• Wion
  • /Photos
  • /'1,500 entered illegally': How many Iranian sleeper cells are active in US?

'1,500 entered illegally': How many Iranian sleeper cells are active in US?

The 2026 threat landscape is defined by "hybrid" operations that combine physical attacks with cyber sabotage. Intelligence agencies expect that any kinetic attack by a sleeper cell will be synchronised with a "wiper" malware strike on US power grids or financial networks. 

1. The "Countless" Open Cases
1 / 7
(Photograph: AFP)

1. The "Countless" Open Cases

During a high-profile budget hearing on January 23, 2026, Attorney General Pam Bondi testified that the Department of Justice is currently managing "countless" active homeland security threat cases. While specific numbers remain classified, Bondi emphasised that the FBI and DHS are on "high alert," tracking a surge in Iranian-linked activity that has intensified since the US strikes on Iranian nuclear facilities in June 2025. This indicates a massive shift in resources toward domestic surveillance of known IRGC and Hezbollah sympathisers.

2. Infiltration via the "Gotaway" Corridor
2 / 7
(Photograph: AI)

2. Infiltration via the "Gotaway" Corridor

A primary concern for the Trump administration is the "gotaway" risk, individuals who entered the U.S. without being processed by border authorities. Intelligence estimates from early 2026 suggest that over 1,500 Iranian nationals have entered the country illegally over the last several years, with many unaccounted for. Experts warn that the most dangerous covert agents are likely among these "gotaways," having assimilated into local communities under the radar of traditional biometric tracking systems.

3. The Shift to "Soft Target" Rural Terrorism
3 / 7
(Photograph: AFP)

3. The Shift to "Soft Target" Rural Terrorism

Counterterrorism experts are warning of a shift in Iranian strategy from high-profile urban landmarks to "soft targets" in rural America. The logic is that rural areas are less fortified and offer a high psychological impact if struck. Authorities are particularly vigilant regarding outdoor entertainment venues, populated vacation spots, and critical infrastructure like local power substations, which are seen as vulnerable points for Iranian operatives looking to cause maximum domestic disruption.

4. The Rise of FPV Suicide Drones
4 / 7
(Photograph: AFP)

4. The Rise of FPV Suicide Drones

A "terrifying new possibility" being tracked by the FBI is the use of First-Person-View (FPV) suicide drones on U.S. soil. Popularized by their ease of use in the Ukraine conflict, these low-cost drones are almost impossible to defend against in a civilian setting. Intelligence sources suggest that Iranian sleeper cells may be training to use these devices to target US citizens or sensitive infrastructure, bringing the tactics of the Middle East battlefield directly to the American homeland.

5. Assassination Plots and "The Soleimani Vow"
5 / 7
(Photograph: AI)

5. Assassination Plots and "The Soleimani Vow"

Tehran maintains a "long-standing commitment" to assassinating US government officials it deems responsible for the 2020 death of Qasem Soleimani. This threat has reached a fever pitch in 2026, with focused monitoring on cells targeting current and former high-ranking members of the Trump administration. The FBI recently disrupted a "professional alien smuggling" ring in New York suspected of helping Iranian operatives enter the country specifically for these high-value "decapitation" missions.

6. Activation Triggers and Religious Edicts
6 / 7
(Photograph: AFP)

6. Activation Triggers and Religious Edicts

DHS bulletins indicate that these cells are likely waiting for a specific "activation trigger" from leadership in Tehran. This could come in the form of a formal religious ruling (fatwa) calling for retaliatory violence, or a direct response to a U.S. military move, such as a strike by the USS Abraham Lincoln. This "wait-and-see" posture allows cells to remain dormant for years, assimilating quietly into society until the moment they are ordered to strike.

7. Hybrid Cyber-Physical Sabotage
7 / 7
(Photograph: AFP)

7. Hybrid Cyber-Physical Sabotage

The 2026 threat landscape is defined by "hybrid" operations that combine physical attacks with cyber sabotage. Intelligence agencies expect that any kinetic attack by a sleeper cell will be synchronised with a "wiper" malware strike on U.S. power grids or financial networks. This coordinated "Digital Pearl Harbor" is designed to paralyse the American response and instill a sense of total vulnerability, forcing the U.S. to focus on internal chaos rather than military operations in the Persian Gulf.