The vessel’s onboard Armed Security Team (AST) was the only thing standing between the attackers and the ship. According to UKMTO reports, "there was an exchange of fire between the small craft and the vessel's armed security team, and the craft then turned away" . The guards’ immediate, decisive response prevented a boarding, and an investigation into the incident was launched .

Who were the attackers?

No group has claimed responsibility, leaving analysts to weigh two possibilities: Houthi escalation or a piracy revival. The Houthis did issue a threat on June 2, 2026, warning of a "complete ban on enemy [Israeli] navigation" in the Red Sea . However, the geography of this attack makes Houthi involvement doubtful. The Balhaf terminal is outside their area of operations, and their past attacks have relied on sophisticated drones and missiles rather than small-arms skirmishes from skiffs .

A more likely explanation is a return of Somali piracy. UKMTO had recently issued warnings about an active pirate group operating in the Gulf of Aden and the wider Somali Basin. For years, international naval patrols had all but eliminated Somali piracy, but with warships now heavily concentrated on countering Houthi missile and drone strikes further north, security gaps have opened up in the southern Gulf of Aden . This attack bears the classic hallmarks of a piracy attempt: a small, fast craft carrying armed men attempting to close in on a commercial vessel.

The two-headed threat: Houthis in the north, pirates in the south

Since November 2023, the Houthi campaign has completely rewritten the security calculus for one of the world’s most important shipping corridors. The Iran-aligned group has attacked commercial ships with drones, ballistic missiles, explosive boats, and mines, framing its campaign as a blockade on Israeli-linked trade in solidarity with Palestinians in Gaza .

The damage has been devastating. In July 2025, the Liberian-flagged cargo ship Eternity C was sunk by Houthi rocket-propelled grenades fired from small boats, leaving at least three crew members dead . The campaign forced many major shipping lines to abandon the Red Sea and Suez Canal route entirely, rerouting vessels around the southern tip of Africa at enormous cost.

Now, as naval coalitions such as the US-led Operation Prosperity Guardian and the EU’s Operation Aspides focus on intercepting Houthi drones and missiles, the older threat of piracy is taking advantage of the distraction. Vessels navigating the southern approach to the Red Sea now face simultaneous dangers: the technological weaponry of the Houthis to the north and the very analog threat of armed men in small boats to the south .

How vessels are adapting

The successful defense on June 10 underscores a hardening reality of modern maritime commerce: private armed security is no longer optional for transits through high-risk zones. The presence of an AST is a proven deterrent against boarding attempts, and this incident adds another data point to its effectiveness .

Following the attack, UKMTO issued Warning 065-26, advising all ships in the area to exercise caution and report suspicious activity . Shipping companies operating in the region are now advised to harden their vessels with physical barriers, maintain strict 24/7 radar and visual watches, and ensure armed teams are ready to engage. The threat matrix now requires preparation for both a missile strike and a skiff assault on the same voyage.

The vessel’s onboard Armed Security Team (AST) was the only thing standing between the attackers and the ship. According to UKMTO reports, "there was an exchange of fire between the small craft and the vessel's armed security team, and the craft then turned away" . The guards’ immediate, decisive response prevented a boarding, and an investigation into the incident was launched .

Who were the attackers?

No group has claimed responsibility, leaving analysts to weigh two possibilities: Houthi escalation or a piracy revival. The Houthis did issue a threat on June 2, 2026, warning of a "complete ban on enemy [Israeli] navigation" in the Red Sea . However, the geography of this attack makes Houthi involvement doubtful. The Balhaf terminal is outside their area of operations, and their past attacks have relied on sophisticated drones and missiles rather than small-arms skirmishes from skiffs .

A more likely explanation is a return of Somali piracy. UKMTO had recently issued warnings about an active pirate group operating in the Gulf of Aden and the wider Somali Basin. For years, international naval patrols had all but eliminated Somali piracy, but with warships now heavily concentrated on countering Houthi missile and drone strikes further north, security gaps have opened up in the southern Gulf of Aden . This attack bears the classic hallmarks of a piracy attempt: a small, fast craft carrying armed men attempting to close in on a commercial vessel.

The two-headed threat: Houthis in the north, pirates in the south

Since November 2023, the Houthi campaign has completely rewritten the security calculus for one of the world’s most important shipping corridors. The Iran-aligned group has attacked commercial ships with drones, ballistic missiles, explosive boats, and mines, framing its campaign as a blockade on Israeli-linked trade in solidarity with Palestinians in Gaza .

The damage has been devastating. In July 2025, the Liberian-flagged cargo ship Eternity C was sunk by Houthi rocket-propelled grenades fired from small boats, leaving at least three crew members dead . The campaign forced many major shipping lines to abandon the Red Sea and Suez Canal route entirely, rerouting vessels around the southern tip of Africa at enormous cost.

Now, as naval coalitions such as the US-led Operation Prosperity Guardian and the EU’s Operation Aspides focus on intercepting Houthi drones and missiles, the older threat of piracy is taking advantage of the distraction. Vessels navigating the southern approach to the Red Sea now face simultaneous dangers: the technological weaponry of the Houthis to the north and the very analog threat of armed men in small boats to the south .

How vessels are adapting

The successful defense on June 10 underscores a hardening reality of modern maritime commerce: private armed security is no longer optional for transits through high-risk zones. The presence of an AST is a proven deterrent against boarding attempts, and this incident adds another data point to its effectiveness .

Following the attack, UKMTO issued Warning 065-26, advising all ships in the area to exercise caution and report suspicious activity . Shipping companies operating in the region are now advised to harden their vessels with physical barriers, maintain strict 24/7 radar and visual watches, and ensure armed teams are ready to engage. The threat matrix now requires preparation for both a missile strike and a skiff assault on the same voyage.