U.S. law enforcement and intelligence agencies warn that Iran might be trying to activate sleeper operatives outside its borders, according to a newly circulated federal alert obtained by ABC News.
ABC News is reporting that U.S. officials have intercepted an encrypted communication believed to have originated in Iran that may serve as "an operational trigger" for "sleeper assets" outside the country based on "preliminary signal analysis" according to a federal alert sent…
— OSINTdefender (@sentdefender) March 9, 2026
Officials say the warning was issued after the U.S. intelligence community intercepted encrypted communications believed to have originated in Iran. Early analysis suggests the transmissions may have served as an “operational trigger” intended for covert assets overseas.
The alert has prompted a nationwide notice to federal, state, and local law enforcement agencies to remain vigilant.
Encrypted signals raise concerns
According to ABC News, the intercepted messages traveled through several countries before being detected and were heavily encoded. That suggests they were likely meant for recipients who already possess the correct encryption keys.
Security officials say this type of transmission is a known method for sending instructions to prepositioned operatives without relying on the internet or phone networks. Because the messages are broadcast rather than sent directly, they are far more difficult to trace.
Authorities are now monitoring unusual radio activity and other potential indicators that sleeper assets could be receiving instructions.
Rising tensions after Khamenei’s killing
The alert comes as tensions between Washington and Tehran continue to escalate following the Feb. 28 killing of Iran’s Supreme Leader, Ayatollah Ali Khamenei, the opening salvo in the current war in Iran.
Since then, the conflict has included thousands of aerial sorties and mounting threats of retaliation. U.S. officials have long warned that Iran and its allies could respond asymmetrically rather than through direct military confrontation.
That could include attacks carried out by covert networks operating far from the Middle East.
Possible role of proxies
Security agencies say Iranian-linked groups could play a role if sleeper networks were activated.
Among the concerns:
- Retaliatory actions against U.S. and allied targets abroad
- Sabotage or assassinations executed by embedded operatives
- Activities conducted by proxy groups like Hezbollah or their affiliated networks
Security experts also warn that the conflict increases the risk of cyberattacks by Iranian-linked hackers or secret surveillance operations in Western countries.
Rare but potentially high impact
Sleeper cells involve operatives who live quietly inside another country for years, sometimes decades, waiting for instructions.
The New York Post continues:
The US warning said intelligence had detected a broadcast station repeatedly transmitting a message to multiple countries outside Iran, according to ABC.
“While the exact contents of these transmissions cannot currently be determined, the sudden appearance of a new station with international rebroadcast characteristics warrants heightened situational awareness,” the memo said.
NOW – Secretary of War Hegseth says the U.S. is ready for possible Iranian sleeper cell attacks on U.S. soil. pic.twitter.com/v4IpxtBMTE
— Disclose.tv (@disclosetv) March 2, 2026
Law enforcement agencies have been called to increase their monitoring of suspicious radio frequencies after the message was intercepted.
While there are no specific credible threats to the public as of yet, counterintelligence experts have warned of the potential for revenge attacks on US soil as a result of the war in Iran.
That reality is part of the reason federal authorities issued the alert. Officials say the goal is early awareness and monitoring rather than reacting after an attack has already occurred.
No confirmed plot
Authorities stress that there is currently no confirmed or credible attack plot tied to the intercepted transmissions.
For now, law enforcement and counterterrorism agencies are increasing monitoring and sharing intelligence across jurisdictions.
Officials say the alert is precautionary. But in the current climate, security agencies are taking the possibility of covert retaliation seriously.
Footage shows a vessel with the Iranian Naval Forces, believed to likely be a Shahid Soleimani-class missile corvette operated by the Islamic Revolutionary Guard Corps Navy (IRGCN), explode today off the coast of Bandar Lengeh in the Persian Gulf, following a strike by the United… pic.twitter.com/H7JjZRKJEt
— OSINTdefender (@sentdefender) March 9, 2026
READ NEXT: Fox Reporter Details Trump’s Reason For Firing Kristi Noem






This is a legit warning. These fanatics are not going to go away peacefully, and if it is possible they will certainly try to create havoc in our homeland. The first time an Iranian (Proxy) is able to blow up a facility and kill Americans in our country is when Trump should take off the gloves and go all out in eliminating these Mutts from humanity.
Why wait ?
But it doesn’t make sense that Iran would wait so long to activate any sleeper cells. Surely they would have done so on day 1. Plus, Trump announced the U.S. will be pulling back very soon.