The latest published intelligence briefing for each active theater, most active first. Every section links to the live theater view on the dashboard.

Ukrainian deep-strike activity against Russian rear areas surged sharply, with a coordinated cluster hitting Rostov Oblast (Taganrog port, Taganrog city, Azov) and Krasnodar's Ilsky refinery, while Russian drone strikes continued to inflict civilian casualties across Kherson, Sumy, Kharkiv, Zaporizhzhia, and Kyiv oblasts.

Rostov Oblast recorded four events versus a 0.6/day baseline (+567%), the period's dominant shift. Verified fires at Taganrog Port (geolocated to 47.20N, 38.94E) and reported fires with a possible oil depot hit in Azov are corroborated; a separate mass-violence signal in Taganrog city is verified by multiple sources but its precise nature remains ambiguous. The FSB's claim of a thwarted 13-drone GUR FPV cache operation against Rostov-Centralny airfield is partial and single-attributed to Russian authorities. In Krasnodar, locals reported a strike on the Ilsky refinery (partial). Russian strikes on Ukrainian territory tracked at or below baseline in most oblasts: one fatality and injuries in Valky (Kharkiv, partial); eight injured when a drone struck a minibus in Kherson (verified); one injured in Sumy apartment buildings (partial); one injured in Zaporizhzhia city (partial); and a Vyshneve warehouse strike that Zelensky confirmed hit a Ukroboronprom ammunition depot (partial).

The Rostov-Krasnodar cluster concentrates on port and refining infrastructure supporting southern Russian logistics, extending the pattern of Ukrainian long-range targeting of fuel and maritime nodes. The Vyshneve disclosure is notable: official acknowledgement of a defence-industrial target complicates Ukrainian ambiguity around depot losses. Russian strikes remain weighted toward civilian and residential targets in frontline and near-frontline cities.

Watch Taganrog and Azov for follow-on imagery clarifying port and oil-depot damage; secondary detonations or berth closures would indicate operational impact. Monitor Ilsky refinery throughput reporting. Watch for Russian retaliatory salvos against Kyiv-oblast defence-industrial sites following the Vyshneve disclosure. Continued daily drone strikes on Kherson, Sumy, and Kharkiv would indicate the civilian-targeting tempo is sustained rather than episodic.

All eight events this period are single-sourced and unverified. The most operationally significant signals are reported Ukrainian UAV strikes on Leningrad Oblast port infrastructure (Ust-Luga, Vysotsk, Luzhsky Polygon) and a described Russian sabotage-recruitment network in Lithuania — neither corroborated.

No baseline exists for the prior 7 days, so every cluster represents a new signal rather than a measurable delta. Leningrad Oblast accounts for the largest reported activity: the regional governor is cited claiming 56 Ukrainian UAVs were downed over Ust-Luga, Vysotsk, and Luzhsky Polygon on 6 July, with reported infrastructure damage at all three sites and internet outages in Saint Petersburg. A second, near-simultaneous report references an attack on Ust-Luga port and the Luzhsky landfill. A related GDELT signal geocoded to Pskov actually references a Leningrad-region port oil terminal strike on 7 July — likely the same event chain. In Estonia, three separate GDELT CAMEO "fighting" codes cluster at 59°N/26°E on 8 July with low mention counts and no actor detail; these are algorithmic signals, not confirmed kinetic activity. Lithuania is covered by a Vot Tak investigation alleging a Russian sabotage network using mass Telegram recruitment for arson and drone surveillance. Over the Baltic, an RAF RC-135W Rivet Joint was reported near Kaliningrad with no intercept or airspace violation noted.

If the Leningrad port strikes are borne out, they extend the Ukrainian deep-strike pattern into Russia's Baltic energy export nodes. The Lithuania sabotage reporting, if substantiated, aligns with a documented hybrid pressure trend on NATO's eastern flank. The Estonia GDELT cluster, absent corroborating reporting, should be treated as noise pending validation.

Watch for second-source confirmation of damage at Ust-Luga and Vysotsk (satellite imagery, shipping/AIS anomalies, Rosmorport notices) — confirmation would indicate a sustained campaign against Baltic export terminals. Watch for Estonian government or NATO statements referencing incidents at 59°N/26°E; silence would suggest the GDELT cluster is spurious. Monitor Lithuanian State Security Department releases on sabotage arrests, which would corroborate the Vot Tak reporting. Track further NATO ISR sorties near Kaliningrad and any Russian intercept response.

All reporting for the period is single-sourced and unverified, but the pattern points to an RSF buildup around Kulbus in West Darfur and a claimed RSF/SPLM-N advance in Blue Nile, alongside a Sudanese army consolidation claim in Al-Gedaref.

