The phrase “sleeper cell” sounds like something created by a television writer who owns too many corkboards and an unlimited supply of red string. Unfortunately, the basic concept is real: a person or small network can live quietly inside a target country, conceal its connections to a foreign government or terrorist organization, and wait for instructions.
That does not mean every alarming headline proves hidden attackers are scattered across America. It means counterterrorism officials take deep-cover operatives seriously because they are designed to look ordinary until they begin surveillance, recruitment, financing, espionage, sabotage, or violence. The hard part is separating a documented national-security risk from rumor, political theater, and the internet’s favorite hobbyturning uncertainty into panic.
What Are Sleeper Cells?
A sleeper cell is a covert individual or small group placed, recruited, or developed inside a target society and kept inactiveor only lightly activeuntil a handler assigns a mission. “Sleeping” rarely means doing absolutely nothing. An operative may build a legal identity, find employment, form relationships, study local routines, cultivate useful contacts, or quietly collect information.
The word “cell” suggests compartmentation. Members may know only a few other people, limiting the damage if one person is identified. Some networks serve an intelligence agency. Others support a terrorist organization. Their potential missions may include espionage, target surveillance, logistics, fundraising, cyber operations, assassination, sabotage, or an attack.
This distinction matters. A deep-cover spy collecting political information is not automatically a terrorist, and a self-radicalized attacker is not automatically part of a sleeper cell. News coverage often pours all three into the same scary bucket, then shakes vigorously.
How Sleeper Cells Differ From Lone Actors and Active Networks
A lone actor generally plans or commits violence without receiving direct operational orders from a larger organization, although online propaganda may provide inspiration. An active terrorist network is already recruiting, financing, communicating, training, or preparing an operation. A sleeper asset is defined mainly by concealment, patience, and delayed activation.
In practice, these categories can overlap. A foreign intelligence service might use a long-established operative to recruit local criminals. A terrorist organization may ask a supporter to conduct surveillance without revealing the final target. A person radicalized online may claim membership in an organization that never knew the person existed.
The FBI has emphasized that lone offenders and small groups can mobilize rapidly, communicate through encrypted platforms, and target civilians or other accessible locations with limited warning. A 2026 CSIS assessment similarly described the current U.S. terrorism landscape as a mixture of formal organizations, loose networks, and lone actors rather than one dominant threat.
In other words, the FBI is not staring only at hypothetical spies with flawless cover identities. It is watching a mixed threat environment involving foreign-directed plots, proxy networks, cyber activity, criminal intermediaries, online radicalization, and small groups capable of moving quickly.
Why the FBI Is Worried Right Now
The immediate concern is tied to renewed confrontation involving the United States, Iran, Israel, and Iran-backed organizations. A February 2025 White House national-security memorandum stated that Iran had directed proxy groups, including Hezbollah’s external operations arm, to embed sleeper cells in the United States. In June 2025, CBS News reported that federal officials had increased monitoring of possible Iran-backed cells during a period of military escalation.
The concern intensified again in March 2026, when ABC News reported that a federal alert described an encrypted transmission believed to have originated in Iran and potentially intended for clandestine recipients outside the country. Crucially, the alert reportedly said there was no operational threat connected to a specific location. That sentence is less cinematic than “cells activated,” but it is the sentence responsible readers should underline.
Is an Attack Imminent?
Publicly available information reviewed for this article does not provide a verified count of Iranian or Hezbollah sleeper cells inside the United States. It also does not establish that a nationwide attack is imminent. What public records do establish is a history of Iranian-directed assassination planning, cyber operations, surveillance, threats against dissidents, and the use of intermediaries.
The FBI therefore has a rational reason to investigate possible dormant assets without pretending every possibility has become a confirmed plot. National-security agencies are paid to worry before everyone else has to. The rest of us are allowed to remain alert without immediately constructing a panic room behind the refrigerator.
