Iran may be activating sleeper cells outside the country, alert says

The encrypted transmission was intercepted by the U.S.

By Aaron Katersky and Josh Margolin

March 9, 2026, 7:26 AM

Trump dismisses economic fallout from war in Iran

The U.S. has intercepted encrypted communications believed to have originated in Iran that may serve as "an operational trigger" for "sleeper assets" outside the country, according to a federal government alert sent to law enforcement agencies.

The alert, reviewed by ABC News, cites "preliminary signals analysis" of a transmission "likely of Iranian origin" that was relayed across multiple countries shortly after the death of Ayatollah Ali Khamenei. Khamenei, the supreme leader of Iran, was killed in a U.S.-Israeli attack on Feb. 28.

Iran live updates: 3 injured as Iranian missiles target central Israel, responders say

The intercepted transmission was encoded and appeared to be destined for "clandestine recipients" who possess the encryption key, the kind of message intended to impart instructions to "covert operatives or sleeper assets" without the use of the internet or cellular networks. 

It's possible the transmissions could "be intended to activate or provide instructions to prepositioned sleeper assets operating outside the originating country," the alert said.

What to know about Mojtaba Khamenei, Iran's next supreme leader

"While the exact contents of these transmissions cannot currently be determined, the sudden appearance of a new station with international rebroadcast characteristics warrants heightened situational awareness," the alert said.

While the alert is careful to say there is "no operational threat tied to a specific location," it does instruct law enforcement agencies to increase their monitoring of suspicious radio-frequency activity.

If the contents of the alert prove true, it would confirm the fears expressed by law enforcement officials after the U.S. and Israel struck Iran that sleeper cells deployed around the West could be used for retaliation.