Sleeper Cell alert: U.S. intercepts encrypted Iranian transmission that may trigger operatives abroad
ET timestamp: 8: 30 p. m. ET — A federal government alert is warning law enforcement agencies that the U. S. intercepted encrypted communications believed to have originated in Iran that may act as an “operational trigger” for a sleeper cell or other “sleeper assets” outside the country. The alert ties the transmission’s appearance to the period shortly after the death of Iran’s supreme leader Ayatollah Ali Khamenei, who was killed in a U. S. -Israeli attack on Feb. 28. Officials emphasize there is no operational threat tied to any specific location, but they are urging heightened situational awareness and increased monitoring for suspicious radio-frequency activity.
What the federal alert says about a sleeper cell signal
The alert describes “preliminary signals analysis” of a transmission “likely of Iranian origin” that was relayed across multiple countries. The transmission was encoded and appeared intended for “clandestine recipients” who possess the encryption key—an approach designed to pass instructions to “covert operatives or sleeper assets” without using the internet or cellular networks.
The alert notes that while the exact contents cannot currently be determined, the sudden appearance of a new station with international rebroadcast characteristics warrants heightened awareness. It also states it is possible the transmissions could be intended to activate or provide instructions to prepositioned sleeper assets operating outside the originating country.
What law enforcement is being asked to do now
Even as the alert stresses that there is “no operational threat tied to a specific location, ” it instructs law enforcement agencies to increase monitoring of suspicious radio-frequency activity. The warning is framed as a practical shift in posture: watch for unusual broadcast activity that may indicate encoded messaging intended for covert recipients.
In parallel, federal counterterrorism authorities have warned that retaliatory actions could come through multiple pathways, including sleeper assets potentially on U. S. soil, affiliated Iranian terrorist groups, lone wolf sympathizers, or targeted cyberattacks. Investigators, however, have so far found no credible specific threat.
Immediate reactions: Trump, FBI/DHS posture, and an expert warning
At a news conference Monday, President Donald Trump said officials were “on top” of the situation. “They’ve been trying for a long time, and we’ve been very much on top of it, ” Trump said when asked whether Iran might activate sleeper cells in the U. S. “We’re watching every single one of them, yeah. We know a lot about them. ”
Federal authorities have also been communicating a heightened stance. The FBI and the Department of Homeland Security have been described as operating on a war footing since Operation Epic Fury launched Feb. 28.
Horace Frank, former head of counterterrorism for the Los Angeles Police Department and a retired assistant chief, said the concern is persistent but sharpened by the current moment: “Sleeper cells have always been a concern when it comes to Iranians and their proxies. This isn’t new, but given the situation, some of their proxies are feeling a lot more desperate. ”
Quick context on the transmissions and broader concerns
Within days of Khamenei’s death, cryptic messages were broadcast globally on a new shortwave radio frequency, including a transmission that began with “Tavajjoh! Tavajjoh!”—Persian for “attention”—followed by a string of numbers. The method echoes historic “number station” broadcasts, where coded numerals could be translated into a readable message by those holding an encryption system.
What’s next for the sleeper cell investigation
In the near term, the central question remains whether analysts can determine the content and intended recipients of the intercepted message, or link it to any operational planning. For now, officials are not naming specific targets or locations, and the alert’s emphasis remains on vigilance—especially tracking suspicious broadcast activity—while investigators assess whether the transmission reflects coordination with a sleeper cell or other sleeper assets outside Iran.
