Hormuz’s Stalled Recovery: Two Strikes and Suspended Evacuation

At a Glance

• Two kinetic incidents in 72 hours have tested the post-MoU operating environment, including the June 25 attack on the Singapore-flagged cargo vessel EVER LOVELY and the June 27 UAV strike on the Panama-flagged VLCC KIKU carrying Qatari crude.
• The June 27 strike on a commercially neutral, non-sanctioned vessel carrying legitimate Gulf cargo represents a significant escalation in targeting parameters.
• The IMO vessel evacuation plan remains suspended following the June 25 attack, with no confirmed resumption date; approximately 115 ships and 2,500 crew members were moved in the three and a half days the plan operated.
• The U.S. military-assisted southern corridor under Project Freedom continues to function, with a Saudi-flagged tanker confirmed transiting under active U.S. AWACS air cover on June 29.
• Total daily transits are averaging approximately 13, roughly 90% below pre-war levels of 130 to 138 per day.
• Two OFAC-sanctioned Iranian-linked tankers were identified broadcasting fraudulent Norwegian flag registrations, one of the most audacious deceptive flagging incidents documented during the conflict.
• Kharg Island resumed dual-berth loading for the first time since June 20 to 22, with a sanctioned IRISL-operated tanker confirmed loading approximately 707,000 barrels on June 28.

Operational Overview

The Strait of Hormuz is technically open, but it is not functioning as commercial infrastructure. Two kinetic incidents in 72 hours, an IMO evacuation corridor suspended without a resumption date, and total daily transits averaging approximately 13, roughly 90% below pre-war levels, collectively describe a corridor that is open in name but operating well below the threshold of normal commercial activity.

What has not collapsed is the U.S.-assisted southern corridor under Project Freedom, which has continued to function throughout the IMO suspension and is now sustaining the southern lane on its own, with a Saudi-flagged tanker confirmed transiting under active U.S. AWACS air cover on June 29.

Iran’s posture is hardening rather than softening. The IRGC issued a formal statement on June 24 declaring any routing outside Iranian-designated lanes highly dangerous and prohibited. The June 25 EVER LOVELY attack followed in the southern corridor, and the June 27 UAV strike on a Panama-flagged VLCC carrying Qatari crude, KIKU, introduced a non-sanctioned, commercially neutral vessel into the targeting set. In parallel, two OFAC-sanctioned Iranian-linked tankers have been identified broadcasting fraudulent Norwegian flag registrations, a deliberate provocation in a corridor under active U.S. and European military scrutiny.

Windward assesses that the Strait is now operating under competing pressures, with Iranian enforcement tightening on one side and U.S. military escort maintaining a corridor on the other, and that the gap between technical openness and functional commercial throughput continues to widen.

Two Strikes in 72 Hours

The post-MoU operating environment has been tested by two kinetic incidents over a three-day window, the first targeting a small cargo vessel and the second a major VLCC carrying Gulf-produced crude.

On June 25, the Singapore-flagged cargo vessel EVER LOVELY (IMO 9629110) was struck by a projectile approximately 7.5 nautical miles southeast of Dahit, Oman, in the southern corridor. UKMTO confirmed damage to the bridge with no casualties and no environmental impact. 

The IMO temporarily paused its vessel evacuation plan in direct response to the attack. In the hours following the incident, the central corridor cleared out, with vessels concentrating along the northern and southern coastal edges in a pattern consistent with operators vacating the exposed center lane.

On June 27, the Panama-flagged VLCC KIKU (IMO 9329796), a 333-meter vessel, was struck by a UAV approximately nine nautical miles north of Khasab, Oman, while transiting outbound laden with Qatari crude. The UAV impacted the vessel’s starboard bridge, causing minor damage, with no casualties reported and the vessel remaining seaworthy and continuing underway. KIKU had emerged from a 13.5-day dark period on June 26, transmitting AIS for approximately five hours before the strike, at which point it ceased transmission. The vessel was operated by a major international trading company and owned by a Liberian entity with Greek technical management, commercially neutral tonnage, and not Iran-affiliated. The strike on a non-sanctioned vessel carrying legitimate Gulf cargo represents a significant escalation in targeting parameters.

The June 25 IRGC turnaround order in the southern corridor, issued via VHF Channel 16 and an official Telegram channel, sits alongside both kinetic incidents as part of the same enforcement posture. Two further vessels were observed performing U-turns at dawn on June 27, likely linked to ongoing U.S. strikes overnight.

The IMO Evacuation Suspended, but Project Freedom Sustains the Southern Lane

The IMO vessel evacuation plan, launched on June 23 to move more than 550 stranded ships out of the Middle East Gulf, remains suspended following the EVER LOVELY attack. In the three and a half days of operation before the suspension, approximately 115 ships and 2,500 crew members were moved. The IMO has not confirmed a resumption date.

