The Saudi-led coalition said it 'intercepted and destroyed a ballistic missile launched by the Iran-aligned Houthi rebels towards Taif' on Wednesday morning, Oct 28, and the Houthis claimed a drone strike on Abha International Airport (The National). DTN said Riyadh had not commented on any damage after reports of a large fire at the Ras Tanura export terminal circulated on Tuesday. The National said Houthi attacks on Saudi Arabia and uncertainty over possible renewed U.S. military action against Iran were lifting prices, and quoted UBS strategist Giovanni Staunovo: 'Middle Eastern flows, while improving, have not yet fully normalised,' adding that 'record freight costs, constrained tanker capacity and recovering Chinese imports are other factors likely to keep oil prices high.' The National also reported that when the Saudi delegation in Tehran asked Iran to press the Houthis to halt their attacks, Iran said it did not have enough influence. Collected quotes show Brent at $110.44 (+0.94%) and WTI at $101.94 (+2.04%).

• Indicators to watch · Any Saudi Energy Ministry or Aramco statement on Ras Tanura; new attack claims from Houthi military spokesman Yahya Saree; whether the Qatari draft's Houthi provisions advance; the Nov 1 OPEC+ meeting; tanker freight and war-risk premiums for Gulf loadings

• B2Oleshky truce holds, but no aid deliveries or evacuations yetAP said the ceasefire was holding without violations but that aid deliveries and evacuations had not yet begun. Zelenskyy said he hopes to set a date for U.S.-brokered technical talks in Abu Dhabi between Nov 6 and 10, after the midterms.
• B2Saudi, Pakistani and Turkish envoys in Tehran agree only to keep talkingThe National said Iranian state media reported the sides 'agreed to continue discussions,' while regional sources described limited headway; the UAE Foreign Ministry urged the region to 'exercise wisdom and pursue political solutions.'

• B2Australia and the EU also add North Korea sanctions this monthVOA said Australia designated two individuals and two entities and the EU earlier listed three individuals and four entities, and that the joint statement stressed sanctions targeting North Korea's overseas workers, malicious cyber activity and illicit military cooperation with Russia.
• —No JCS confirmation of North Korean loudspeaker broadcastsHELIOS found no announcement during this window that South Korea's Joint Chiefs of Staff had confirmed loudspeaker broadcasts toward the South, which Kim Yo Jong had said would start in October. No notable developments confirmed.

Watchlist next 12–48 hours and beyond

• Thu, Oct 29, 9:15 a.m. ET
  European Central Bank decision; Samsung Electronics third-quarter results (Oct 29–30 Korea time); Bank of Japan decision Thursday night ET
• By Sat, Oct 31
  Iran's formal reply to Qatar's draft deal; North Korea's self-declared October deadline for loudspeaker broadcasts and any JCS confirmation
• Sun, Nov 1
  Iran's start date for legal action against Sinokor-linked ships; OPEC+ meeting; scheduled end of the Oleshky truce and any extension
• Tue, Nov 3
  U.S. midterm elections, and any U.S. force movements or statements on Iran around the vote
• Nov 6–10
  Zelenskyy's hoped-for window for U.S.-brokered technical talks with Russia in Abu Dhabi
• Wed, Dec 9, 2 p.m. ET
  FOMC decision, statement and dot plot: whether the Fed resumes hiking

