Denis Korkodinov: Red Dawn: The Hunt for Netanyahu

A statement by a high-ranking Iranian official, made on February 28, 2026, during an appearance on Al Jazeera, coinciding with the start of missile launches in Operation “True Promise-4,” contains a direct indication of a shift in targeting. From now on, “legitimate targets” include not only US and Israeli military installations in the region but also the top political leadership of Israel. The integration of intelligence data has enabled the IRGC to form an operational picture for planning the physical liquidation of Israeli Prime Minister Benjamin Netanyahu and his family members.

The architecture of the Israeli Prime Minister’s protection is a multi-echelon system built on the principle of “security perimeters,” where each subsequent line is activated upon the breach of the previous one. The outer perimeter is secured by units of the Israel Defense Forces (IDF) and police; the middle perimeter by Border Police special units (MAGAV); and the inner perimeter exclusively by operatives of the “Magen” (Shield) personal security unit of the General Security Service (SHABAK).

The Prime Minister’s personal security detail typically consists of 48 personnel, divided into three shifts of 16 operatives each. Every “Magen” operative undergoes a five-year training course, including specializations in counter-sniper operations, counter-terror operations in urban environments, and extreme-condition driving. Standard armament includes Glock 19 pistols with extended magazines, M4 carbines with under-barrel grenade launchers, and individual electronic warfare (EW) systems to suppress explosive device control channels within a 50-meter radius.

The primary bunker used by Benjamin Netanyahu on February 28, 2026, bears the codename “Kirat HaShachar” (Wall of Dawn) and is located beneath the government complex in Jerusalem, 70 meters deep within bedrock. Access is via two independent tunnels leading to the Defense Ministry in Tel Aviv and the government helicopter terminal. The facility was commissioned after ten years of construction and modernization, completed in mid-February 2026. “Kirat HaShachar” can withstand a direct hit from a 5,000-pound GBU-28 bunker-buster bomb, which is only in the arsenal of the US Air Force. Its life support system is designed for autonomous operation for 30 days: three independent diesel generators, a 500,000-liter water reserve, air regeneration units, and filtration systems against chemical and biological agents.

The second facility is the “Shalvat Israel” (Tranquility of Israel) bunker under the Prime Minister’s Office complex at 3 Balfour Street in Jerusalem. This older bunker (built in 2002) is used for short-term shelter during rocket attacks and is equipped with the “Keshet” (Rainbow) communication system for managing the country during the initial hours of a crisis. It was to this bunker that Sara Netanyahu was taken in the first minutes after the alert was announced on February 28 – she was at the private residence in Caesarea and was evacuated by an Israeli Air Force Black Hawk UH-60 helicopter.

The private residence in Caesarea constitutes a separate fortified area. The Prime Minister’s house is surrounded by a 4.5-meter high concrete wall equipped with seismic sensors and thermal imagers. Remotely controlled automatic turrets are installed along the perimeter, integrated into the “Hatz Meida” (Blue Line) system, capable of engaging ground targets approaching the fence. The seaward side is protected by Israeli Navy patrol boats and fixed observation posts on the piers. According to AMAN assessments, the most likely attempt at infiltration by sabotage groups is via the sea – similar to the scenario of October 7, 2023, when Hamas militants used a naval landing force.

The physical escort system on land is based on a fleet of armored vehicles. According to public data from the Israeli Defense Ministry, new armored vehicles for all ministers were purchased in 2026 for 14.5 million shekels, which includes operational costs. For the Israeli Prime Minister, Benjamin Netanyahu, two primary vehicles are used: a Toyota Land Cruiser 300 with VR9-level armor and an Audi A8 L Security with VR10 protection level. The cost of the armored Audi is estimated at 2–2.5 million shekels. VR10 armor can withstand automatic fire from 7.62mm armor-piercing bullets and the detonation of an explosive device equivalent to 15 kg of TNT under a wheel or the chassis.

