The FBI is actively monitoring known Iranian operatives and suspected sleeper cells currently inside the United States, with surveillance efforts escalating sharply after joint U.S.-Israel strikes killed Iranian Supreme Leader Ayatollah Khamenei in late February 2026. FBI Director Kash Patel placed all counterterrorism and counterintelligence teams on elevated alert status nationwide, while the bureau has boosted surveillance of what CBS sources described as Hezbollah-linked sleeper cells operating on American soil. Since President Trump took office in January 2025, the FBI has made more than 70 arrests linked to hostile foreign intelligence activity and has disrupted several alleged Iranian-linked plots. The threat is not theoretical.
In October 2024, an IRGC official tasked operative Farhad Shakeri with planning the assassination of Donald Trump himself, with co-conspirators Carlisle Rivera and Jonathon Loadholt of New York City appearing in court and being ordered detained. A leaked memo reported by the New York Post revealed that more than 700 Iranian nationals were allowed to remain in the U.S. after crossing the border illegally over the past four years, raising pointed questions about how many potential operatives may already be embedded in American communities. This article covers the scope of FBI monitoring operations, the history and evolution of Iranian plots on U.S. soil, recent arrests and disrupted attacks, and what counterterrorism experts say about the threat level going forward.
Table of Contents
- How Is the FBI Monitoring Known Iranian Operatives Inside the United States?
- The Growing Pattern of Iranian Plots Targeting the U.S. Homeland
- Recent Arrests and Disrupted Iranian-Linked Plots on American Soil
- Sleeper Cells vs. Criminal Proxies — Two Different Threat Models
- The Leadership Vacuum Problem and Why Experts Are Worried
- What Heightened Security Looks Like in U.S. Cities Right Now
- What Comes Next in the FBI’s Iran Monitoring Operations
- Conclusion
- Frequently Asked Questions
How Is the FBI Monitoring Known Iranian Operatives Inside the United States?
The FBI’s monitoring apparatus involves multiple layers of surveillance and intelligence coordination. Following the strikes that killed Khamenei, Director Kash Patel activated elevated alert protocols across every FBI field office in the country, with counterterrorism and counterintelligence teams running parallel operations. dhs Secretary Kristi Noem confirmed she is “in direct coordination with federal intelligence and law enforcement partners” to monitor and thwart potential homeland threats, while federal and local law enforcement boosted on-the-ground security in major U.S. cities as a precautionary measure. The FBI is specifically intensifying monitoring of individuals with suspected ties to the Islamic Revolutionary Guard Corps and its proxies, including Hezbollah and Kataib Hezbollah. FBI Operations Director Michael Glasheen testified in December 2025 that Iran continues to plot attacks against former U.S.
officials, support proxy groups, and conduct surveillance of Jewish and Israeli targets in the United States. This is not a new posture built from scratch — a former assistant FBI director has stated that Hezbollah and Hamas have maintained a presence in the United States since the 1980s, meaning the bureau is working with decades of institutional knowledge about these networks. It is worth noting, however, that despite the elevated alert status, no specific, credible threat has been publicly identified as of early March 2026. The distinction matters. Elevated alert means the FBI believes conditions are ripe for retaliation and is positioning resources accordingly, but it does not mean an imminent attack has been detected. The public should understand this difference to avoid unnecessary panic while still taking the threat environment seriously.
The Growing Pattern of Iranian Plots Targeting the U.S. Homeland
The data tells a clear story of escalation. According to a Washington Institute database tracking iranian foreign plots globally, 23 of 105 total Iranian foreign plots have occurred since the U.S. killing of IRGC commander Qasem Soleimani in January 2020. Of those 23 incidents, six — or 26.1 percent — took place inside the United States, compared to just 12 of 82 plots (14.6 percent) before Soleimani’s death. That near-doubling of the rate of U.S.-targeted operations indicates that Iran has become significantly more willing to strike on American soil in the years since Soleimani was eliminated. This pattern has a troubling implication for the current moment. Counterterrorism experts warn that the elimination of Iranian leadership — now including Khamenei himself — has removed the deterrent that previously restrained sleeper cells from acting.
The logic is straightforward: when the leadership that gave orders and maintained discipline is gone, the operatives already in place may feel liberated or compelled to act on their own initiative, potentially accelerating attack planning rather than waiting for instructions that may never come. However, there is an important caveat. Not all Iranian-linked activity on U.S. soil involves sophisticated military-style operations. Iran is increasingly relying on low-level criminals and untrained intermediaries recruited through prison networks to carry out operations inside the United States. This means the threat profile is shifting — instead of watching for trained intelligence operatives, the fbi must also track loosely connected criminal figures who may not fit traditional profiles of foreign agents. This makes the surveillance challenge considerably more complex and raises the odds that some plots could slip through monitoring efforts.
