The US Department of Homeland Security, following the confirmation of Khamenei’s death, warned of the escalated terrorist threat, asserting that Iran will almost certainly pursue retaliatory action.  

Iran has historically operationalised asymmetric attacks as a key component of its strategy to affect Western interests over the last half-century. These attacks rely on proxy networks and hybrid warfare to threaten US interests while minimising the risk of retaliatory direct conflict. As such, Iran has been labelled by the US as the world’s leading state sponsor of terrorism.  

Terrorism from Iran functions through four distinct pathways: direct Iranian agents, criminal surrogates, terrorist proxies, and lone offenders. These pathways constitute the substantial scale of Iranian covert operations against the West. The Washington Institute for Near East Policy has recorded 157 cases of Iranian foreign operations in the last five years, 27 of which were plots in the United States, and 54 targeting Europe between 2021 and 2024. Since January 2022, MI5 Director General Ken McCallum revealed that 20 Iranian plots of potentially lethal threat to UK citizens had been uncovered.

The US intelligence community believes Iran is committed to the deepening of proxy networks within the US, and also to assassinate US government officials it sees as responsible for the death of Iranian military officer Qaseem Soleimani in 2020. This threat was reaffirmed when the Department of Justice charged Iranian Asset Farhad Shakeri with murder-for-hire in the 2024 IRCG-directed plot to assassinate President Trump.  

The plot is emblematic of Iran’s operational methodology that relies on criminal proxy and surrogate networks, such as drug traffickers and organised criminal networks, to establish layers of plausible deniability. A July 2025 joint statement by the US and 15 other Western Nations reaffirmed that Iranian intelligence services were deepening their collaboration with international crime organisations. 

Post-Strike Threat Escalation 

The Department of Homeland Security warned of an escalated terrorist threat following  Khamenei’s death, asserting that Iran will likely pursue retaliatory actions. The West Point Combating Terrorist Centre assessed that initial plots following the February 2026 strikes are likely to be carried out by lone offenders and criminal proxies. Lone offender attacks are especially difficult to avert because of the unpredictability of individual perpetrators. 

This threat was actualised on March 1st, when 53-year-old Ndiaga Diagne, a naturalised US citizen originally from Senegal, opened fire outside Burford’s, a popular bar in Austin, Texas. Two people were killed, and 14 severely injured, before Diagne was neutralised by law enforcement. Diagne wore clothing bearing the emblem of the Islamic Republic of Iran, while photos of the Iranian regime’s leadership and flags of the Iranian Republic were found following a search of his apartment and his vehicle.  

On the same day, a boxing gym in Ontario, Canada, owned by Salar Gholami, an Iranian-Canadian dissident of the Iranian Regime, was shot at with 17 rounds of live ammunition. The shooter specifically targeted windows displaying the Iranian lion and sun flag, emblematic of pro-Iranian liberation and outlawed by the Islamic Republic. 

On March 12th, Ayman Mohamed Ghazali, a Lebanese-born US citizen, rammed his truck, laden with mortar-type explosives, into Temple Israel Synagogue in Michigan, before exiting the vehicle armed with a rifle. Ghazali was killed by synagogue security, and no deaths or injuries were recorded. The attack is under FBI investigation as a targeted act of violence against the Jewish community. Jewish community centres are suspected to be primary targets for sleeper networks across the US and Europe. 

Although there is no direct evidence currently tying these incidents to Iran, past regime changes in the region have been paired with significant increases in terrorism, exemplified by previous interventions in Iraq, Libya, Syria, and Afghanistan. Claire Moravec, a former FBI national security official, has detailed how wars can operate as ‘accelerants’ for those disaffected and susceptible to radicalisation. 

Major General Mohammad Bagheri, chairman of Iran’s Armed Forces General Staff, before his death in an Israeli airstrike in 2025, told Iranian state media in 2023 that “revenge against the masterminds and perpetrators of General Soleimani’s assassination will never be removed from the agenda of the youths of the Muslim world and his devotees across the world”.  

This sentiment is only likely to deepen following the assassination of security chief Ali Larijani and Ayatollah Khamenei, who took up a symbolic role in extremist Shia movements, potentially motivating lone offending extremists to latch on to the martyrdom of the Iranian regime’s leadership. 

Foreign Avenging Plots

While near-term plots are likely to be committed by lone offenders and criminal proxies, in the longer term, Iran is likely to orchestrate foreign plots to avenge the decapitation of their leadership. Iranian army chief Amir Hatemi, in a statement on March 18th, vowed revenge for the assassination of Larijani, promising ‘decisive and regrettable’ retaliation. 

European intelligence officials and lawmakers, including German representative Marc Henrichmann, have cautioned that sleeper cells across the continent are likely to pursue retaliatory measures. Security analysts believe that European networks, operating under a semi-autonomous command model, will primarily target Jewish community centres, Israeli diplomatic missions, and US government personnel.  

On March 23rd, these threats were realised when four ambulances belonging to the Jewish volunteer group Haztola, were set on fire outside a London synagogue. A new, reportedly IRCG-linked militant group, Ashab al-Yamin, has claimed responsibility for the attack. A group of the same name has also previously admitted responsibility for synagogue attacks in the Netherlands and Belgium. 

FBI Director Kash Patel has also increased surveillance protocols over suspected Hezbollah-linked sleeper cells. The International Centre for Counterterrorism sees the threat of these terrorist attacks as relatively predictable, given the established networks, routes, and relationships that Iran has developed with sleeper cells across the globe and their repeated deployment of these tactics historically.  

The ISIS Resurgence Risk

The war in Iran produces a potential security vacuum in the Levant that facilitates the conditions for Sunni jihadist organisations to rebuild. Counter-terrorism experts have warned that the diversion of Western resources towards containing Iran and its Shia proxies, coupled with aggressive military campaigns, destabilises state structures and facilitates the reconstitution of Sunni jihadist entities. 

The escape of 15,000 to 20,000 individuals associated with the Islamic State (IS) from the al-Hol detention camp in March 2026 exemplifies the dangers of this security vacuum. The al-Hol camp housed IS militants and their families. The mass prison break was facilitated by the collapse of the fragile security architecture around detention centres in North-Eastern Syria and occurred precisely as the US military and the Syrian Democratic Forces (SDF) redirected attention towards Iranian missile strikes.  

The ISIS threat reporting issued by the UN Secretary General details an adaptive IS that is consolidating in the midst of the heightened fragility of Syrian regime change. IS activity along the Syrian border has increased significantly following the fall of the Assad regime in 2024, increasing to 294 attacks in 2024, from 121 in 2023. In 2025, attacks declined to 244. In December 2025, three Americans were killed in Syria when a lone gunman targeted US troops. 

The release of 20,000 indoctrinated individuals into an active war zone allows for IS to reclaim lost territory and take advantage of the security vacuum provided by sectarian grievances, the withdrawal of US troops and the US-Israeli campaign against Shia powers. Further, the women and children who escaped the camp could come to represent the future generation of IS. The strengthening of IS, although primarily focused on fighting in the Middle East, allows for the establishment of a continued and bolstered territorial presence and a greater opportunity to plot external attacks that directly threaten Europe and the US.

For more information download The Iran War and the Global Terrorism Threat report. 

AUTHOR

voh-articles-author-box-charles

Charles Fitchew

Communications Intern, IEP
FULL BIO

Vision of Humanity

Vision of Humanity is brought to you by the Institute for Economics and Peace (IEP), by staff in our global offices in Sydney, New York, The Hague, Harare and Mexico. Alongside maps and global indices, we present fresh perspectives on current affairs reflecting our editorial philosophy.