West Darfur, absent from the 7-day baseline, produced three unconfirmed reports: two describing RSF reinforcements massing on the outskirts of Kulbus with forces reportedly arriving from Al-Geneina and North Darfur, and a GDELT-coded assault entry in Geneina lacking operational detail. In Blue Nile (baseline 0.3/day), joint RSF and SPLM-N elements claimed control of four unspecified areas, supported only by circulated video. In Al-Gedaref, with no prior baseline, the governor claimed the Sudanese army had entered the governorate and taken control of all administrative units, paired with an announced return of 70,000 displaced persons. North Kordofan and a Kassala entry mislabeled as "Fasher" are both GDELT-coded assaults tied to an Al Jazeera report on a UN probe characterizing prior RSF mass killings and gang rapes as genocide — context rather than new kinetic events. A GDELT-coded clash in Khartoum is single-sourced with no detail.

If corroborated, the Kulbus buildup would indicate RSF intent to reverse a recent SAF-claimed gain in West Darfur, while the Blue Nile claim and Al-Gedaref announcement point to competing territorial narratives on opposite flanks. The UN genocide finding, though contextual, raises the political cost of any confirmed RSF offensive in Darfur and Kordofan.

Watch for independent corroboration of RSF movement toward Kulbus and any imagery of contact around Geneina; confirmation would indicate a shift from posturing to assault. Monitor second-source reporting on the Blue Nile territorial claim and on SAF administrative presence in Al-Gedaref, including any displacement-return movement.

All six reported incidents across the Israel theater in this 24-hour window are single-sourced and unverified. No corroborated activity is available; the geographic spread is the most notable signal.

Against a 7-day baseline that showed activity only in the Northern District (0.1 events/day), six unconfirmed incidents surfaced across previously quiet areas: a reported raid with a wounded Palestinian and detained medics in the West Bank, a GDELT-coded clash in Tel Aviv, fighting near Hayogev in the Northern District, a clash near the Gaza Strip, an Israeli incursion with temporary checkpoints in southern Quneitra reported by Syrian state media, and fighting in the Jordan Valley. Each is drawn from a single source, and four rely on GDELT CAMEO coding with minimal narrative detail. The Quneitra report is the only cross-border item and the only one with specific tactical description (checkpoints, vehicle searches, withdrawal).

The distribution — West Bank, Jordan Valley, Tel Aviv, Northern District, Gaza vicinity, and Syrian Quneitra — spans every active front simultaneously, but none of the reports are corroborated. Treated as signal rather than fact, the pattern suggests either a genuine uptick across multiple axes or a reporting artifact from automated coding. The Quneitra incursion, if accurate, is the most operationally significant item because it implies continued Israeli ground activity inside Syrian territory.

Watch for second-source confirmation of the Quneitra incursion from Syrian or Israeli channels; independent reporting would indicate a sustained posture beyond one-off patrols. Watch for named-unit or casualty detail on the West Bank raid, which would elevate it above GDELT-level noise. Watch whether the Hayogev, Tel Aviv, Gaza-vicinity, and Jordan Valley clashes are echoed by local media; absence of follow-up would indicate coding artifacts rather than kinetic events.

Iran's IRGC conducted a ballistic missile strike on Jordan's Azraq military base while a reported US strike hit Chabahar port infrastructure — a partially-corroborated but sharp escalation in direct US-Iran exchanges spanning both flanks of the theater.

Three partially-corroborated events define the period. The IRGC fired 10 ballistic missiles at Azraq Military Base in Jordan's Zarqa Governorate, with Jordanian state media reporting eight intercepts and no casualties; the IRGC explicitly threatened further strikes on US regional bases (four sources). This is a step-change against a baseline of 0.1 events/day in Zarqa. In parallel, a reported US strike damaged the maritime navigation center at Chabahar port in Sistan and Baluchestan without disrupting port operations (two sources) — the first kinetic US action reported on Iranian soil in this dataset, against a 0.4/day baseline. Along the Lebanon axis, an Israeli drone struck a truck in Nabatieh, wounding two, with continued demolition activity in Khiam (two sources) — consistent with, not above, the 0.7/day South Lebanon tempo despite the nominal 43% uptick.

The Azraq strike and the Chabahar strike, if confirmed, together mark a shift from proxy exchanges to declared state-on-state kinetic action between Washington and Tehran, with Jordanian territory drawn in as a target set. The IRGC's stated conditional threat against US bases converts any subsequent US action into a pre-announced trigger. The Nabatieh strike indicates the Lebanon track continues in parallel rather than substituting for the Gulf escalation.

Watch for: independent confirmation of the Chabahar strike and battle damage assessment beyond the navigation center; follow-on IRGC launches against other US basing in the Gulf, which would indicate the Azraq salvo was an opener rather than a discrete signal; Jordanian government posture on airspace and basing; and whether South Lebanon strike tempo diverges upward from its 0.7/day baseline.

