Arsenal
Two wars. Three crises hidden inside them. This week, The New Arsenal covers what the headlines are getting wrong.
In Iran, the US is running the most intense air campaign since 2003 — and going through its most advanced munitions at a rate that is drawn significant attention on Capitol Hill and in defense policy circles. The Strait of Hormuz is functionally closed. Oil is above $100. A new supreme leader sits in Tehran who has not said a single word in public. The IRGC is speaking for him. And Russia — watching carefully from the sidelines — just launched a global cyber campaign targeting the encrypted messaging apps that NATO military personnel depend on.
In Ukraine, Day 1,476 looks like every other day: nearly 10,000 kamikaze drones overnight, guided aerial bombs falling on Kharkiv, and peace talks described by Zelensky himself as "stuck." But beneath the static, something is shifting. Saudi Arabia is reportedly prepping a major Ukrainian weapons deal. And Ukraine is sending drone specialists to Jordan to help protect US bases — the first known transfer of Ukrainian drone-war expertise to a Gulf theater.
This edition: the munitions math no one wants to talk about, the Hormuz shutdown as a weapons system, Russia's cyber pivot, and what Ukraine's drone export means for how this technology spreads.
CriticalThe Washington Post reported this week that the US deployed $5.6 billion in munitions in the first 48 hours of Operation Epic Fury — a figure that reflects the scale and intensity of the campaign. The number needs context to understand why it matters.
The US Tomahawk cruise missile — the weapon of choice for deep inland strikes against hardened Iranian facilities — costs approximately $2 million per unit (est., varies by variant and contract year; exact figures partially classified). The B-2 Spirit, which has been flying missions from Diego Garcia against deeply buried targets, costs an estimated $130,000+ per flight hour (est., per publicly available GAO and CRS reporting; operational costs classified) and carries a payload of precision-guided munitions. At $5.6 billion in two days, the US was spending roughly $116 million per hour in munitions alone — a rate derived from the confirmed Washington Post figure, not an independently sourced calculation.
Gen. Caine listed three objectives: destroy Iran's missiles and production capability, destroy its navy, and permanently deny it nuclear weapons. Iran's nuclear program itself, which Operation Midnight Hammer already struck in June 2025.
The campaign is visibly working on its stated military metrics. Iranian ballistic missile launches are down 90%. The Iranian navy is described as "combat ineffective" after more than 50 vessels were sunk. The new supreme leader, Mojtaba Khamenei — elected on March 8 to succeed his father — has not made a single public statement. The IRGC is speaking for the regime. That silence is significant: either he is consolidating power before speaking, or someone else is already making the decisions.
But the munitions consumption rate raises a structural question that extends well beyond this campaign: the US defense industrial base was not designed to sustain this pace. Tomahawk production has been estimated at roughly 100–200 missiles per year in publicly available Congressional Research Service reports (current rate may differ; Raytheon has announced expansion plans). At that baseline, the US may have fired a significant fraction of its deep-strike precision inventory in eleven days. Replenishment will take years, not months — a reality the Pentagon has acknowledged in general terms without releasing specific stockpile figures.
Defense Secretary Hegseth addressed the question directly: "Our munitions are full up and our will is ironclad."
Sources: Washington Post · The War Zone (twz.com) · NBC News live blog · CNBC · The National News · Joint Chiefs press conference transcript · Congressional Research Service (Tomahawk production est.)
Dual-UseThe Strait of Hormuz did not close because Iran fired missiles at naval vessels. It closed because Iran fired a handful of drones near tankers — and the insurance market did the rest.
This is a dual-use weapons story that deserves close attention. The strait is 33km wide at its narrowest, with a shipping lane just 3km in each direction. It handles 20 million barrels of oil per day — roughly 20% of world petroleum consumption and 20% of global LNG trade. A ship in that lane has almost no room to maneuver. Insurance underwriters, operating on actuarial models built for peacetime, immediately withdrew coverage when Iranian missiles began hitting tankers.