Sources 24

• N
  NBC NewsFederal Reserve leaves interest rates unchanged despite rising inflation
  B
• F
  FortuneFed holds rates steady as a governor and president dissent together for the first time since 1992
  B
• A
  ABC NewsFederal Reserve holds interest rates steady as midterm elections loom
  B
• T
  The Edge MalaysiaBank of Canada raises rates to 2.5%, says more could be needed
  C
• I
  Internazionale (Reuters)Iran sees only unacceptable ideas in latest mediation to end war, official says
  B
• T
  The NationalIran 'welcomes negotiations' after reported Qatari-mediated draft deal
  B
• J
  JFeedIran Nuclear Offer: Week-Long Strikes Expected if It Fails
  C
• G
  GV Wire (Reuters)US Sanctions North Korean Network Accused of Defrauding Businesses
  B
• C
  ChainalysisOFAC Sanctions North Korean IT Worker Fraud Scheme
  C
• K
  K-VIBE (Yonhap)U.S. sanctions 10 individuals, entity over N. Korean IT worker fraud schemes
  B
• V
  VOA KoreanJoint statement by 11 countries including the U.S. and South Korea urges North Korea's denuclearization and full implementation of sanctions (in Korean)
  B
• K
  K-VIBE (Yonhap)Defense chiefs of S. Korea, Japan reaffirm 3-way coordination with U.S. amid N.K. threats
  B
• N
  NewspimDefense Minister Kang raises North Korea's DMZ mines with Japan's Koizumi (in Korean)
  B
• T
  The RecordJapan Airlines warns of data breach as country grapples with multiple cyber incidents
  C
• T
  The StandardJAL hit by major data breach affecting 92,000 customers
  C
• F
  Finance MagnatesOANDA Japan Holds Withdrawals After Hack at Server Host Used by FX Traders
  C
• K
  Kumamoto Nichinichi Shimbun (Kyodo)GMO urgently requests active cyber defense after confirming unauthorized access; would be first use (in Japanese)
  B
• T
  TechCrunchHacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents
  C
• G
  GV Wire (Reuters)Leak Website Releases Data on Tens of Thousands of DHS Employees
  B
• T
  The NationalOil prices up due to Houthi strikes and US threat to renew Iran war
  B
• D
  DTNOil Rises After Strike on Oil Hub Highlights Supply Risks
  C
• Y
  YnetIsrael election results: Netanyahu bloc at 53 seats, Eisenkot bloc at 48 as nearly all votes counted
  B
• A
  Al JazeeraPartial results show no clear winner in Israel election
  B
• K
  KSAT (AP)A ceasefire in a Ukrainian city is holding, officials say, as Moscow and Kyiv await US-led talks
  B

Reuters reported on Wednesday, Oct 28, that a senior Iranian official involved in the talks said Qatar had presented only 'unacceptable ideas and not an offer' in its seven-day draft deal, and that Tehran's policy of showing no flexibility on the nuclear issue was unchanged. According to Reuters, Iran insists that sanctions relief and an end to the U.S. blockade of its ports must come before nuclear negotiations, while Washington wants the nuclear program on the table from the start. Qatar asked Iran to stop threatening Gulf states and to reopen the Strait of Hormuz as a show of good faith, and Foreign Minister Abbas Araqchi said Iran's own seven-day proposal 'could be implemented in less than a week' and that Tehran remains in close contact with intermediaries (Reuters). The National quoted an Iranian official as saying Iran 'welcomes any efforts aimed at negotiations, talks or collective consultation.' It said Saudi Defense Minister Prince Khalid bin Salman led a delegation with Pakistan's Field Marshal Asim Munir and Turkish intelligence chief Ibrahim Kalin to Tehran on Monday, Oct 26, with limited headway, and that Iran proposed a two-week pause in regional hostilities to allow negotiations and a gradual reopening of Hormuz. JFeed reported that U.S. and Israeli officials expect a bombing campaign of roughly a week against Iran after the U.S. midterms if the Qatari-mediated talks collapse, and that the proposal on the table would give U.N. inspectors access to bombed nuclear sites in exchange for limited sanctions relief and access to frozen funds.

• Indicators to watch · Iran's formal reply to the Qatari draft; carrier and air defense movements around the Nov 3 midterms; follow-up mediation by Saudi Arabia, Pakistan and Turkey; any U.S. response to Iran's proposed two-week pause; White House and Iranian Foreign Ministry statements

