Homeland Security Brief - The Iranian Threat in the Wake of Operation Epic Fury
This brief highlights significant threats to US homeland security posed by Iran since the start of Operation Epic Fury launched on February 28, 2026.
Summary:
Observed Threats - Current activity that poses direct risk to US homeland security
Lone-wolf actors inspired by Iran and the Axis of Resistance have conducted two attacks in the US in Texas and Michigan.
Iran is intensifying cyber attacks against US corporations and Iranian dissidents.
Horizon Threats - International activity that may pose future risk to US homeland security
There is mounting evidence that Iran has activated overseas terror sleeper cells to conduct attacks targeting Jewish communities, Iranian activists, and US and Israeli officials worldwide.
OBSERVED THREATS
Current activity that poses direct risk to US homeland security
1. TWO LONE-WOLF ACTORS INSPIRED BY IRAN AND THE AXIS OF RESISTANCE LAUNCH TERROR ATTACKS IN US
Mass Shooting in Texas Linked to Sympathy for Iran
On February 29 at approximately 1:30 am, a US citizen, Ndiaga Diagne, launched a mass shooting at Buford’s bar in downtown Austin, Texas killing three and wounding 13. Diagne began shooting into the bar’s outdoor seating from his SUV before exiting his vehicle and shooting at bystanders on foot.
There are strong indications the attack was launched in support of the Iranian regime. The attack occurred within 24 hours of the start of Operation Epic Fury. Diagne also reportedly wore an Iranian flag shirt underneath a hoodie emblazoned with the words “Property of Allah” during the attack. Diagne’s social media activity also features several messages hinting at pro-regime sympathies.
Synagogue Attack in Michigan Linked to Hezbollah Sympathies
On March 12, a US citizen, Ayman Mohamad Ghazali, attacked the Temple Israel synagogue outside Detroit. Ghazali rammed a truck carrying improvised explosive devices into the synagogue’s school. He then engaged in a brief firefight with onsite security guards using a semi-automatic rifle, before committing suicide after becoming stuck in his burning vehicle. Ghazali was the attack's only fatality, though the vehicle ramming injured a security guard and smoke from the resulting fire caused injuries to multiple first responders. No children were present at the time.
Ghazali is believed to have carried out the attack in retaliation for an Israeli drone strike in southern Lebanon on March 5, which killed four of his relatives, including two brothers. Israel alleged one of those brothers, Ibrahim Mohamad Ghazali, was a Hezbollah commander. CBS News, citing local sources in Lebanon, confirmed that both brothers killed in the strike were members of Hezbollah's rocket forces.
Additional Information:
Iran is Using Religious Rulings to Instigate Lone-Wolf Attacks: Multiple Iranian clerics have ordered religious rulings (fatwas) calling for violence against Americans in the wake of Operation Epic Fury. Two fatwas issued on March 1 called on all Muslims to take revenge on Americans for the killing of Ayatollah Ali Khamenei. These were followed on March 4 by a fatwa requiring violent attacks on Israelis and President Trump.
Attackers Were Known to be Mentally Unstable: Both assailants were reportedly known to be mentally unstable prior to their attacks, suggesting both men were self-radicalized and did not act as part of a broader network of Iranian sleeper cells and contract killers. Ayman Mohamad Ghazali’s ex-wife reportedly called 911 about an hour before the attack to warn local authorities that her ex-husband had become unstable after the deaths of his brothers in Lebanon and was potentially planning violence against himself and others.
Other Potential Lone-Wolf Attacks in North America: A series of additional drive-by shootings targeting synagogues and the US consulate in Toronto between March 6-10, may also be lone-wolf attacks inspired by Iran, though these incidents remain under investigation.
2. IRAN-LINKED CYBER THREATS TARGET IRANIAN DISSIDENTS AND US CORPORATIONS
Iranian Hackivists Target US Medical Device Giant Stryker
Between March 1-12, Handala, a pro-Tehran “hackivist” group linked to Iran’s intelligence apparatus, engaged in several cyber operations to intimidate Americans and disrupt American companies. The most significant of these was a malware attack on March 11 that disrupted the operations of US medical device manufacturer Stryker.
According to the Cybersecurity and Infrastructure Security Agency (CISA), the attack targeted the company’s Microsoft Intune account (a cloud based corporate IT platform). Stryker reports the attack remained confined to its internal Microsoft environment and did not leak into or compromise any of its products, though some Stryker devices were disrupted by efforts to contain the malware.
Iranian Intelligence Targeting Dissidents with Malware on Telegram
On March 20, the FBI issued a flash cyber intelligence alert that Iran's Ministry of Intelligence and Security (MOIS) has escalated a cyber campaign on Telegram targeting overseas Iranian dissidents and journalists with malware. The cyber attacks used social engineering to trick victims into installing malicious applications disguised as common programs, such as security authenticators. Once installed, the malware activated Telegram bots that gave attackers remote command and control over victims' accounts and devices.
