The U.S. government has intercepted an encrypted communication believed to have originated in Iran that federal authorities say could be “an operational trigger” for “sleeper cells” in other countries — a development that, if confirmed, would mark one of the most alarming escalations of the U.S.-Iran war beyond the battlefield.
According to a federal alert sent to law enforcement agencies and reviewed by ABC News, intelligence officials detected a coded transmission “likely of Iranian origin” that was relayed across multiple countries shortly after the assassination of Supreme Leader Ayatollah Ali Khamenei on February 28.
The message was not sent over the internet or through cell networks.
It was broadcast through what analysts describe as a previously unknown radio station, encrypted and intended for “clandestine recipients” who possess the key to decode it.
The alert warns that the transmission could “be intended to activate or provide instructions to prepositioned sleeper assets operating outside the originating country.”
What the Alert Actually Says — and What it Doesn’t
The federal warning is carefully worded. It states that the exact contents of the transmission cannot currently be determined.
It says there is “no operational threat tied to a specific location.” And it stops short of confirming that any sleeper cell has been activated or that an attack is imminent.
What it does say is that the “sudden appearance of a new station with international rebroadcast characteristics warrants heightened situational awareness.”
Law enforcement agencies have been instructed to increase monitoring of suspicious radio-frequency activity.
The FBI declined to comment when contacted by Newsweek. The White House did not respond to requests for comment.
In practical terms, the alert means federal and local agencies are now operating under the assumption that Iran may be attempting to use covert communication channels to reach operatives already positioned in Western countries — a scenario that intelligence officials have warned about for years but that has never been publicly confirmed on this scale.
This isn’t a New Fear — But the War Made it Real
The concept of Iranian sleeper cells in the West is not new. U.S. intelligence agencies have tracked Iran’s clandestine infrastructure for decades, and the IRGC’s Quds Force and its proxy Hezbollah have long maintained networks of operatives positioned in Europe, Latin America, and the United States.
The most detailed public account came from Ali Kourani, a naturalized U.S. citizen from Lebanon who was arrested in 2017 and convicted of conducting covert intelligence missions for Hezbollah’s Unit 910 — its external operations arm.
According to court records cited by the Washington Institute for Near East Policy, Kourani told the FBI he was part of a “sleeper cell” and that operatives like him would “expect to be called upon to act” if the United States and Iran went to war.
He was sentenced to 40 years in prison.
Federal authorities have publicly stated that they disrupted at least 17 Iranian plots on U.S. soil since the 2020 killing of IRGC commander Qassem Soleimani, including murder-for-hire schemes targeting former officials like John Bolton, Mike Pompeo, and Trump himself.
In 2021, authorities foiled an Iranian plot to kidnap Masih Alinejad, a prominent Iranian-American journalist and dissident, from her home in Brooklyn.
Before the current war even started, Iran reportedly passed a warning to the Trump administration that it could activate cells inside the United States if strikes were launched against its nuclear facilities.
The Department of Homeland Security has issued multiple bulletins over the past year referencing an “elevated threat environment” connected to Iranian-backed operations.
The Austin Shooting and the Fear Already Taking Hold
The alert comes in a climate of real fear, some of it justified and some of it being weaponized for political purposes.
On March 1 — just one day after the U.S.-Israeli strikes on Iran began — a 53-year-old man named Ndiaga Diagne opened fire outside a bar in Austin, Texas, killing three people and wounding 14 others.
Diagne, a naturalized U.S. citizen originally from Senegal, was wearing a sweatshirt reading “Property of Allah” and a shirt bearing an Iranian flag design.
Authorities found an Iranian flag and photographs of Iranian leaders in his apartment, along with a Quran in his vehicle.
The FBI is investigating the shooting as a potential act of terrorism, though officials have stressed that it remains too early to determine a definitive motive.
Investigators are examining whether Diagne, who had a prior criminal history and documented mental health episodes, may have self-radicalized.
An X account believed to belong to the shooter contained pro-Iranian and antisemitic posts dating back to 2024, but showed no indication of a planned attack.
The weapons were legally purchased in 2017.
The FBI confirmed that Diagne was not on any watchlist before the shooting.
Despite the ongoing investigation, politicians moved quickly to frame the attack within a sleeper cell narrative. Texas Governor Greg Abbott warned that Iranian sleeper cells pose a “serious threat” and deployed National Guard troops and additional state police.
Senator Ted Cruz cited the shooting as proof of what he described as the consequences of “open borders.” Texas Agriculture Commissioner Sid Miller called it evidence of “the Islamification of Texas.”
This is the space where legitimate security concerns begin to blur with xenophobia and political opportunism.
What European Allies Are Doing
The concern extends well beyond U.S. borders. In Germany, security officials have increased protection at synagogues, Jewish schools, and Israeli and American diplomatic facilities.
The head of the German Federal Police Union said it “cannot be ruled out” that Iran could deploy operatives across the world to target Israeli and American locations.
Grand Ayatollah Nasser Makarem Shirazi issued a fatwa on March 1 calling for holy war against the U.S. and Israel following Khamenei’s death, declaring that all Muslims were obligated to avenge “the blood of the martyr.”
While fatwas are not universally binding and are often used as political instruments, German security expert Hans-Jakob Schindler of the Counter Extremism Project warned that Iran’s defense strategy relies heavily on hybrid warfare, including using “terror attacks” abroad to increase the political and economic costs of military confrontation.
European authorities disrupted multiple Iranian-linked plots in Sweden and Germany during a previous round of Israeli strikes on Iran in June 2025.
Intelligence officials have noted that Iran has increasingly shifted toward hiring local European criminals rather than deploying its own operatives, making detection significantly harder.
In Canada, a boxing gym owned by Iranian-Canadian dissident Salar Gholami was targeted by a gun attack in Richmond Hill, Ontario, on the same weekend as the Austin shooting.
Gholami, who has organized anti-regime protests in Toronto, told Iran International he believes the attack was “intimidation directed at critics of the Islamic Republic.”
The Bigger Picture: A Regime With Nothing Left to Lose
Security analysts have long argued that the greatest danger from Iran’s clandestine networks would come at a moment of existential crisis — precisely the kind of crisis the regime is now facing.
With Khamenei dead, the IRGC’s conventional military capacity being degraded by ongoing U.S. and Israeli strikes, and the regime’s missile output reportedly declining day by day, the calculus that previously restrained sleeper cell activation may no longer apply.
Analysts at the Middle East Forum warned that “a regime in its death throes loses the deterrent calculus that previously restrained sleeper cell activation — it has nothing left to preserve by holding cells in reserve.”
The appointment of Mojtaba Khamenei as the new supreme leader — a figure even more hardline than his father with deep personal ties to the IRGC — further reduces the likelihood of any near-term de-escalation.
None of this means that a coordinated wave of attacks is imminent. The federal alert itself is careful to avoid that conclusion.
But the interception of a coded, internationally broadcast transmission from inside a country at war, sent through a channel designed specifically to reach covert operatives, is not something that happens in peacetime.
The war in Iran was sold as a strike against a distant enemy. The intercepted transmission is a reminder that the consequences may not stay distant for long.
