The Hidden Network: How Iran’s Sleeper Cells Actually Operate on American Soil

Federal authorities intercepted an encrypted transmission originating from Iran on March 7, sparking concerns that the regime may be attempting to activate covert operatives stationed across the United States and allied nations. The mysterious broadcast, relayed through multiple countries shortly after the death of Iran’s supreme leader, the Ayatollah Ali Khamenei, represents what intelligence analysts describe as a potential operational trigger for dormant assets that could be embedded within American communities.The alert, distributed to law enforcement agencies nationwide, warns that while authorities cannot currently determine the exact contents of these transmissions, the sudden appearance of a new station with international rebroadcast characteristics warrants heightened awareness. Though officials emphasize no specific threat has been tied to a particular location, the intercept has revived urgent questions about the scope and sophistication of Iranian networks that may be operating beneath the surface of everyday American life.The FBI also warned law enforcement agencies last month that Tehran might try to retaliate for any United States strikes on Iran by launching surprise drone attacks in California. Governor Gavin Newsom, however, said the bulletin was one of many security updates the state received daily, adding he was not aware of an “imminent threat” to California and overheated reports about the alert, which was first reported by ABC News, were largely knocked down.In any case, experts emphasize that there is cause for concern.“The threat level regarding terrorist attacks in the USA and Europe has increased due to the conflict with the Islamist regime in Iran,” Counter Extremism Project Senior Director Hans-Jakob Schindler tells the Sun. “Currently, however, it’s an abstract threat, meaning that it is likely the regime will attempt to carry out attacks in the USA and Europe as part of its hybrid warfare strategy, but no warnings about concrete attacks have been received until now.”However, how do these so-called cells actually function on American soil?The Architecture of InfiltrationSecurity analysts paint a picture of Iranian operations that bears little resemblance to Hollywood depictions of sleeper cells. Rather than large, coordinated terror units awaiting a single activation command, Iran’s presence functions through a diffuse web of intelligence operatives, criminal proxies, and sympathizers who often operate with minimal direct contact with Tehran.Research compiled by the Washington Institute for Near East Policy has documented at least 27 plots connected to Iranian agents or proxies on United States soil over the past decade, spanning from surveillance targeting Iranian dissidents to attempted assassinations of American officials.The Islamic Revolutionary Guard Corps and its Quds Force have demonstrated a pattern of recruiting unlikely operatives. Court documents reveal a preference for criminal intermediaries and dual nationals who move through American society without attracting suspicion.In 2011, federal authorities disrupted a plot in which Manssor Arbabsiar, a naturalized American citizen, attempted to hire Mexican cartel members to assassinate Saudi Ambassador Adel al-Jubeir at a Washington restaurant. Arbabsiar, a failed used car salesman, was recruited by then Quds Force commander Gholam Shakuri, demonstrating Iran’s reliance on what officials term “unlikely surrogate assassins.”“Iran offers safe harbor to the leaders of transnational criminal syndicates,” United Against Nuclear Iran Policy Director Jason Brodsky tells the Sun. “In exchange, these criminal networks offer services to Iranian intelligence agencies, namely the Ministry of Intelligence and the IRGC’s Intelligence Organization.”Federal prosecutors have charged Iranian operatives with recruiting Eastern European crime syndicates to conduct surveillance and attempted hits on Iranian dissidents in New York, underscoring how Iran outsources sensitive operations to maintain plausible deniability.Three Attack ScenariosThese networks don’t follow a single playbook.Mr. Schindler outlines three distinct operational methods the Iranian regime employs. The first involves a division of labor between the regime’s intelligence assets, which handle planning and logistics, and Hezbollah operators, who carry out the attacks. This was the method used in the 1994 attack on the Jewish Center in Buenos Aires and the 2012 bombing of Israeli tourists in Burgas, Bulgaria.The second method involves cooperation between IRGC intelligence structures and organized crime elements.“In this scenario, the Iranian side pays members of organized crime to carry out attacks,” Mr. Schindler explains.This method was used in the 2022 shooting at the former rabbi’s house at the Old Synagogue in Essen, Germany, as well as in a Molotov cocktail attack on a school next to the synagogue in Bochum. In these attacks, members of the outlaw motorcycle gang, the Hells Angels, were paid by the Revolutionary Guard Corps to carry out the operations.The third scenario involves radicalized lone actors. Intelligence officials note extensive Iranian surveillance of military personnel, Jewish institutions, and regime critics. In early 2026, the FBI investigated increased surveillance targeting service members in Tampa. Last week, authorities examined individuals expressing support for the Revolutionary Guard at Austin, where a mass shooting killed two and wounded 14 at a bar.The shooter, Ndiaga Diagne, a Senegalese national, wore a sweatshirt reading “Property of Allah” and a shirt featuring the Iranian flag. Authorities discovered a flag of the Islamic Republic and photographs of Iranian regime leaders in his apartment. While the FBI has not definitively linked the attack to Iranian direction, officials are investigating possible connections.