Distrust quiet as evidence of de-escalation: zero tankers is the blockade functioning as designed. The variable worth tracking is the Egyptian-port workaround. Every barrel that reaches market around the strait devalues the toll Tehran is negotiating over.

Sources: Windward Daily Intelligence — one transit, zero tankers, US disabling fire on 24 July · GlobalSecurity — Day 149 operational summary: first two-day gap in Iranian attacks · NBC News — Strait of Hormuz traffic tracker, updated 21 July · Al Jazeera — shipping grinds to a halt as US and Iran resume fighting · UN News — IMO says roughly 6,000 seafarers stranded

Sahel Monitor

Mali, Burkina, Niger, the AES bloc, JNIM, and the Russian bargain — security as economics.

Sovereignty Day

Tiani Blames an Élysée “Sahel Cell” for Attacks on Niamey Airport and Keeps Benin Shut

On the eve of the third anniversary of Mohamed Bazoum’s removal — a date Niamey now marks as National Sovereignty Day rather than a coup anniversary — Gen. Abdourahamane Tiani said he holds evidence of French involvement in attacks on Niger’s main airport. No evidence has been published and no French response has surfaced.

Tiani gave the interview on Saturday 25 July to Niger’s state broadcaster, described by the Beninese outlet La Nouvelle Tribune as “la télévision publique nigérienne,” a day before the anniversary of the 26 July 2023 removal of President Bazoum. He said he possessed “des éléments” pointing to French involvement in attacks on Niamey airport and attributed a “stratégie de déstabilisation” to what he called the Élysée’s “cellule Sahel.” Two independent regional outlets, La Nouvelle Tribune in Cotonou and Burkina24 in Ouagadougou, carried the same interview on the same date; no AFP, Reuters or AP copy on it turned up in this desk’s searches. The attacks Tiani referred to could not be independently dated or sized from the material retrieved — neither their timing, their scale nor any casualty figure is established here.

On the closed Benin border, Tiani spoke of “plaies” still to be healed and said that despite progress by a joint committee, “préalables” remain before reopening — Burkina24 renders his condition as wanting assurances the frontier will belong to the people and no longer be subject to outside control, in a sentence truncated in the copy available. Benin’s President Romuald Wadagni travelled to Niamey on 2 June, nine days after his inauguration, per La Nouvelle Tribune’s dating; seven weeks later the border remains shut. Two days before the interview, on Friday 24 July, Tiani received at the presidency the commission charged with organising, preparing and following up Niger’s “mobilisation générale,” according to the Nigerien site Kaweru.

Assessment: The reportable event here is not the accusation but the calendar. Renaming 26 July as Sovereignty Day converts the origin of the government into a national holiday, which removes the anniversary as a date opponents can own. Naming a named French cell supplies a permanent external author for domestic insecurity, and it is a claim by a head of state, not an established fact — treat it that way until evidence or a French reply appears. The costlier item is the border: Niamey is choosing to keep its cheapest route to the sea closed while a standing general-mobilisation commission sits at the presidency. That combination — permanent emergency machinery plus a self-imposed economic closure — is the thing to watch, not the rhetoric.

Sources: La Nouvelle Tribune — Tiani imputes a destabilisation strategy to the Élysée’s “cellule Sahel” · La Nouvelle Tribune — Tiani on “plaies à panser” before the Niger–Benin border reopens · Burkina24 — Tiani’s message three years after 26 July 2023 · Kaweru — Tiani receives the commission charged with the “mobilisation générale”

Resupply and Retreat

A Russian Convoy Runs a New Route to Bamako While Africa Corps Posts Photos From Anefis

The Africa Report says dozens of armoured vehicles and new Russian equipment were hours from Bamako on 23 July, on a route it describes as built to circumvent sanctions. The claim rests on one publishing group’s unnamed sources.

The Africa Report, publishing around 24 July, reported that on the afternoon of 23 July dozens of armoured vehicles and a large shipment of new Russian military equipment were moving toward Bamako and were hours from arrival at the time of writing, along a route it called new, hazardous and structured to evade sanctions. The outlet attributes the detail to information gathered by its sister publication Jeune Afrique — a single publishing group, unnamed sources, with no confirmation from Bamako or Moscow retrieved. The route’s actual geography is not given in the material available, which is the detail that would matter most. The article’s lead image is credited “Africa Corps/X” and captioned as Africa Corps personnel patrolling Anefis on 12 July: publicity material from the force about its own presence, not independent confirmation of who controls the town.