The Iran and Hezbollah Connection
Iran has long used asymmetric tools to pressure its adversaries, including cyberattacks, intelligence operations, proxy forces, sabotage, and targeted violence. These methods can provide plausible deniability and avoid the immediate costs of conventional warfare. RAND analysts noted during the 2025 Israel-Iran escalation that cyber operations, sabotage, and terrorism remained among Iran’s available response options.
The Council on Foreign Relations describes Iran’s armed-partner network as a way for Tehran to expand its influence and impose costs while reducing its exposure to direct retaliation. Hezbollah has traditionally been one of the most important organizations in that network.
The FBI describes the Iranian threat as a combination of terrorism, foreign intelligence activity, cyber operations, sanctions evasion, illicit procurement, harassment, kidnapping, and lethal targeting. Federal cybersecurity agencies have also documented continuing activity by Iranian and Iran-affiliated cyber actors against American networks and critical infrastructure.
That means the concern is broader than a suspicious van parked near a landmark. It includes online infrastructure, money, surveillance, criminal recruitment, stolen information, cyber access, and efforts to target dissidents or public officials.
Documented Hezbollah-Related Cases
Hezbollah is especially relevant because U.S. criminal cases have documented operatives conducting surveillance and receiving military-style training. Federal prosecutors alleged that Ali Kourani surveyed military, law-enforcement, and aviation-related locations in New York. Samer El Debek was accused of conducting reconnaissance abroad, including assessments involving American and Israeli facilities.
In another case, Alexei Saab was convicted after prosecutors presented evidence that he had received Hezbollah training and conducted surveillance of potential targets in the United States. He was sentenced in 2023 to 12 years in federal prison.
Real Cases That Explain the Fear
The Asif Merchant Assassination Plot
In March 2026, a federal jury convicted Asif Merchant, whom the Justice Department described as a trained operative connected to Iran’s Islamic Revolutionary Guard Corps. Prosecutors said Merchant entered the United States in 2024 seeking to arrange political assassinations and steal documents. Undercover officers disrupted the plan before an attack occurred.
Merchant was not a decades-long suburban sleeper in the classic Hollywood sense. However, the case demonstrates the operational pattern officials fear: foreign direction, covert travel, local recruitment, financial arrangements, and a violent mission intended to be carried out through intermediaries.
The Hezbollah Surveillance Cases
The Hezbollah-related prosecutions more closely resemble the idea of prepositioned operatives. Kourani was accused of conducting target surveillance while maintaining contact with handlers. Saab lived in the United States for years before his arrest and conviction.
These cases do not prove that an unknown number of identical cells are waiting in every American city. They prove something narrower but still serious: covert operatives, overseas training, foreign tasking, and advance surveillance are not fictional inventions.
Operation Ghost Stories
Espionage offers another instructive example. In Operation Ghost Stories, the FBI investigated Russian “illegals” who created ordinary lives in the United States while secretly working for Russia’s Foreign Intelligence Service. The investigation lasted more than a decade, and ten operatives were arrested in 2010.
Their mission involved cultivating contacts and collecting information rather than committing terrorism. Nevertheless, the case illustrates why deep-cover networks are difficult to detect. Normal life was not an accidental part of their cover. Normal life was the cover.
Why Sleeper Cells Are So Difficult to Detect
Dormant operatives try to minimize the signals investigators normally follow. They may avoid frequent communication, conspicuous financing, weapons purchases, public threats, or regular contact with known extremists. A small, compartmented network creates fewer opportunities for informants and fewer digital breadcrumbs.
Operation Ghost Stories demonstrated how a foreign service can spend years establishing identities, relationships, employment, and social credibility. The longer a cover identity survives, the more ordinary it appears and the more expensive it becomes to investigate.
Investigators also face an essential legal reality: living quietly is not a crime. Holding a job, attending religious services, traveling, criticizing government policy, participating in demonstrations, or communicating privately cannot by itself justify treating someone as a terrorist.