“This scenario was demonstrated in the attack on a bar in Austin, Texas, on March 1, 2026, by an individual with no direct connection to the Iranian regime but with clear sympathies for the regime,” Mr. Schindler says.Criminal Networks and Cover OperationsIran’s approach relies heavily on existing criminal infrastructure. American Enterprise Institute Senior Fellow Michael Rubin tells the Sun that “Iran will tap into existing criminal networks, think Mexican cartels and Azerbaijani mafioso, or ideological fellow-travelers like some black Muslim groups or leftist organizations like Code Pink.”A United States intelligence operative, speaking on background, tells the Sun that the networks extend beyond Iranian and Hezbollah operatives.“You should add to the mix not just Iranian and Hezbollah, but also al-Qaeda, whose leadership received refuge and support for decades,” the source observes. “They also have good relations with Tren de Aragua, MS-13, and the Sinaloa cartel through decades-long relationships, family and criminal.”These connections provide Tehran with ready-made operational infrastructure across multiple continents.The Quds Force has also used conferences, academic exchanges, and cultural events as recruitment platforms. For one, in 2012, former Air Force intelligence specialist, Monica Witt, allegedly attended an Iranian conference organized with Revolutionary Guard cooperation. Prosecutors later indicted Ms. Witt for researching United States intelligence personnel and assembling target packages for Iranian handlers. Ms. Witt, a convert to Islam who defected to Iran in 2023, is on the FBI’s Most Wanted list.Border records show more than 1,750 Iranians crossed the southern border unlawfully between 2021 and 2024. Intelligence officials caution that elite operatives could be hiding among them, merging into neighborhoods undetected.The Intelligence GapThe scope of Iranian infiltration in the United States has proven difficult for intelligence agencies to fully assess, with officials acknowledging significant gaps in understanding how deeply operatives have penetrated American communities.Yet not everyone shares the same level of alarm.A Pentagon official, speaking to the Sun on background, expressed skepticism about the severity of the sleeper cell threat.“I think it was a red herring,” the official says. “That there was no hit so far makes me think it might not actually be a threat. They should have already hit us.”The official also noted that Iran has underperformed expectations in multiple areas.“So far, Iran has largely disappointed,” the insider continues. “We expected missiles to bury Israel. Didn’t happen so far.”However, the intelligence operative sharply disagreed with the threat assessment. When asked about the most concerning attack types, the intelligence operative responded: “Most common: lone wolf, vehicular. Dirty bomb. It is more a question of whether they want to do it.”European authorities have documented similar infiltration patterns. German security services have identified what they describe as a “German Network” operated by the Quds Force, with three assassination squads tasked with targeting Iranian dissidents and Jewish individuals.German officials closed the Islamic Centre in Hamburg over regime ties, though several mosques across Europe reportedly operate under Iranian control. Following Mr. Khamenei’s assassination late last month, Qatar arrested 10 suspects in two Revolutionary Guard cells. Seven conducted surveillance on military facilities, while three were tasked with sabotage.Back in Washington, authorities say they are taking no chances. FBI Director Kash Patel announced last week that counterterrorism teams have been placed on high alert following the intercepted transmissions.“I instructed our counterterrorism and intelligence teams to be on high alert and mobilize all assisting security assets needed,” Mr. Patel stated.A senior White House source, speaking to the Sun on condition of anonymity, acknowledged the balance authorities face.“Sleeper cells are a potential problem, and of course, extra resources are being used to fight them. There’s an effort to downplay it on the messaging side, but operationally, there is a high alert to keep people safe,” the source said.Mr. Rubin, however, warns that the threat should be normalized in public consciousness.“It’s going to be the new normal,” he adds.

The Hidden Network: How Iran’s Sleeper Cells Actually Operate on American Soil

More from the New York Sun

Taliban Frees American Academic Held More Than Year

Belgium Deploys Troops To Protect Jewish Sites as Iran-Linked Group Claims Attacks Across Europe

California Governor Debate Abruptly Cancelled After Participation Rules Exclude All Non-White Candidates

Vance Leads 2028 GOP Presidential Contenders in Polling, but Rubio’s Star Is Rising in First-in-the-Nation Primary State

Oil Market Trades Executed Minutes Before Trump Iran Announcement Net Mystery Buyers $580 Million in Profits

Delta Air Lines Suspends Special Services for Members of Congress Amid DHS Shutdown

A ‘Yentl’ Adaptation That Finally Captures the Spirit of Isaac Bashevis Singer

Epic Fury: What New Arms Are in Play