Cumulative Energy and Food Crisis Inspiring Cyber Actors

Executive Summary

Three simultaneous conflicts—the war in Iran, the Russia-Ukraine war, and Iran-allied Houthi attacks in the Red Sea—are converging with extreme weather to disrupt global energy and food supply chains. On the energy side, the fighting in Iran has kept oil prices elevated; meanwhile, Iran-allied Houthi rebels in Yemen have begun attacking tankers in the Red Sea, which had served as a backup export route since the war in Iran began. Ukrainian strikes on Russian ships and oil refineries have sharply limited Russian exports and led Russia to respond in kind with highly damaging strikes on Ukraine’s port infrastructure. On the food side, these same conflicts are squeezing grain and fertilizer exports; Russia and Ukraine are leading grain exporters, while the Middle East is a fertilizer exporter.

Lastly, a global heatwave is damaging crops across the world, pushing food prices to a three-year high while simultaneously triggering increased demand for air conditioning, further straining energy supplies. These overlapping shocks are set to ripple through global supply chains, lifting costs for fuel and food staples alike. Further, both geopolitically and financially motivated cyber threat actors are likely to view the affected sectors as vulnerable targets.

Details

Middle East

Over the last month, fighting between the United States and Iran escalated before subsiding in early August. The Memorandum of Understanding (MOU) on ending the war went into effect on June 17;¹ however, bouts of intermittent fighting resumed on June 25, before the ceasefire effectively collapsed on July 8.² This led to nearly three weeks of constant fighting before the Trump administration unilaterally halted attacks on July 25³, likely because the resulting energy price inflation induced them to return to the negotiating table.

• On July 12, Iran again declared the vital energy corridor Strait of Hormuz (SoH) closed; on July 13, U.S. President Donald Trump said the U.S. Navy would reimpose its blockade of vessel traffic affiliated with Iran.⁴

On July 20, Yemen’s Houthi militia declared a blockade of Saudi Arabia’s Red Sea ports, further impacting global oil shipments.⁵

• Houthi attacks threaten to further squeeze global oil supply. Since the SoH was blocked, Saudi Arabia has rerouted the majority of its oil shipments to the Red Sea via the East-West pipeline.⁶ This, combined with other workarounds, has very likely kept oil prices from rising even more than they have to date.
• The Houthis claim to have struck at least eight cargo vessels as part of the blockade,⁷ likely necessitating additional workarounds.

Commodity Impacts

During this period, oil prices predictably seesawed. However, the region’s role in the liquefied natural gas (LNG) and fertilizer trade was less widely discussed. Following the U.S.-Iran airstrikes between June 25–29, Qatari LNG exports effectively halted, while oil tanker transit continued relatively uninterrupted until the ceasefire collapsed in early July. This disruption was partly due to an attack on a Qatari-linked oil tanker,⁸ which spiked insurance rates for Qatari vessels and likely signaled that they will be prioritized targets compared to other Gulf state vessels. This also led to a widespread divergence in LNG prices and oil prices. The latter spiked only modestly during the renewed hostilities, while LNG prices remain well above pre-war norms. 

• LNG operations are almost certainly more inherently complex to restart than oil production. This disparity likely further incentivizes the targeting of Qatari vessels over those transporting more readily available commodities, such as oil. This divergence in prices, coupled with consistent attacks on Qatari ships, is likely a signal that Qatari and the wider LNG trade cannot resume as quickly as the oil trade can.
• On July 28, 2026, QatarEnergy extended force majeure on LNG shipments for European and Asian customers until September, very likely signaling a  constraint in overall supply.⁹ Qatar produces 20 percent of the world’s LNG, and nearly all of this volume transits the SoH by ship with no alternative pipeline capacity—unlike oil, which benefits from numerous producing states and existing SoH bypasses. This vulnerability likely influenced Iran's decision to target Qatari ships during recent hostilities; a single attack on Qatar very likely represents a greater threat to the LNG industry than a similar strike on an oil vessel. 

The energy-producing Gulf region is also central to fertilizer exports. Before the latest conflict in Iran, approximately 20–40 cargo ships loaded with fertilizer would depart the SoH on a daily basis. However, that number dropped to the low single digits in late June and likely dropped to zero on some days during the worst of the July hostilities.¹⁰

• Prices for urea fertilizer jumped 6.2 percent for the week of July 10.¹¹
• The El Niño weather phenomenon was already expected to weaken crop forecasts for 2026 and 2027; these will likely be worsened by fertilizer shortages. Some farmers will likely decide against planting and instead opt to wait out price increases; this is expected to translate into higher global food prices.

