Hormuz’s NCAGS Corridor Under Attack: Two Laden Tankers Struck Overnight

At a Glance

• Two laden tankers were struck overnight on the NCAGS-approved outbound route, including AL REKAYYAT, a Marshall Islands-flagged Qatari LNG carrier, and a Saudi-owned ULCC, both running dark at the time of attack.
• The AL REKAYYAT strike is the third confirmed IRGC attack on Qatari LNG assets in 2026, following a hit near Ras Laffan in March and the turning back of two LNG carriers under IRGC pressure in April.
• Six vessels were rerouted from the southern corridor to the central corridor in immediate response, and one LNG tanker carrying approximately 902,200 barrels of cargo halted its transit and anchored midway in the Strait.
• The strikes occurred during multi-day funeral proceedings in Iran for former Supreme Leader Ali Khamenei and amid ongoing U.S.-Iran peace talks.
• Kharg Island reached simultaneous three-terminal loading activity for the first time in weeks, with 85% of the eastern waiting area assessed as laden.
• Windward has confirmed a new Iranian sanctions evasion technique, asymmetric anchor-swing spoofing, in which vessels broadcast fabricated AIS anchorage tracks while actually loading at Kharg Island.
• July 6 recorded 45 transits, and two convoys of 11 commercial vessels each were observed approaching the southern corridor exit on the morning of July 7.
• Windward assesses the operational risk environment for commercial shipping throughout the Strait of Hormuz, Gulf of Oman, and northern Arabian Gulf as critical.

Operational Overview

The Strait of Hormuz is functionally contested again. Overnight into July 7, the IRGC struck two laden tankers running dark on the NCAGS-approved outbound route, hitting a Qatari LNG carrier and a Saudi-owned ULCC in a single window. Six vessels rerouted from the southern corridor to the central corridor in immediate response, and one LNG tanker halted its transit and anchored midway to the Strait.

The AL REKAYYAT strike marks the third confirmed IRGC attack on Qatari LNG assets in 2026. Combined with the concurrent strike on a Saudi ULCC, the pattern suggests U.S.-aligned Gulf energy infrastructure is now within the IRGC’s target envelope. 

The southern NCAGS corridor’s status as a safe transit lane, sustained through the past two weeks by U.S. military escort under Project Freedom, is now in serious question. Commercial traffic is still moving, with 45 transits on July 6 and two 11-vessel convoys approaching the southern corridor on the morning of July 7, but the operating assumptions behind the reopening are being retested in real time.

At Kharg Island, Iranian crude export operations continued to accelerate irrespective of the escalation, with all three loading terminals simultaneously active for the first time in weeks and the eastern waiting area 85% laden. Separately, Windward confirmed a sophisticated new Iranian evasion technique, asymmetric anchor-swing spoofing, in which sanctioned tankers broadcast fabricated AIS anchorage tracks while actually loading at Kharg.

Windward assesses the operational risk environment throughout the Strait of Hormuz, Gulf of Oman, and northern Arabian Gulf as Critical, with IRGC kinetic strikes on the approved outbound route, active corridor enforcement, and the IMO evacuation framework suspended all compounding simultaneously.

Two Laden Tankers Struck on the NCAGS-Approved Outbound Route

Two laden tankers were struck by IRGC missiles during outbound transit of the Strait of Hormuz via the NCAGS-approved route, both running dark at the time of attack.

The first vessel struck was AL REKAYYAT (IMO 9397339), a Marshall Islands-flagged Qatari LNG carrier of 315 meters operated by Qatar Liquefied Gas Company and owned by a Qatar state-linked entity. The vessel was hit by IRGC missiles near the engine room east of the Musandam Peninsula, with a fire reported. All crew were safe, and no casualties were reported. The vessel carries no sanctions exposure.

AL REKAYYAT had been dark since June 18, a 19-day AIS blackout, with pre-dark anomalies between June 5 and 18, including extended drifting, low-speed states, and five course deviations in the Arabian Sea inconsistent with normal LNG transit behavior. A draft change was recorded on July 6 at 23:14 UTC from 9.6 to 12.4 meters, with the vessel’s transmitted destination updating from the Arabian Sea to Dahej, India.