That caption sits eight days after 4 July, when AFP reported a second wave of coordinated attacks across Malian towns and a prison, and quoted a regional elected official — named by role only — saying rebels controlled Anefis, with Russians entrenched in the camp there. The army said all the attacks were thwarted. On 22 July, Al Jazeera reported an ambush that killed at least 50 Malian soldiers; the Malian military confirmed the assault and said it had launched counter-operations, but on the material retrieved has not itself confirmed the toll. Africa Corps subsequently released footage it said showed drone strikes on the fighters involved — again, a claim about its own imagery.

Two interested parties describe the same pattern from opposite directions. Militarnyi, a Ukrainian defence outlet with an evident stake in the story, reports that Russian personnel withdrew at the height of a battle and left Malian troops behind as a convoy took heavy losses in armour and men, illustrating it with an image of a burning Malian government fuel truck credited to the anti-Kremlin Telegram channel Exilenova+. ADF Magazine, which is published by US Africa Command, reported on 16 June that Africa Corps is shifting tactics in Mali to reduce its own casualties. Neither is a neutral tracker, and their agreement is not corroboration.

Assessment: Weigh the convoy above the footage. Drone videos and patrol photographs are cheap to produce and impossible to date-check; a resupply column of armour moving on a deliberately reconfigured overland route is expensive, slow and reveals what Moscow thinks it needs in Mali after a summer of losses. If the sanctions-evading corridor is real, it is the story — and the missing geography is the reporting task, not a detail. The other half of the picture is Algiers: Bamako announced on 10 July that it was restoring diplomatic cooperation and reopening its airspace to Algeria, a détente the International Crisis Group calls reversible. Russian logistics and Algerian goodwill are competing answers to the same problem.

Sources: The Africa Report — Africa Corps convoy circumvents sanctions on hazardous new route to Mali · Al Jazeera — how armed group alliances are reshaping Mali’s conflict · France 24/AFP — Mali hit by new wave of coordinated attacks · Militarnyi — Russia’s Africa Corps abandoned Malian troops on the battlefield · ADF Magazine (US Africa Command) — Africa Corps shifts tactics in Mali · International Crisis Group — Algérie-Mali : consolider la détente

Sudan Crisis Monitor

SAF versus RSF, the sieges and the famine, the gold economy, and the diplomacy of press releases.

The denominators behind Bara

Sudanese hunger caseloads against which any territorial claim has to be read

IPC Special Snapshot (Feb 2026–Jan 2027); UNICEF, 15 May 2026; UN News citing IPC, 5 Feb 2026

Claimed Twice

The Army Says It Has Bara — the Same City Was Announced Retaken Seven Weeks Ago

Sudan’s General Command claims five North Kordofan locations and 73 destroyed RSF vehicles. The RSF has said nothing, and one of the towns was declared liberated once already in June.

The SAF General Command announced on Saturday 25 July that its forces, alongside the Joint Force, had retaken Bara — North Kordofan’s second-largest city, some 45 kilometres east of El Obeid — together with Jabrat al-Sheikh and Um Sayala. Sudan Tribune’s rendering of the same statement adds Al-Baraka and Um Qurfa, and Qatar News Agency’s wire copy carries all five. The statement claims 73 RSF combat vehicles destroyed, further vehicles seized and “several” RSF personnel and officers killed, and says the towns were taken “by force and with determination following well-planned military operations” in Ahram Online’s translation. Joint Force spokesman Mutawakil Ali Wakeel named the participating formations as the army, the Joint Force, “Qashan” forces and supporting troops. Two commanders were named dead at Bara: Major General Abdelaziz Ismail Abakar, known as “Mr Attack 77,” and Brigadier Abdullah Sharafeldin Abakar, “Showh,” the Joint Force’s administrative chief. Darfur Region Governor Minni Arko Minnawi wrote on Facebook that the gains were “not the end of the battle, but the beginning of a new phase of decisive action.”