Recent Arrests and Disrupted Iranian-Linked Plots on American Soil
The more than 70 arrests linked to hostile foreign intelligence activity since January 2025 represent one of the most aggressive counterintelligence campaigns in recent FBI history. The most alarming of the disrupted plots was the IRGC’s plan to assassinate Donald Trump. In October 2024, IRGC official operatives tasked Farhad Shakeri with planning the hit, and his co-conspirators Carlisle Rivera, 49, and Jonathon Loadholt, 36, both of New York City, appeared in court on November 7, 2024 and were ordered detained pending trial. The fact that Iran attempted to assassinate a sitting presidential candidate — and later president — on American soil through proxies already living in New York City underscores the severity of the threat. The cyber dimension is equally concerning. In September 2024, three IRGC employees — Masoud Jalili, Seyyed Ali Aghamiri, and Yaser Balaghi — were indicted by the Department of Justice for a hack-and-leak operation specifically designed to influence the 2024 U.S. presidential election.
This was not a theoretical capability demonstration; it was an active attempt to manipulate American democracy. Then in December 2024, the founder of an Iranian company was arrested for providing material support to the IRGC and procuring sensitive U.S. technology for IRGC military drones, showing that Iranian procurement networks are actively operating within U.S. borders to supply Tehran’s war machine. These cases illustrate that Iranian operations in the United States are not limited to a single type of threat. They span assassination plots, election interference, technology theft, and material support for designated terrorist organizations. Each requires different investigative techniques and resources, stretching the FBI’s counterintelligence capabilities across multiple fronts simultaneously.
Sleeper Cells vs. Criminal Proxies — Two Different Threat Models
Understanding the Iranian threat inside the United States requires distinguishing between two fundamentally different operational models. The first is the traditional sleeper cell — trained operatives embedded in communities for years or decades, maintaining normal lives while awaiting activation. The former assistant FBI director’s acknowledgment that Hezbollah and Hamas have had a presence in the United States since the 1980s points to this model. These are individuals with deep cover, established identities, and the discipline to remain dormant for extended periods. They are harder to detect but also historically more restrained, acting only under direct orders from leadership. The second model is newer and, in some ways, more dangerous: the use of low-level criminals and untrained intermediaries recruited through prison networks.
The Trump assassination plot exemplifies this approach. Rather than deploying a trained intelligence officer, the IRGC worked through individuals already in the criminal ecosystem — people who are harder to connect to Iranian state activity through traditional intelligence indicators. The tradeoff for Iran is clear: criminal proxies are less reliable and less skilled, but they are also far less likely to be on the FBI’s radar before they act. This dual-track threat means the FBI cannot rely on a single surveillance methodology. Monitoring known associates of Hezbollah and the IRGC covers the sleeper cell threat, but it does nothing to catch a prison recruit in New York who receives instructions through encrypted channels. The more than 700 Iranian nationals who crossed the border illegally and were allowed to remain in the country over the past four years represent yet another category of concern — individuals whose backgrounds and connections may not have been fully vetted before they disappeared into the broader population.
The Leadership Vacuum Problem and Why Experts Are Worried
The killing of Ayatollah Khamenei creates a paradox that counterterrorism experts are grappling with openly. On one hand, eliminating the supreme leader of Iran is a devastating blow to the regime’s command and control structure. On the other hand, that same disruption may unleash rather than suppress the threat from operatives already positioned inside the United States. When the chain of command is intact, sleeper cells wait for orders. When it is shattered, individual operatives or local cell leaders may decide to act on their own initiative, seeking revenge or fulfilling what they believe their orders would have been. This is not without precedent in counterterrorism analysis.
Decapitation strikes against terrorist leadership have historically produced mixed results — sometimes degrading operational capability, sometimes triggering retaliatory attacks by surviving members. The Washington Institute data showing that Iranian plots accelerated after Soleimani’s killing in 2020 suggests that Iran’s network responds to the loss of leadership with more activity, not less. If the same pattern holds after Khamenei’s death, the United States may be entering a period of heightened danger rather than reduced threat. The limitation of even the best surveillance program is that it cannot predict when an individual will decide to transition from dormant operative to active attacker. FBI Director Patel’s decision to place all counterterrorism teams on elevated alert reflects this reality — the bureau is preparing for a threat it can characterize but cannot yet pinpoint. Michael Glasheen’s December 2025 testimony that Iran continues to plot attacks against former U.S. officials and conduct surveillance of Jewish and Israeli targets in the United States suggests that operational planning was already underway before the strikes on Khamenei, and the elimination of Iranian leadership may have accelerated timelines that were already in motion.