The strike on AL REKAYYAT is the third confirmed IRGC attack on Qatari LNG assets in 2026, following a hit on another tanker near Ras Laffan in March and the turning back of two LNG carriers under IRGC pressure in April.

The second vessel struck was a Saudi-owned ULCC, laden and transiting dark outbound approximately eight nautical miles east of Limah, Oman. A port-side fire was reported with no casualties.

Iranian state media confirmed the strikes, stating the Qatari LNG carrier was hit after ignoring warnings. Iran’s joint military command had previously warned vessels to use its approved routes.

Windward assesses the pair of strikes, one IRGC-attributed against Qatari LNG assets and one unattributed against a Saudi ULCC, in a single overnight window, most likely threatening Qatar’s plans to rapidly revive LNG exports from Ras Laffan and signaling that the Strait remains functionally contested despite reopening rhetoric.

Immediate Commercial Response to IRGC Strikes

The overnight strikes triggered an immediate commercial response, with six vessels rerouting from the southern corridor to the central corridor and one LNG tanker halting its transit and anchoring midway in the Strait.

Windward and Vortexa data identified the six rerouting vessels comprised a Panama-flagged LPG tanker of 224 meters carrying approximately 271,500 barrels of LPG propane and 242,900 barrels of LPG butane from Ras Laffan bound for an Indian ship-to-ship, a Barbados-flagged oil and chemicals tanker of 146 meters carrying approximately 151,400 barrels of chemicals from Shuaiba, Kuwait bound for Mundra, an Equatorial Guinea-flagged OFAC-sanctioned LPG tanker of 225 meters with a fraudulent registry arriving from China in ballast bound for a Dubai ship-to-ship, a Panama-flagged vessel that had departed Sirri Island bound for Singapore, an Iran-flagged OFAC-sanctioned bulk carrier of 190 meters, and a Panama-flagged vehicles carrier of 200 meters departing Port Khalifa, UAE.

The LNG tanker that halted its transit had departed Ras Laffan bound for Pakistan, carrying approximately 902,200 barrels of cargo of unknown material, assessed as probably LNG. The vessel anchored midway in the Strait rather than proceeding.

Funeral Proceedings and Ongoing Peace Talks

The strikes occurred during multi-day funeral proceedings in Iran for former Supreme Leader Ali Khamenei and amid ongoing U.S.-Iran peace talks, a context that amplifies the diplomatic significance of the escalation. Iran’s joint military command had previously warned vessels to use its approved routes, and Iranian state media confirmed the strikes with attribution to the failure of the Qatari LNG carrier to comply with those warnings.

July 6 Transits of the Strait of Hormuz

July 6 recorded 45 transits, comprising 18 inbound and 27 outbound.

The inbound group comprised 14 AIS-transmitting and four dark vessels, with eight tankers under Panama, Marshall Islands, Comoros, Bahamas, Nicaragua, Cameroon, and Iran flags, two bulk carriers under Malta and Iran flags, and eight cargo vessels under Bolivia, Comoros, Panama, Iran, Sri Lanka, and unidentified flags. Fourteen transited via the northern corridor and four via the southern corridor.

The outbound group comprised 23 AIS-transmitting and four dark vessels, with 15 tankers under Palau, Cameroon, Panama, Singapore, Mozambique, Marshall Islands, Cook Islands, Japan, Guyana, and unidentified flags, one unidentified bulk carrier, and 11 cargo vessels under Panama, Marshall Islands, India, Japan, Iran, Madagascar, Comoros, and unidentified flags. Twenty-three transited via the northern corridor and four via the southern corridor.

Kharg Island Reaches Simultaneous Three-Terminal Loading

EO imagery collected over Kharg Island on July 7 between 06:05 and 07:27 UTC showed the export complex running at high terminal utilization across all three berths simultaneously, a notable step up from the vacant picture on July 5.

At the western terminal, a dark tanker of approximately 333 meters was alongside for at least a second consecutive day, appearing to sit deeper than the July 6 collection, consistent with an ongoing loading operation. At the eastern terminal, two dark tankers of approximately 333 meters each, both present in the July 6 collection, also appeared more laden today, indicating parallel loading in progress across both eastern berths. At the LPG terminal, a dark LPG tanker of approximately 118 meters was assessed as having arrived today, not present in the July 6 collection.