The claim has not been matched by anything outside the SAF-aligned information space. Radio Dabanga, the most careful of the accounts, headlines it as a claim, reports field sources saying an RSF counter-attack was repelled, and states that it approached the RSF for comment; no RSF statement, denial or counter-claim has surfaced. Ahram Online dates the General Command statement to Sunday, against QNA’s and Sudan Tribune’s Saturday. The National, published in Abu Dhabi, frames the same events at their lowest: “a vital town and four nearby villages,” easing “some of the pressure” on El Obeid. On Sunday Sudan Tribune escalated further, reporting that the army now holds the full 350-kilometre Omdurman–El Obeid export road and publishing video it says shows troops from Khartoum linking up with forces inside the city. As of compilation that claim exists in one outlet. And on 3 June the International Center for Transitional Justice reported an SAF announcement that it had expelled the RSF from Bara and secured El Obeid.

Assessment: Two announced liberations of the same city in seven weeks means one of three things: Bara changed hands again in the interval, the June announcement was premature, or this one is. Nothing in the available reporting settles which. Read the 73-vehicle figure as belonging to the same genre as the army’s 16 July claim of roughly 205 vehicles and four FH-95 drones destroyed in a fortnight — belligerent arithmetic, unverified, and rising in tempo alongside the diplomatic track. The tell to watch is not the video but the silence: an RSF that does not contest a claim about a corridor it needs is either regrouping or conceding. The Emirati outlet’s markedly conservative framing is its own datapoint.

Sources: Sudan Tribune — SAF announces recapture of Bara and North Kordofan towns · Sudan Tribune — Army says it controls the full Omdurman–El Obeid export road · QNA — Sudanese army announces recapture of Bara, other areas in North Kordofan · Radio Dabanga — Sudanese army claim capture of strategic North Kordofan towns · Ahram Online — Sudanese army recaptures Bara city, other strategic areas · ICTJ (3 June 2026) — Sudanese army retakes Bara, secures El Obeid

From Omdurman to Um Dafuq

A Day After the Kordofan Claim, the Army Sets Its War Aim at the Central African Border

Yasir al-Atta told troops in Omdurman the advance would move “in successive waves” to Um Dafuq. That is the far southwestern corner of Darfur, roughly the whole width of the country from where the fighting is.

Speaking at the Military Medical Hospital in Omdurman on Sunday, Assistant Commander-in-Chief Yasir al-Atta told troops and supporters that army and allied forces would advance “in successive waves” toward Um Dafuq on the southwestern border, offered RSF fighters and foreign mercenaries a choice between surrendering and leaving the country, and pledged to dismantle every RSF position. Sudan Tribune reports, citing a senior military officer, that General Abdel Fattah al-Burhan has ordered a sweeping offensive to clear the country up to the border with the Central African Republic. The same outlet reported on 21 July that the SAF had pushed large reinforcements into desert positions in Northern state to open a new front and cut RSF supply lines running in from Libya — the northern half of the same interdiction logic. Whether the Kordofan advance produced the new war aim or executed an existing plan is not established by the reporting.

Against the declared objective sits El Obeid, a city of more than 500,000 hosting nearly 100,000 displaced people and anchoring humanitarian operations for all three Kordofan states. A UNFPA flash update of 2 July describes near-daily drone attacks systematically targeting power substations, fuel stations, water facilities and health infrastructure to impose siege conditions; The National reported the city in total blackout on 6 July. CNN, citing the UN, counted 880 civilians killed by drone strikes nationwide in the first four months of 2026 — more than 80 per cent of all civilian deaths the UN recorded. The IPC’s February snapshot puts nearly 19.5 million people in Phase 3 or above through May, with around 135,000 in Catastrophe. On the diplomatic track, Sudan Tribune reported on 14 July that the RSF had answered Washington’s proposals by accepting a truce and rejecting withdrawal.

Assessment: Announced war aims are cheap the morning after a battlefield claim, and al-Atta’s are the cheapest kind: maximalist, undated, and pointed at terrain a thousand kilometres from the fighting. The function is domestic — it forecloses the withdrawal question the Quad’s ninety-day framework depends on, and it does so from a pulpit rather than a negotiating table, which is now the pattern. Note what the window did not produce: no new IPC product, no OFAC, EU, UK or Panel of Experts action, no new patron statement, nothing on gold routes or Dubai transit. When the war economy goes quiet in the reporting, it is not quiet on the ground.

