Daily intelligence briefing: 15 August 2026

The strait’s day 167 opens in a new register: two Abu Dhabi National Oil Company tankers were struck by drones on Thursday evening while transiting outbound, the first direct attack on Gulf state shipping inside the waterway itself, and the Emirates has blamed Iran’s Revolutionary Guard Corps outright, calling the strikes acts of piracy. Tehran has not responded. The carrier signal yesterday’s briefing waited on has failed: Air France did not restore Riyadh on Thursday and now holds the route until 21 August, with Dubai and Beirut pushed to the 25th, even as Emirates restores a single daily Dubai to Bahrain rotation today and Turkish Airlines returns to Abu Dhabi, Dubai, Beirut and Amman. Brent closed at 88.50 dollars, up nearly 5 per cent on the week as Washington leans on economic pressure. London wakes to a gentler rhythm: the amber heat health alert, extended late yesterday across every English region, closes at 10:00 this morning, overnight thunderstorms have cleared eastwards, the Arriva walkout lifted at 04:30, and the weekend carries the second Wembley night this evening alongside the Formula E weekend at ExCeL. On the digital side the Coldcard tally has risen again, to 1,778 Bitcoin across more than 5,000 affected addresses, and Google’s threat intelligence team has published its fullest account yet of the UNC6671 four brand operation against the finance sector.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely, and the Palestine Action proscription remains fully in force. The Metropolitan Police newsroom carries nothing in the last 24 hours that bears on the standing counter terrorism picture, but two items from midweek deserve note in this readership: detectives are appealing for information after a woman died following a burglary in Finsbury Park on Wednesday, and a fatal shooting in Clapham earlier in the week remains under investigation. A death in the course of a residential burglary in north London, in peak burglary season with families away, is a reminder that the domestic perimeter carries real rather than theoretical risk this month.

The heat has broken, a day later than expected. The UK Health Security Agency extended its amber alert late yesterday to cover every English region, with London’s running to 10:00 this morning rather than the 21:00 Friday close previous guidance anticipated; overnight thunderstorms cleared eastwards in the early hours, no Met Office warnings are currently in force for London, and noticeably fresher, less humid air arrives for Sunday. The Arriva North London walkout ended at 04:30 this morning with all 41 routes restoring through the day; the next strike blocks run from the 18th to the 21st and the 25th to the 28th, and TfL’s planned Piccadilly line closures coincide with some of those dates. Tonight is the second of The Weeknd’s five Wembley Stadium nights, with the third tomorrow and returns on the 18th and 19th, pressing crowds onto the Metropolitan and Jubilee lines through the evening, and the Formula E London E-Prix occupies ExCeL today and tomorrow, with racing inside and around the building from 08:30 to 16:00 on Sunday. RMT members at East Midlands Railway strike again today, and the Barons Court westbound District and Piccadilly closure remains the standing rail constraint. With the strike lifted and the heat gone, this weekend is the cleanest London window in a fortnight; the next friction stack arrives on Tuesday the 18th.

Travel corridors

Hormuz enters day 167 with the risk picture materially changed. Two ADNOC tankers were struck by drones on Thursday evening while transiting outbound, suffering minor damage with no casualties; the UAE foreign ministry blamed Iran directly, describing the strikes as a flagrant violation of United Nations navigation principles and as acts of piracy by the Revolutionary Guard Corps, and Tehran has so far said nothing. This is the first direct attack on Gulf state commercial shipping inside the strait since the closure began, and it lands as the southern picture also darkens: fires broke out at Yemen’s Mokha port after reported Houthi missile strikes, and the Houthis claimed to have targeted Saudi Aramco facilities. The transit numbers remain contested: IMF PortWatch counted a single crossing on 9 August against a pre crisis norm of around 73 in its dataset, while other trackers put Thursday’s crossings at 13, up from 9 the day before. The commercial economics are unambiguous either way: war risk premiums for very large crude carriers sit at roughly 30 times pre crisis levels, around 10 million dollars a voyage, six protection and indemnity clubs have withdrawn cover entirely, and four of the nine largest container lines have suspended Hormuz service, with Cape of Good Hope surcharges of 600 to 1,200 dollars per twenty foot container. Brent settled at 88.50 dollars, up 1.6 per cent on Thursday and close to 5 per cent on the week. Our test is unchanged and unmet: no verified normalisation of commercial transit has occurred, and all Gulf travel, including Dubai, should remain deferred.

