// Threat Briefing

Iranian Sleeper Cell Threat to the US Homeland — What Americans Need to Know

Published: March 31, 2026 12:45 am   |   Updated: March 31, 2026 11:50 pm

// Situation Overview

On June 22, 2025, the Department of Homeland Security issued a National Terrorism Advisory System bulletin warning of a “heightened threat environment” inside the United States following US and Israeli military strikes on Iran’s nuclear program. FBI Director Kash Patel directed counterterrorism and intelligence teams to mobilize. The bulletin specifically cited the possibility of sleeper-style actors targeting US infrastructure and personnel.

This is not theoretical. Iran privately warned President Trump before the strikes that it would unleash terrorist attacks on US soil conducted by sleeper cells if the US proceeded. It then proceeded anyway. As of late March 2026, US law enforcement has intercepted encrypted communications believed to have originated in Iran that may serve as an operational trigger for sleeper assets already positioned inside the country.

// Current Status

The US is in an active military conflict with Iran. All historical trigger conditions identified by captured Hezbollah sleeper agent Ali Kourani — war with Iran, targeting of Hezbollah leadership, strikes on Iranian interests — have now been met simultaneously. Intelligence and counterterrorism professionals consider this the highest-risk domestic threat environment since 9/11.

// What Is a Sleeper Cell

A sleeper cell is a covert operative or small group embedded inside a target country, living normal lives — working, raising families, paying taxes — until receiving an activation signal. Iran and its primary proxy Hezbollah have maintained this infrastructure inside the United States since at least the 1980s.

The activation mechanism was described in detail by Ali Kourani, a Hezbollah Islamic Jihad Organization operative arrested in the Bronx in 2017 after eight years operating as a sleeper agent. Kourani told FBI agents that his cell would receive a one-word coded command via what appeared to be ordinary spam email. “There would be certain scenarios that would require action or conduct by those who belonged to the cell,” Kourani said. He listed those scenarios explicitly: if the United States went to war with Iran, if the US targeted Hezbollah leadership, or if the US struck Iranian interests. All three have now occurred.

Kourani also described the IJO — Hezbollah’s Islamic Jihad Organization, the operational unit responsible for overseas attacks — as “Iranian-controlled.” The unit reports directly to Iranian leadership and is funded by Iran at levels between $200 million and $800 million per year.

// The Geographic Footprint

For years, Hezbollah maintained primary networks in major American cities: New York, Houston, Detroit, Los Angeles, and Boston. When FBI surveillance increased and cell members began being arrested in those cities, Iranian intelligence made a deliberate strategic shift.

According to a former head of the FBI’s Iran-Hezbollah unit: “Hezbollah started placing operatives in areas such as Portland, Oregon; Louisville, Kentucky; and these operatives were to blend into the community and establish, essentially, sleeper cells to be activated, to conduct whatever activities Hezbollah may want of them.”

A 2022 George Washington University study — the most comprehensive academic analysis of Hezbollah’s US networks — found the highest documented Hezbollah activity in Michigan, New York, North Carolina, and California. But the deliberate dispersal strategy means less-monitored communities in the South and Midwest are now considered priority placement zones.

// Confirmed High-Risk Regions

Michigan — Dearborn / Detroit
The single largest documented Hezbollah support hub in the United States. Dearborn has the highest concentration of Lebanese Americans in the country, which Hezbollah has historically exploited for financing, logistics, and recruitment. Samer El-Debek, an IJO operative trained in bomb-making and explosives, was arrested in Michigan in 2017. Federal arrests tied to Hezbollah material support and financing have occurred repeatedly in the Detroit metro area.

New York — New York City / New Jersey
Ali Kourani operated for eight years out of the Bronx conducting surveillance on JFK Airport, LaGuardia Airport, FBI facilities, Secret Service offices, and US military installations in the New York area. He was tasked with identifying Israeli Defense Force members who could be targeted and locating weapons suppliers. Alexei Saab of Morristown, New Jersey, conducted separate surveillance on Manhattan landmarks including Times Square, the Empire State Building, Rockefeller Center, the Statue of Liberty, and transportation infrastructure. Both were IJO operatives.

