The Drill
Mowing the grass
The US tried to move the Iran war from the Strait to the balance sheet in August; the IRGC dragged it back to the water, and Washington now answers with “tanker for tanker” and a standing campaign against the Iranian coast. At the same time, Berlin has formally blamed Moscow for the Leipzig airport drone and rockets that hit a Brandenburg grid substation.
The US tried to move the Iran war from the Strait to the balance sheet in August; the IRGC dragged it back to the water, and Washington now answers with “tanker for tanker” and a standing campaign against the Iranian coast. At the same time, Berlin has formally blamed Moscow for the Leipzig airport drone and rockets that hit a Brandenburg grid substation.
The Battle of Hormuz: Round Three
Through August, the US tried to pivot the war away from kinetic force: Bessent's G20 line was to “economically asphyxiate” the regime, the June MoU was left to expire, and there were no major US strikes for about a month. The IRGC did not accept the pivot. It attacked ADNOC vessels on 8 and 14 August, fired ballistic missiles at maritime traffic off the UAE on 18-19 August, and on Monday evening hit two VLCCs carrying Saudi crude, Sidr and Senegal Prosperity, within minutes of each other off Khasab.
Washington has pivoted back with a clearer doctrine than in June or July. Trump approved a “tanker for tanker” policy, and on Tuesday the US hit roughly 100 targets, including two Iranian government tankers, the first US strikes on Iranian tankers in this war. Alongside it CENTCOM is “mowing the lawn”, the officials' own phrase: repeated strikes at Bandar Abbas, Jask, Chabahar, Qeshm and Larak to keep IRGC radar, missile, drone and mine-laying capabilities degraded rather than letting them rebuild between rounds. The “we're close to a deal” messaging is gone; Trump declined Pezeshkian's offer to accept the June MoU, and the White House now says the Iranians are “always a day late and a dollar short”. Israeli-sourced reporting says the larger campaign, nuclear file included, is being saved for after the midterms while munitions and interceptors are rebuilt. I treat that as plausible rather than confirmed.
Iranian retaliation is thinner than the rhetoric. Saturday's missiles at Jordan were intercepted, the “dozens of drones” claimed against Al Minhad in Dubai produced one confirmed interception, and Gulf interception rates have been the highest of the war since July. Iran is playing the Dubai card, trying to make the war unbearable for US partners with a far lower tolerance for missiles over their cities than Washington has. The UAE's answer so far is an indefinite trade embargo on Iran.
To sum up: the war remains concentrated on the Strait, Kpler counted five commodity transits on Monday (none of them tankers, against roughly 85 a day before the war), and Iran is under massive pressure. I retain my estimate that Tehran will have to compromise within one to two months. In the meantime the pattern in the chart is the one I am trading: each US cluster has been followed by one to two weeks of IRGC retaliation and a Brent spike, then a decline once the IRGC's capacity to hit shipping is visibly degraded and both sides pause. That is how early June and late July played out.
My take: I lean short oil. Brent is up 8.6% week to date to $95.70, a six-week high, so we are in the spike phase now, and if the pattern holds, we get another one to two weeks of attacks before the IRGC breaks a bit and Brent trends down again. This is speculative and not rock-hard technical analysis, but this is war, so it is the best we have. Instruments in the Friday portfolio update.
The bigger macro issue sits in refined products rather than crude. Gulf product and LNG exporters behind the Strait cannot shuttle output the way crude can (Qatar's LNG exports are down as much as 96%, force majeure now runs to November), and the second leg of the squeeze is Russian. The US diesel crack broke $100/bbl in August and set a record above $106 on Tuesday.