Europe

Russia-Ukraine

As the initial round of fighting between the United States and Iran died down, Ukraine began a successful campaign targeting Russia’s leading revenue sources, which has constricted Russia’s oil refining capacity and ability to export grain. Russia retaliated in kind with similar strikes damaging Ukraine’s agricultural sector. These increased hostilities in the Black Sea region have prompted a mutually degrading security environment, creating a spillover effect for food and energy supply chains that did not exist in the early stages of the war in Iran but is now having daily impacts. 

Refining

Oil prices dropped quickly following the brief reopening of the SoH in June; however, refining capacity has not returned online as quickly as crude oil supplies. Therefore, benchmark crude prices dropped, but the prices consumers paid for gasoline, diesel, and jet fuel remained abnormally elevated. Ukraine’s growing accuracy in targeting Russian refineries will almost certainly worsen this dichotomy. 

• The crack spread (the difference between the price of oil and the refining margin) determines the prices consumers and businesses pay for fossil fuel products rather than the more closely tracked crude oil prices. The costs for refined products are at record highs, despite crude prices rising more modestly.
• In response to Ukrainian attacks, on July 30, Russia extended temporary export bans on gasoline, diesel, marine fuels, and gas oils through January 2027.¹² Russia has also banned the export of jet fuel, which is currently set to expire in November 2026, though is also likely to be extended. These measures suggest officials believe Ukrainian attacks will continue to hamper refining capacity for the foreseeable future. 
• Given Russia’s role as a leading diesel exporter, Ukrainian attacks have almost certainly drastically reduced the global supply of diesel. The Middle East plays a similar role in jet fuel refining, while gasoline refining is a relatively global practice.¹³ Other refiners, very likely incentivized by the higher margins to refine diesel and jet fuel, have stepped in to fill the gap while simultaneously reducing their output of gasoline; therefore, all three fuel types have elevated prices compared to the price of crude oil.

Food

Ukraine’s seaborne drone campaign has effectively halted all Russian traffic in the Sea of Azov since mid-July. It is a near certainty that these strikes have restricted Russia's ability to export grain, as the Sea of Azov handles about a quarter of Russia's grain exports.  Russian media outlets reported that primary grain crops decreased by 37.6 percent year-over-year in July: wheat fell by 17.7 percent, corn by 71.9 percent, and barley by 82.1 percent.¹⁴ 

Meanwhile, Russian strikes on Ukraine's Black Sea ports of Odesa and Chornomorsk also disrupted Ukraine's ability to export grain, erasing about one-third of Ukraine’s export capacity.¹⁵ Ukraine is diverting some exports to the Danube River, though the waterway cannot supplant Black Sea routes, which typically handle between 90 to 95 percent of Ukraine’s grain exports.¹⁶

• The Black Sea is one of the world’s most important agricultural export corridors. Ukraine’s ports serve as a supply chain to markets in Africa, the Middle East, and Asia, while the Sea of Azov connects Russian ports to global markets, handling roughly one-third of the country’s seaborne wheat exports.

This is very likely impacting global food supplies, as the two waterways are critical supply chains for the wheat, corn, and vegetable oil trade. Wheat prices hit a two-year high on July 20, as Russia remains the world’s largest wheat exporter.¹⁷

• As Black Sea wheat is typically the most cost-effective global source, price-sensitive buyers either have to reduce import demand or pay significantly higher prices, both of which will likely drive global food inflation.
• This crisis compounds existing supply chain pressures, including the impact the war in Iran is having on fertilizer supplies and the incoming El Niño weather phenomenon, which is expected to further weaken food production.

The reduced usability of these corridors is very likely the leading reason why global food prices reached a three-year high in July 2026.¹⁸ However, there are other contributing factors—particularly for Europe, where European crops were also hit by heat and drought and surging air-conditioning demand further strained energy supplies. 

• A June heatwave destroyed nine million tons of crops across Europe, and the European Union (EU)’s total grains output is likely to shrink by more than 9 percent this year.¹⁹ This does not account for the Middle East conflict's earlier hit to fuel and fertilizer costs, which almost certainly slashed plantings across the continent. Looking ahead, the return of El Niño will likely mean reduced yields in the coming months, even if the war risk subsides.