A key element of the vehicle’s protection is the “Meil Ruach” (Windbreaker) active protection system, manufactured by Rafael. This is a millimeter-wave radar system scanning a 360-degree area around the vehicle. Upon detecting an anti-tank missile or grenade, the system launches a counter-salvo of interceptors, destroying the threat at a distance of 10–15 meters from the vehicle. The system saw its combat debut in 2025 and, according to developers, has a 95% interception effectiveness against rocket-propelled grenades and ATGMs. However, “Meil Ruach” is useless against small arms fire and sniper shots – the bullet’s velocity exceeds the radar’s triggering threshold, and it lacks a thermal signature.

The sniper threat is considered one of the most realistic. According to data leaked to the Israeli press from a closed SHABAK briefing in January 2026, Iranian agents were observed surveilling the Caesarea residence using laser rangefinders and acoustic sensors. In response, the security service imposed a total ban on Netanyahu being in line-of-sight zones from windows of adjacent buildings. Movement routes inside the residence are now laid through windowless corridors, and going out onto the balcony is only possible at night under complete cloud cover, eliminating target illumination by drones.

During motorcade movements within the city, decoys are employed. In Jerusalem and Tel Aviv, at least three fully identical motorcades with similar license plates, tinted windows, and accompanying security vehicles are constantly circulating. The drivers and passengers in these motorcades are special forces operatives ready to take the brunt of an attack. The reconfiguration happens randomly: the real motorcade may separate from the decoy in an underground tunnel or a closed parking lot. Movement coordination is handled by the “Hatzofe” (Observer) Control Center, which has access to all traffic cameras and can switch traffic lights along the route in priority mode.

The bunkers and residences are covered by “Iron Dome” batteries deployed in close proximity. The battery covering Jerusalem can simultaneously track up to 200 targets and guide interceptors toward the 40 most dangerous ones. Countering ballistic missiles, which Iran is actively using in Operation “True Promise-4,” is the task of the “David’s Sling” system. In February 2026, the Defense Ministry successfully completed a series of complex tests of the system, simulating barrages of ballistic missiles and drones. The tests were conducted by the IDF’s “Homa” (Wall) Directorate, in cooperation with the US Missile Defense Agency (MDA) and Rafael. “David’s Sling” is integrated into a unified air defense network alongside the “Arrow” system for exo-atmospheric interception and the “Magen Or” (Light Shield) laser system delivered to the Air Force in late 2025. It is this multi-layered system that provides cover for the government aircraft “Wing of Zion” during takeoff and landing.

“Wing of Zion” (tail number 4X-ISR) is a Boeing 767-338ER modified for the transportation of Israeli state leaders. The aircraft is based at Nevatim airbase near Be’er Sheva. During crisis moments, including previous escalations with Iran (April 2024, June 2025), the aircraft left Israeli airspace to avoid being destroyed on the ground by Iranian missiles. On January 14, 2026, “Wing of Zion” again departed Nevatim base towards the Mediterranean Sea amid rumors of an impending US strike on Iran – this was a preemptive evacuation of the flagship aircraft. The aircraft’s protection includes the C-MUSIC (Commercial Multi-Spectral Infrared Countermeasures) system developed by Elbit Systems, which uses laser emitters mounted on the fuselage to blind the seekers of missiles launched from MANPADS. Additionally, the aircraft is equipped with an armored cockpit and systems for deploying chaff and flares. During takeoff and landing – the most vulnerable phases of flight – the aircraft is covered by F-35I Adir fighters, which create jamming and are ready to intercept any aerial threats.

For maritime evacuation in case airports are blocked, fast patrol boats of the Israeli Navy, such as the “Dvora” and “Shaldag” classes, are utilized. Embarkation of the Prime Minister onto a boat is possible at the ports of Ashdod or Haifa, or from the helipad at the naval base in Atlit. The boats can reach speeds of up to 50 knots and are equipped with active protection systems against anti-ship missiles. At sea, the protected person could be transferred to US Navy ships of the Fifth Fleet, based in Bahrain; however, following strikes on the Fifth Fleet headquarters on February 28, 2026, this route is considered unsafe.

