Homeland Security Brief - May 2026
This brief highlights significant threats to US homeland security posed by China, Russia, Iran, and North Korea observed in May 2026.
Summary:
Observed Threats - Current activity that poses direct risk to US homeland security
An operative of the Iranian Islamic Revolutionary Guard Corps indicted for global terror plots, also planned assassinations of the Trump family.
Cuba has expanded security and intelligence cooperation with Russia, China, and Iran, including the expansion of spy bases and purchase of attack drones.
The mayor of a city in Los Angeles County pleaded guilty to serving as an illegal foreign agent of China.
A new report suggests hackers from Iran are behind recent cyber intrusions that compromised safety monitors at fueling stations.
Horizon Threats - International activity that may pose future risk to US homeland security
A new report highlighted the role of Russia’s “Social Design Agency” in provoking civil unrest and election manipulation in Europe, efforts which may soon be replicated in America given the organization’s previous activities.
OBSERVED THREATS
Current activity that poses direct risk to US homeland security
1. INDICTED IRANIAN OPERATIVE PLANNED ATTACK ON PRESIDENT’S FAMILY
A report by the New York Post alleges that Mohammad Baqer Saad Dawood Al-Saadi, an Iraqi-Iranian operative of the Islamic Revolutionary Guard Corps (IRGC), detained in Turkey on May 15 and extradited to the US had plans to assassinate Ivanka Trump, the daughter of President Trump and wife of special envoy Jared Kushner. The plot was conceived as revenge for the US’s assassination of Qasem Soleimani.
Al-Saadi has been indicted for his role in planning and coordinating attacks on American and Israeli interests as well as Jews across Europe and had attempted to carry out attacks in the US. According to a statement by the US Department of Justice:
“Al-Saadi has helped plan and direct approximately 18 attacks and attempted attacks across Europe on behalf of those terrorist organizations (the “European Terrorist Attacks”). Those attacks were carried out in the name of a purportedly new terrorist group with the pseudonym Harakat Ashab al-Yamin al-Islamiya, which is actually a front of Kata’ib Hizballah and other U.S. designated FTOs.
“In addition, in or about March and April 2026, Al-Saadi attempted to carry out attacks in the United States, including against a synagogue in New York, New York. Most recently, on or about April 30, Al-Saadi tried to find someone in the United States who could carry out a terrorist attack and kill or injure individuals here.”
Additional Information:
The indictment provides additional public insight into the nature of recent Iranian overseas proxy operations by labeling the group “Harakat Ashab al-Yamin al-Islamiyya,” an elaborate cover for Kaitab Hezbollah, an Iraqi paramilitary group sponsored by Iran’s IRGC. As noted in previous Homeland Security Briefs for March and April, Harakat Ashab al-Yamin al-Islamiyya has claimed responsibility for dozens of attacks on Jews and Iranian dissidents and American and Israeli interests across Europe. The connection with Al-Saadi and Kaitab Hezbollah reveals that Iranian forces have been much more directly involved in violent and disruptive incidents in Europe than previously publicly acknowledged, and that Iran has been attempting to export such activities to the US with less success.
According to George Washington University’s Program on Extremism, Iran has both plotted and conducted assassinations against Iranian dissidents and an array of other perceived threats within the US since 1980. But the regime has become brazen in its target selection in recent years, elevating its preference for targets to top government officials in the wake of the killing of Qasem Soleimani in 2020. Since then Iran has engaged in multiple plots to target Donald Trump and members of his first administration.
-
On March 6, 2026, Pakistani national Asif Merchant was convicted of attempting to arrange murder-for-hire schemes in the US targeting President Trump. Like Al-Saadi, Merchant served as a third-country national operative of the IRGC. Both cases illustrate a common tactic in Iran’s proxy operations in the West, the use of multiple layers of proxies to distance Iranian nationals from being implicated in terrorist plots. In these and other cases the IRGC has attempted to utilize vetted operatives from third countries to coordinate local actors, often from criminal organizations or disaffected groups, to carry out violent attacks or other forms of direct action.
