Defense Briefing

Trump postponed an attack on Iran announced for May 18 at the request of Arab state leaders – but implicitly confirmed that concrete attack plans exist. The US-Israel-Iran war, running since February 28, 2026, is in a fragile pause: oil rose to $112/barrel, Iran blocks the Strait of Hormuz. Polymarket sees only 34% chance of a permanent deal by June – the escalation risk remains structurally high.

On May 17, Ukraine conducted one of its largest drone attacks directly on Moscow – at least three deaths in the Moscow region, Russian air defense reported massive interception attempts. Zelensky stated that long-range attacks over 500 km are now a regular part of the strategy to force Russia to end the war. The TikTok video achieved 128,000 views and shows the shift in mood: the war reaches Putin's power center symbolically for the first time.

The Pentagon has paused planned rotations to Poland and Germany and is reducing US troop presence in Europe by around 5,000 to pre-war 2022 levels. This is a direct implementation of the new National Defense Strategy 2026, which assigns Europe greater responsibility. Warsaw denied reports of a complete withdrawal, but the signal to NATO partners is clear: the US is operationally withdrawing from forward defense.

NATO is currently conducting its largest special forces exercise in Europe – 'Dynamic Mongoose 2026' is running in parallel, Europe's first arctic anti-submarine warfare exercise in response to Russian threats in the North Sea. The exercises signal that the alliance wants to remain operationally capable despite US troop reductions. Particularly noteworthy: UK's HMS Prince of Wales Carrier Strike Group has arrived for exercises in Norway.

The FBI conducted a covert operation and removed GRU malware from thousands of compromised home and office routers – a botnet that targeted military, government agencies, and critical infrastructure. It was already the fourth such FBI operation against the Russian military intelligence unit. The incident underscores that cyberattacks on Western infrastructure are no longer just preparation, but actively underway.