After Operation Epic Fury decapitated Iran’s leadership, the question isn’t whether Tehran wants revenge—it’s whether dormant Hezbollah-linked networks inside America are positioned to deliver it.
Quick Take
- FBI and DHS raised their posture after the Feb. 28, 2026 U.S.-Israel strike that reportedly killed Iran’s Supreme Leader and senior officials, while stating no specific credible threat has been publicly identified.
- Past U.S. cases show Hezbollah operatives conducted long-term surveillance of American and Canadian targets, a classic “sleeper” model designed to wait for direction.
- Officials and former investigators warn Iran often retaliates asymmetrically—through proxies, plots against officials, and potentially cyber operations—rather than conventional attacks.
- Encoded radio broadcasts and a handful of recent violent incidents have fueled public concern, but available reporting does not confirm an active, directed sleeper-cell plot on U.S. soil.
Why the Alert Level Changed After Epic Fury
Federal authorities increased monitoring after Operation Epic Fury on Feb. 28, 2026, a U.S.-Israel strike described in reporting as killing Ayatollah Ali Khamenei and other senior Iranian figures. Public statements referenced heightened vigilance, coordination with local partners, and an evolving threat picture, while also emphasizing the absence of a publicly disclosed, specific credible threat. That combination—high alert with limited confirmed specifics—signals preparedness for retaliation rather than proof of imminent attack.
Reporting also points to indicators that can rattle the public without proving a plot, including mention of encoded radio broadcasts detected after the strike and worries that Iran or its proxies might interpret the moment as a call to activate contingency plans. For everyday Americans, that uncertainty is the hardest part: a government warning can be justified by prudence, but it also leaves families and local communities wondering what “high alert” means in practical terms.
What “Sleeper Cells” Means in the Hezbollah Context
The most concrete evidence in the current debate comes from historical cases, not fresh arrests. Analysts have highlighted Hezbollah’s use of disciplined, long-horizon operatives who perform surveillance, assess vulnerabilities, and build logistics rather than rushing into headline-grabbing violence. Reporting describes Hezbollah’s “910” external operations apparatus as a structure that can hold assets in place for years, waiting for geopolitical triggers. That design makes sleeper allegations plausible in concept, even when no current plot is confirmed.
Two names recur because they offer documented examples of how this looks in practice: Ali Kourani and Samer el Debek. Reporting recounts surveillance activity tied to airports, potential targets, and even law-enforcement-related facilities, describing behavior consistent with pre-attack preparation rather than spontaneous radicalization. Those cases matter because they demonstrate capability and method. They do not, by themselves, establish that similar teams are currently active, directed, or operationally ready today.
Retaliation Options Iran Has Used Before—and Why That Matters Now
Recent coverage stresses that Iran has a track record of pursuing asymmetric retaliation, including alleged assassination plotting against U.S. officials after earlier flashpoints in the U.S.-Iran conflict. The reporting references cases and charges involving efforts to target high-profile figures, reinforcing why law enforcement would treat the post-Epic Fury environment as volatile. If Iran views decapitation strikes as existential, it has incentives to respond indirectly through proxies rather than risking immediate conventional escalation.
Another reason the threat assessment feels murky is that retaliation does not have to look like a coordinated, mass-casualty event to be effective. Analysts cited in reporting discuss a spectrum that includes lone actors inspired or enabled by networks, plus cyberattacks that can disrupt systems without a clear, visible perpetrator. That reality complicates the public’s demand for clarity: a government can be on alert for many scenarios at once, some of which may never materialize.
Border, Protests, and the Limits of What’s Confirmed
Some former officials and commentators argue that border vulnerabilities in the pre-2025 era increased the risk of hostile operatives blending into the country, and that large public protests can provide cover for sympathizers or agitators. Other reporting emphasizes that Hezbollah-linked networks in North America date back decades, meaning the “sleeper” problem—if present—could be as much about entrenched infrastructure as about new infiltration. Based on available sources, this point remains contested and not definitively resolved.
Public concern has also been fueled by references to a recent Austin shooting and a gym attack in Canada being discussed in the same breath as Iranian-proxy fears. The key limitation is straightforward: the cited reporting raises alarms and context, but it does not conclusively tie those incidents to an activated Hezbollah or IRGC-directed sleeper-cell campaign. For a country tired of government narratives that lurch between complacency and panic, that distinction matters.
What Americans Should Watch For From Here
The most responsible takeaway is a split screen: the sleeper-cell concept is not “conspiracy” because documented Hezbollah surveillance cases exist, but the leap from capability to a current, active plot is not proven in the reporting available. The constitutional bottom line is that legitimate counterterrorism requires targeted, evidence-driven policing—not broad suspicion of law-abiding communities. In the coming weeks, the most meaningful signals will be arrests tied to material support or surveillance activity, and clear federal briefings that separate confirmed facts from precautionary posture.