Additional Information:
Iranian Threat Actors Typically Attack Targets of Opportunity, Particularly Linked to Defense and Israel: According to CISA, Iranian hackers focus their efforts on exploiting poorly secured systems and network edge devices using,
“unpatched or outdated software with known Common Vulnerabilities and Exposures (CVEs) or the use of default or common passwords on internet-connected accounts and devices…These malicious cyber actors commonly use techniques such as automated password guessing, cracking password hashes using online resources, and inputting default manufacturer passwords. When specifically targeting operational technology (OT), these malicious cyber actors also use system engineering and diagnostic tools to target entities such as engineering and operator devices, performance and security systems, and vendor and third-party maintenance and monitoring systems.”
HORIZON THREATS
International activity that may pose future risk to US homeland security
3. IRAN ACTIVATING OVERSEAS SLEEPER CELLS TO ATTACK JEWS, DISSIDENTS, AND US AND ISRAELI OFFICIALS
Iran Allegedly Activated Transnational Terrorist Sleeper Cells
US officials have reported that Iran has sent an encrypted operational trigger to activate overseas sleeper cells to begin preparations for terrorist attacks. The message is believed to have been relayed across Iranian networks in numerous countries shortly after the death of Ayatollah Ali Khamenei on February 28.
New Iranian Transnational Terror Group Claims Responsibility for Attacks In Europe
A new Iran-linked transnational terror group Harakat Ashab al-Yamin al-Islamia (The Islamic Movement of the Companions of the Right) claimed responsibility for a series of attacks on Jewish organizations in Europe since the start of March. Attacks include the bombing of a synagogue in Liege, Belgium on March 9; the bombing of a synagogue in the Netherlands city of Rotterdam on March 13; and the bombing of an Orthodox Jewish school in the Netherlands city of Amsterdam on March 14.
Iranian Nationals Arrested for Surveillance of Jewish Institutions and Military Bases in UK
On March 6, the London Metropolitan Police announced the arrest of one Iranian national, and three dual British-Iranian citizens suspected of spying on Jewish communities in the city for suspected future terror attacks.
On March 20, two suspected Iranian spies were arrested after attempting to enter HM Naval Base Clyde near Glasgow, the site of the UK’s sea-based nuclear deterrent.
Additional Information:
Questions Linger About the Authenticity of Harakat Ashab al-Yamin al-Islamia: While the group has claimed responsibility for several recent attacks, those incidents may have been carried out by lone-wolf actors or sleeper cells affiliated with Islamic Revolutionary Guard Corps (IRGC) rather than an organized network of pro-Iranian militants. The group has also claimed credit for an attack in Greece that may never have taken place. This suggests the group could in fact be a disinformation operation claiming a variety of attacks carried out by others in order to exaggerate the reach and organization of pro-Iranian terror networks in the West.
Iran Threatens to Launch Indiscriminate Attacks to Target American and Israeli Officials: On March 20, Spokesman for General Staff of Armed Forces Brigadier General Abolfazl Shekarchi, announced that Iran will not hesitate to attack “recreational areas, tourist destinations and leisure centers around the world” in order to kill its enemies.
Historical Cases Suggest Iran will Target Government Officials, Prominent Dissidents and Jewish Institutions Using Local Proxies: As noted in Homeland Security Brief - December 2025, Iranian overseas assassinations and terror operations follow similar tactics, techniques and procedures. These operations, coordinated by the elite Quds Force of the IRGC, have for years been conducted through layers of intermediaries with Quds Force operatives serving as operational planners who subcontract the plots through local proxies generally recruited from organized crime and disaffected members of marginalized groups.
-
For decades, the most common targets for these attacks have been Jewish and Israeli groups around the world. However, since 2020 Iranian actors have plotted to assassinate members of the first Trump administration including Donald Trump, John Bolton, and Mike Pompeo for the killing of former IRGC commander Qasem Soleimani. Iran has also engaged in transnational repression targeting prominent dissidents in recent years. Most notably, in 2022 it attempted to organize the assassination of high-profile Iranian-American activist Masih Alinejad, and in 2024 plotted to kill two Maryland-based Iranian dissidents, in both cases using contacts in organized crime.
-
There are numerous signs the IRGC may be redoubling its efforts to conduct overseas attacks. The new commander of the IRGC, Ahmad Vadhi, appointed on March 1, has experience serving in the Quds Force, and is accused by Argentina of plotting the 1994 bombing of the Jewish Mutual Aid Association in Buenos Aires that killed 85. Since the start of Operation Epic Fury, multiple prominent Iranian activists living abroad have been killed or injured under mysterious circumstances. On March 6, anti-regime activist Masoud Masjoudi was found dead near Vancouver BC. Two Iranian nationals living in Canada have been charged with his killing. Masjoudi had been conducting investigations into IRGC affiliates in Canada at the time of his death.1 On March 19, a Dutch police officer of Iranian descent known for holding critical views of the Iranian regime, was shot and wounded.
Iranian-Canadian activist Masoud Masjoudi. Source: IranWire
There is also evidence to suggest Masjoudi’s death may be related to a dispute with other members of the Iranian opposition.