Sources: Sudan Tribune — Burhan orders offensive to clear country to CAR border; al-Atta in Omdurman · Sudan Tribune — SAF reinforcements into Northern state to cut Libya supply lines · UNFPA — Flash update, situation in El Obeid, North Kordofan, 2 July 2026 · CNN — Drone strikes killed 880 civilians in four months, per UN · IPC — Sudan acute food insecurity special snapshot, Feb 2026–Jan 2027 · Sudan Tribune — RSF response to US proposals: truce yes, withdrawal no

The Brotherhood Brief

The organization as structure — designations, networks, finances, legal battles. Structure over slogans.

Four executive actions, no bills

Cumulative US designation actions against Brotherhood-linked targets under E.O. 13224, 2026

US Treasury and State Department releases, as recited in Treasury press release sb0572

A Statement, Not a Docket

The Brotherhood Says It Will Take Washington to Court, and One Outlet Reports It

Middle East Online says the movement’s London-based leadership has called Thursday’s US designations “unjust” and intends to fight them in American courts. There is no filing, no second outlet, and no copy of the statement on the group’s own portals.

Middle East Online reported that the Egyptian Muslim Brotherhood rejected the 23 July sanctions in a statement issued by its London-based leadership, describing them as unjust and unsupported by legal evidence, and saying the movement would challenge the designation through US courts and pursue all available legal avenues to halt implementation and defend the rights of the organisation and its members. This desk could not locate the underlying statement on the Brotherhood’s ikhwanonline.com or on its Freedom and Justice portal, fj-p.com, and found no second outlet carrying it. What is on the record is the action it responds to: the Office of Foreign Assets Control designated Mahmoud al-Abyari, a UK-based senior Egyptian Muslim Brotherhood figure whom Treasury identifies as Secretary General of the Muslim Brotherhood General Secretariat, for acting for or on behalf of the EMB, designated a Specially Designated Global Terrorist in January.

The gap between the announcement and any legal event is the whole of this story. A designated person has two routes: an administrative delisting petition to OFAC, which is slow and largely invisible until it succeeds, and a suit in US federal court, which generates a docket number the same day it is filed. Neither has surfaced. Anyone litigating would be arguing against a record Treasury says was built with the Federal Bureau of Investigation, the Drug Enforcement Administration and Customs and Border Protection, and against OFAC’s specific claim that al-Abyari supported fundraising for Filistin Vakfi and Hayat Yolu, two entities already sanctioned over Hamas ties. Treasury Secretary Scott Bessent framed the action in categorical terms: “Whether operating under the guise of charities, businesses, or underground financial networks, those who enable Hamas will be exposed, sanctioned, and held accountable.”

Assessment: Treat this as an intention reported by one outlet, not a case. Press statements cost nothing and serve an audience of members and donors who need to hear that the leadership is not simply absorbing the blow. A filing is different: it puts the movement’s structure, its finances and its relationship to the General Secretariat into an adversarial process it does not control, and it requires naming a plaintiff with standing. Watch for a docket, not a communiqué. And note the venue nobody is discussing — al-Abyari lives in Britain, where the group is not banned and where London has still said nothing.

Sources: Middle East Online — Brotherhood says it will challenge designation in US courts · US Treasury — designation of al-Abyari and six others under E.O. 13224 · State Department — Dismantling Muslim Brotherhood and Hamas financial networks · i24NEWS — entity-by-entity breakdown of the 23 July action

Authority Without Statute

Four Executive Designations Since January, and Three Congressional Bills That Have Not Moved

Treasury’s own recitation places Thursday’s action as the fourth against Brotherhood-linked targets in seven months, all under Executive Order 13224. The legislation that would make the label statutory sits where it sat in 2025.

The chain is documented in the government’s own releases. On 13 January Treasury and State jointly designated Muslim Brotherhood branches as terrorist organisations, the action that made the Egyptian Muslim Brotherhood an SDGT. A further OFAC action followed on 21 January, cited by name in Treasury’s 23 July release. On 9 March the State Department designated the Sudanese Muslim Brotherhood. A second OFAC action came on 12 March. Thursday 23 July brought al-Abyari, three further individuals and three entities, among them the Turkey-based El-Kahira for General Trading, which Treasury says moved “hundreds of thousands of dollars” for Hamas and provided underground banking services, including in cryptocurrency, to the Sweden-based Foxtrot Network. Which chapters were named on 13 January this desk has not verified against the State releases, and that list governs any serious mapping of the international organisation.

