Supplemental Info:
This sitrep compiles open-source intelligence, agency advisories, and real-time indicators to inform AlertsUSA subscribers.
U.S. federal, state, and local authorities have implemented enhanced security protocols around government facilities, critical infrastructure, and high-value targets following joint U.S.-Israeli strikes on Iran under Operation Epic Fury. These measures stem from intelligence assessments indicating an elevated risk of asymmetric retaliation by Iranian state actors or proxies, including the potential activation of sleeper cells within the U.S. homeland. No confirmed attacks have been reported to date, but the threat environment remains dynamic, with particular concerns for physical sabotage, cyber intrusions, and lone-actor violence inspired by the conflict.
Background
The current escalation follows a series of U.S. and allied military actions against Iran as part of Operation Epic Fury, which resulted in the death of Iran's Supreme Leader Ayatollah Ali Khamenei and significant damage to regime infrastructure.
Iranian leadership has publicly vowed revenge for the attack and Khamenei's death. Intelligence assessments from the FBI, DHS, and the Office of the Director of National Intelligence (ODNI) highlight Iran's historical use of surrogates, such as Hezbollah, Houthis, and Shiite militias, to conduct operations abroad. Recent disruptions include at least 17 Iranian-linked plots in the U.S. over the past five years, involving surveillance of potential targets and acquisition of explosive precursors.
https://ctc.westpoint.edu/tehrans-homeland-option-terror-pathways-for-iran-to-strike-in-the-united-states
Border security gaps under prior administrations have raised alarms about undocumented Iranian nationals or affiliates entering as "got-aways," potentially forming dormant networks.
AlertsUSA's weekly Threat Journal newsletter recently covered the threat of Iranian proxies operating in Mexico.
https://www.threatjournal.com/archive/tj02142026.html
Current Threat Indicators
Sleeper Cells and Proxy Activation: U.S. officials assess that Iran maintains a "homeland option" for strikes, leveraging pre-positioned operatives or inspiring lone actors. Hezbollah, in particular, is viewed as a high-capability proxy with a global footprint, including possible cells in the U.S. that could target civilians, military installations, or infrastructure (see the West Point paper above).
The 2025 DHS Homeland Threat Assessment notes Iran's commitment to developing surrogate networks for such operations. Cyber actors aligned with Iran may also target vulnerable networks, with CISA warning of potential intrusions against Defense Industrial Base entities and other critical sectors.
https://www.dhs.gov/sites/default/files/2024-10/24_0930_ia_24-320-ia-publication-2025-hta-final-30sep24-508.pdf
Target Profile: High-probability targets include mass transit systems, entertainment venues, places of worship (especially Jewish, Christian churches and other pro-Israel sites), government buildings, schools, and critical infrastructure such as energy grids, water utilities, and transportation hubs.
Recommended Actions for the General Public
In light of heightened security concerns related to potential Iranian retaliation, here are key steps individuals can take based on DHS guidance:
Report Suspicious Activity: If you see unusual behavior, unattended packages, or potential threats (online or in person), immediately contact local law enforcement, the FBI, or call 911. Use the "If You See Something, Say Something" campaign to report tips without delay.
Stay Informed and Vigilant: Monitor official sources for updates on threats. Be aware of your surroundings, especially at public events, transit hubs, or crowded places. Ear buds and phone stay in your pocket...
Prepare for Emergencies: Assemble a basic emergency kit with essentials like water, food, medications, and flashlights. Develop a family communication plan, including evacuation routes and meeting points.
Enhance Personal Cybersecurity: Follow CISA best practices, such as using strong passwords, enabling two-factor authentication, and avoiding suspicious links to guard against cyber threats tied to geopolitical tensions.