Three partially corroborated incidents span Gaza and the West Bank in the 24-hour window, with a lethal Israeli drone strike west of Khan Younis and a settler-linked clash near Ramallah driving activity above the 7-day baseline in both theaters.

Activity rose against baseline in three sub-theaters, though from low absolute counts. West of Khan Younis, a drone strike on a group of civilians reportedly killed two Palestinians and wounded others per Wafa citing medical sources — a 900% increase versus the 0.1/day baseline for Khan Younis. In Al-Maghir, northeast of Ramallah, Israeli soldiers reportedly raided a residence and assaulted occupants while settlers concurrently attacked surrounding lands, producing clashes. A separate assault event in Gaza is logged via GDELT CAMEO-18 classification with no operational detail. All three are two-source PARTIAL; none are independently verified.

The Khan Younis strike, if the medical-source casualty figures hold, is the period's only kinetic Israeli action with reported fatalities and fits an established pattern of drone engagement in western Khan Younis. The Al-Maghir incident is notable for the simultaneous military raid and settler land incursion — a combined-actor dynamic that has previously escalated into wider village-level confrontations in the Ramallah governorate. The Gaza City assault report lacks specificity and cannot be weighted operationally.

Watch Al-Maghir and adjacent Ramallah-area villages for follow-on settler mobilization or IDF cordon activity; renewed raids would indicate the incident is part of a sustained operation rather than a discrete event. Monitor western Khan Younis for repeat drone engagements against civilian gatherings, which would indicate a persistent targeting posture in that sector. Track whether the single-sourced Gaza City assault report attracts corroborating reporting; absence of follow-up would suggest it remains a low-signal GDELT artifact.

A Ukrainian UAV strike on a Tver oil depot continues to burn into a second day, while a separate fire in the southeastern Moscow metropolitan area (Lyubertsy) remains unattributed. Both incidents drive Moscow and Tver above their 7-day baselines.

Two partially verified incidents dominate the period. In Tver, a Ukrainian UAV strike on an oil depot remains active, with sources reporting the facility still burning and linking the damage to broader Russian fuel supply strain (two-source, partial). In the southeastern Moscow area near Lyubertsy, a fire was reported at geolocated coordinates with no stated cause, actor, or weapon (single-source, partial). Against the 7-day baseline, Tver activity is up roughly 233% (0.3/day baseline) and Moscow up roughly 150% (0.4/day baseline), though the increase rests on one event in each oblast.

The Tver oil depot fire is the more operationally significant of the two: sustained burn time compounds losses at a single refining/storage node and, per reporting, is being tied to ongoing fuel shortages — consistent with the pattern of Ukrainian long-range UAV targeting of Russian petroleum infrastructure. The Lyubertsy incident, absent attribution, cannot yet be characterized as a strike despite its "STRIKE" tag; its proximity to the capital nonetheless raises the reporting profile of any Moscow-area fire.

• Watch for follow-on imagery or official statements from Tver clarifying tankage destroyed and time-to-extinguish; continued burn would indicate deeper structural damage than initially visible.
• Watch for attribution or air-defense claims around the Lyubertsy fire; silence from Russian channels would suggest a non-kinetic cause, while MoD acknowledgment would recharacterize it as a strike.
• Watch regional fuel price and supply reporting for corroboration of the shortage claim tied to Tver.

Syrian authorities announced arrests tied to bombings in Damascus that coincided with a visit by French President Macron, while General Security forces began a quiet withdrawal from Esh Al-Wuroud in Rif Dimashq. Both reports are partially corroborated.

Activity in both Damascus and Rif Dimashq exceeded the 7-day baseline (0.6 and 0.1 events/day respectively). In Damascus, authorities publicly linked a detained cell to "terrorist bombings" that occurred during Macron's visit — the first reporting tying a specific network to those explosions, per two sources. In Esh Al-Wuroud (Rif Dimashq), General Security elements are described as conducting a gradual, non-kinetic withdrawal amid unspecified public accusations against the force. Both clusters are partial-confidence (two sources each); neither has independent verified corroboration.

The Damascus announcement frames the earlier explosions as an organised plot rather than an isolated incident and attaches political weight through the timing with a visiting head of state, shaping how Syrian authorities will justify follow-on security measures. The Esh Al-Wuroud withdrawal, absent any reported fighting, suggests a pressure- or legitimacy-driven repositioning rather than a tactical retreat, and points to friction between General Security and the local population or a rival actor. Together, the two events indicate the security apparatus is simultaneously projecting counter-terror capability in the capital and ceding presence on its periphery.