Three bills remain live in the 119th Congress: H.R.4397, the Muslim Brotherhood Terrorist Designation Act of 2025, its Senate companion S.2293, and H.R.3883. No floor action, markup or vote inside the 20–27 July window turned up in this sweep, which is an absence of evidence rather than proof of stasis. The Foundation for Defense of Democracies, an advocacy think tank that welcomes the policy, reads the July action as Washington moving beyond chapters to “the senior officials, financiers, and facilitators who sustain the movement” — a framing worth attributing rather than adopting, but a testable one: this is the first action in the chain to name a serving officeholder of the transnational General Secretariat, resident in a NATO member state.

Assessment: E.O. 13224 already delivers what the bills would codify — asset freezes, secondary exposure for anyone transacting — without a single vote. That is the attraction and the weakness. What one administration writes with a pen, the next can unwrite with a pen, and every foreign ministry weighing whether to mirror the designation knows it. It is a plausible part of why Britain, Turkey and Indonesia have all stayed quiet while their jurisdictions appear in the same Treasury release. It also shapes the calculation behind any litigation: a movement contesting an executive action is contesting an administration’s policy, not the settled position of the United States.

Sources: US Treasury — 23 July 2026 designations, citing the January and March actions · US Treasury — 13 January 2026 designation of Muslim Brotherhood branches · State Department — terrorist designation of the Sudanese Muslim Brotherhood, 9 March 2026 · Congress.gov — H.R.4397, Muslim Brotherhood Terrorist Designation Act of 2025 · Congress.gov — S.2293, Senate companion · FDD — Treasury extends its Muslim Brotherhood campaign to Europe

Western Media Watch

How NYT, WaPo, FT, BBC and the wires frame the region — what is emphasized, what is omitted, and what the gap reveals.

One Wire, Two Headlines

Reuters Rewrote Its Gaza Force Headline Mid-Cycle to Say Who Was Actually Talking

Israel’s security cabinet approved a legal framework for a multinational force in Gaza on Sunday. Every Western version of the story rests on one unnamed Israeli official ote headline back its own reporting ” and Reuters eventually put that in the headline.

Reuters first moved the story on 26 July as “Israeli Security Cabinet Approves Letting International Force Enter Gaza Areas Beyond Israeli Control,” the version carried by U.S. News at 12:25 p.m. and by Internazionale. It later moved as “Israel to allow international force into Gaza, Israeli official says.” The mechanical evidence of the revision is in the URLs: Yahoo and KFGO still carry the original slug “israeli-security-cabinet-approves-letting” while displaying the revised wording. Two things changed. The caveat “Israeli official says” was inserted, and the phrase “Beyond Israeli Control” was dropped. The underlying detail carried by Reuters \u2014 that the mission “will include 200 members from ‘friendly countries such as Uganda and Morocco' deploying in areas that are not under Israeli control” \u2014 comes from that same single unnamed official. There is no Board of Peace statement, no Ugandan or Moroccan confirmation and no Palestinian comment anywhere in the sample.

The rest of the field split on which word carried the story. Middle East Eye ran “beyond Israeli-occupied areas” where Reuters had “control” \u2014 one word, a different legal claim \u2014 under its standing live-blog label “Israel’s genocide in Gaza.” The Times of Israel added two qualifiers no Western outlet in the sample put in a headline: “limited” and “for pilot.” The Jerusalem Post reframed a security-cabinet vote entirely, as “Israel approves Board of Peace’s proposal to launch Gaza reconstruction.” Al Jazeera’s “Israeli government nods to international stabilisation force in Gaza” carried two facts the Reuters headline did not: that the force operates “in full coordination with” the Israeli military, and that “the cabinet determined that Israel will have the authority to approve which countries can send forces” \u2014 the first attributed to an Israeli official via the Times of Israel, so second-hand from the same well. Israel Hayom reported the approval came over the objection of National Security Minister Itamar Ben-Gvir.

Assessment: The Reuters edit deserves credit rather than suspicion: moving from a flat declarative to an attributed one is what a wire desk is supposed to do when a story is a single anonymous source deep. The problem is that the first version ran for part of a news cycle and was syndicated under the original slug, and downstream aggregators \u2014 Pakistan Today, Tribune \u2014 rebuilt the story from “Israeli media reports” rather than from the source. Watch the vocabulary, not the volume. Whether Israel retains a veto over which states may contribute troops, and whether the force is a 200-person pilot or a stabilisation force, are the two questions that decide what was actually approved. Neither survived into most headlines. Netanyahu flies to Washington today; expect the number to be quoted back as settled.

