DHS warns of lone-wolf and cyber threats amid U.S. strikes on Iran

A Department of Homeland Security law enforcement bulletin warns that Iran and Iran-aligned actors pose a persistent risk of targeted attacks inside the United States and that hacktivists are likely to mount low-level cyber attacks on U.S. networks, according to the bulletin text and federal statements. The document says a large-scale physical attack is unlikely but cautions the threat picture could intensify if reports of the Ayatollah’s death are confirmed.

The bulletin states, “Although a large‑scale physical attack is unlikely, Iran and its proxies probably pose a persistent threat of targeted attacks in the Homeland, and will almost certainly escalate retaliatory actions—or calls to action—if reports of the Ayatollah’s death are confirmed.” It adds that, “In the short‑term, we are most concerned that Iran‑aligned hacktivists will conduct low‑level cyber attacks against US networks, such as website defacements and distributed denial‑of‑service attacks.” DHS also warned that both hacktivists and Iranian government-affiliated actors “routinely target poorly secured US networks and Internet‑connected devices for disruptive cyber attacks.”

Officials say the alert was issued over the weekend and was followed the next day by a shooting in Austin, Texas that authorities are probing for possible links to the overseas situation. Law enforcement sources described the Austin suspect as wearing a sweatshirt reading “Property of Allah” over a shirt bearing the word “Iran” and the Iranian flag. Investigators are examining whether the shooting was inspired by events abroad and are assessing the suspect’s mental health; officials have not released a motive or charges.

Federal agencies have signaled stepped-up operational measures. On X, FBI Director Kash Patel wrote, “Last night, I instructed our Counterterrorism and intelligence teams to be on high alert and mobilize all assisting security assets needed. Our JTTFs throughout the country are working 24/7, as always, to address and disrupt any potential threats to the homeland.” Homeland Security Secretary Kristi Noem said she is “in direct coordination with our federal intelligence and law enforcement partners as we continue to closely monitor and thwart any potential threats to the homeland.” Washington metropolitan police added, “At this time, there are no known threats to DC” and said they are prepared to increase their presence as needed.

The bulletin links current risks to longer-term Iranian targeting, noting Tehran’s “long‑standing commitment to target US Government officials it views as responsible for the death of an Iranian military commander killed in January 2020” and records that U.S. law enforcement has disrupted multiple potentially lethal Iranian‑backed plots in the United States since 2020.

Security analysts warned the threat could include asymmetric cyber and clandestine measures. Thomas Warrick, a scholar at the Atlantic Council and a former DHS deputy assistant secretary for counterterrorism policy, said, “Iran will try every cyber trick it can mount, testing the Department of Homeland Security, the private sector, and U.S. cyber defenses.” Colin Clarke of The Soufan Center cautioned that Tehran could activate dormant networks in the West to pressure the United States and its partners.

There is a notable timing question: DHS’s public National Terrorism Advisory System bulletin on DHS.gov is dated June 22, 2025, while law enforcement officials describe a more recent alert issued the weekend before March 1, 2026. Officials have not publicly clarified whether those documents are the same. For now, federal and local agencies say they have increased surveillance and technical collection and urge the public to report suspicious activity as investigations continue.