2. ROLE OF RUSSIA, CHINA, AND IRAN AS TOP CUBAN SECURITY PARTNERS COMES UNDER SCRUTINY AMID INTENSIFYING US PRESSURE CAMPAIGN AGAINST THE ISLAND
Russia and Iran Have Been Supplying Cuba with Long-Range Attack Drones
According to a May 17 report by Axios, the US intelligence community assesses that Cuba has received over 300 Shahed-type drones from Russia and Iran since 2023. The Cuban military has allegedly considered plans for using the drones to attack the US Navy base at Guantanamo Bay, as well as additional military targets in Key West and the Caribbean.
Russia and China Expanding Listening Posts in Cuba
According to a May 22 report by the Wall Street Journal, both China and Russia have greatly increased the number of intelligence officers and support personnel to their signals intelligence collection sites in Cuba since 2023. According to the report, China maintains three signals intelligence sites on the island while Russia maintains two.
Additional Information:
First and foremost, it is worth noting that the intelligence assessments released this month come amid a mounting campaign of political and economic pressure on Cuba by the US, and do not necessarily reflect new imminent threats to US homeland security. Nevertheless Russia, China, and Iran have strong incentives to provide Cuba with security assistance which may directly or indirectly pose future threats to US homeland security.
-
Cuba is Russia’s most consequential ally in Latin America. Cuba has historically served as both a security partner for Moscow and a hub for regional influence. Cubans today are believed to make up the largest number of foreign fighters in Russia’s war in Ukraine, with a force of up to 5,000 Cuban “volunteers” continuously deployed with the Russian armed forces in combat. Havana’s importance to Moscow has grown in the wake of the US operation to arrest former Venezuelan President Nicolas Maduro.
-
China similarly views Cuba as important, though ultimately not an essential partner in the region. Cuba provides Beijing with a geopolitical foothold near US shores and a presence in security cooperation in Latin America. The growing importance of the region to China’s global interests is evident in China’s decision to release a new official policy paper on engagement with Latin America and the Caribbean (its first in nine years) only five days after the release of the 2025 US National Security Strategy which invoked a return of the Monroe Doctrine.
-
Iran and its proxy Hezbollah have cultivated ties with Cuba and Venezuela as well as other anti-American dictatorships in Latin America since the early 2000s. While much of its previous cooperation focused on financing IRGC operations through regional drug trafficking and money laundering, Iran has new incentives to both arm Cuba and use the island as staging ground for its own proxy operations against the US homeland as revenge for US attacks and to establish leverage to deter future US military operations.According to the Center for Strategic and International Studies, China has been expanding and redeveloping the Cold War-era Bejucal signals intelligence facility since 2014. The expansion has included the building of multiple new circularly disposed antenna arrays and probable infrastructure for more advanced electronic surveillance. Russia’s primary spy base in Cuba is the Lourdes electronic warfare center located near Havana. Lourdes is a Cold War-era signals intelligence base which Russia reopened in 2014 as part of an agreement to write off 90% of Cuba’s debt, as a retaliatory measure for deteriorating relations with the US after the Russian seizure of Crimea.
In March 2026, prominent Russian military blogger “Rybar” (the alias of Mikhail Zvinchuk, a former press officer for Russia’s Ministry of Defense) suggested that based on lessons Russia and Iran had learned from their own drone wars, Cuba could use Shahed-type drones most effectively in a confrontation with the US to not only strike military targets but to wreak havoc on critical infrastructure by striking data centers and threatening regional airports to snarl air travel. While Rybar is not a government official, the extremely popular Telegram account with 1.5 million followers receives substantial information and financial support from the Russian military and defense sector, suggesting familiarity with official plans—including the presence of Russian drones in the country two months before public acknowledgement by the US.
Illustration of the range of Russian Geran/Shahed drones from Cuba and potential targets. Source: Rybar on Telegram
3. LA COUNTY MAYOR PLEADS GUILTY TO ACTING AS A CHINESE FOREIGN AGENT
On May 11, the Department of Justice announced that Eileen Wang, the Mayor of the City of Arcadia, in Los Angeles County, California, will plead guilty to operating as an illegal foreign agent of the People’s Republic of China (PRC). Wang was first elected to the Arcadia City Council in November 2022, and was selected to serve as Mayor through December 2026 through the council’s leadership rotation.
