America’s top security veterans are warning that Iranian sleeper cells and radicalized sympathizers may be planning retaliation for America’s war on Iran.
As US and Israeli forces pound targets inside Iran, including the operation that killed Supreme Leader Ayatollah Ali Khamenei on Saturday, federal counterterror teams have fanned out across the country, bracing for what could come next.
In an exclusive interview with the Daily Mail, former DHS senior adviser and Secret Service supervisor Charles Marino said the nation is facing a ‘convergence’ of threats – from Iran-aligned lone wolves to potential sleeper cells.
‘Is it possible you have 10, 15, 20 people in the country that are part of a cell that then go out and carry out simultaneous or near-simultaneous attacks? Yes,’ Marino said.
He warns that terrorists seeking maximum carnage would likely target ‘soft’ venues: crowded events, such as concerts and sports matches, public spaces and mass gatherings.
Among the looming concerns is the upcoming World Cup, designated a National Special Security Event. The tournament will draw massive crowds and global attention – precisely the type of stage extremist groups crave.
Marino invoked the specter of coordinated ‘Mumbai-style’ atrocities, referencing the 2008 attacks in India that involved multiple teams striking different locations in rapid succession.
‘You have this convergence of all of these threats and all of these possibilities now coming together,’ he said, urging DHS to formally elevate the national threat advisory level so security protocols nationwide automatically snap into place.
Soccer World Cup venues, such as the MetLife Stadium in New Jersey, make for potential targets in the US, said Charles Marino
The Islamic fanatic behind the terror attack in Austin has been identified as Ndiaga Diagne, 53. He was said to have been wearing a ‘Property of Allah’ hoodie when he shot up Buford’s Backyard Beer Garden in Austin, Texas
His warning comes as the FBI and Department of Homeland Security have placed counterterrorism and intelligence units on heightened alert. FBI Director Kash Patel has mobilized teams nationwide to monitor and disrupt potential plots.
Joint Terrorism Task Forces are operating around the clock in major cities including Washington, DC, New York City and Los Angeles, coordinating with state and local law enforcement to safeguard sensitive sites.
Officials have briefed Congress that they have no specific intelligence showing Iran had planned to strike the US preemptively. But the killing of Iran’s top cleric and the intensifying military campaign have fueled fears of downstream retaliation – whether directed or inspired.
Stefano Ritondale warns of new terrorist cells in a ravaged Iran
Authorities stress there is no publicly confirmed, credible domestic terror plot.
One incident already under scrutiny is a deadly shooting in Austin, Texas, where the suspect allegedly wore clothing bearing Iranian symbolism. Investigators are probing whether it was a self-radicalized act connected to Middle East tensions.
Marino said the threat landscape has been years in the making. He contends that porous borders allowed millions of unvetted migrants from 180 countries to enter the US, including individuals from ‘special interest’ nations where terrorist groups operate.
In his view, the critical question is no longer whether potential threats exist inside the country – but whether all of them have been identified.
‘Nobody can say what the probability is – and that’s a scary place for us to be,’ he said.
Marino believes Tehran or its proxies – including operatives tied to the Islamic Revolutionary Guard Corps, Hezbollah or Hamas – may not even need to issue new instructions.
The assassination of Khamenei, he suggests, could itself serve as the activation signal.
While Marino focuses on organized cells, retired FBI Supervisory Special Agent Jason Pack sees an even more unpredictable danger: the lone wolf already here.
‘The most immediate domestic threat is not an IRGC team flying in with a mission,’ Pack said. ‘It is the self-radicalized individual already living inside the US who decides to act on his own.’
Smoke and flames rise behind buildings after an explosion in Tehran, Iran, on the second consecutive day of strikes by US and Israeli forces
President Donald Trump spoke by phone with the Daily Mail Sunday afternoon from Mar-a-Lago and talked about the three American service members who were killed in action amid the strikes on Iran
Pack explained that Iranian state media and proxy outlets publicly naming American and Israeli targets amounts to incitement, even if Tehran prefers deniable warfare.