Sources: Reuters via U.S. News \u2014 original headline, 26 July 12:25 p.m. · Reuters via KFGO \u2014 revised headline on the original slug · Reuters via Yahoo \u2014 “Israel to allow international force into Gaza, Israeli official says” · Al Jazeera \u2014 Israeli veto over contributor states, “full coordination” with the IDF · Middle East Eye \u2014 “beyond Israeli-occupied areas” · Times of Israel \u2014 “limited” entry “for pilot”

Israel Press Review

Reading Haaretz, Times of Israel, Ynet and the Hebrew press — what Israeli media and officials are actually saying.

Hikers or Raiders

One Firefight Near Nablus, Four Words for How It Started — and the IDF Chose “Hiking”

Two Israelis and four Palestinians were killed at Tell on Friday. Israeli, Palestinian and wire accounts agree on the dead and disagree on who arrived first, and the gap runs through every subsequent headline.

The Times of Israel reported that two Israelis and four Palestinians were killed on Friday after a Palestinian snatched a weapon from a group of settlers who had raided a northern West Bank village and opened fire. Its account rests partly on the raiders' own footage: an armed Israeli firing into the air amid shouts of “revenge” by the young Israelis looking on, then a pair of Palestinians confronting Havat Gilad civil defence squad member Benayahu Mellet, 32, one of whom grabbed his rifle. Mellet and IDF artillery battery commander Maj. Yuval Ezra, 27, were killed; a platoon commander who arrived with Ezra shot the attacker dead, and three other Palestinians were killed in the exchange. Haaretz names the same outpost and reports the IDF’s version — a Palestinian seized a security officer’s weapon and opened fire.

The origin story splits four ways. The Israeli army, per Al Jazeera, said it dispatched troops following “an attack on Israelis hiking in the area.” The Times of Israel’s own podcast called them “a far-right hiking group of Israelis” that “allegedly raided the town.” Its news copy and Haaretz both say settlers who raided. Palestinian and local security sources cited by Al Jazeera say settlers attacked the town of Tal and opened live fire as residents tried to protect their homes. Al Jazeera also describes both Israeli dead as soldiers; the Israeli identification of one as a civil security squad member is the more precise one, and the more consequential. Palestinian health officials counted four other Palestinians wounded, three critically.

Assessment: The verb is the whole argument. “Hiking” makes the armed Israelis victims of an ambush and the Palestinians the initiating party; “raided” makes the shooting the second event in a sequence, not the first. The Times of Israel is running both formulations in the same building on the same day, which is less an inconsistency than a picture of an editorial line under strain — its news desk had the settlers' own video and could not unsee it. Watch the Mellet detail rather than the casualty count: an outpost civil defence squad member, armed by the state, killed while participating in something the army called a hike. That is the structural fact the framing dispute exists to blur.

Sources: Times of Israel — 2 Israelis, 4 Palestinians killed in gunfight sparked by settler raid · Haaretz — Israeli, four Palestinians killed in shooting after clashes erupt in West Bank · Al Jazeera — Four Palestinians killed as Israeli settlers raid occupied West Bank town · Times of Israel — IDF arrests dozens of Palestinians in sweeping raids across West Bank

Dozens to Hundreds

Bluth Signs the Sealing Order, Duvdevan Takes Two Men Out of a Nablus Hospital, and Two Mosques Burn

Netanyahu’s ordered operation moved from arrests to house sealing in three days, while settler reprisals ran alongside it in the same villages.

Al Jazeera reports that shortly after Friday’s killings Netanyahu announced he had ordered raids in Palestinian villages suspected of hosting “militants,” and that by Sunday the military had stormed several towns and detained hundreds. The Times of Israel’s Saturday count was narrower — sweeping overnight raids arresting dozens, with the main focus the village of Tell, including searches of the homes of the families of the Palestinians killed. The two figures cover different windows and should not be merged. Israeli commandos of the Duvdevan Unit raided a hospital in Nablus where two wounded Palestinians the military said took part in the clash had been brought, and took them for Shin Bet questioning. The IDF’s statement: “The identities of all the terrorists who participated in the attack are known.”