North Carolina — Charlotte
A major Hezbollah financing network was broken up in Charlotte in 2000 — a cigarette smuggling ring that funneled millions to Hezbollah. The GWU study confirmed North Carolina as one of the four states with the highest documented Hezbollah activity. The FBI’s former Iran-Hezbollah unit specifically investigated Charlotte as a hub for financial and support networks.

California — Los Angeles / San Francisco Bay Area
Longstanding Hezbollah financial networks operate across California. In early 2026, the FBI sent a memo to California law enforcement warning of unverified intelligence about potential Iranian drone strikes targeting the West Coast — the memo was later characterized as unconfirmed, but its issuance reflects the elevated threat assessment for the state.

Texas — Houston / Austin
Houston has been a documented Hezbollah scouting target since the 1990s. The Austin 6th Street mass shooting in mid-2025, which killed two and injured fourteen, was subsequently investigated for potential Iran nexus. Texas’s size, its energy infrastructure concentration, and its border proximity make it a persistent concern for counterterrorism analysts.

Oregon (Portland) and Kentucky (Louisville)
Explicitly named by FBI counterterrorism leadership as deliberate sleeper placement destinations — chosen specifically because they were not major cities where FBI surveillance was concentrated. Operatives were sent to these communities to blend in and wait.

// What Are They Likely Targeting

Based on surveillance operations that have been documented through criminal prosecutions, Hezbollah’s IJO has conducted reconnaissance on the following categories of targets inside the United States:

The 2025 DHS bulletin specifically referenced surveillance of transport centers, synagogues, student groups, and energy infrastructure. Former FBI counterterrorism agents assess that the most likely attack profiles are low-sophistication, high-casualty events: vehicle rammings, shootings, improvised explosive devices in crowded public spaces, and infrastructure sabotage designed to disrupt rather than destroy.

There is also a credible concern about “hybrid” operations combining cyber attacks, coordinated shootings, and psychological warfare — designed not just to cause casualties but to undermine confidence in national security and force a halt to US military operations.

// The Decentralized Threat

One factor that complicates the current threat picture significantly: with Iranian and Hezbollah command-and-control leadership decimated by US and Israeli strikes, intelligence analysts are asking who now controls the sleeper cells. As one analyst put it: “If Israel’s able to decapitate the IRGC command and control, who actually then controls the sleeper cells? Do they become more decentralized, more atomized? Do they become more like lone wolf actors?”

A decentralized threat is in some ways harder to detect and disrupt than a coordinated one. Cells that are no longer receiving instructions from a functioning command structure may act on their own initiative, on irregular timelines, with targets of their own choosing. Former DHS senior adviser Charles Marino stated: “The fact is nobody, if they’re speaking honestly, from US intelligence or law enforcement can tell you as a matter of fact how badly we’ve been infiltrated here in the United States.”

// What Law Enforcement Is Doing

FBI Director Kash Patel has redirected counterterrorism and intelligence resources back to Iranian threat monitoring following the June 2025 escalation. ICE has arrested more than 130 Iranian nationals flagged as potential security risks since mid-2025, including at least one individual with confirmed IRGC ties and another who served as a military sniper in Iran within the past four years.

Law enforcement agencies have been instructed to heighten monitoring for suspicious radio-frequency activity following the interception of encrypted communications potentially originating in Iran. A joint statement in July 2025 from 14 Western nations condemned what they called the growing threat posed by Iranian intelligence services conducting covert activities on Western soil.

// Preparedness Considerations

ThreatMap USA does not provide security or law enforcement guidance. The following reflects publicly available preparedness awareness information:

Report suspicious activity: FBI tip line — 1-800-CALL-FBI (1-800-225-5324) or tips.fbi.gov. In an emergency, call 911.

// Sources

Department of Homeland Security National Terrorism Advisory System Bulletin, June 22, 2025 · Combating Terrorism Center at West Point, “Tehran’s Homeland Option,” August 2025 · George Washington University, “Hezbollah’s Operations and Networks in the United States,” June 2022 · US Department of Justice, United States v. Ali Kourani, 2017 · US Department of Justice, United States v. Alexei Saab, 2019 · The Soufan Center, August 2025 · FBI counterterrorism briefings, public record.