Proxy, Surrogate, and Criminal Networks
The more plausible near-term threat lies in proxy and surrogate activity, including the deliberate use of criminal intermediaries. This distinction is critical to resource allocation and threat prioritization. Direct state-authorized attacks carry high symbolic impact but low probability. Proxy, surrogate, and criminal operations carry a moderate probability with the benefit of deniability. Decentralized violence carries a high probability with a low detection signature. This is likely what is occurring with the recent rash of attacks claimed by the shadowy group Harakat Ashab al-Yamin al-Islamia (HAYI), a group responsible for more than a dozen attacks since the war in Iran kicked off in late February.
Iran’s long-standing investment in criminal surrogate networks, particularly those with access to the United States through Central and South American criminal infrastructure, provides an operational path that preserves deniability while delivering retaliatory effect. Attacks carried out through criminal intermediaries, targeting government facilities or symbolic American sites, would allow Tehran to signal capability without formally authorizing state-directed terrorism. Counterterrorism officials have noted Iran’s documented collaboration with criminal networks that provide operational reach without formal state authorization.[i]
The Lone-Actor Threat: The Most Immediate Risk
The highest probability threat in the near term is decentralized violence by lone actors or small cells.[ii] These individuals require minimal coordination, generate fewer detectable signals, and can mobilize rapidly in response to emotionally resonant events. The conflict provides powerful motivational drivers, including widespread digital exposure to violence, identity-based grievance narratives, and continuous amplification through social media. Critically, these drivers are compounded by a deep sense of injustice rooted in documented atrocities: the killing of tens of thousands of Palestinian civilians, including women and children, in Gaza; and the February 28, 2026, U.S.-Israeli airstrike that killed at least 165 schoolgirls at the Shajareh Tayyebeh primary school in Minab, Iran. For individuals already primed by political anger or economic hardship, these events do not require organizational direction to produce violent action. They function as independent catalysts.
Importantly, this threat is not confined to any single ideological category. It also includes individuals with no ethnic, religious, or organizational ties to the Middle East who interpret rising inflation, reductions in social welfare spending, and sustained investment in foreign conflicts as evidence that domestic needs are being subordinated to overseas priorities. For some already predisposed toward anti-government or conspiratorial worldviews, these perceptions can intensify resentment and lower the threshold for politically motivated violence.
It also includes anti-Jewish, anti-Muslim, and hybrid forms of extremism shaped by the conflict. The emotional, moral, and economic resonance of the war does not produce radicalization along a single vector; rather, it amplifies multiple preexisting tensions simultaneously. Clarke and Costa have warned that the combined American and Israeli offensive against Iran is likely to stoke further anger and elevate anti-Jewish and anti-American sentiment, grievances already inflamed by nearly two years of conflict in Gaza.[iii] These perceptions are likely to have enduring effects, particularly among the demographic cohort commonly identified as Generation Z, many of whom have politically matured during the Gaza conflict.
Economic Shock, Migration Pressures, and Radicalization Spillover
This conflict is not only about terrorism. It is also a maritime and energy-security crisis with direct implications for the global radicalization environment. The Strait of Hormuz, through which roughly twenty percent of global oil and LNG flows, has experienced severe disruption. Shipping traffic dropped dramatically during peak periods of escalation, and the European Union moved to expand sanctions in response to interference with maritime navigation.
The downstream economic effects have been global. Fuel costs, food prices, and transportation expenses have risen across every populated continent. For working populations in South Asia, sub-Saharan Africa, and Latin America already managing fragile economic conditions, renewed inflation creates a direct and personal connection to a conflict that might otherwise feel distant. Radicalization research consistently shows that economic grievance, when combined with political anger, perceived injustice, and a narrative that assigns blame, increases the risk of mobilization.[iv] For a young person watching prices rise while simultaneously consuming images of civilian deaths in Gaza or the destruction of a girls’ school in southern Iran, these pressures can become mutually reinforcing.
The effects are equally relevant in Western democracies, including the United States. Higher gasoline prices, rising grocery bills, and more expensive daily transportation place real strain on households already coping with stagnant wages and debt. Conflict-driven instability has also accelerated migration pressures from regions such as Ukraine, Syria, and parts of Latin America. Across Europe and North America, populist movements increasingly portray migrants as symbols of economic decline, cultural anxiety, and elite failure. When personal hardship is fused with messaging that blames immigrants, foreign wars, or political institutions for domestic suffering, the result can be a broader pool of grievance vulnerable to radicalization across ideological lines.[v]
The Cyber Dimension: A Primary Battlespace
Cyber operations are now central to the threat environment and represent one of the most likely pathways for state-aligned retaliation. U.S. agencies, including the FBI, NSA, CISA, and Department of Energy, have warned that Iranian-linked cyber actors have intensified targeting of U.S. critical infrastructure since the start of the war. These efforts have focused particularly on industrial control systems, including PLC and SCADA platforms used in the energy and water sectors.
Cyber operations offer high-impact disruption with limited attribution risk, making them well-suited to Iran’s doctrine of deniable coercion. Unlike kinetic attacks on U.S. soil, a successful cyberattack on energy infrastructure can inflict significant economic and public safety consequences while preserving the ambiguity that Tehran has always relied upon to avoid triggering an escalatory American response. This category of threat warrants dedicated analytical attention and sustained resource investment, which are currently not fully reflected in the public counterterrorism posture.
