Today's briefing:
The story behind the commercial engine of the drone that struck the Barakah nuclear plant.
Al-Saadi had blueprints of Ivanka Trump's home before federal prosecutors had him.
France deployed 22,000 officers for PSG celebrations. 780 arrested, 57 officers hurt.
Welcome to your Tuesday briefing.
The reach of proxy actors keeps expanding, and it’s not due to a leap in technical sophistication — it's supply chain. Commercial components, assembled outside state programs, were directed at targets that were previously in a different threat category entirely. The reporting from the last two weeks makes that pattern hard to argue with. Good to have you here.
Don’t have time to read? Watch 👇
TOP STORY
A Chinese Commercial Supplier Provided the Engine for the Nuclear Plant Drone Strike
A Houthi drone struck the Barakah nuclear power plant in the UAE in late May 2026. The IAEA confirmed the facility restored power. There was no radiological release. The drone's propulsion system was a Limbach L550 engine — sourced through Xiamen Victory Technology, a China-based commercial supplier with no documented connection to military procurement.
That last detail is the development. This newsletter noted in the May 19 edition that a drone had struck within five kilometers of Barakah. This is the confirmed direct hit, and the supply chain behind it changes the threat assessment.
The supply chain
Intelligence reporting during this period identified Xiamen Victory Technology, a China-based commercial company, as a supplier of Limbach L550 engines to Iranian networks. The L550 is the primary propulsion system for the Shahed-136 — the suicide drone platform deployed by Iran and its proxy forces across the Red Sea campaign and, now, into the UAE's airspace. The physical components of a weapon that struck nuclear infrastructure were sourced through civilian commercial channels, exported across multiple jurisdictions, and assembled by a non-state militia.
This matters because it removes a longstanding planning assumption: that precision UAS capability capable of reaching hardened targets requires state-level development programs. It doesn't. It requires a functioning supply chain and time.
What the attack tells security planners
Barakah is not a soft target. It sits inside the UAE's physical security architecture within a country that has invested significantly in air and missile defense. It was still reached. The question for security professionals advising on operations in the Gulf — or in any geography where Iranian-aligned proxy forces operate — is not whether their facilities are hardened. It's whether the hardening accounts for a UAS threat assembled from commercially available components.
Most pre-attack site surveys conducted before the Shahed-136 became a documented operational platform don't. The structural and access-control elements are solid. The aerial approach analysis isn't there. That's the gap.
The wider proxy thread
The Barakah strike is one data point in a pattern. The same Iranian supply network that equips Houthi drone operations appears in the al-Saadi indictment (see below) — not through drones, but through intelligence collection. Architectural blueprints of a private US residence, coordinated attack planning across 18 operations in Europe and North America. The methodology differs. The network origin, and the directing hand, does not.
Our Take
The nuclear dimension of the Barakah strike is significant on its own terms. A non-state proxy force, for the first time, demonstrated the reach and capability to strike a commercial nuclear facility with an uncrewed aerial system. The IAEA outcome — power restored, no release — is the best result from a genuinely dangerous incident.
The more durable issue is the supply chain. When a commercial engine sourced from a Chinese exporter can be routed through Iranian networks, assembled into an airframe by a Yemeni militia, and directed at nuclear infrastructure in Abu Dhabi, the threat model for any critical facility in a conflict-adjacent region needs updating. That's a planning problem, not a technology problem. The defensive systems exist. The question is whether the threat assessment that preceded the installation included this class of delivery system.
If it was written before 2022, it almost certainly didn't.
READER POLL
Does your current site security assessment include a UAS threat scenario?
This week’s briefing is brought to you in partnership with:
Fine-Tuning LLMs: Know When It's Worth It.
Most engineers reach for fine-tuning too early. In this free online session, Gauntlet AI's Aaron Gallant covers fine-tuning, PEFT, and QLoRA — the real tradeoffs, when it actually makes sense, and when prompt engineering gets you there first. Register free.
MEANWHILE
The IRGC Operative With Blueprints of Ivanka Trump's Florida Home
Before Mohammad al-Saadi was indicted in New York on May 28, his network had obtained architectural blueprints and surveillance maps of Ivanka Trump's private Florida residence. Structural layouts. Geographical maps. The pre-operational intelligence package you build when a physical approach is being planned, not considered.
Al-Saadi — an Iraqi national operating on behalf of Kata'ib Hezbollah and the IRGC's Quds Force — was extradited from Turkey on May 15 and indicted on six terrorism counts. Federal prosecutors allege he coordinated a minimum of 18 attacks across Europe and North America. The operation was framed in intercepted communications as retaliation for the 2020 Soleimani killing.
Al-Saadi's network appeared in this newsletter on May 19 in connection with the targeting of Jewish institutions in the US and UK. The residential blueprints in the New York indictment are new. They indicate that intelligence collection against a private protectee was running well ahead of any operational phase — and extended to the structural layout of the property, not just external observation. For EP teams managing private principal security, the takeaway is straightforward: if state-sponsored proxy networks are acquiring architectural drawings, the perimeter review has to go further back than the fence line.