The IMO plan was built on the assumption that safety guarantees from Iran were in place. That assumption is now in question. The attack on EVER LOVELY did not come without warning. On June 24, the IRGC issued a formal statement declaring that any routing outside Iranian-designated lanes was highly dangerous and prohibited. Iran’s Persian Gulf Strait Authority subsequently placed full responsibility for any incident on owners and operators of vessels using unauthorized routes.

A separate U.S. military-assisted corridor along the same Omani coastline has continued operating throughout the suspension. Project Freedom, in operation since May, is coordinated through U.S. NCAGS and Oman rather than UKMTO or the MICA Centre, and provides the only verified safe-passage mechanism currently active in the southern corridor.

On June 27, the IMO confirmed that 11 vessels used the southern Omani corridor and four used the northern Iranian-controlled route. As of June 29, Windward tracking confirms a Saudi-flagged oil and chemicals tanker of 183 meters managed by a Saudi industrial conglomerate transiting the southern corridor at 13 knots, with a U.S. Air Force E-3B Sentry AWACS aircraft operating over the UAE and Gulf of Oman simultaneously, consistent with active U.S. air cover for the vessel’s passage.

Traffic data since June 27 shows a further shift, with fewer vessels using the southern Omani corridor and the majority of limited transit traffic now routing via the northern Iranian-controlled lane. Total daily transits are averaging approximately 13, roughly 90% below pre-war levels of 130 to 138 per day.

An ADNOC LNG Carrier Holds at the Southern Corridor Approach

A Liberia-flagged ADNOC-operated LNG tanker was observed on June 29 sailing at approximately 10 knots toward what appeared to be the southern corridor outbound approach before halting and circling a fixed point on the western side of the Strait adjacent to the Omani coast. The vessel had entered the Strait after May 10, having gone dark outside the Strait along the Omani coast prior to that date, and remained dark until June 29, when it resumed movement toward the southern corridor.

Whether the vessel is preparing for an outbound transit or holding pending clearance or escort coordination is not yet determined. The vessel’s next move will be an early indicator of operator confidence in the corridor’s safety, particularly for high-value LNG tonnage. Windward is monitoring the vessel closely.

Fraudulent Norwegian Flag Vessels Mark an Escalation in Deceptive Flagging

Two OFAC-sanctioned Iranian-linked tankers have been identified broadcasting fraudulent Norwegian flag registrations, representing one of the most audacious examples of deceptive flagging documented during the Hormuz conflict. One is an oil and chemicals tanker, the second is an LPG tanker. Both were identified within the same week.

Norway is a NATO member with active involvement in shadow fleet enforcement in European waters. The use of a European NATO flag by sanctioned Iranian tonnage in a corridor under active U.S. and European military scrutiny is assessed as a deliberate provocation, consistent with the broader pattern of Iran signaling that it will continue energy commodity exports irrespective of international maritime rules and regulations.

June 28 Transits of the Strait of Hormuz

June 28 recorded 42 transits, comprising 28 inbound and 14 outbound, with corridor distribution heavily weighted toward the Iranian-controlled northern lane and the southern corridor accounting for the remainder.

The inbound group comprised 25 AIS-transmitting and three dark vessels, with 12 tankers spanning UAE, Singapore, Madagascar, Comoros, Liberia, Iran, Palau, Panama, St. Kitts and Nevis, and Marshall Islands flags, alongside two Liberia-flagged bulk carriers and 11 cargo vessels under India, Iran, Panama, Togo, Comoros, Sri Lanka, and Equatorial Guinea flags. Thirteen transited via the northern corridor and 12 via the southern corridor.

The outbound group comprised 12 AIS-transmitting and two dark vessels, with three tankers under Liberia and Panama flags, four bulk carriers under Hong Kong, Panama, Marshall Islands, and India flags, and five cargo vessels under Panama, Hong Kong, Antigua and Barbuda, France, and Comoros flags. Eight transited via the northern corridor and four via the southern corridor.

Coordinated Evasion Behavior in the Overnight Window

Three OFAC-sanctioned vessels transited in the June 28 to 29 overnight window. An OFAC-sanctioned Comoros-flagged oil and chemicals tanker of 183 meters transited outbound carrying approximately 337,100 barrels, according to Vortexa,  following recent calls at Russian Baltic ports, with destination listed as Shinas, Oman. A Curacao-flagged oil products tanker of 183 meters heading to Larak, Iran, had emerged from a 92-day AIS blackout with six identity manipulation events. A Guyana-flagged LPG tanker of 120 meters with an 89-day dark period had conducted confirmed IMO spoofing, alternating between two IMO numbers with dozens of name changes.

A Panama-flagged oil and chemicals tanker of 183 meters with identity tampering and multiple equatorial null island meeting events in May 2026 also transited outbound, with Vortexa data suggesting that it was carrying approximately 185,500 barrels with Iraqi port history, consistent with ship-to-ship transfers or coordination at a location chosen to avoid monitoring.