• Watch for named affiliations, charges, or further detentions linked to the Damascus cell; attribution to an external sponsor would indicate escalation of the political framing.
• Watch for follow-on force movements into or around Esh Al-Wuroud; entry by an alternate armed actor would indicate the withdrawal was negotiated rather than administrative.
• Watch for official Syrian commentary on the accusations driving the Rif Dimashq pullback.

A verified rocket strike hit residential wards and the Tatmadaw's North Eastern Military Command headquarters in Lashio on 9 July, the first recorded activity in Northern Shan State in a week and a direct hit on a regional command node.

Northern Shan State registered one verified strike against the prior 7-day baseline of 0.1 events/day. Four rocket bombs impacted both civilian residential areas and the North Eastern Military Command compound in Lashio on Thursday evening. No casualty figures have been released, and no group has claimed responsibility. The targeting of the regional command headquarters — rather than forward positions or patrols — marks a qualitative shift from the quiet baseline period.

Lashio hosts the Tatmadaw's North Eastern Military Command, the operational hub for regime forces across Northern Shan. A strike reaching the command compound itself, regardless of damage, signals that stand-off fires can be delivered into the state capital. The concurrent impact on residential wards raises civilian-harm concerns and complicates any regime narrative of rear-area security. The absence of a claim leaves attribution open among multiple armed actors historically active in the corridor.

Monitor for a delayed claim of responsibility; attribution would clarify whether this represents a resumption of Brotherhood Alliance–linked pressure or a distinct actor. Watch for Tatmadaw statements or imagery indicating damage to the North Eastern Military Command compound, which would confirm the strike's operational effect. Track follow-on indirect fire or ground activity in and around Lashio — repeat strikes would indicate a sustained campaign rather than an isolated incident. Watch civilian displacement reporting from the affected wards as a secondary signal of impact severity.

A single-sourced, unconfirmed report of fighting in La Guaira (Vargas) is the only signal for the period. There is no verified activity to assess.

Against an empty 7-day baseline, one unconfirmed clash signal emerged in La Guaira, Vargas, on 9 July. The report is single-sourced and provides no detail on actors, weapons, or casualties. No corroborating reporting has surfaced within the window, and no other locations registered activity. Treat the Vargas "shift" as a reporting artifact rather than a confirmed escalation until additional sourcing appears.

With zero verified or partially corroborated events, the theater offers no basis for assessing operational tempo or actor behavior over this period. La Guaira's coastal position — hosting Venezuela's principal port and Maiquetía international airport adjacent to Caracas — means any genuine armed incident there would carry outsized significance for regime security and maritime logistics. That significance is precisely why an uncorroborated single-source clash report warrants caution rather than amplification.

• Watch for second-source confirmation of the La Guaira incident: independent local reporting, imagery, or official statements would move it from unconfirmed toward partial.
• Watch for follow-on security deployments or road/port disruptions around La Guaira and the Caracas–Maiquetía corridor; observed movements would indicate the initial signal reflected a real event rather than noise.
• Watch for silence: continued absence of corroboration across 72 hours would indicate the report should be down-weighted.
• Watch adjacent Miranda and Distrito Capital feeds for spillover indicators that would contextualize any Vargas activity.

A partially corroborated Red Sea maritime attack off Hodeida — reported via a British military advisory and cited in Indian press — is the sole recorded incident this period, representing the first activity in Al Hudaydah in a week.

Al Hudaydah registered one clash-coded event tied to a reported attack on a cargo vessel in the Red Sea off Yemen's coast, sourced to a British military report relayed through The Hindu. Against a 7-day baseline of 0.1 events/day, this constitutes a numerical spike (approximately 900%), but from a very low base and off a single partially verified incident. No ground clashes, strikes, or additional maritime interdictions inside the theater were logged during the period. The vessel's identity, flag, and damage state are not established in the supplied reporting, and the incident is two-sourced but flagged partial rather than verified.

Even a single confirmed Red Sea attack off Hodeida bears on shipping risk calculus for operators transiting the Bab el-Mandeb approaches and on insurance and rerouting decisions. The absence of any accompanying land-based activity in Al Hudaydah suggests the reported action is maritime-domain only rather than part of a broader escalatory pulse. Reliance on a British military advisory as the underlying source — rather than direct claims or independent imagery — means attribution and targeting details remain unresolved for now.

Watch for follow-on advisories from UKMTO or allied naval task forces referencing the Hodeida-area incident; corroborating detail on vessel identity or damage would upgrade confidence. Watch for any Houthi-affiliated claim of responsibility, which would indicate a deliberate signalling posture. Monitor for additional maritime incidents along the Red Sea corridor off Al Hudaydah, which would indicate a shift from isolated event to renewed campaign tempo.