U.S. Intelligence Assessment Warns of Iranian Retaliation Following Khamenei’s Death

A newly reviewed intelligence assessment from the U.S. Department of Homeland Security (DHS) warns that Iran and its affiliated proxy groups may seek to retaliate against the United States after the reported killing of Iranian Supreme Leader Ali Khamenei. While officials believe a large-scale physical attack on U.S. soil is unlikely, the threat of targeted actions—including cyber operations—remains significant.

The February 28 threat assessment, prepared by the Office of Intelligence and Analysis within DHS, indicates that Iran and its regional allies “probably” pose an ongoing risk of targeted attacks within the United States. The report, reviewed by Reuters, emphasizes that retaliatory measures could escalate if confirmation of Khamenei’s death continues to circulate.

DHS Assessment: Cyber Threats Most Likely

According to the intelligence report, the most immediate concern centers on cyber activity. Iranian-aligned “hacktivists” are expected to conduct low-level cyberattacks targeting U.S. networks. These actions may include website defacements and distributed denial-of-service (DDoS) attacks, aimed at disrupting online infrastructure rather than causing widespread physical harm.

Officials assess that while coordinated large-scale physical attacks are improbable in the short term, cyber retaliation is highly likely. Such digital operations are considered cost-effective, deniable, and symbolically impactful tools frequently used by state-aligned actors.

The assessment underscores that Iran and its proxy organizations maintain the capability and intent to conduct targeted actions within the U.S. homeland. The potential for escalation increases if the Iranian government officially confirms Khamenei’s death and frames it as an act of aggression by Washington.

Official U.S. Response

In response to inquiries regarding the assessment, Homeland Security Secretary Kristi Noem stated that federal authorities are actively coordinating to monitor and prevent potential threats.

“I am in direct coordination with our federal intelligence and law enforcement partners as we continue to closely monitor and thwart any potential threats to the homeland,” Noem said in a public statement.

The administration of President Donald Trump has not released additional operational details, but intelligence and law enforcement agencies are reportedly heightening surveillance of potential cyber and extremist activity.

Confirmation of Khamenei’s Death

Iran officially confirmed reports on Sunday that Ali Khamenei was killed in a strike on Saturday. The strike had initially been announced by Israel and President Trump before Tehran’s confirmation.

Khamenei’s death represents a seismic political event in Iran, given his long-standing role as the country’s supreme authority since 1989. His influence extended across military, political, and religious institutions, including the Islamic Revolutionary Guard Corps (IRGC) and allied regional militias.

Intelligence analysts believe his death may trigger internal unrest within Iran while simultaneously motivating external retaliation against perceived adversaries, particularly the United States and Israel.

Broader Regional Conflict Expands

The intelligence warning comes amid an expanding military confrontation in the Middle East. The ongoing U.S. and Israeli air campaign against Iranian targets has widened geographically.

On Monday, Israel launched airstrikes against Lebanon following reported attacks by the Iran-backed militant group Hezbollah. Meanwhile, Tehran continued missile and drone strikes against Gulf states hosting U.S. military bases.

The regional escalation raises the risk of indirect conflict spreading beyond traditional battlegrounds, potentially increasing cyber operations, proxy attacks, and politically motivated violence in Western countries.

Domestic Security Concerns in the U.S.

U.S. authorities are also evaluating whether recent domestic incidents may be linked to the escalating conflict.

In Austin, Texas, investigators are examining a shooting at a bar that left at least two people dead. Law enforcement officials have stated it is too early to determine whether the attack was motivated by geopolitical tensions.

However, photographs obtained by Reuters reportedly show the deceased gunman wearing a shirt featuring the Iranian flag and the word “IRAN” spelled out in green, white, and red. He was also wearing a sweatshirt bearing the phrase “Property of Allah,” according to a U.S. law enforcement official.

While officials caution against premature conclusions, the imagery has intensified concerns about potential ideologically motivated violence inspired by events in the Middle East.

Iran’s Retaliation Capabilities

Iran’s asymmetric warfare strategy historically relies on indirect action. Rather than launching overt military strikes against the U.S. mainland, Tehran has frequently leveraged:

Cyber warfare
Proxy militias in the Middle East
Targeted operations against diplomatic and military facilities abroad
Propaganda and influence campaigns

The DHS assessment suggests that in the current environment, cyberattacks represent the most plausible and immediate form of retaliation. These operations may target government agencies, financial institutions, energy infrastructure, or private-sector networks.

The report also notes that Iranian leadership could publicly blame senior U.S. officials for unrest sparked by regime-change rhetoric, potentially encouraging retaliatory mobilization among sympathizers.

Heightened Homeland Security Monitoring

Federal agencies are reportedly increasing intelligence-sharing across cybersecurity centers, law enforcement divisions, and state authorities. Infrastructure operators are being advised to review cybersecurity protocols and ensure rapid incident response capabilities.

Critical sectors considered most vulnerable include:

Energy and utilities
Financial systems
Transportation networks
Government digital platforms

While no imminent large-scale attack has been identified, authorities describe the threat environment as “persistent” and evolving.

Outlook: Elevated but Contained Risk

Security analysts characterize the current threat level as elevated but manageable. A direct military assault on U.S. territory is deemed unlikely, but cyber disruptions and isolated targeted incidents remain credible risks.

The coming weeks are expected to be pivotal. If Iran consolidates internal leadership without major unrest, retaliation may be limited to symbolic cyber actions. However, if political instability intensifies or if further strikes occur in the region, escalation cannot be ruled out.

For now, U.S. intelligence agencies continue to monitor developments closely, balancing vigilance with measured public communication to avoid panic.

Key Takeaways

DHS intelligence warns of possible Iranian retaliation following Khamenei’s death.
Cyberattacks are considered the most likely threat to U.S. networks.
Large-scale physical attacks inside the U.S. are assessed as unlikely.
Regional conflict between Iran, Israel, and U.S. forces is expanding.
Domestic authorities are reviewing recent violent incidents for possible geopolitical links.

The situation remains fluid as diplomatic, military, and intelligence efforts continue to evolve in response to one of the most significant geopolitical developments in recent Middle Eastern history.