U.S. intelligence agencies are analyzing an encrypted transmission believed to have originated inside Iran that may have been intended for covert operatives abroad, according to an alert cited by ABC News.
Officials familiar with the matter described the message as a possible “operational trigger,” potentially directed at what intelligence analysts call sleeper assets—individuals embedded in foreign countries who maintain ordinary lives while remaining ready to act upon receiving specific instructions. Such operatives are typically difficult to identify because they can remain inactive for extended periods.
The transmission was reportedly detected shortly after claims that Iranian Supreme Leader Ali Khamenei was killed in a joint U.S.-Israeli airstrike in Tehran on February 28. In the aftermath, Iranian authorities announced that his son, Mojtaba Khamenei, had assumed leadership, signaling a rapid transition at the highest level of the country’s political structure.
According to the intelligence alert, the encrypted signal was picked up across multiple countries and flagged by U.S. monitoring systems designed to track unusual communications patterns. Analysts assessed that the message likely originated in Iran and may have been intended for recipients equipped to decode it using prearranged keys, phrases, or passcodes.
Officials noted that the transmission displayed characteristics consistent with “international rebroadcast” methods. These techniques have historically been used to send coded instructions across long distances without relying on internet-based communication channels, making them harder to trace or disrupt. Such systems can involve radio frequencies or other non-digital means, allowing messages to be transmitted widely while remaining accessible only to those with the proper decoding tools.
The alert indicated that the signals resemble communication methods previously associated with covert networks, including those used to pass instructions to sleeper operatives. In some cases, such transmissions may serve to activate pre-positioned individuals or provide guidance for future actions outside the originating country.
Concerns among U.S. security officials have grown in response to the development, particularly as tensions continue to escalate between Iran, the United States, and Israel. The possibility that sleeper cells could exist within the United States or allied nations has added urgency to intelligence monitoring and counterterrorism efforts.
Previous reporting has also raised questions about how foreign operatives might enter Western countries. One claim pointed to a potential “passport pipeline” in which individuals linked to Iran could travel through Venezuela before making their way north. While such reports remain a subject of debate, they have contributed to broader concerns about the ability of hostile networks to establish a presence close to U.S. borders.
At the same time, geopolitical tensions have intensified. Ongoing military actions and retaliatory strikes have increased the risk of broader regional instability. Reports of friction between Washington and Jerusalem have also emerged, particularly following Israeli strikes on Iranian oil infrastructure. U.S. officials have expressed concern that such actions could have economic consequences, including rising global oil prices that may affect American consumers.
Security experts caution that potential threats may not be limited to organized networks. Individuals acting alone but motivated by ideological alignment or geopolitical developments could also pose risks. This combination of structured cells and independent actors has been described by some analysts as a “convergence” of threats.
Charles Marino, a former adviser to the Department of Homeland Security and a former Secret Service supervisor, warned that coordinated attacks by small groups remain a possibility. He noted that even a relatively small number of operatives—if organized and directed—could attempt near-simultaneous actions designed to create widespread disruption.
Marino emphasized that attackers seeking to maximize casualties often target “soft” locations, including concerts, sporting events, and other crowded public venues where security may be less rigid than at government or military sites.
Large-scale events are drawing particular scrutiny from security planners. The upcoming World Cup, designated as a National Special Security Event, is expected to attract significant international attendance, making it a potential focus for heightened security measures.
Meanwhile, the White House has defended recent U.S. military actions in the region. Press Secretary Karoline Leavitt characterized operations targeting Iranian missile systems, nuclear infrastructure, and leadership as effective responses to perceived threats. She stated that the campaign, referred to by officials as Operation Epic Fury, reflects a broader effort to counter Iran’s capabilities and deter further aggression.
Leavitt also framed the administration’s approach as a decisive shift in U.S. foreign policy, emphasizing a commitment to confronting threats directly. As the situation continues to evolve, intelligence agencies and security officials remain on high alert, closely monitoring developments and assessing potential risks both abroad and at home.