LNG Imports

Monthly LNG imports into northwest Europe, Italy, and Spain reached only 4.9 million metric tons in July, down 34 percent from a year earlier and continuing a downward trend in LNG imports since April. European gas storage levels are now at their lowest levels for this time of year in 18 years, standing at only 57 percent full. EU nations traditionally require tanks to be 90 percent filled by November 1, a requirement that was dropped to 80 percent last year.²⁰

• EU nations typically purchase winter gas supplies during the summer, when prices are lower. However, the war in Iran has spiked natural gas costs, prompting EU states to delay purchases—very likely in hopes that hostilities end and prices decline. This tactic appeared justified when the SoH reopened for three weeks in mid-June, but the subsequent resumption of hostilities has caused prices to skyrocket again. As the window to fill reserves shrinks, EU states will likely have to pay a premium for last-minute supplies or fall short of the bloc’s November 1 target of 80 percent.²¹ Current prices are about 80 percent above prewar levels and remain higher than contracts to buy gas in November and December.²²

Drought

Europe’s two most important inland supply chains, The Danube and Rhine rivers, have fallen to record-low levels in the last week due to a lack of rain, with water levels shrinking faster than anticipated as a result of successive heatwaves.^23,24 Both rivers are used to move oil products, chemicals, coal, iron ore, grains, and other goods in containers.

• The wars in Iran and Ukraine have already triggered energy price spikes, leading many European businesses to purchase as little fuel as possible in recent months. Therefore, the weather crisis is occurring in the context of ongoing disruptions in other maritime supply chains, such as the Red Sea, the SoH, and the Black Sea. 

The Danube functions as a key supply chain artery for several European countries, particularly for the energy sector. The Rhine connects chemical plants, oil refineries, and other manufacturing sites across Switzerland, Germany, and France with the Dutch port of Rotterdam. 

• At current levels, Rhine-bound ships can only carry 20 percent of their capacity (800 tons, a significant decrease from the usual 5,100 tons), and prices to use the river have thus surged from around EUR 45 per ton in June to EUR 150 a ton in July.²⁵
• The Danube also provides water for navigation and for cooling nuclear power plants further into Central Europe. Hungary, Romania, Serbia, and Moldova rely on the Danube to transport goods and cool their nuclear facilities; consequently, these nations are likely to institute water and electricity limits in August. Historically, water levels in the Danube reach annual low points in August or September, often forcing nuclear plants to shutdown; the plants require a week to bring the reactors online once water levels become adequate again. If such a shutdown is required this summer, affected countries are likely to have to do without nuclear energy assets—the biggest energy source for many central European nations—for several months.

The lack of rain is also impacting Nordic nations that historically rely on hydro power. Under current conditions, it is a near certainty that Nordic nations will enter the winter heating season with lower-than-normal water levels, which will almost certainly push up prices. Adequate rains usually allow these nations to offset supply disruptions of other types of energy (such as natural gas). 

• If these low water levels persist, affected countries will likely face localized fuel shortages, reduced output at petrochemical and steel plants, and the need to tap into strategic oil reserves.

Cyber Impacts

Energy

From the collapse of the ceasefire on July 8 until August 6, ZeroFox intelligence observed 19 instances of cyber threat actors targeting the energy industry.

• Notably, on July 10, 2026, ZeroFox identified an update on the Everest ransomware leak site targeting NIMR Oil, a Qatar-based oil and gas services provider.²⁶  We also observed several instances of alternative LNG producers being targeted. On July 27, 2026, ZeroFox noted an update on the BLACKWATER leak site targeting MSGÁS, a Brazil-based, state-owned natural gas distribution company.²⁷
• In both instances, the threat actors were likely financially motivated and responding to the accompanying LNG price increase to target organizations impacted by the supply shock.

In addition to the targeting of MSGÁS, ZeroFox has also observed targeting of energy assets outside of the Middle East that are likely benefitting from added demand for their products.

• ZeroFox notes several Latin American energy companies have been targeted in recent weeks. These include the Colombian state-owned oil company Ecopetrol, which was targeted by The Gentlemen ransomware group on July 20;²⁸ Ecuador’s WellPerf, which was targeted by Qilin ransomware on July 24;²⁹ and Argentina 's Oleoductos del Valle, also targeted by Qlin on July 24.³⁰ Argentina’s nascent energy exports (particularly for LNG) have notably benefited from the energy price increases prompted by the supply shock in the Middle East, while Colombia and Ecuador have more established oil export industries.
• Lastly, ZeroFox observed the targeting of DB Tarımsal Enerji, a Turkey-based biodiesel and bioenergy producer, by Qilin ransomware group on July 31.³¹ Biofuel products, which are typically made from corn and vegetable oil, have seen a noticeable increase in demand in recent months as war in Iran has lifted oil prices.

During the reporting period from July 8 to August 5, ZeroFox also identified 23 instances in which the food and agriculture sector was targeted by threat actors, as well as five directly targeting those involved in the fertilizer trade since June 1.

