Following Operation Epic Fury, regional kinetic operations have transitioned into direct, persistent threats against commercial shipping, energy infrastructure, and critical supply chains.

The Flashpoint Threat Intelligence Brief: Middle East cuts through headline noise to deliver tactical, ground-level intelligence for government agencies, corporate security leads, and global logistics teams—turning Flashpoint’s primary source intelligence into proactive risk mitigation.

Here are the updates from this week that your security operations team should be tracking.

Operational SITREP: Executive Summary

Between October 23 and October 29, Ansarallah (the Houthi movement) continued its campaign against Saudi aviation, military, and energy infrastructure. Houthi military spokesperson Yahya Saree claimed ballistic missile and drone strikes on King Khalid International Airport, Saudi Aramco facilities in Yanbu, crude oil pumping stations, and the Ras Tanura refinery. On October 27, the group also claimed to have struck Saudi Arabia’s Ministry of Defense headquarters in Riyadh and military transport aircraft at Abha airport along with King Khalid Air Base. Saudi authorities have not confirmed damage at several of these sites.

Saudi-led coalition forces reported intercepting missiles and drones targeting Riyadh, Khamis Mushait, the Eastern Province, and other areas, including 10 ballistic missiles directed toward southern Saudi Arabia on October 25. King Khalid International Airport resumed international flights that day, although Ansarallah warned airlines that the airport remained a military target. Coalition air strikes continued in northern Yemen, with the Sanaa-based Health Ministry reporting eight fatalities following a strike on workers’ housing in Hamdan.

Houthi ground operations also intensified around Taiz and Lahj, with reported advances along the Jabal Sabr front and an assault on Al-Maqatira Castle. On October 29, Yemeni government forces reported that Ansarallah fired two ballistic missiles at Aden International Airport, extending the threat to another major aviation facility.

The United States ordered nonessential staff and families to depart its embassy in Riyadh and consulates in Jeddah and Dhahran following statements by Islamic Revolutionary Guard Corps (IRGC) officials identifying American diplomats as legitimate targets. Similar precautionary measures were reported at US missions elsewhere in the Middle East. US officials also cited intelligence indicating potential Iranian assassination planning against American diplomatic and government personnel.

Iran continued operations against Kurdish opposition groups in Iraq, with the IRGC conducting a drone strike on a Komala facility near Erbil on October 24. Maritime incidents persisted near the Strait of Hormuz, including a UKMTO report of a vessel on fire north of Khasab, Oman on October 29. The IRGC Navy separately claimed to have electronically seized and landed a US drone west of the strait, although that claim remains unverified.

In the cyber domain, researchers from TrendAI, Citizen Lab, and Confiant identified additional surveillance activity involving Israeli advertising technology firm Discover-Tech. The company reportedly bid on advertising traffic associated with Starlink users in more than 100 countries, enabling potential identification and geolocation of individuals in conflict-affected regions. Google and Comcast subsequently removed the firm from their advertising platforms.

Kinetic & Maritime Risk

The resumption of international flights at King Khalid International Airport does not eliminate the risk of further disruption. Ansarallah has continued to designate the airport as a military target, while missile interceptions have created additional hazards for surrounding communities. In Khamis Mushait and Ahad Rafidah, falling debris injured two people and damaged residential buildings and vehicles. Similar debris was reported across parts of western Saudi Arabia, including areas around Jeddah, Taif, and Rabigh.

In Yemen, Houthi advances along the Jabal Sabr front have brought fighting closer to government-held positions overlooking Taiz, including areas near Taiz University. The expanding offensive threatens access routes around a city where the UN has warned that approximately 800,000 people urgently need humanitarian assistance. Continued operations in Lahj and attacks toward Aden add further uncertainty for transport and government facilities in southern Yemen.

Western-linked personnel and facilities face increased exposure following Iranian threats against American diplomats. The US drawdown extends beyond Saudi Arabia, with similar precautionary measures reported at diplomatic missions in the UAE, Lebanon, Qatar, Jordan, Bahrain, and Kuwait. Iranian allegations that US aircraft are operating from Gulf states could also increase the risk of Tehran identifying host-nation military facilities as potential targets in a renewed confrontation.

At sea, the reported incidents near Khasab and Iraq’s Al-Faw port highlight risks across both the Strait of Hormuz approaches and the northern Gulf. The reporting identifies 113 maritime attacks in and around the Strait of Hormuz since February 28, underscoring the sustained exposure of commercial vessels operating through the region.

Cyber and Hybrid Risk

The latest Discover-Tech findings raise particular concerns about the information exposed through real-time advertising auctions. Researchers found that the firm could use advertising bid requests to identify and geolocate Starlink users, with activity concentrated in countries affected by conflict or political instability. This creates potential surveillance exposure for personnel relying on satellite internet services in areas where other communications infrastructure may be limited or disrupted.