Ukraine's refinery campaign has been running since March 2024, but 2026 is when it stopped being a nuisance and became a structural hole in the diesel market. Our estimate of Russian capacity offline crossed 50% in July and peaked near 58% at the height of the strike campaign, with runs at 3.6-3.8 mb/d against a seasonal norm of 5.3-5.6 mb/d, a 24-year low. Moscow answered with a diesel export ban in July, since extended, and Russia's share of global diesel exports has gone from roughly 12% before the campaign to about 1%. Two of the world's three big product-exporting regions are now impaired at once, and that is a European problem before it is anyone else's. It is also the bridge to this week's second topic, because the refinery campaign is the clearest example of how far Europe's proxy war on the Russian economy has already gone.
Europe and Russia Are Escalating at the Same Time
Europe and Russia Are Escalating at the Same Time
European foreign ministers met at the Gymnich in Wicklow on Tuesday and Wednesday, straight after the defense ministers' informal at the same venue. The published agenda was winter support for Ukraine, the 22nd sanctions package and Hormuz, but hybrid war took over the margins. On Monday Interior Minister Dobrindt formally attributed the Leipzig airport drone to Russia: a drone carrying about 0.6 kg of explosives with a failed detonator, found on 5 August next to a Ukrainian An-124 used for weapons transport, with US intelligence pointing at the GRU. Berlin is closing the Russian consulate in Bonn and pushing for EU sanctions. Hours later, improvised rockets fitted with explosives were fired at the Turnow-Preilack substation that connects the Janschwalde lignite plant to the 50Hertz grid. No outage, no official attribution yet, but Der Spiegel reports the trail points at Russian intelligence, and Kallas called Leipzig “state-sponsored terrorism” on her way into the meeting.
What I see is a mutual escalation through 2026 that Western media has treated as a series of isolated incidents. The other direction is just as real. Since 18 July Ukraine has hit around 20 Wildberries facilities across Russia, including a 600-drone strike on 16 August that destroyed the Koledino complex near Podolsk, Russia's largest e-commerce warehouse, preceded by HUR cyber operations against the company's systems. Seven of Wildberries ten largest logistics centers are reportedly out, at a cost estimated at $6-12bn. Add the refinery campaign from the chart above. These are strikes on the Russian civilian economy, conducted with Ukrainian drones but tolerated and increasingly cheered in European capitals.
That is the context for CIA Director Ratcliffe's Moscow visit on 25-26 August, where he met SVR chief Naryshkin. Politico reported he warned Moscow off any move against Estonia, Latvia or Lithuania; CNN adds that he pressed Russia to cut support for Iran, and Baltic officials themselves say their threat assessment has not changed. I read the trip as Washington trying to keep two escalation ladders apart.
Meanwhile, Russia is preparing for the winter and, quite possibly, a much larger mobilization after the 18-20 September Duma elections. Zelensky, citing HUR, puts it at around 300,000 after the election and up to 500,000 in 2027; ISW assesses Putin will try to add 300,000-400,000 through covert channels rather than a declared draft. The operational goal of the winter campaign is the fortress belt from Kostiantynivka through Druzhkivka to Kramatorsk and Sloviansk.
Gerasimov claims his troops are 4 km from Sloviansk; DeepState and ISW have them at 12-16 km, with Russian groups about 7 km east of Kramatorsk airfield. If Russia takes the belt, it essentially completes the Donbas and leaves a fait accompli that is very hard for Ukraine and the West to reverse. The honest counterpoint is that ISW rates a near-term capture as extremely unlikely and Russia actually lost net territory in August.
What is the timeline? I do not think Ukraine collapses, and I do not think Russia invades Lithuania. An imminent collapse of the Russian economy or army is not realistic either. What is more tangible than the war timeline is that Europe is growing bolder, Russia is answering with kinetic hybrid attacks on European infrastructure, and the logical result is European rearmament in the layer that hardware rearmament skipped: cyber defense, secure networks, sovereign infrastructure.
The H2 cyber calendar, and the names we push into it
The H2 cyber calendar, and the names we push into it
The political calendar, the incident data and two earnings prints now fall in the same 90-day window. That window is where I want to be long the European cyber layer, and the three names below are how.