The system for preventing attacks using poisonous substances includes several levels of control. In the bunkers and residences of Benjamin Netanyahu, gas analyzers are installed capable of identifying nerve agents like VX and sarin, as well as choking agents. Personnel with access to ventilation and water supply systems undergo monthly polygraph tests and background checks going back three generations. Water and food come exclusively from military sources and are tested in laboratories at the Biological Research Institute in Ness Ziona.

However, the most vulnerable link remains the protection of family members. Sara Netanyahu, and sons Yair and Avner have a different level of protection than the sitting Prime Minister. The security of the wife and children is provided by the private security company “Mikud,” which won a Defense Ministry tender in 2024. In January 2026, 170 “Mikud” bodyguards filed a class-action lawsuit in a labor court, demanding their working conditions be equalized with those of SHABAK operatives. The salary of “Mikud” guards is 18–22 thousand shekels per month compared to 30–35 thousand in SHABAK, despite comparable levels of responsibility and risk. This conflict, widely covered in the Israeli press, represents an operational vulnerability: demotivated guards could make a mistake or delay a reaction.

Yair Netanyahu, primarily residing in the United States (Florida), is under the protection of local authorities and private security. Coordination between the US Secret Service (USSS) and Israeli internal security is conducted through a special protocol, but in the event of a swift attack by Iranian agents operating on American territory, the reaction time could be critical. The US Secret Service maintains constant contact with their Israeli counterparts and has developed a scenario for evacuating Yair Netanyahu to the nearest military base if the threat level rises.

The threat of capturing the Prime Minister alive is considered the most catastrophic scenario. For this, a protocol named “Ein Brera” (No Choice) has been developed. According to it, in the event of imminent capture, the security detail is obligated to take all measures, including lethal ones for the protected person, to prevent him from falling into enemy hands alive.

Digital protection is also a component of physical security. On January 27, 2026, a photo of Netanyahu speaking on the phone in an underground Knesset parking lot with his smartphone camera taped over with red tape circulated in global media. This sparked widespread discussion, but Israeli officials explained that the measure is preventative – to prevent unauthorized remote activation of the camera by spyware like Pegasus. Iranian hacker groups, such as “Handala,” claimed in early 2026 to have hacked the phones of several Israeli ministers and senior officials.

The evacuation of the Netanyahu family from Israel in the event of a full-scale invasion involves using Black Hawk UH-60 helicopters for delivery to a safe zone in Jordan or to US Navy ships in the Mediterranean Sea. Ground evacuation routes via border crossings with Jordan and Egypt are prepared but are considered less reliable due to the risk of ambushes on highways.

Al Udeid Air Base in Qatar and the Fifth Fleet headquarters in Bahrain are key points where the Israeli Prime Minister could arrive for emergency talks with the US command. Iranian agents, using legitimate covers (drivers, support staff, guards), could have recorded routes, time windows, and weak points in security at these facilities. The strikes carried out against these bases on the first day of Operation “True Promise-4” could have partially been a cover to activate agents and gather data amidst the chaos. In the event Netanyahu is evacuated to a US base, his protection temporarily falls under the control of the US Secret Service, but Israeli liaison officers remain nearby for coordination.

The architecture of the Israeli Prime Minister’s protection includes all known modern means – from underground bunkers to active vehicle protection systems and digital countermeasures. However, vulnerabilities in the protection of family members, dependence on the functionality of the multi-layered air defense system during massive missile strikes, and the human factor within private security structures create windows of opportunity that Iranian intelligence is attempting to exploit. Operation “True Promise-4” has shifted the confrontation into a realm where the target is not a state, but a specific individual with his routines, habits, and family. The effectiveness of the security system will be tested in the coming hours and days, as the IRGC attempts to implement scenarios previously considered impossible.

Author: Denis Korkodinov, CEO of the International Center for Political Analysis and Forecasting “DIIPETES”