"All Iran had to do was several drone strikes in the vicinity," one energy analyst told NPR. "And all of a sudden, insurers and shipping companies decided that it was unsafe." It's an insurance-driven shutdown, not a purely military one — and it represents a novel economic pressure mechanism.
The tools that exposed and then paralyzed Strait shipping are all commercial platforms repurposed as intelligence and targeting infrastructure:
The downstream consequences are compounding. Saudi Arabia, Kuwait, Iraq, and the UAE have cut combined output by 6.7 million barrels per day — not because of strikes on their facilities, but because storage is filling up with no tankers able to move the oil. Iraq shut down operations at the Rumaila field entirely. One-third of the world's fertilizer trade — a fact almost entirely absent from mainstream coverage — also moves through the strait. Food price pressure is coming.
Trump has signaled the US military could escort tankers through the strait, mirroring the "Tanker War" convoy operations of 1987. He also threatened Iran would be hit "twenty times harder" if the strait remains blocked. Whether naval escorts can restore insurer confidence is the open question — it wasn't military force that closed the strait, so it may not be military force that reopens it.
Sources: NPR · Al Jazeera · Bloomberg · Wikipedia (2026 Strait of Hormuz Crisis) · CBS News · The Conversation · Congress.gov CRS Report
Day 1,476The frontline is grinding. Russia launched 137 drones and 90 airstrikes with 251 guided aerial bombs overnight. A March 7 Izdeliye-30 cruise missile strike on a Kharkiv residential block killed 11, including two children and a primary school teacher and her son. Russian forces are attempting to establish a 20-kilometer buffer zone along the Sumy and Kharkiv border regions, seizing small villages in the process.
Five frontline oblasts are currently without electricity due to Russian infrastructure strikes. The peace talks picture: Trump called them "a never-ending fight" after his Monday call with Putin. Zelensky told Italian media the talks are "stuck" over territory — Putin is demanding Ukraine cede the entire Donbas region. No breakthrough is visible.
But two developments this week deserve more attention than they are getting:
Ukraine's drone war experience is now an exportable product. The country is simultaneously a recipient of Western weapons aid and a provider of battlefield-validated drone expertise to US partners. That's a structural shift in Ukraine's strategic position.
The summer campaign picture is beginning to take shape. Ukrainian counteroffensive forces recovered 285.6 km² in the south in recent weeks, per Army Chief Syrskyi — but a thick winter ice layer has delayed spring sowing by 2–4 weeks, adding agricultural stress on top of infrastructure damage. Russian forces, per Putin's own admission, have pushed Ukrainian control of the Donetsk People's Republic territory down from 25% to 15–17% over six months. That rate of Russian territorial gain is historically low — but it is sustained.
Sources: Ukrainian General Staff · Kyiv Independent · Al Jazeera · LiveUAMap · Moscow Times · Ukraine's Ministry of Defense
Dual-UseRussia's military intelligence is running a global phishing campaign targeting Signal and WhatsApp accounts belonging to military personnel, government officials, diplomats, and journalists — confirmed this week by the Netherlands' MIVD and AIVD intelligence agencies. Dutch government employees have already had accounts compromised. The technique is straightforward and deeply instructive.
Russian hackers are not breaking Signal's encryption. The Signal Protocol — end-to-end encryption built on Curve25519, AES-256, and HMAC-SHA256 — remains cryptographically uncompromised. Instead, they are attacking the human layer:
The dual-use dimension here is precise: Signal was designed as a civilian privacy tool. It became the default battlefield communications platform for the Ukrainian military because it offered stronger encryption than government-issued alternatives and was already installed on soldiers' personal phones. The same app used by journalists and activists is now core military communications infrastructure — which makes compromising it both militarily and politically valuable in a single operation.