Four vessels across the window share a pattern of extensive AIS blackouts and identity tampering, with dark periods of 89 to 92 days alongside multiple identity manipulation events. The pattern is consistent with a coordinated evasion network rather than isolated technical failure. A Panama-flagged container ship with a Russian port history and a Netherlands Caribbean-flagged vessel both met a sanctioned inbound tanker in June 2026, a shared contact that warrants further examination.

Vortexa data indicates that outbound cargo in the overnight window totaled approximately 522,600 barrels of oil products at an estimated value of approximately $37.6 million.

Kharg Island Resumes Dual-Berth Loading

EO imagery collected over Kharg Island across multiple windows from June 25 to 28 documents a sustained and expanding crude loading cycle.

The June 25 collection confirmed one dark VLCC at the eastern terminal’s northern berths, assessed as laden, with 21 tankers in the waiting area, an above-average queue consistent with high export demand or a slower-than-usual loading cadence. The June 26 collection showed a new ballast VLCC of approximately 333 meters at the eastern terminal T-jetty, with the eastern waiting area holding 26 vessels, including 23 tankers, with laden dark vessels comprising 71% of the dark fleet. One OFAC-sanctioned Iran-flagged tanker of 183 meters was transmitting AIS in the waiting area, notable for a sanctioned vessel and consistent with the post-MoU shift toward reduced concealment.

The June 27 collection showed both export terminals active simultaneously for the first time since the post-MoU OFAC loading event on June 20 to 22. The eastern terminal T-jetty VLCC showed reduced freeboard versus the June 26 ballast collection, confirming loading commenced overnight. The western terminal had a new VLCC of 334 meters at berth with loading arms connected, the first vessel at this berth since the two sanctioned VLCCs departed on June 25.

The June 28 collection showed the western terminal with a VLCC of approximately 334 meters berthed with pipes connected in an active or final loading phase. The eastern oil terminal had two tankers alongside loading, including an identified OFAC-sanctioned IRISL-operated Iran-flagged oil products tanker of 183 meters confirmed loading since 02:51 UTC carrying approximately 707,000 barrels of gas oil and gasoline, with departure estimated between 22:00 UTC on June 28 and 06:00 UTC on June 29. A dark tanker has been alongside the adjacent eastern berth since June 26, identity unknown.

IRGC High-Speed Craft Activity

IRGC high-speed craft counts have declined sharply since the MoU ceasefire took effect on June 18, following a peak of 673 craft on May 14 and a count of 106 on June 14. Weekly totals from EO and SAR detections between June 17 and 25 recorded 148 craft across five collection days, comprising 39 on June 17, 17 on June 19, 45 on June 20, 32 on June 22, and 15 on June 24. The June 20 rebound to 45 and the June 22 count of 32 coincided with Iran’s PGSA re-closure announcement on June 21, indicating that enforcement capacity remains intact even as formation size has reduced.

The June 27 collection documented a swarm of approximately 100 craft mid-strait heading northward, representing the weekly peak. The June 28 collection documented approximately 60 crafts across three zones in western Hormuz.

Windward assesses that the shift from mass swarm formations to a smaller, dispersed patrol posture reflects a transition from blockade enforcement to monitoring and control. The June 25 VHF turnaround order and the June 27 UAV strike both demonstrate that coercive capacity remains active with fewer craft. Enforcement is now radio and kinetic rather than swarm-based.

Saudi Aramco Helicopter Crash at Ras Tanura

A Saudi Aramco helicopter crashed at Ras Tanura, Saudi Arabia, on June 28, killing at least 14 people. The cause of the crash is unknown, and an investigation is ongoing. Ras Tanura hosts the largest refinery in the Middle East. No impact on refinery operations has been confirmed at this time. Windward is monitoring for any downstream effect on crude loading or export activity at the terminal.

Outlook

The Strait of Hormuz is open, but recovery has stalled. Two kinetic incidents in 72 hours, one of them targeting a commercially neutral VLCC carrying Qatari crude, have raised the targeting threshold beyond sanctioned tonnage. The IMO evacuation framework is suspended without a confirmed resumption date. Total daily transits are running at roughly 10% of pre-war volume. Iranian enforcement is now active across all three corridors, and the deliberate provocation of fraudulent Norwegian flag broadcasts signals that Iran does not intend to recalibrate its export network to international standards.

What has held the corridor together is the U.S.-assisted southern lane under Project Freedom, now sustaining limited safe-passage transits with active AWACS air cover. Whether that mechanism alone can carry the corridor while the IMO framework is suspended will be tested in the coming days, with the ADNOC LNG carrier’s next movement at the southern corridor approach the clearest near-term indicator of operator confidence.

The gap between technical openness and functional commercial throughput continues to widen, and a full normalization of the Strait remains contingent on Iranian enforcement of de-escalation, the resumption of the IMO evacuation framework, and the clearance of the Traffic Separation Scheme, none of which are in prospect as of this reporting cycle.