On Sunday the process moved to property. The Times of Israel’s liveblog reported troops sealed the home of a Palestinian involved in the Tell shooting; its news copy adds that the temporary sealing was approved by Central Command chief Maj. Gen. Avi Bluth, and that the military “intends to continue to advance the process” of demolition. Running in parallel, and sourced by the Times of Israel to both the IDF and Palestinian reports: settlers attacked several Palestinian towns and villages overnight Saturday, torching two mosques, a home and several vehicles and spraying graffiti claiming “revenge” for the killing of an Israeli. Palestinian media reported settlers raided Qusra, south of Nablus, and set fire to a mosque there.

Assessment: Two enforcement systems are operating in the same villages this week and only one of them files statements. The state’s track is legible and attributable — a named general signs the sealing order, a named unit lifts men from a hospital ward, the Shin Bet takes custody. The settler track produces burnt mosques and graffiti and no arrests reported in the brief. That asymmetry is the durable finding, not the arrest totals, which are being counted over different windows by outlets with different access. Note also what the sealing order signals: Bluth’s approval is the procedural first step toward demolition, and the army said so on the record. Expect the demolition, not the arrests, to be the next confirmable event.

Sources: Al Jazeera — Israeli crackdown in occupied West Bank intensifies, settlers cause mayhem · Times of Israel — IDF arrests dozens of Palestinians in sweeping raids across West Bank · Times of Israel — Liveblog, 26 July 2026

Digital Front Monitor

Cyber operations, information warfare and the infrastructure of control across the region.

Update, Not Incident

Six US Agencies Widen the Iranian PLC Advisory to Siemens and Schneider, Three Months On

The joint advisory AA26-097A was revised on 22 July to add detection guidance and two new PLC manufacturers. It documents a campaign that began in November 2023 — not a new intrusion this weekend.

CISA published a revised version of AA26-097A, “Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure,” on 22 July 2026. The original, issued on 7 April by the FBI, CISA, the NSA, the EPA, the Department of Energy and US Cyber Command’s Cyber National Mission Force, covered internet-exposed Rockwell Automation PLCs in US government facilities, water and wastewater systems and energy infrastructure. The July revision adds guidance on detecting malicious changes in reusable code modules inside Rockwell PLC programs and expands the manufacturer scope to include observed targeting of Schneider Electric, Siemens and potentially other branded controllers, stressing that direct internet access be restricted. The advisory attributes the activity to actors affiliated with the IRGC’s Cyber Electronic Command operating as “CyberAv3ngers,” also tracked as Hydro Kitten, Storm-0784, Bauxite and UNC5691, and dates the comparable earlier campaign against US PLCs and HMIs to November 2023.

The framing gap is visible in how the document travelled. WaterISAC told members that the agencies had “updated” the advisory, that the original dated from 7 April, and that the revision was circulated “to draw awareness to the new information which may require utility action if not done already.” Several trade outlets ran the same document as an Iranian escalation story over the weekend. Nothing in the material reviewed reports a fresh intrusion or disruptive effect inside the 24–27 July window. The escalation language traces back to April, when Burns & McDonnell’s 1898 & Co. called the original advisory “a significant escalation in Iranian offensive cyber capability against operational technology, consistent with anticipated retaliatory activity” — a characterisation from a firm that sells detection services built against this advisory.

Assessment: Two things are being conflated: the state’s threat picture widening, and the threat itself widening this week. Only the first is documented. A scope expansion from one PLC brand to three tells you where defenders have since looked, not necessarily where attackers have since gone — and the agencies say as much by publishing detection guidance rather than incident reporting. Treat the recirculation tempo as a signal about the news cycle around the Gulf confrontation, not about intrusion tempo. Readers should also note what this desk could not check inside the window: Predatory Sparrow activity, platform takedowns, Israeli directorate statements and current NetBlocks postings on Iranian connectivity. Unchecked is not absent.