FBI policies governing suspicious-activity information require a connection to criminal conduct or a national-security threat. They also prohibit entries based solely on a person’s ethnicity, race, religion, national origin, or lawful First Amendment activity.
How Authorities Connect the Pieces
Long-term investigations may combine intelligence analysis, court-authorized surveillance, financial records, border information, human sources, cyber evidence, foreign partnerships, and public tips. The FBI’s Threat Screening Center consolidates terrorism-related identity information, while Joint Terrorism Task Forces coordinate agencies with different authorities and expertise.
The objective is to connect fragments that might appear harmless when viewed separately. A photograph, payment, trip, message, or attempted purchase may mean little alone. A series of those events connected to foreign tasking, deception, target selection, or violent intent can create a much more significant picture.
What “Activation” Could Actually Look Like
Activation does not necessarily mean an immediate mass-casualty attack. A handler might request updated photographs, travel information, access to a facility, a financial transfer, cyber assistance, or recruitment of another person. An operative could be told to watch a target, test security, store materials, spread disinformation, or support a separate attacker.
This is one reason public warnings sometimes sound frustratingly vague. Intelligence agencies may detect a change in communication or intent before they know the target, timing, or method. Officials must then decide whether to increase monitoring, alert local law enforcement, protect possible targets, or disrupt a network before the complete plan becomes visible.
The public should also understand that “possible activation” is an intelligence assessment, not a courtroom verdict. Intelligence reporting deals in probabilities, confidence levels, fragmentary evidence, and competing explanations. Headlines prefer certainty because “Officials Assess a Possibility With Important Caveats” is a terrible bumper sticker.
What Americans Shouldand Should NotDo
Focus on Behavior, Not Identity
People should report specific, observable behavior that reasonably suggests pre-operational planning or criminal activity. Examples may include repeated attempts to enter restricted areas, unusual surveillance of security procedures, credible threats, efforts to obtain controlled materials without a legitimate explanation, or detailed statements indicating an intention to attack.
NCTC guidance defines suspicious activity around behavior reasonably indicative of pre-operational planning. It also emphasizes protecting privacy, civil rights, and civil liberties when reports involve conduct that may be lawful or constitutionally protected.
People should not report someone merely because of nationality, ethnicity, religion, language, political opinion, clothing, or travel history. A neighbor cooking unfamiliar food is not a national-security lead. It is probably dinner, and it may smell better than yours.
The same restraint should apply online. Viral posts frequently recycle old photographs, mislabel unrelated arrests, invent “FBI alerts,” or treat an anonymous social-media account as a federal intelligence bulletin. Responsible readers should look for dated information from official agencies or reputable news organizations and check whether the report describes a specific threat, a general warning, or an unverified possibility.
The Civil-Liberties Balance
Counterterrorism is most effective when it is precise. Broad suspicion directed at entire communities wastes investigative attention, damages cooperation, encourages harassment, and generates false positives. It can also make witnesses less willing to contact law enforcement when they observe genuinely dangerous behavior.
Watchlists and information-sharing systems can be useful, but they are not infallible. A 2025 Government Accountability Office review found that U.S. persons may be misidentified as watchlisted individuals or remain listed when inclusion is no longer warranted. The report emphasized quality controls and procedures through which affected people can seek redress.
Civil-liberties organizations have also warned that secret or overly broad watchlisting standards can harm innocent people and weaken confidence in security institutions. Security and due process are not rival sports teams. A system that cannot identify and correct errors eventually becomes less credible and less effective.
The FBI’s research on lone-offender terrorism makes a related point: predicting attacks with certainty is not possible, but prevention may improve when relatives, friends, colleagues, or community members report meaningful behavior connected to planning or movement toward violence. The focus is behavior, capability, intent, and preparationnot identity.
