Iran Activates Sleeper Cells Worldwide After Khamenei’s Feb. 28 Death, US Intel Warns

U.S. intelligence agencies intercepted an encrypted transmission that officials believe likely originated in Iran and may serve as an 'operational trigger' to activate sleeper operatives overseas.

“Iran may be activating sleeper cells outside the country, alert says The encrypted transmission was intercepted by the U”

ABC News

The interception prompted a federal alert to law-enforcement describing the communication as encrypted and top-secret and warning it could already have activated such cells.

ABC News

The timing of the transmission, relayed across multiple countries shortly after the reported death of Iran's Supreme Leader Ayatollah Ali Khamenei on Feb. 28, is cited in the notice and has heightened concern among counterterrorism officials.

Analysts emphasize that the transmission was strongly encrypted, was repeatedly rebroadcast internationally, and officials have not decoded the message.

Because of that encryption and the preliminary nature of the signals analysis, intelligence agencies caution there is no confirmed attack plan while treating the transmission as a potential operational trigger and stepping up monitoring of suspicious signals and networks.

BNO News

U.S. and allied agencies have outlined a broad, global risk picture rather than naming a single target.

“A federal government alert had been sent to law enforcement agencies, ABC News said”

London Evening Standard

They identified countries and regions most likely to be elevated based on historical patterns and strategic interests.

Reporting lists areas at risk that include Israel, described as a primary target, the United States and US facilities, and Gulf states hosting US forces.

They also list Iraq and Syria, where Iranian proxies operate; Lebanon and Yemen, where Iran-backed groups are active; and several European nations with past plots or significant Iranian communities.

Reporting ties the heightened alert to a series of violent and aviation incidents across multiple countries.

It also links the alert to renewed political concerns at home, prompting officials to increase surveillance and issue public warnings.

New York Post

Media accounts cite embassy and drone strikes abroad, an intercepted missile, and domestic incidents under investigation.

U.S. leaders and security figures publicly say they are monitoring the threat, though responses and attributions remain under review.

Officials and analysts stress uncertainty, with multiple outlets noting that the intelligence is preliminary, some items remain under investigation, and reporting includes conflicting accounts.

“US intelligence agencies have issued a security alert after intercepting an encrypted transmission that may signal the activation of Iranian “sleeper assets” operating overseas”

The Sunday Guardian

Senior security figures have urged elevated vigilance while acknowledging unresolved questions about whether the intercepted transmission has been decoded or has produced concrete activations.

The Sunday Guardian

Governments are balancing caution with verification as they monitor networks worldwide.