Treasury's Office of Foreign Assets Control on Wednesday, Oct 28, sanctioned 10 individuals and one entity for roles in North Korean government-run IT worker schemes (Reuters, Chainalysis). Yonhap said the targets are eight North Koreans and two Russians who facilitated cryptocurrency transactions, and that the entity is the First Financial and Technical Development Center, a Russia-based operation controlled by North Korea. Treasury said North Korean IT workers fraudulently obtain jobs with companies in the U.S. and elsewhere and that Pyongyang takes most of their wages to fund its weapons of mass destruction and ballistic missile programs (Reuters). Citing the Treasury action, Chainalysis said one sanctioned Russian national has converted nearly $2 million in cryptocurrency into fiat for North Korean officials since January 2025 and handled at least $1.25 million in other currency transactions, and that six workers generated more than $750,000 for the center since 2025. Treasury said the networks 'permeate through the global financial system, necessitating a unified response,' and noted that Australia and the European Union also imposed North Korea-related sanctions this month (Reuters). The same day, the U.S., South Korea, Japan, Australia, Canada, France, Germany, Italy, the Netherlands, New Zealand, the U.K. and the EU issued a joint statement calling for North Korea's complete, verifiable and irreversible denuclearization and urging all U.N. members, particularly permanent Security Council members, to fully implement the relevant resolutions (VOA). Reuters said the move comes as President Trump seeks to restart talks with North Korea, which has shown little interest in denuclearization talks.

• Indicators to watch · KCNA or North Korean Foreign Ministry reaction to the sanctions and joint statement; the outcome of the Swiss foreign minister's Oct 29–30 visit to Pyongyang; further designations by Treasury or allies; any White House remarks on talks with Kim; FBI or Treasury advisories on remote IT hiring

U.S. Impact Assessment

• Federal workforce and contractorsThe DHS archive links named CBP, ICE and CISA employees to their roles, phone numbers and system access, which raises the risk of targeted phishing, impersonation and harassment. Agencies and contractors that share identity providers with DHS should review single sign-on logs back to mid-August and brief staff on social-engineering attempts that cite their real job details.
• Rates and financingTwo officials voted to hike, and ABC said futures put the odds of a December increase near 80%. With collected quotes showing the 10-year Treasury yield at 5.045% (+5bp), companies with floating-rate debt or refinancing needs before year-end should plan for rates staying high or rising through the Dec 9 decision.
• Energy and shippingIran's rejection of the Qatari draft, reports that U.S. and Israeli officials expect post-midterm strikes, and continuing Houthi fire at Saudi targets keep supply risk elevated, with UBS pointing to record freight costs and tight tanker capacity. Refiners, airlines and shippers should review November fuel hedges, Gulf routing and war-risk cover; collected quotes show Brent at $110.44 (+0.94%).
• Remote hiring and sanctions exposureTreasury says North Korean IT workers use fraudulent identities to land jobs at U.S. companies and that their wages fund weapons programs. Employers using remote contractors should tighten identity checks at hiring and payroll, and finance teams should screen payment and crypto off-ramp counterparties against the new designations to avoid OFAC exposure.

