Frontline Watch provides a weekly update on emerging terrorist activities and global threat trends, with Counterterrorism Managing Editor Dr. Mahmut Cengiz examining the developments shaping the security landscape both domestically and internationally, with research assistance from Sean Dilallo.
This week’s edition turns its focus to the evolving threat landscape surrounding Iran and its network of proxies. While some assessments suggest these groups have weakened, the analysis presented here underscores that the overall risk environment remains complex and far from diminished. In “Iran’s Proxies Are Weaker. That Doesn’t Mean We’re Safer,” Dexter Ingram examines the shifting capabilities of Tehran’s proxy network, while Kristyn Shapiro’s “The Iran Threat Is Already Here” highlights the immediacy of the challenge. Suha Hassen’s “The Killing Vessel: Iran’s Narrative Strategy and the Hidden Threat to the United States” explores the role of strategic messaging, and Dr. Kutluer Karademir’s “Does the US-Iran War Increase the Risk of Lone-Actor Terrorism in the UK?” assesses the potential for escalation to inspire lone-actor attacks in Western countries. Finally, Mahmut Cengiz and Sean Dilallo’s “The Global Terrorism Spillover of the U.S.–Israel–Iran Conflict” highlights how ongoing operations have already contributed to a rise in hybrid threats that combine proxy-style attacks and self-radicalized lone actors in North America and Europe.
The edition also provides a review of U.S. military operations and policy signals related to counterterrorism, as well as notable terrorist attacks recorded between March 21 and March 27.
Counterterrorism Snapshot: U.S. Operations and Policy Signals (March 21 – March 27)
On March 21, 2026, Reuters reported that the United States had deployed several MQ-9 drones to Nigeria along with 200 U.S. troops. These forces are providing training and intelligence support to the Nigerian military.
On March 25, 2026, U.S. Southern Command conducted a strike on a suspected drug boat in the Caribbean. SOUTHCOM stated that the boat was operated by a Designated Terrorist Organization.
On March 24, 2026, Pakistani security forces detained two Azerbaijani nationals suspected of being members of Islamic State Khorasan. This marks part of an expanding effort by the Islamic State to increase its presence in the South Caucasus.
On March 25, 2026, Spanish and Moroccan authorities announced a joint operation that dismantled an ISIS network that was operating in both countries. Interestingly, the network was providing financial and logistical support to Islamic State branches in the Sahel and Somalia.
On March 25, 2026, U.S. authorities in Florida announced an indictment against two individuals accused of planting an improvised explosive device (IED) outside MacDill Air Force Base earlier in the month. The device was allegedly planted on March 11 but was not discovered until March 16, when it was safely disposed of. One suspect is currently in custody, while the other is believed to be in China.
Notable Terrorist Attacks
On March 22, 2026, in London, United Kingdom, four ambulances belonging to Hatzola Northwest were set on fire. Hatzola Northwest is a Jewish volunteer emergency medical service. No casualties were reported in the attack. Ashab al-Yamin claimedresponsibility for the attack. Ashab al-Yamin has claimed multiple attacks against Synagogues and Jewish organizations in Europe since the beginning of U.S. and Israeli operations in Iran.
On the night of March 22-23, 2026, in Antwerp, Belgium, a car was set on fire in an anti-semitic attack. The attack was claimed by Ashab Al Yamin Al Islamiya, who have been behind multiple attacks in Europe since March 1. Two minors were arrested in connection with the incident.
On March 24, 2026, in Kebbi State, Nigeria, nine soldiers were killed, and several others were injured in a suspected Lakurawa attack. The assault reportedly occurred in the Shanga district when gunmen opened fire on a military patrol.
Hotspots & Emerging Threats
The Iran Threat is Already Here
By Kristyn Shapiro
- Iran poses a credible and near-term homeland threat to the United States, based on clear indicators of intent, capability, and opportunity. TheIslamic Revolutionary Guard Corps and its Qods Force are specifically designed to conduct asymmetric operations abroad, making them highly relevant in the current conflict environment.
- This threat is grounded in a documented pattern of both physical and cyber operations on U.S. soil. Plots targeting individuals such asMasih Alinejad, John Bolton, and Donald Trump, alongside cyberattacks on banks, hospitals, and water systems, demonstrate a willingness to disrupt civilian life and critical infrastructure.
- At the same time, U.S. preparedness may be weakening due to the diversion of national security resources and the loss of specialized expertise. This creates potential gaps in detection and response at a moment when threat indicators are increasing and require heightened focus.
As the world’s attention is fixed on the fast-moving conflict in Iran, my first instinct as a homeland security practitioner was to look here at home. In moments of major geopolitical upheaval, the question is never just what happens there; it is how adversaries may move to create effects here. And in light of the Iran war, the operative question is whether Iran poses an imminent threat to the United States. If we evaluate intent, capability, and opportunity the way practitioners must, the answer is yes.
Read the rest of the analysis here.
The Killing Vessel: Iran’s Narrative Strategy and the Hidden Threat to the United States
By Suha Hassen, PhD
- Iran’s influence extends beyond military capabilities to the export of a powerful ideological system centered on martyrdom. Rooted in the historical memory ofthe Battle of Karbala and the legacy of Husayn ibn Ali, this narrative reframes sacrifice as a sacred duty and mobilizes individuals, especially youth, into a perceived moral struggle.