The carrier calendar failed its first test. Air France did not fly the Riyadh restoration that was due on Thursday and now holds the route until 21 August, with Dubai and Beirut pushed to 25 August; yesterday’s briefing called the restoration reversible until it had flown and repeated, and it reversed before it flew. The counter signal comes from regional carriers: Emirates restores a single daily Dubai to Bahrain rotation from today, with its Kuwait routes still suspended, and Turkish Airlines has resumed Abu Dhabi, Dubai, Damascus, Beirut and Amman, with Iran flights still off. These are political and commercial signals from carriers with regional imperatives, not evidence of a normalised security environment. The remainder is unchanged: British Airways stays away from Dubai, Tel Aviv, Bahrain and Amman until 25 October with Jeddah dropped permanently and Doha and Riyadh reduced to daily; KLM is away from Riyadh, Dammam and Dubai until 6 September; Lufthansa and SWISS remain away from Dubai until 13 September, which continues to bear on the Zurich corridor, with the wider group’s regional suspensions running to 24 October; Singapore Airlines is away until 24 October, Cathay Pacific until the 25th and 26th, Scoot stays off Jeddah until 12 September, and Air Canada holds to the middle of January 2027. Specific flights should be confirmed before any movement is built around them.

Paris spends the Assumption holiday at the bottom of its engineering trough, on a reduced public holiday service. The RER B remains suspended between Gare du Nord and La Croix de Berny and Robinson with roughly one train every seven minutes on the northern branch and heavy crowding expected at Gare du Nord, the RER A is closed between Vincennes and Noisy le Grand until the 23rd, the RER D is disrupted between Gare du Nord and Gare de Lyon with Stade de France not served from Paris, metro Line 13 is cut between Saint Denis Universite and La Fourche until the 17th, and trams T1 and T2 are interrupted, T2 until the 23rd; airport transfers by road with generous margins remain firmly preferable to rail through the weekend. Geneva is quiet after the AI forum’s conclusion cleared the UN district, though new cantonal figures published this week show recorded offences up 14.1 per cent between 2022 and 2025 with vehicle thefts up 19.1 per cent, a reminder that Geneva’s exposure is property crime rather than violence. Zurich’s only incident of note was a wartime hand grenade recovered by army disposal teams from the Limmat at Unterer Letten and destroyed without injury; the corridor’s real constraint remains the SWISS suspension from Dubai. Monaco passes the Assumption holiday in high season quiet with no new security developments reported. New York offers the cleanest window of the corridors: sunny around 28 degrees today, a 50 per cent chance of afternoon thunderstorms tomorrow, early showers clearing Monday into the mid 80s Fahrenheit, and all three airports operating normally.

Digital and privacy exposure

The Coldcard ledger has been revised upwards again. Current reporting puts the confirmed theft at 1,778 Bitcoin, roughly 112 million dollars, drained from more than 5,000 affected addresses, with Galaxy Research now identifying at least a dozen distinct attackers exploiting the same flaw: firmware version 4.0.1, shipped in March 2021, drew seed phrases from a predictable software generator rather than the device’s hardware entropy source, a weakness flagged publicly as early as May 2025. Around 1,531 Bitcoin of attacker holdings sit unmoved under continuous public monitoring while mixing of the remainder continues at a deliberate pace, and the brazen on chain offer earlier this month to launder the proceeds for a 10 per cent fee stands as a reminder that every unsolicited approach around these funds, to attackers and victims alike, is hostile. The guidance is unchanged: assets on any affected Coldcard device should move to a fresh seed generated on updated firmware without delay, ownership of these devices should be treated as a matter of record, and no recovery offer arriving by any channel should be engaged.

Google’s Threat Intelligence Group has published its fullest account of UNC6671, and it confirms the pattern this briefing has tracked: the BlackFile shutdown in May was a rebrand rather than a retirement, and REDACT, FALCON, HELIX and PINK now run simultaneously on shared infrastructure. Targeting has moved deliberately up the value chain through the summer, settling since July on financial services, legal and private equity, firms holding client identities, deal material and litigation files. The method is unchanged and effective: calls to personal mobile numbers from spoofed helpdesk lines, an urgent passkey enrolment pretext, lookalike pages of the form company.createssopasskey.com that harvest credentials and tokens in real time, then deleted confirmation messages and scripted exfiltration from Microsoft 365 and Okta. Tracked payments stand at 141.65 Bitcoin, about 10.7 million dollars across 18 wallets, with settlements clustering around three quarters of a million, and the operational tempo is rising, a new phishing domain every 1.6 days through June and July and seven registered inside 72 hours late last month. The defences remain structural: phishing resistant authentication genuinely enforced, since WebAuthn’s origin binding defeats the lookalike page outright; callback verification through known channels for every credential, code and payment instruction; and access restricted to managed devices. With families abroad for the holiday weekend in peak burglary month, and a fatal burglary in north London this week underlining the point, the standing rule against real time holiday posting from any family account applies with particular force, and household staff should understand that a quiet house is not an advertised one.