The U.S. has intercepted encrypted communications believed to originate from Iran that may signal the activation of sleeper cells overseas. According to a federal government alert shared with law enforcement agencies, these intercepted transmissions could serve as an 'operational trigger' for Iranian sleeper assets located outside the country. The alert, reviewed by ABC News, cites 'preliminary signals analysis' indicating a transmission 'likely of Iranian origin' that was relayed across multiple nations shortly following the death of Ayatollah Ali Khamenei, Iran's supreme leader, on February 28, 2026.
The intercepted communications, described by the alert as 'critical intelligence,' were detected by U.S. agencies through advanced monitoring systems. Analysts suggest these transmissions might be linked to a coordinated effort to deploy Iranian operatives who remain dormant until specific conditions are met. This move comes amid heightened tensions between Iran and its adversaries, particularly following the U.S.-Israeli military operation that resulted in Khamenei's death. The timing of the intercepted signals—just days after the supreme leader's passing—has raised concerns about potential internal restructuring within Iran's security apparatus.
Iran's security forces have been under scrutiny for their ability to maintain covert operations, especially in the wake of significant leadership changes. The alert highlights a potential shift in Iranian strategy, where sleeper cells could be activated to carry out targeted operations against U.S. interests abroad. These cells, often embedded within communities or organizations, remain inactive until triggered by specific stimuli, such as a change in leadership or a strategic opportunity. The activation of such cells could have implications for regional stability, particularly in areas with significant Iranian diaspora populations.
Experts warn that the discovery of these communications underscores the evolving nature of asymmetric warfare. The use of encrypted channels allows for the covert dissemination of information and instructions, making detection challenging. However, the U.S. has increasingly deployed sophisticated tools to monitor such activities. The alert emphasizes the importance of vigilance in identifying and neutralizing potential threats before they materialize into active attacks.
The implications of this development extend beyond immediate security concerns. Analysts suggest that the activation of sleeper cells could be part of a broader strategy to exploit geopolitical vulnerabilities. For instance, sleeper cells might target diplomatic missions, financial institutions, or critical infrastructure in multiple countries. The U.S. and its allies must remain prepared to respond to these evolving threats, particularly given the complex interplay of political, economic, and military factors shaping the Middle East.
The situation has sparked discussions among defense officials about the need for enhanced intelligence sharing and coordination. With the U.S. having previously intercepted similar signals linked to Iranian activities, the government is now focusing on identifying and neutralizing these assets before they can be activated. This case highlights the critical role of timely intelligence in preventing potential attacks and maintaining regional security.