The research also builds on earlier findings connecting Discover-Tech to the delivery of Candiru spyware through online advertisements. Although advertising-based tracking does not itself establish that a device was compromised, the ability to identify and locate specific users could support subsequent targeting. Google and Comcast’s removal of Discover-Tech from their advertising platforms represents a response to the reported activity.

Separately, the IRGC Navy’s claimed electronic takeover of a US drone near the Strait of Hormuz remains unverified. If substantiated, the incident would indicate an electronic warfare capability relevant to unmanned aircraft operating near Iranian-controlled waters. Iran’s announcement of arrests involving alleged US- and Israel-linked intelligence cells also reflects its continued focus on identifying suspected foreign intelligence activity, although the alleged affiliations have not been independently established.

Recommended Risk Posture and Protective Controls

Organizations with personnel, facilities, or operations exposed to the conflict should maintain heightened awareness of physical security, travel, maritime, and surveillance risks.

Cyber Defense

• Limit advertising-based tracking: Organizations with personnel using Starlink or other satellite internet services in conflict zones should review network- and browser-level ad blocking, restrict advertising identifiers on managed devices, and assess exposure of location and device data through advertising systems.
• Review counterintelligence exposure: Organizations with personnel or partners traveling to Iran should limit the sensitive information carried on devices, review communications practices, and reinforce check-in procedures in light of recent arrests of alleged foreign-linked cells.

Physical and Operational Defense

• Strengthen protections for US-linked personnel: Organizations supporting diplomatic missions or employing current and former US government officials should review travel, residence, and event security in response to reported Iranian threats.
• Reassess Saudi Arabia travel and facility plans: Confirm flight status before travel, review shelter procedures, and account for the risks associated with missile interception debris, particularly in Riyadh, Jeddah, Dhahran, and southern Saudi Arabia.
• Maintain heightened maritime security: Shipping operators should monitor UKMTO advisories, review transit risks near Khasab and Al-Faw, and reinforce crew readiness for fires and other onboard emergencies.
• Review exposure near Erbil: Organizations operating in Iraq’s Kurdistan region should assess proximity to Iranian Kurdish opposition facilities and update shelter and personnel-accountability procedures following repeated IRGC strikes.

Strategic Outlook: Operational Forecast

Over the next 48–72 hours, Houthi forces are likely to sustain missile and drone attacks against Saudi aviation, energy, and military infrastructure while continuing operations around Taiz, Lahj, and Aden. The resumption of international flights at King Khalid International Airport does not eliminate the threat of renewed disruption, particularly given Ansarallah’s continued designation of the airport as a target. Saudi-led coalition strikes in northern Yemen are also likely to continue.

The US diplomatic drawdown reflects heightened concern about threats to American personnel, while reported planning for additional US strikes against Iran introduces uncertainty ahead of the November 3 midterm elections. Iranian Foreign Minister Abbas Araghchi’s statements about continued diplomatic contacts suggest negotiations remain possible, although no breakthrough has been reported.

Maritime incidents near the Strait of Hormuz and northern Gulf are likely to persist, with additional uncertainty surrounding the IRGC’s claims of electronic warfare operations against US aircraft. Iranian strikes against Kurdish opposition positions near Erbil may also continue, alongside further counterintelligence arrests and public accusations of foreign involvement.

In the cyber domain, the latest Discover-Tech findings may prompt additional scrutiny of advertising-based surveillance and the exposure of satellite internet users in conflict-affected regions.

Enhance Threat Intelligence Using Flashpoint

As the conflict continues to affect military operations, commercial shipping, regional infrastructure, and digital communications, security teams need timely intelligence to assess emerging risks and protect their organizations.

Flashpoint combines primary-source monitoring, open-source intelligence, and geospatial analysis to help organizations identify developing threats, assess operational exposure, and make informed security decisions.

Request a demo to learn how Flashpoint supports physical security intelligence, threat monitoring, and operational risk assessment.

Frequently Asked Questions (FAQs)

What is the Flashpoint Physical Threat Intelligence Brief?

The Flashpoint Physical Threat Intelligence Brief: Middle East is a recurring threat intelligence update that translates raw primary-source open-source intelligence (OSINT) and geospatial data into actionable physical security analysis. It focuses on kinetic conflict developments, standoff weapon capabilities, maritime corridor security, and critical infrastructure risks across the Middle East.

How does Flashpoint gather physical security intelligence for the Middle East?

Flashpoint Physical Security Intelligence (PSI) gathers data by combining global open-source intelligence (OSINT), geolocated social media signals, satellite imagery, and primary-source threat monitoring. The platform uses AI-driven natural language processing and geospatial mapping to track kinetic developments, weapon strike radiuses, and physical security threats in real time.