ZeroFox assesses that threat actors are increasingly targeting food and downstream organizations. Ransomware groups that include RansomHouse, INC Ransom, Everest, and Anubis have claimed victims such as Nichirei,³² Ali-Monde,³³ Emirates Flight Catering,³⁴ Vedan Enterprise,³⁵ Fairlife,³⁶ and Just Eat,³⁷ while Chick-fil-A³⁸ disclosed a credential stuffing incident. 

• The activity is claimed by separate actors and likely does not reflect a coordinated campaign, though-food related entities are likely attractive targets due to their historically weaker cybersecurity maturity and their criticality as war and weather impact key agricultural supply chains.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:45 PM (EDT) on August 6, 2026; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

ZeroFox Intelligence Probability Scale 

All ZeroFox intelligence products leverage probabilistic assessment language in analytic judgments. Qualitative statements used in these judgments refer to associated probability ranges, which state the likelihood of occurrence of an event or development. Ranges are used to avoid a false impression of accuracy. This scale is a standard that aligns with how readers should interpret such terms.

• ZeroFox Flash Report: U.S.-Iran Agree to End War – SITREP #40: June 18, 2026
• ZeroFox Flash Report: Ceasefire Unravels – SITREP #41: July 10, 2026
• ZeroFox Flash Report: Ceasefire Collapse Likely Temporary – SITREP #42: July 15, 2026
• hXXps://www.reuters[.]com/world/asia-pacific/iran-declares-strait-hormuz-closed-unauthorised-vessel-hit-2026-07-11/
• hXXps://www.reuters[.]com/world/middle-east/yemens-houthis-declare-naval-blockade-against-saudi-arabia-statement-2026-07-20/
• hXXps://www.middleeasteye[.]net/news/saudi-aramco-reports-bumper-profits-citing-use-pipeline-bypass-strait-hormuz
• hXXps://www.nytimes[.]com/2026/08/05/world/middleeast/houthis-claim-attack-saudi-arabia-tanker.html
• hXXps://gcaptain[.]com/second-tanker-struck-in-strait-of-hormuz-as-u-s-iran-shipping-crisis-deepens/
• hXXps://www.reuters[.]com/business/energy/qatarenergy-extends-force-majeure-three-lng-cargoes-edison-says-2026-07-28/
• hXXps://www.bloomberg[.]com/news/articles/2026-07-10/iran-tensions-risk-fertilizer-flows-to-south-american-farmers
• hXXps://tradingeconomics[.]com/commodity/urea
• hXXp://government[.]ru/news/59474/
• ZeroFox Weekly Global Supply Chain Risk Reports, July 23 and 30, 2026
• hXXps://www.vedomosti[.]ru/business/news/2026/08/04/1218730-eksporta-pshenitsi, hXXps://www.interfax[.]ru/business/1107205
• hXXps://www.reuters[.]com/world/ukraines-black-sea-ports-lose-third-grain-export-capacity-farmers-union-says-2026-07-15/
• hXXps://tvpworld[.]com/94707849/ukraine-grain-exports-stall-as-attacks-halt-odesa-shipping
• hXXps://tradingeconomics[.]com/commodity/wheat
• hXXps://www.reuters[.]com/world/world-food-prices-hit-3-year-high-july-weather-war-weigh-fao-says-2026-08-07/
• hXXps://www.bloomberg[.]com/news/articles/2026-07-22/heat-and-war-deal-europe-s-grain-harvest-biggest-blow-in-decades
• hXXps://www.bloomberg[.]com/news/articles/2026-08-03/eu-s-winter-gas-buffer-at-risk-as-storage-levels-hit-18-year-low
• hXXps://www.bloomberg[.]com/news/articles/2026-07-24/europe-faces-winter-gas-reckoning-as-global-fight-for-lng-brews
• hXXps://tradingeconomics[.]com/commodity/eu-natural-gas
• hXXps://www.smithsonianmag[.]com/smart-news/the-danube-river-has-fallen-to-record-low-water-levels-revealing-nazi-warships-bombs-and-woolly-mammoth-bones-in-its-channel-180989255/
• hXXps://www.bbc[.]com/news/articles/c78gn8zvrx4o
• hXXps://en.mercopress[.]com/2026/08/03/rhine-barges-run-at-20-of-capacity-as-freight-rates-surge
• ZeroFox Intelligence
• ZeroFox Intelligence
• ZeroFox Intelligence
• ZeroFox Intelligence
• ZeroFox Intelligence
• ZeroFox Intelligence
• ZeroFox Intelligence
• ZeroFox Intelligence
• ZeroFox Intelligence
• ZeroFox Intelligence
• ZeroFox Intelligence
• ZeroFox Intelligence
• hXXps://www.bleepingcomputer[.]com/news/security/chick-fil-a-discloses-data-breach-after-credential-stuffing-attacks/