Edition archiveRSS

• Saturday, Oct 31 · Morning Edition · 05:42 ETAttacks on ships around Hormuz hit a wartime monthly high as Trump says the Iran war will be “wrapped up soon,” Binance finds more entry points behind its $6.3 billion theft, and Seoul weighs stretching its Cheonghae naval unit toward Oman
• Friday, Oct 30 · Evening Edition · 17:44 ETTankers keep getting hit around the Strait of Hormuz as Qatari mediators carry a U.S. letter into Tehran, a tech rout hands the S&P 500 its worst day since June, and the Secret Service joins the hunt for Binance's stolen $6.3 billion
• Friday, Oct 30 · Morning Edition · 05:40 ETA small boat attached explosives to a tanker in the Strait of Hormuz, Binance was hit by a roughly $6.3 billion hack that blockchain analysts tie to North Korea, and AI-spending worries sent South Korea's KOSPI down 3.48%
• Thursday, Oct 29 · Evening Edition · 17:46 ETIran's Revolutionary Guards say three tankers hit mines on Hormuz's southern route and Houthi missiles are downed over Riyadh, as a Russian drone kills at least 14 at a Dnipro rail station and Florida discloses a student-aid breach that may affect 4.9 million people
• Thursday, Oct 29 · Morning Edition · 05:42 ETNorth Korea fires about 10 short-range ballistic missiles six days after Seoul offered military talks, as DHS says it is working to contain a leak of 40,000-plus employee records and Trump says Vance's Iran outreach was about medical aid, not peace talks
• Wednesday, Oct 28 · Evening Edition · 17:40 ET · CurrentIran dismisses Qatar's draft deal as 'unacceptable ideas' amid reports that U.S. and Israeli officials expect a week of strikes after the midterms if talks fail, while a leak exposes more than 40,000 DHS employees and the Fed holds with two votes for a hike
• Wednesday, Oct 28 · Morning Edition · 05:36 ETThe U.S. has reportedly told Gulf allies to brace for a short, intense Iran campaign after the Nov 3 midterms as oil rebounds, while three South Korean financial firms, including crypto exchange Bithumb, disclose hacks
• Tuesday, Oct 27 · Evening Edition · 17:39 ETA cyberattack forces ambulance diversions at New Mexico's only Level 1 trauma center, the Houthis claim a missile hit on Saudi Arabia's largest refinery, and Iran threatens 'legal action' against every ship run by Sinokor, the biggest crude carrier through Hormuz
• Tuesday, Oct 27 · Morning Edition · 05:44 ETA local truce takes hold in occupied Oleshky even as Russian missiles hit Kyiv's Southern Bridge and a student dorm, the Houthis fire ballistic missiles at Saudi Arabia's Eastern Province hours after the Tehran talks, and CISA confirms PHP2Shell is under attack
• Monday, Oct 26 · Evening Edition · 17:45 ETIran and three Mecca pact powers agree to keep talking after a first four-way meeting in Tehran and oil eases, but the Saudi-led coalition widens strikes on Houthi missile sites and North Korea parks self-propelled guns in plain view of the South
• Monday, Oct 26 · Morning Edition · 05:47 ETMediators converge on Tehran and oil eases, but a Houthi missile again targets Riyadh and South Korea reports its first hacking-related customer data leak at an insurer
• Sunday, Oct 25 · Evening Edition · 17:44 ETTrump says it's decision time on Iran, 'finish it off' or make a deal, but rules out a strike Sunday, as the Houthis claim a ballistic-missile barrage on Riyadh's newly reopened airport and CENTCOM's commander says Hormuz shipping lanes are clear of mines
• Sunday, Oct 25 · Morning Edition · 05:50 ETTrump says a U.S. strike on Iran could come 'maybe tomorrow' while floating a 'big, beautiful agreement,' as Houthi missiles and drones fly at Riyadh and Khamis Mushait and Musk says SpaceX throttled Ukraine over 'offensive' Starlink use
• Saturday, Oct 24 · Evening Edition · 17:43 ETA U.S. intelligence memo warns Iranian plots against Americans abroad have reached 'advanced stages' as the State Department thins out Gulf embassies, Houthi ballistic missiles fly at Riyadh, Taif and Yanbu, and Ukraine says its Starlink speed caps are gone

The nonprofit transparency collective Distributed Denial of Secrets (DDoSecrets) on Wednesday, Oct 28, published an archive it calls 'Icepick' with personal information on more than 40,000 Department of Homeland Security staffers (TechCrunch, Reuters). TechCrunch said the dataset includes more than 21,000 records tied to Customs and Border Protection, about 10,000 tied to Immigration and Customs Enforcement and its Homeland Security Investigations unit, and nearly 1,000 tied to CISA, covering names, job titles, work email addresses, cell phone numbers, office locations and records showing which internal systems and applications employees could access; TechCrunch said the data was taken in mid-August. Reuters said the files include assignment details revealing roles in 'special operations, surveillance jobs, computer forensics and undercover work.' A hacker calling itself 'Department of Peace' claims it harvested the data from the Okta single sign-on service DHS uses for employee and contractor logins. DHS did not immediately respond to requests for comment from TechCrunch or Reuters, and HELIOS found no official confirmation of how the data was obtained.