‘Iran doesn’t do things like Pearl Harbors,’ he said. ‘They do more slow bleeds – proxies and cutouts.’
The challenge for investigators lies in the constitutional divide between speech and action.
‘The gap between ‘this person concerns us’ and ‘we can charge this person’ is exactly where the danger lives,’ Pack said.
Many lone actors, he noted, have no criminal history, no foreign travel, and no direct contact with foreign handlers. They do not fit traditional threat profiles – until they act.
Though a centrally directed Iranian strike on US soil would be ‘highly difficult,’ Pack cautioned that nothing is impossible. At the same time, he emphasized that the FBI’s counterterrorism infrastructure has been tracking Iranian-linked threats for years.
‘The American people should be alert, not afraid,’ he said. ‘Do not let fear do Iran’s job for them.’
Beyond bombs and bullets, experts warn the battlefield may extend into cyberspace.
James Knight, a digital security specialist with more than 25 years’ experience, said Iranian-affiliated hackers are already probing American systems.
‘There’s definitely evidence’ of targeting, he said, describing it as ‘low to medium’ intensity.
So far, activity has centered on reconnaissance and attempted denial-of-service attacks designed to overwhelm websites and servers with fake traffic. There have been no major disruptions.
A chilling image shows officials surrounding someone who was injured in the street after shots rang out in Austin
‘It’s not been as bad as it could be,’ Knight said.
He believes US and Israeli strikes have degraded Iran’s centralized cyber infrastructure, much of which operates inside the country. That damage likely limits Tehran’s ability to launch a coordinated, large-scale digital assault.
However, Knight warned that Iranian-linked operatives could already be inside the US, equipped with hacking toolkits capable of targeting banks, pipelines, hospitals or power grids.
‘Theoretically they can, but it’s going to be heavily degraded,’ he said.
While he does not expect Russia or China to intervene on Iran’s behalf in cyberspace, Knight cautioned that a ‘last gasp’ or ‘kamikaze’ cyberattack remains possible – potentially causing temporary blackouts or outages affecting online banking and utilities.
For ordinary Americans, he advises calm preparedness: keep some cash on hand, maintain basic supplies, and practice good cyber hygiene.
Meanwhile, Stefano Ritondale, Chief Intelligence Officer at geopolitical risk consultancy Artorias, sees an even longer shadow forming.
He warns that the greatest danger following Khamenei’s assassination may not be immediate retaliation – but the fragmentation of Iran’s power structure into something more chaotic and extreme.
Removing the regime’s figurehead, Ritondale said, ‘may result in a change in regime, but could also yield the creation of new terrorist organizations.’
He points to history: after the US invasion of Iraq, the fall of the Ba’ath Party helped fuel the rise of al-Qaeda in Iraq, which later morphed into ISIS.
The IRGC, he notes, possesses ballistic missiles, drone capabilities and deep proxy networks across the region. If splinter factions break away, they could evolve into a new breed of transnational terror group.
‘Do they become, you know, a version of ISIS in a way, or their own terror group… and view Israel, the US , and Europe as their enemy?’ Ritondale asked.
Even if the war winds down, he cautions, the ideological and operational infrastructure may survive.
The FBI and Department of Homeland Security have placed counterterrorism and intelligence units on heightened alert.
Smoke rises after explosions rocked multiple areas of Tehran on Sunday during the second day of US and Israeli strikes against the Islamic regime, which took out 48 leaders, Trump told the Daily Mail on Sunday
‘Just because the war is over, the threat of terrorism from Iran and these groups… would not be over.’
President Donald Trump said Monday that the US has ‘the capability to go far longer’ than the projected four-to-five-week timeline for operations against Iran.
Tehran and its allies have responded with missile strikes against Israel, Gulf states, and energy infrastructure critical to global oil and gas supplies.
With no clear endgame articulated by Washington or Jerusalem, the conflict risks becoming a drawn-out confrontation with global repercussions.
For US security officials, the most immediate concern is not Tehran’s missiles – but what may already be embedded within America’s borders. Sleeper cells. Radicalized sympathizers. Cyber operatives probing quietly in the dark.