The campaign is part of a broader pattern that Google's Threat Intelligence Group documented in February: multiple Russian espionage clusters — including APT44/Sandworm, UNC5976, and UNC6096 — are systematically targeting defense sector personnel through commercial platforms. UNC5125 has specifically targeted frontline drone unit operators, using Google Forms questionnaires as reconnaissance tools before delivering malware through WhatsApp.
The attack surface for military communications is now any consumer smartphone. Every commercial messaging app used by military personnel is a potential intelligence collection vector. The encryption is not the vulnerability — the human is.
Defense One reports Russia may also be attempting to use the Iran war as cover for escalating cyber operations against NATO — with some analysts suggesting Russian-linked groups could be providing cyber support to Iran as a form of proxy retaliation for US involvement. Attribution remains complex. What is not complex: the commercial infrastructure that runs modern warfare is the attack surface.
Sources: TechCrunch · The Record (Recorded Future) · Kyiv Independent · Defense One · The Hacker News · NBC News · Dutch MIVD/AIVD advisory
$5.6 billion in 48 hours — confirmed by US officials via the Washington Post — against a Tomahawk production rate estimated at roughly 100–200/year in CRS public reporting (current contracted rate may be higher following recent expansion orders; exact figures are not fully public). If the baseline estimate is even approximately accurate, the consumption pace is to be considered. Anduril's Arsenal-1 opening in July matters here — not for Tomahawks, but as proof that alternative manufacturing models can scale faster than legacy procurement. Watch for emergency defense industrial base appropriations in the coming weeks.
Iran has not needed to win militarily to impose massive global economic damage. The insurance-driven Hormuz closure is costing the global economy hundreds of billions per week in stranded oil, rising energy prices, and disrupted LNG markets. If this continues past 30 days, the downstream effects — on food prices through fertilizer disruption, on Asian manufacturing through energy costs — could create political pressure in unexpected places. The US solution (naval escorts + political risk insurance) mirrors the 1987 Tanker War playbook. Whether it works in the era of drone swarms is an open question.
The deployment of Ukrainian drone specialists to Jordan is a turning point that has received almost no analysis. Ukraine has spent 1,476 days developing more real-world drone warfare operational experience than any other military in history. That knowledge — FPV intercept tactics, acoustic detection, fiber-optic counter-jamming, electronic warfare countermeasures — is now being packaged and exported. Saudi Arabia's "huge deal" interest suggests this is becoming formalized. Ukraine is transitioning from a weapons recipient to a defense technology exporter. That changes its geopolitical leverage significantly.
Russia's messaging app campaign is not a side operation — it is doctrine. The military communications layer has moved entirely onto commercial platforms, and the adversary has adapted accordingly. The lesson: every commercial communications tool used for military coordination is an intelligence collection opportunity. Signal's encryption is not the vulnerability. The human verification process is. This will drive NATO investment in hardware-secured communications devices and stricter operational security protocols for messaging apps. But the cultural shift — soldiers using consumer smartphones for tactical coordination — is not reversing.
Mojtaba Khamenei's silence is either tactical or forced. The IRGC is running current operations. If the new supreme leader's first public act is to authorize negotiations — even indirect ones — the war could end faster than anyone expects. If his first act is to escalate (mining the strait, attacking a US carrier, hitting Israeli infrastructure at a level that demands a ground response), the conflict expands in ways the current US operational posture is not designed for. Watch Tehran, not Washington, for the war's next phase signal.
The technology layer this week is the story beneath the story. The Hormuz shutdown is an insurance problem masquerading as a military one. The Signal campaign is a consumer app becoming a military intelligence vulnerability. Ukraine's drone exports are a startup pivot hiding inside a war update. The munitions burn rate is a defense industrial policy crisis dressed as a press conference number.
That's what The New Arsenal is for. Next week: a deep dive on the munitions stockpile problem and what Arsenal-1 can and cannot fix. Plus: what Ukraine's domestically produced FP-9 means for the escalation ceiling.
— Emeka Alozie · The New Arsenal · March 10, 2026