PSG Won the Champions League. Paris Paid With 57 Injured Officers and 780 Arrests.
57 French police officers were injured and 780 people detained after PSG's Champions League victory on May 30 — in a city that had pre-deployed 22,000 officers before celebrations began.
France had pre-deployed 22,000 officers. The volume of the deployment was not the failure. The problem was what the crowd contained: organized factions using the cover of celebration to target law enforcement directly. Fireworks were fired horizontally at officers. One group attempted to breach a local police station. Shared bicycles were assembled into improvised barricades. Interior Minister Laurent Nuñez authorized tear gas and street-by-street pursuit to regain control.
For those planning around major sporting events in European capitals: the celebratory crowd and the tactical mob are not separate populations. They occupy the same street simultaneously, and the transition between them is too fast for reactive deployment to address after the fact. Paris had months of preparation and 22,000 officers in position before the first bottle was thrown. It still absorbed 57 casualties among its own ranks.
Sound even smarter:
The Southern District of New York has become the primary US federal venue for IRGC-linked assassination conspiracy prosecutions. Prior indictments include the 2022 plot to kill former National Security Advisor John Bolton and a 2023 attempt to target Iranian-American journalist Masih Alinejad. Al-Saadi's May 28 indictment marks the third significant IRGC-linked assassination conspiracy case brought in the SDNY in four years.
Investigations of Shahed-series drones recovered from the Ukraine conflict identified components sourced from at least a dozen US, European, and Chinese commercial manufacturers — including microcontrollers, GPS receivers, and engine parts available through standard civilian procurement. The Limbach L550 is a four-cylinder aircraft engine used commercially in light sport aviation.
SNAPSHOTS
🇲🇽 MEXICO — Multiple candidates killed in coordinated attacks during the current electoral cycle, including one whose bodyguard died alongside him. At least 69 of the targeted incidents this period involved female politicians.
🇬🇪 GEORGIA — Tens of thousands marched in Tbilisi on Independence Day (May 26), extending a protest movement now past 500 consecutive days against the Russian-aligned Georgian Dream government.
🇭🇹 HAITI — Armed gangs control approximately 90 percent of Port-au-Prince; Doctors Without Borders has evacuated patients from multiple hospitals and 1.4 million Haitians are internally displaced.
🇨🇴 COLOMBIA — Operation Jade netted 121 arrests in simultaneous sweeps targeting Gulf Clan, ELN, and Tren de Aragua kidnap-for-ransom networks across six cities and provinces.
EXTRA INSIGHT
DOMESTIC OPERATIONS — New Jersey State Police arrested 20 to 25 people outside Newark's Delaney Hall ICE detention center on May 31 following eight days of protests; arrestees were equipped with helmets, shields, and gas masks. State police had taken over perimeter control from federal ICE earlier in the week.
RESIDENTIAL SECURITY — A suspect entered a Grosse Pointe Farms residence overnight through an unlocked front door and exited through an unsecured perimeter gate. Exterior cameras recorded the breach and led to the arrest but did not prevent entry.
Threat assessments have a shelf life, and the specific ways they expire are rarely obvious until documented. Commercial supply chains enabling precision strikes on hardened infrastructure, pre-operational intelligence collection reaching private residences, organized elements operating inside civilian crowds: none of these were standard entries in most threat models five years ago. They are now. If the last full review for any principal or facility you cover predates that shift, the gap is worth finding before someone else does.
See you next week.
– On The Circuit
If you found this useful, forward it to someone who needs to read it. If someone forwarded this to you, subscribe at circuit-magazine.com
To give or receive feedback, hit reply.
PREVIOUS POLL - RESULTS
Q: Is Iran's strategy of striking commercial infrastructure working?
Should armed security at houses of worship be a legal requirement?
🟩🟩🟩🟩🟩🟩 A. Yes — the threat environment demands it (72%)
⬜️⬜️⬜️⬜️⬜️⬜️ B. No — it changes the character of these spaces (0%)
⬜️⬜️⬜️⬜️⬜️⬜️ C. It should be government-funded, not mandated (6%)
🟨⬜️⬜️⬜️⬜️⬜️ D. Something else. Let us know → (22%)
Your Comments:
F: “I don't know if it should be a requirement but any house of worship that wants security should be allowed to have it and not be told no or have it regulated so severely that it equates to a no.”
GM: “It should be legally allowed, but not a legal requirement. Beliefs, politics, laws, will dictate how it will be done”
HM: “There is NO TIME to wait for Law Enforcement. Active Shooters must be engaged immediately.”
BJ: “There should be some funding that goes towards places of worship to have armed security that are licensed and able to be properly trained. It is a different environment for security to be in and requires the necessary training to adapt to it. Not every situation requires an armed response, but being able to train with the proper funding that supports this endeavor is best in my opinion.”
***
Daily news for curious minds.
Be the smartest person in the room. 1440 navigates 100+ sources to deliver a comprehensive, unbiased news roundup — politics, business, culture, and more — in a quick, 5-minute read. Completely free, completely factual.
