U.S. intelligence agencies have intercepted a series of encrypted transmissions believed to be a “high-level operational trigger” for Iranian sleeper cells positioned globally, according to a federal alert distributed to law enforcement agencies on Monday.
The signals analysis, first reported by ABC News, suggests the encoded broadcasts originated in Tehran shortly after the Feb. 28 joint U.S.-Israeli airstrike that killed Supreme Leader Ayatollah Ali Khamenei. Federal authorities warn that these “clandestine transmissions” may be intended to activate prepositioned assets or provide final tactical instructions for retaliatory strikes on Western soil.
The Signal and the Strike
The intercepted communications were reportedly broadcast across multiple countries and utilized an encryption key held by “clandestine recipients.” While the specific contents remain classified, the federal alert noted the transmission’s characteristics align with historical protocols used to mobilize “sleeper assets.”
The heightened alert comes in the wake of Operation Epic Fury, the massive military strike on Feb. 28 that decimated the upper echelons of the Iranian regime. Khamenei, the 86-year-old clerical leader who ruled Iran for nearly four decades, was killed alongside several family members and senior commanders of the Islamic Revolutionary Guard Corps (IRGC).
This escalation follows a precedent set in June 2025, when U.S. and Israeli forces targeted Iranian nuclear facilities. At that time, Tehran privately warned the Trump administration that direct strikes on its leadership would result in “asymmetric retaliation” inside the United States.
Domestic Vulnerabilities Amid Federal Shutdown
Speaking from a press conference on Monday, President Donald Trump confirmed that the administration is aware of the potential for domestic sleeper cell activity but claimed that national security efforts are being hampered by a partial government shutdown.
“We’ve got very, very good intelligence on that,” Trump told reporters. “The biggest problem we have is the Democrat shutdown. It doesn’t allow us to do what we have to do. The apparatus is hobbled.”
The shutdown has specifically affected the Department of Homeland Security (DHS), though FBI Director Kash Patel maintained in recent social media statements that the bureau remains “fully engaged” and is working “24/7 to disrupt any potential threats to the homeland.”
However, critics point to recent purges within the FBI’s counterintelligence divisions as a potential blind spot. Reports indicate that over a dozen agents specializing in Middle Eastern threats were recently terminated, raising concerns about the Bureau’s current capacity to track sophisticated Iranian networks.
Terrorist Activity in New York
The warning of Iranian “triggers” coincides with a spike in domestic radicalization. Over the weekend, two men—Ibrahim Kayumi, 19, and Emir Balat, 18—were charged in connection with a failed bombing near the residence of New York City Mayor Zohran Mamdani.
While the suspects claimed allegiance to the Islamic State (ISIS), investigators are examining whether the current regional instability is serving as a broader catalyst for various extremist factions.
- The Device: A homemade bomb thrown during protests that police say “could have caused death.”
- The Status: Both men are in federal custody facing charges of using a weapon of mass destruction.
- The Link: NYPD Commissioner Jessica Tisch stated Monday that there is currently “no information connecting this investigation” directly to the Iranian regime, though the atmosphere of heightened alert remains.
The ‘Asymmetric’ Threat
Security experts warn that Iran’s retaliation is unlikely to look like conventional warfare. Chris Swecker, a former assistant FBI director, noted that the infrastructure for an attack has been in place for years.
“If ever there’s going to be a Hezbollah or Hamas cell act in the United States in a violent way, it’s now,” Swecker told Fox News. “We know they have cells here. We also know there are lone sympathizers.”
The U.S. government has instructed local law enforcement to maintain “extreme situational awareness” regarding critical infrastructure and high-profile targets as intelligence agencies continue to monitor the radio frequencies used in the intercepted transmissions.