• Indicators to watch · Any DHS or CISA statement on how the data was obtained; whether access through the Okta sign-on service is confirmed; guidance to affected employees and contractors; reports of targeted phishing or doxxing of CBP, ICE or CISA staff; congressional oversight letters

The Federal Reserve on Wednesday, Oct 28, kept its benchmark rate in a 3.75%–4% target range (ABC, Fortune). The FOMC vote was 10–2, with Governor Lisa Cook and Cleveland Fed President Beth Hammack dissenting in favor of a quarter-point hike (Fortune). Fortune said it was the first time since October 1992 that a Fed governor and a regional bank president dissented together on the same side. NBC said the Fed had voted 12–0 to raise rates in September, and that inflation climbed from 3.4% in August to 3.7% in September. Chair Kevin Warsh said 'inflation is too high' and that energy prices had risen again, announced that the Fed will cut its policy meetings from eight to seven next year with further reductions in 2028, and said the midterms and politics 'played no role in the decision' (NBC). Warsh also said 'the overwhelming consensus is that what we've done in this monetary medicine is starting to work some, but there is no firm conclusions' (Fortune). ABC said CME FedWatch data put the odds of a quarter-point hike in December near 80%. The same day, the Bank of Canada raised its policy rate a quarter point to 2.5%, its first increase in more than three years (The Edge Malaysia). Collected quotes show the S&P 500 at 7,743.98 (+0.28%) and the 10-year Treasury yield at 5.045% (+5bp).

• Indicators to watch · October CPI in November; oil prices; remarks by Warsh and other FOMC members; the Dec 9 statement and dot plot; the 10-year yield

• B2Fed to hold seven policy meetings next year instead of eightNBC said Warsh argued that fewer meetings would improve the 'quality' of decisions, with further reductions planned for 2028.

• —No new Iranian statement on Sinokor ships ahead of the Nov 1 deadlineHELIOS found no new statement from Iran's Persian Gulf Strait Authority or the IRGC about Sinokor-linked vessels, and no official position from South Korea's Foreign or Oceans ministries, during this window. No notable developments confirmed.

• —No disclosure yet of Mirae Asset Life's affected-customer countHELIOS found no statement during this window from Mirae Asset Life, the Financial Services Commission or the Financial Supervisory Service giving the number of customers affected by the company's hacking-related leak. No notable developments confirmed.

Intelligence gaps · unconfirmed

• Quote conflict: The National put Brent at $114.87 (+0.87%) as of 2 p.m. UAE time on Oct 28, and DTN put December Brent at $115.14 (+$1.26) and WTI at $101.81, versus collected quotes of Brent $110.44 (+0.94%) and WTI $101.94 (+2.04%), likely reflecting different contract months and times. Only collected quotes are used in the text.
• Iran strike planning: The account that U.S. and Israeli officials expect about a week of post-midterm strikes was confirmed only in JFeed's report and rests on anonymous officials. The related Axios report could not be opened (HTTP 403), and HELIOS found no White House or Pentagon confirmation.
• Qatari draft: The 'unacceptable ideas' remark comes from a single senior Iranian official quoted by Reuters; Iran has not issued a formal reply. Iran's proposed two-week pause in regional hostilities and the NAVCENT advisory were confirmed only by The National.
• DHS leak: The claim that the data came from DHS's Okta single sign-on system is the hacker's; HELIOS found no confirmation from DHS or Okta. The mid-August exfiltration date comes only from TechCrunch.
• Korea-Japan defense talks: Yonhap (via K-VIBE) placed the meeting in Cebu and Newspim in Manila; the text says only 'the Philippines.'
• GMO incident: A Hacker News headline says GMO offered a $1 million bounty to catch the hackers, while some Japanese reports describe a $1 million demand by the hackers. HELIOS could not open the original and did not use either account.
• Energy data: HELIOS could not open the EIA's Oct 28 weekly petroleum report, and found no Saudi Energy Ministry or Aramco statement on Ras Tanura.
• Israel count: Ynet (85.6% counted: 53, 48 and 19 seats) and Al Jazeera (about 57% counted: 56, 49 and 16 seats) reflect different stages of the count.
• Not used: U.S. sanctions on Rwanda's defense ministry (ABC, Reuters), Flávio Bolsonaro's arrival in Miami after Brazil's election (BBC could not be fetched), 123 Reg's disclosure of an 'AI cyberattack' (The Register) and USNI's posting of a report to Congress on Iran operations could not be opened and were left out.
• Scoring note: 'fed-hike-oct-2026-fomc' (a hike at the Oct 27–28 FOMC) appears to resolve no, given the Oct 28 hold.