Experiences and Lessons From Past Sleeper-Cell Investigations
Lesson 1: Patience Cuts Both Ways
Real investigations show that patience benefits both operatives and investigators. Deep-cover agents may spend years developing access, but authorities may also spend years identifying handlers, communication patterns, supporting personnel, and the full scope of a network.
Operation Ghost Stories was not solved by one brilliant agent spotting a suspicious haircut at a coffee shop. It required sustained surveillance, technical analysis, coordination, and restraint. Arresting too early might expose only one operative. Waiting too long could allow the network to accomplish its mission.
Lesson 2: Reconnaissance Matters
In Hezbollah-related cases, surveillance of airports, military facilities, law-enforcement locations, and other potential targets became important evidence. Reconnaissance alone may have innocent explanations, so context remains essential.
Repeated observation, deceptive explanations, foreign tasking, specialized training, unusual communications, and evidence of target selection can transform an odd incident into a meaningful pattern. Investigators are not simply asking, “Was someone taking photographs?” They are asking who requested the photographs, why they were taken, and what happened next.
Lesson 3: Local Intermediaries Reduce the Need for Large Cells
Foreign-directed plots increasingly rely on people recruited inside the target country. An overseas operative may provide money and intent while local intermediaries provide access, transportation, weapons, technical knowledge, or perceived anonymity.
The Merchant prosecution illustrates this concern. Prosecutors said he attempted to arrange violence through people he believed were willing participants, but those individuals were working with law enforcement. This type of disruption demonstrates why undercover operations remain an important counterterrorism tool.
Lesson 4: Cyber and Physical Operations Now Overlap
A hostile intelligence service can steal personal data, map relationships, threaten dissidents, expose home addresses, disrupt infrastructure, and encourage violence without deploying a traditional attack team. A modern “cell” may therefore be partly physical and partly digital.
It might consist of handlers, hackers, criminal proxies, propagandists, and opportunists who never sit at the same table. Federal cases and cybersecurity warnings involving Iranian actors demonstrate that online and offline threats can support the same strategic objective.
Lesson 5: Fear Can Become Part of the Operation
Rumors about hidden enemies can produce distrust, harassment, political overreaction, and social division even when no attack occurs. That psychological effect is inexpensive, scalable, and difficult to reverse.
Responsible security communication must therefore accomplish two tasks at once: take credible foreign threats seriously and refuse to convert uncertainty into collective blame. An exaggerated response can hand an adversary a psychological victory without requiring that adversary to carry out a single successful operation.
Lesson 6: Successful Disruption Is Often Invisible
The public usually learns about a counterterrorism investigation after an arrest, indictment, conviction, or declassification. It rarely sees the thousands of tips reviewed, false leads closed, protective measures added, or suspected threats quietly ruled out.
That can create the impression that officials are either doing nothing or hiding everything. The less dramatic reality is that counterterrorism consists largely of patient filteringfinding the few signals that matter inside an ocean of ordinary life. The work is less like an action movie and more like completing the world’s most stressful jigsaw puzzle while several pieces may be missing.
Conclusion: Concern Without Panic
Sleeper cells are real as a counterintelligence and counterterrorism concept. Documented U.S. cases show that foreign operatives have lived under cover, gathered intelligence, conducted surveillance, maintained relationships with handlers, and attempted to recruit people for violent missions.
Current concern is tied especially to Iran’s history of proxy activity, assassination plotting, cyber operations, transnational repression, and retaliation during periods of military escalation. The FBI must consider what Iran or an allied organization could do, not merely what has already happened.
Yet “real threat” does not mean “confirmed attackers on every block.” Public evidence must be described honestly: some plots are documented, some networks have been disrupted, significant intelligence remains classified, and many alarming claims remain unverified.
The sensible response is neither denial nor panic. It is focused investigation, careful public reporting, strong civil-liberties safeguards, better protection of vulnerable targets, and a population that notices meaningful behavior without turning ordinary neighbors into suspects.