As part of her plea agreement Wang admitted to working with Chinese officials to promote pro-PRC narratives in the US, through a news website catering to Chinese-American communities called “U.S. News Center,” between 2020 and 2022. Wang denies that her conduct continued after being elected.
Additional Information:
Eileen Wang’s denials that she either continued her illegal operations on behalf of the PRC after her election or moved beyond republishing propaganda deserve further scrutiny. Wang operated with multiple co-conspirators including her long-time political advisor Yaoning “Mike” Sun, and a high-level PRC intelligence operative “John” Chen Jun. As noted in the Homeland Security Brief - February 2026, both Sun and Chen engaged in aggressive efforts to not only spread PRC propaganda but to surveil and intimidate local Chinese communities in Southern California on behalf of intelligence operatives affiliated with the PRC’s Los Angeles Consulate into 2024. Further, as part of his plea agreement, Sun claims to have brought Wang to a meeting with PRC officials in December 2022, one month after her election, in which he claimed both he and Wang were dedicated to advancing PRC interests.
Illustrative of the growing extent of China’s transnational repression is that only two days after Wang pleaded guilty, a 64 year-old Chinese-American man “Harry” Lu Jianwang, was convicted of serving as an illegal foreign agent of the PRC in federal court in Brooklyn. In that case, Lu and a co-defendant, Chen Jinping, helped operate an illegal overseas “police station” for China’s Ministry of Public Security in Manhattan’s Chinatown neighborhood. Chen pleaded guilty to conspiring to act as an illegal foreign agent of the PRC in December 2024.
4. SUSPECTED IRANIAN CYBER OPERATIVES HACKED SAFETY MONITORS AT US GAS STATIONS
A May 15 report by CNN alleged that US officials believe that Iranian threat actors were involved in a series of cyber intrusions into automatic tank gauge (ATG) systems that monitor the amount of fuel in fuel tanks at gas stations across several US states. While no damage has yet been observed from the hack, the hacks could have allowed gas leaks to go undetected and potentially cause catastrophic explosions. Some experts see the incident as the first step toward a “kinetic” cyber attack in which malicious digital disruptions result in real-world destruction.
Additional Information:
As noted in the CNN report, and cited in a 2021 report by the UK’s Sky News, Iranian actors have previously singled out ATGs as attractive targets for cyber attacks due to a combination of perceived vulnerability to intrusion, and capacity to result in substantial physical damage. Iranian actors have pursued similar easy-to-access, single points of system failure in other forms of critical infrastructure. As noted in the Homeland Security Brief - April, this has included programmable logic controllers governing water and wastewater facilities at small municipal systems.
HORIZON THREATS
International activity that may pose future risk to US homeland security
5. RUSSIAN OPERATIVES CONDUCTING HATE CRIMES AND ELECTION INFLUENCE OPS ACROSS EUROPE
A May 24 report by the Organized Crime and Corruption Reporting Project (OCCRP) has found that leaked documents obtained from Russia’s Social Design Agency (SDA), a Kremlin-led intelligence task force fronting as a public relations firm, show Russian operatives have been behind a series of vandalism incidents and hate crimes in Europe used to stoke civil unrest. Notable operations executed by SDA in recent months included the May 2025 defacement of the Paris Holocaust Museum and three local synagogues with green paint and the September 2025 vandalism of nine Paris mosques and Islamic cultural centers with pig heads.
Additional Information:
In addition to fomenting civil unrest, a major long-running project for Russia’s SDA is conducting election influence operations. As noted in the OCCRP report, the SDA has employed sophisticated disinformation operations ahead of Armenia’s nationwide election in June to discredit the party of pro-Western Armenian Prime Minister Nikol Pashinyan. The lessons learned from that campaign are likely to be used against the US in the upcoming 2026 midterm election. In September 2024 the US Department of Justice announced it had disrupted a plot by the SDA to spread disinformation about US support to Ukraine across US social media outlets ahead of the 2024 general election.
This briefing was compiled by Dan White. For more information, corrections, or comments, please contact dan@opforjournal.com