A U.S. intelligence assessment dated February 28 and produced by the Office of Intelligence and Analysis at the Department of Homeland Security warns that Iran and Iran-aligned proxy groups could carry out targeted attacks on the United States in response to the reported killing of Iranian Supreme Leader Ali Khamenei in strikes attributed to Israel and the United States.
The DHS threat assessment stated that while a large-scale physical attack on the U.S. homeland is unlikely, Iran and its proxies "probably" pose an ongoing danger of targeted operations. In the near term, the report said, the primary concern is that Iran-affiliated "hacktivists" will pursue low-level cyber intrusions against U.S. networks, including website defacements and distributed denial-of-service attacks.
"Although a large-scale physical attack is unlikely, Iran and its proxies probably pose a persistent threat of targeted attacks in the Homeland, and will almost certainly escalate retaliatory actions - or calls to action - if reports of the Ayatollah’s death are confirmed," the DHS report said.
DHS did not immediately respond to a request for comment. Iran on Sunday confirmed reports that Khamenei died in a strike on Saturday that was initially announced by Israel and U.S. President Donald Trump.
Beyond potential operations directed at the U.S. homeland, the assessment noted that Iran will likely continue attacks against U.S. and allied targets across the Middle East. The report also warned that Tehran would almost certainly hold senior U.S. government officials responsible for unrest that might arise after President Trump’s remarks calling for regime change.
The wider military picture has shown a rapid intensification since the strikes. The U.S. and Israeli air campaign that began on Saturday expanded on Monday, with Israel launching strikes into Lebanon in response to attacks by Hezbollah. At the same time, Iran continued missile and drone operations against Gulf states that host U.S. military bases.
Domestic incidents have raised questions about potential spillover effects. Authorities probing a shooting at a bar in Austin, Texas, that occurred on Sunday and left at least two people dead said investigators could not yet determine whether the gunman was motivated by the conflict with Iran. Photographs of the deceased shooter showed him wearing a shirt bearing an Iranian flag with "IRAN" spelled in green, white and red across the front. He was also photographed in a sweatshirt reading "Property of Allah," a U.S. law enforcement official said.
The DHS assessment frames a multi-pronged threat environment: an elevated risk of targeted physical attacks, the near-term prospect of cyber nuisance attacks from Iran-aligned actors, and continued military engagements in the Middle East that complicate regional security and the protection of U.S. forces and partners.
Analysts and decision-makers are left to weigh the likelihood of isolated retaliatory incidents against the low probability of a broad-scale physical assault on U.S. soil, while preparing for cyber disruptions and monitoring developments tied to the expanding regional hostilities.