The eastern waiting area held 20 dark stationary tankers across five size classes, with 17 of 20 assessed as laden, a waiting anchorage heavily skewed toward laden vessels at 85%, reading more as loaded-and-holding in floating storage or awaiting ship-to-ship transfer or onward routing than an inbound-empty queue. The composition comprised 10 VLCCs of approximately 333 meters, nine laden and one ballast, two vessels of approximately 272 meters, one laden and one ballast, four Suezmax-class vessels of approximately 250 meters, three laden and one ballast, three Aframax-class vessels of approximately 180 meters, all laden, and one tanker of approximately 113 meters laden.

Three IRGC high-speed craft were observed transiting through the waiting-area tanker cluster rather than patrolling its perimeter.

Windward assesses the simultaneous three-terminal loading, combined with the 85%-laden waiting area, and confirms that Iranian crude export operations continue at pace irrespective of the kinetic escalation in the Strait.

A New Evasion Technique: Asymmetric Anchor-Swing Spoofing

Windward has identified a sophisticated AIS manipulation method being used by sanctioned Iranian dark fleet tankers to conceal loading operations at Kharg Island. Rather than broadcasting a static false position, the classic spoofing tell, vessels are transmitting tracks that swing asymmetrically around a fixed point, replicating how a genuinely anchored ship yaws on its chain with wind and current. The irregular, non-circular loops read as a real anchorage on AIS alone and defeat simple stationary-is-suspicious detection heuristics. The method is exposable only with coincident imagery, where a SAR or EO pass over the broadcast position showing open water confirms the anchor is fabricated.

Two vessels have been confirmed using this method since April 2026. The first, an OFAC-SDGT-sanctioned Guyana-flagged VLCC of 333 meters designated under the Iran program, was identified by EO imagery at the Kharg Island NIOC Sea Island Terminal on July 2 while its AIS simultaneously broadcast a false anchor approximately 57 nautical miles west in the Iraq-Kuwait-Iran tri-border area near the Basra and Al-Faw oil terminal. Vortexa cargo data confirms approximately 1.87 million barrels of Iranian heavy crude loaded at Kharg between July 1 and 2 during the 10.4-day false-anchor window. The vessel’s actual destination is assessed as Lanshan, China, with an estimated arrival of approximately July 28.

The second, an OFAC-sanctioned LPG tanker under the Iran program, has been broadcasting a false anchor at the same tri-border coordinates since April 14, over 84 days ongoing, with a prior 96-day event at the same coordinates between October 2025 and January 2026, constituting a semi-permanent manipulation station. SAR imagery collected on June 28 over both broadcast positions confirmed no vessel was present at either location.

The tri-border box near Basra and Al-Faw is deliberately chosen, as a stationary tanker there appears routine and jurisdictional ambiguity complicates enforcement. Because AIS alone cannot separate this from a genuine anchorage, Windward assesses that persistent apparently anchored dark fleet tankers in this area should be treated as a standing imagery-tasking trigger.

Two Convoys Approach the Southern Corridor

During the morning of July 7, two convoys of 11 commercial ships each were observed in Omani waters approaching what appears to be the southern corridor exit. Windward is monitoring both groups for any diversions or turnarounds consistent with IRGC enforcement activity.

Outlook

The NCAGS-approved outbound route is no longer functioning as a safe lane. The IRGC has now struck two dark laden tankers on that route in a single overnight window, including a Qatari LNG asset for the third time this year.

The commercial response has been immediate. Six vessels rerouted from the southern corridor to the central corridor, and an LNG tanker halted mid-transit and anchored, all before the morning was out. The two 11-vessel convoys now approaching the southern corridor exit are the next indicator of whether commercial confidence in the lane can be sustained under current conditions.

Iran’s export operations are running in the opposite direction. Kharg Island is at peak throughput, all three terminals loading simultaneously, the waiting area 85% laden, and sanctioned tonnage is now exporting under a new fabricated-anchorage evasion technique that AIS monitoring alone cannot detect.

Windward assesses the operational risk environment as critical. The IMO evacuation framework remains suspended, IRGC corridor enforcement is now kinetic across the previously safe southern lane, and the gap between diplomatic engagement and maritime reality continues to widen.