The al-Qaeda Dimension: Saif al-Adl, Iran, and the Convergence of Grievances
The most underexamined threat vector in current public discourse on the Iran war’s terrorism implications is the al-Qaeda factor. It concerns the presence of Saif al-Adl, the de facto leader of al-Qaeda, inside Iran, and what the current conflict means for his organization’s operational trajectory.
Saif al-Adl, whose given name is Mohammed Salahuddin Zeidan, is an Egyptian-born former officer in Egypt’s special forces and one of al-Qaeda’s founding generation. He has been under U.S. federal indictment since the late 1990s for his alleged role in the 1998 bombings of American embassies in Kenya and Tanzania, attacks that killed 224 civilians. Following the collapse of al-Qaeda’s Afghan sanctuary after 2001, al-Adl relocated to Iran, where he has been based, with varying degrees of freedom of movement, for over two decades. A 2023 United Nations report concluded that al-Adl is now the de facto and uncontested leader of al-Qaeda, a conclusion supported by the U.S. State Department.[vi]
Al-Adl’s presence in Iran should not be read as evidence of Iranian operational direction over al-Qaeda. The relationship is better understood as one of mutual, uncomfortable utility. Iran retains some degree of leverage over a globally significant jihadist figure, and al-Adl maintains a relatively secure environment for operational planning. Al-Adl himself has stated that coordination occurred with individuals hostile to Americans and Israelis, deliberately distancing himself from any formal relationship with the Iranian government.[vii] The arrangement persists because neither party wishes to acknowledge it formally, and because it has served both parties’ interests across two decades.
What matters for the current threat assessment is not whether Tehran is directing al-Adl, but what al-Adl is witnessing and experiencing from his position inside Iran. He is a man who has spent more than two decades in a country that has now been directly attacked by the United States, that has lost senior commanders, that has watched its civilian infrastructure struck from the air, and whose population is now suffering the economic consequences of a war it did not initiate. Whatever the formal character of al-Adl’s relationship with the Iranian state, it would be analytically irresponsible to assume that living through these events as a long-term resident of a country at war with the United States produces no effect on his operational orientation, his sense of urgency, or his communications to al-Qaeda’s branches worldwide. He does not need to receive instructions from Tehran to be influenced by what Tehran is experiencing. In analysis of the Iran war to date, this has remained an underexamined threat vector.
Al-Qaeda has not formally proclaimed al-Adl as emir, for reasons that illuminate the organization’s complicated relationship with Iran. Sunni jihadists do not want to admit that they rely on Shia Iran for a safe haven, and Tehran similarly does not want to publicly acknowledge harboring senior al-Qaeda figures. The current conflict, however, creates conditions that may render this ambiguity unsustainable. Al-Qaeda’s messaging since October 7, 2023, has already demonstrated the organization’s capacity to harness the killing of civilians, women, and children in Gaza as a recruitment and mobilization tool across sectarian lines. As recently as June 2024, al-Adl issued a call under the pseudonym Salim al-Sharif for supporters worldwide to migrate to Afghanistan for training before undertaking attacks against Western targets.[viii] The Iran war, with its documented civilian casualties and the destruction of a girls’ school in the opening hours of the offensive, provides fresher and more potent material for the same narrative.
Stay tuned for Part 3: Strategic Recommendations & Conclusions
References
[i] Sune Engel Rasmussen, “How Iran Uses Criminal Gangs in the West to Target Its Enemies,” The Wall Street Journal, October 2024, https://www.wsj.com/world/middle-east/how-iran-uses-criminal-gangs-in-the-west-to-target-its-enemies-e0f87cc1?utm
[ii] Yayla, A. (2025). Anatomy of Terrorist Cells: A Critical Examination and Identified Gaps in Current Research. Studies in Conflict & Terrorism, 1–28. https://doi.org/10.1080/1057610X.2025.2471294
[iii] Clarke, C. P., & Costa, C. P. (2025, June 25). Terrorism Means Something Different Now, Foreign Policy. https://foreignpolicy.com/2025/06/25/counter-terrorism-iran-united-states/
[iv] McCauley, C., & Moskalenko, S. (2017). Friction: How radicalization happens to them and us. Oxford University Press.
[v] Sageman, M. (2008). Leaderless jihad: Terror networks in the twenty-first century. University of Pennsylvania Press.
[vi] United Nations Analytical Support and Sanctions Monitoring Team. (2023). Report of the Analytical Support and Sanctions Monitoring Team submitted pursuant to Resolution 2610. United Nations Security Council.
[vii] Wilson Center. (2023). Profile: Saif al-Adel of al-Qaeda. https://www.wilsoncenter.org/article/profile-saif-al-adel-al-qaeda
[viii] Joscelyn, T., & Roggio, B. (2024, June 8). Al-Qaeda leader calls foreign fighters to Afghanistan. FDD’s Long War Journal. https://www.longwarjournal.org/archives/2024/06/al-qaeda-leader-calls-foreign-fighters-to-afghanistan.php & Special Inspector General for Afghanistan Reconstruction. (2024, August 4). [Post on X, formerly Twitter]. https://x.com/SIGARHQ/status/1820112895134306561