The Gymnich opened the Irish Presidency's security semester, and Ireland has made the Cybersecurity Act revision its headline cyber file, alongside NIS2, the Critical Entities Resilience directive and the CRA. On 11 September, nine days from now, the CRA’s reporting obligations take effect: manufacturers of connected products and software must report actively exploited vulnerabilities and severe incidents across the EU. That is compliance spending that lands this quarter. The National Cyber Security Conference in Dublin on 7 October, the centerpiece of the Presidency’s Cyber Week, covers digital sovereignty and supply chains, subsea cables, attribution and deterrence, and civil-military cooperation. ENISA habitually publishes its Threat Landscape in October; whatever the count, it will land after the worst visible ransomware half-year on record in Europe (TicTac counts 1,115 attacks in H1 2026, up 29% year on year, April the worst single month at 245).
The structural piece is the Cybersecurity Act 2, tabled in January. It gives the Commission a list of high-risk suppliers and mandates that their components be phased out of electronic communications networks within 36 months, with a wider ICT supply-chain framework across the 18 NIS2 sectors. Russia and China are not named in the text, and there is no official timetable for adoption yet, but Beijing's Commerce Ministry has already objected, which tells you who the list is for. On enforcement, the Commission has moved past warning letters: in July it referred Ireland, Spain, France and the Netherlands to the Court of Justice with a request for daily penalties over NIS2 non-transposition. Then Thales reports Q3 order intake on 22 October and secunet reports on 12 November, both into a six-week news flow defined by Cyber Week, ENISA and the Presidency.
secunet (XETRA: YSN) is the most compelling position. H1 2026, published 13 August, showed revenue up 19.2% to EUR 204.7m, EBIT up 20.4%, and order intake up 78.7% to EUR 287.4m, the largest half in the company's history, with Q2 EBIT more than doubling. Management now guides to the upper end of the EUR 460-500m revenue range. Full-year 2025 order intake was EUR 531.9m and the backlog stood at EUR 360.8m at end June, so a large share of 2026 revenue was already booked before a single new contract. secunet is the German federal government's designated IT security partner and owns the SINA classified-network architecture that the BSI approves up to GEHEIM; every tightening of the high-risk supplier rules strengthens that franchise. The stock has slid to around EUR 177-179 from EUR 189 in mid-August despite the print, against Warburg at EUR 260 and Berenberg at EUR 254. The 12 November Q3 report is the catalyst; October's Cyber Week sets the narrative. Illiquidity is the real risk, so size accordingly.
Thales (EPA: HO) is the larger-cap, cleaner entry. RBC initiated at Outperform with a EUR 330 target on August 11th, consensus sits around EUR 295, and the stock has kept falling to around EUR 238-244, roughly 10% below where RBC started coverage. European defence as a sector is 9-11% off its Q1 high depending on the instrument. The bear case is that the digital identity and security division is the weak spot. That division is exactly what benefits from CRA compliance demand and from procurement being rerouted away from high-risk suppliers, and the 22 October Q3 print is the first window where management can quantify it. H1 order intake already grew 22% organically to EUR 12.5bn, and in July Thales raised its book-to-bill and cash-conversion targets.
OVHcloud (EPA: OVH) is the longer-duration expression: Gartner has European sovereign cloud IaaS spend going from $6.7bn in 2025 to $23.1bn in 2027, and OVHcloud sits in the consortium selected in April for the Commission's own sovereign cloud framework. It belongs in the thesis but not as a 60-day trade. The CFO's surprise departure on 26 August took the stock down 8% in a day; it has fallen further since to around EUR 13.8. Consensus targets are still below the price, and the capital intensity is ongoing.
The rearmament premium repriced hardware in 2025 and has been giving some of it back since Q1. The cyber layer never got the premium in the first place. That is the trade, and position sizes go in the Friday portfolio update.