What Heightened Security Looks Like in U.S. Cities Right Now
Federal and local law enforcement have boosted on-the-ground security in major U.S. cities in the wake of the Iran strikes, though officials have been deliberately vague about the specifics. This is standard operational security — broadcasting exactly what enhanced measures look like would help adversaries identify gaps.
What is publicly known is that the coordination runs from the federal level through DHS and the FBI down to local police departments in cities considered high-value targets. Locations associated with Jewish and Israeli communities, government buildings, and diplomatic facilities are receiving particular attention, consistent with Glasheen’s testimony about Iranian surveillance of those targets. For ordinary Americans, the practical reality is that this heightened posture may be visible in the form of increased police presence at certain locations, potential delays at security checkpoints, and a general request from law enforcement to remain vigilant and report suspicious activity. The “see something, say something” framework, often dismissed as a cliché, takes on genuine operational significance when the FBI has identified a credible threat environment even if no specific plot has been detected.
What Comes Next in the FBI’s Iran Monitoring Operations
The trajectory of the FBI’s Iran monitoring effort depends heavily on what happens inside Iran in the coming weeks and months. If the regime collapses or fractures into competing power centers, the sleeper cell threat could either intensify — as operatives lose central restraint — or dissipate as the state apparatus that funds and directs them disintegrates. Neither outcome is guaranteed, and the FBI will need to maintain elevated operations until the picture clarifies.
What is clear is that the counterintelligence challenge posed by Iran inside the United States is not a temporary condition. The infrastructure for Iranian operations on American soil — built over four decades through Hezbollah networks, IRGC proxies, criminal recruitment pipelines, and cyber capabilities — will outlast any single leader’s death. The 70-plus arrests since January 2025 represent the visible tip of a much larger investigative effort, and the coming months will test whether the FBI’s expanded surveillance posture is sufficient to prevent the retaliation that counterterrorism experts consider all but inevitable.
Conclusion
The FBI’s monitoring of Iranian operatives inside the United States represents one of the most significant domestic counterterrorism operations in years. With more than 70 arrests since January 2025, active surveillance of Hezbollah-linked sleeper cells, and the disruption of plots including an assassination attempt against Donald Trump, the bureau is operating at a tempo that reflects the seriousness of the threat. The data supports this urgency — Iranian plots targeting the U.S. homeland have nearly doubled in frequency since 2020, and the elimination of Khamenei may accelerate that trend further.
The challenge ahead is sustaining this level of vigilance while navigating the uncertainty of a threat that spans trained intelligence operatives, criminal proxies, cyber actors, and technology procurement networks. More than 700 Iranian nationals who entered the country illegally and remain unaccounted for add another dimension to an already complex picture. Americans should understand that while no specific, credible threat has been publicly identified, the conditions for Iranian retaliation on U.S. soil are at their most acute in decades, and the FBI’s response reflects that assessment.
Frequently Asked Questions
Has the FBI identified a specific, credible threat of Iranian retaliation inside the United States?
As of early March 2026, no specific, credible threat has been publicly identified. However, FBI Director Kash Patel placed all counterterrorism and counterintelligence teams on elevated alert status nationwide as a precautionary measure following the strikes that killed Ayatollah Khamenei. The elevated alert reflects assessed conditions, not a confirmed plot.
How many arrests has the FBI made related to Iranian or foreign intelligence activity?
The FBI has made more than 70 arrests linked to hostile foreign intelligence activity since President Trump took office in January 2025. These include individuals connected to assassination plots, election interference operations, and technology procurement for the IRGC.
What is a sleeper cell, and does the FBI believe they exist in the United States?
A sleeper cell is a group of operatives embedded in a country who live normal lives while awaiting orders to carry out attacks or intelligence operations. The FBI has boosted surveillance of what sources described as Hezbollah-linked sleeper cells, and a former assistant FBI director has stated that Hezbollah and Hamas have maintained a presence in the United States since the 1980s.
How has the pattern of Iranian plots changed in recent years?
According to the Washington Institute, 26.1 percent of Iranian foreign plots since Soleimani’s killing in January 2020 have targeted the United States, compared to 14.6 percent before his death. This indicates a significant increase in Iran’s willingness to conduct operations on American soil.
Were there Iranian plots to assassinate U.S. political figures?
Yes. In October 2024, an IRGC official tasked Farhad Shakeri with planning the assassination of Donald Trump. Co-conspirators Carlisle Rivera and Jonathon Loadholt of New York City were arrested and ordered detained. FBI Operations Director Michael Glasheen testified in December 2025 that Iran continues to plot attacks against former U.S. officials.
How many Iranian nationals are currently in the U.S. after crossing the border illegally?
According to a leaked memo reported by the New York Post, more than 700 Iranian nationals were allowed to remain in the U.S. after crossing the border illegally over the past four years.