Sources: CISA — Advisory AA26-097A, updated 22 July 2026 · CISA — Full advisory PDF, version date 22 July 2026 · WaterISAC — CISA updates Iranian-affiliated PLC targeting advisory · 1898 & Co. (Burns & McDonnell) — July 2026 update on Iran-affiliated PLC targeting · Infosecurity Magazine — Iranian hackers and Siemens/Schneider controllers · AHA — Joint cybersecurity advisory relay, 23 July 2026

Eleven Days Old

A DGST Insider Says Pegasus Reached Rabat in a Villa in 2017, and Morocco Has Not Answered

The Forbidden Stories–Amnesty consortium published its Moroccan whistleblower investigation on 16 July. It is circulating this weekend as though it broke this weekend.

On Thursday 16 July, Forbidden Stories, Amnesty International and 13 media organisations published testimony from a man given the pseudonym “Safir,” described as a near-decade veteran of Morocco’s Direction Générale de la Surveillance du Territoire, on Rabat’s use of Pegasus and other spyware against journalists, human rights defenders and foreign officials. The consortium says his account was corroborated by leaked emails, targeting records, victim testimony, internal training material and data analysed by Amnesty’s Security Lab, and reports that Pegasus was first introduced to Moroccan intelligence in 2017, in a villa in Rabat. The byline is José Bautista, Eloïse Layan, Hicham Mansouri and Guillaume Vénétitay. Omar Radi is named among the targets. Morocco denied comparable allegations in 2021; a Moroccan response inside this window is not established in the material reviewed. France 24’s press review tied the publication date to the French prime minister’s visit to Morocco.

The same day, Amnesty’s Security Lab published what it calls its most complete technical analysis of Pegasus, drawing on previously unpublished NSO Group marketing and engineering material disclosed in the WhatsApp and Meta civil case in a US court, with selected exhibits republished on GitHub. It describes the “Pegasus Anonymizing Transmission Network,” a custom VPN layer used to deliver payloads and route collected data back to the customer’s on-site system so that neither target nor investigator can identify the operator, and says NSO’s “White Services” department creates fresh customer-specific accounts and domains as standard practice, citing exhibit ECF 800-3. Separately, Citizen Lab reported on 3 July that former MEP Stelios Kouloglou was infected in October 2022 and March 2023 while sitting on the European Parliament’s PEGA committee.

Assessment: Three documents, none from this window, all moving as if new — the second recirculation pattern of the day. The Moroccan file rests on one pseudonymous human source plus a documentary record; those are different evidentiary weights and should not be merged into a single confidence level. Amnesty is an advocacy organisation whose forensic work has repeatedly held up, and it is also the plaintiff-adjacent party benefiting from the NSO litigation record it is quoting. What the Kouloglou finding adds is the accountability measure: the parliamentarians investigating spyware were themselves targeted, and nothing followed. Watch for whether Rabat answers at all — silence has been the durable strategy since 2021.

Sources: Forbidden Stories — How Morocco became addicted to tracking its opponents with spyware · Middle East Eye — Whistleblower reveals Morocco spied on dissidents with Pegasus · Amnesty Security Lab — Inside Pegasus: the evolution of the world’s most notorious spyware · Amnesty International — Hacking of former MEP investigating Pegasus abuses · France 24 — Press review: new Pegasus revelations as French PM visits Morocco · Amnesty Security Lab — Joint statement: Pegasus in the Parliament

Watch Tomorrow — The Files' Forward Radar

Iran File: Whether Windward’s daily count records a second tanker transit or a second American disabling-fire incident, and whether CENTCOM issues any strike readout for the night of 27 July.
Sahel Monitor: Whether AFP, Reuters or AP file their own copy on Tiani’s 25 July state-television interview, and whether the Élysée answers the “cellule Sahel” allegation on the record.
Sudan Crisis Monitor: Whether any wire other than Sudan Tribune confirms army control of the full 350km Omdurman–El Obeid road, and whether the RSF issues its first statement on Bara.
The Brotherhood Brief: Whether an OFAC delisting petition or a US district court complaint is actually filed by the Brotherhood’s London leadership — a filing is an event, a press statement is not.
Western Media Watch: Whether any outlet in the ISF cluster upgrades the 200-personnel figure and the Uganda and Morocco contributions beyond the single unnamed Israeli official they all rest on.
Israel Press Review: Whether Central Command follows the Bluth-approved sealing at Tell with a demolition order, and whether any arrest is announced over the two mosques burned near Nablus.
Digital Front Monitor: Whether Rabat responds to the Forbidden Stories consortium’s DGST findings, eleven days after publication, and whether any utility reports an actual intrusion under AA26-097A.