- This process transforms individuals at the level of identity through what the article describes as a “Killing Vessel,” where belief is converted into violent action. Reinforced by rituals likeAshura, propaganda, and digital amplification, the narrative becomes self-sustaining, producing decentralized, self-mobilized actors without direct command.
- Traditional counterterrorism approaches are ill-equipped to address this threat because they focus on organizations rather than narratives. To respond effectively, policymakers must treat ideology as a core instrument of statecraft and disrupt the mechanisms—symbolic, linguistic, and emotional—that turn belief into violence.
Iran’s influence is often measured in missiles, militias, and military reach. But this framing misses a more enduring and dangerous reality: Iran is not only exporting weapons; it is exporting and sustaining a martyrdom narrative.
Which is more dangerous: a ballistic missile or the narrative that convinces someone to become one? Or when that narrative evolves into a self-sustaining system capable of producing violence on its own?
Read the rest of the analysis here.
Iran’s Proxies Are Weaker. That Doesn’t Mean We’re Safer.
By Dexter Ingram
A damaged network isn’t a defeated one – and we’re less prepared than we should be.
- Days before the conflict escalated, the dismissal of FBI agents monitoring Iranian threats weakened U.S. preparedness at a critical moment. At the same time, Iran’s proxy network—though degraded—has become more fragmented and harder to track, increasing the risk posed by decentralized and less visible cells.
- Even as groups likeHezbollah and Hamas have suffered losses, the broader threat environment is becoming more volatile. Rising radicalization and opportunistic violence—sometimes inspired by groups like ISIS—are already producing attacks and plots across the United States and Europe.
- Compounding the risk, significant cuts to U.S. counterterrorism infrastructure, including at theDepartment of Justice and Department of State, have reduced monitoring capacity and strained international partnerships. The result is a dangerous gap between a more adaptive threat landscape and a weakened ability to detect and prevent attacks.
Days before Operation Epic Fury began, the FBI fired a dozen agents who had been monitoring Iranian threats – not for poor performance, but because they had worked on the investigation into the handling of classified documents at Mar-a-Lago. That unit was dismantled right before we went to war.
Read the rest of the analysis here.
Does the US-Iran War Increase the Risk of Lone-Actor Terrorism in the UK?
By: Dr. Kutluer Karademir
- Lone-actor terrorism in the UK remains a persistent but relatively infrequent threat, with incidents such as theManchester Arena bombing illustrating its potential impact. Despite low attack numbers, disrupted plots and warnings from MI5 show that the risk environment remains active.
- The US–Israel–Iran conflict is unlikely to directly increase attacks, as the UK underKeir Starmer has avoided offensive involvement. However, it may still fuel polarization and grievance narratives that can contribute to radicalization.
- Overall, the risk is indirect and conditional, driven more by how the conflict is interpreted and amplified than by the conflict itself.
The long-lasting escalation at the Iran-Israel-US triangle has culminated in a full-scale war situation following US-Israeli attacks on Iran in late February 2026. In an era of digital media saturation, fragmented identities, and decentralized extremism, conflicts in one region can reshape domestic emotional climates in ways that influence political violence elsewhere. For the British population, one of the key questions to ask at this point is whether the US-Israel-Iran conflict may contribute to a heightened lone-actor terrorism risk environment in the UK. As a major ally of the US with a sizeable and diverse Muslim population, the UK may be exposed to intensified grievance narratives, identity polarization, and online radicalization dynamics, which are the factors consistently identified in research as enabling conditions for individual acts of extremist violence. This article examines the current state of lone-actor terrorism in the UK, evaluates potential risk factors, and assesses whether the risk environment is likely to change as a result of the conflict.
Read the rest of the analysis here.
The Global Terrorism Spillover of the U.S.–Israel–Iran Conflict
By Mahmut Cengiz, PhD and Sean Dilallo
- The U.S.–Israel–Iran confrontation has coincided with a noticeable increase in incidents across North America and Europe. These include both intimidation-style attacks on Jewish and U.S. targets abroad and lone-actor violence in the U.S., reflecting immediate global spillover effects.
- Attacks show two overlapping patterns: possible proxy-style operations linked to Iran (often using local criminal networks) and decentralized violence by self-radicalized individuals, including those inspired byISIS. This combination makes attribution, detection, and prevention significantly more difficult.
- Self-radicalized individuals operate with little warning and diverse motivations, limiting traditional intelligence tools. Effective response will depend on stronger coordination, community engagement, and adapting counterterrorism approaches to a more fragmented threat landscape.
Now in its fourth week, U.S. and Israeli strikes on Iran have introduced a new phase of uncertainty with consequences that extend well beyond the immediate battlefield. While the campaign has sought to degrade Iran’s missile and nuclear capabilities, weaken its regional posture, and potentially embolden domestic opposition, it remains unclear whether these objectives are being achieved. On the contrary, Iran’s continued resistance and calibrated retaliatory actions suggest a protracted confrontation, compounded by broader geopolitical tensions, including rising global oil prices. Amid extensive debate over the strategic outcomes of these operations, one of the most tangible and immediate effects has been a noticeable increase in lone-actor attacks carried out by self-radicalized individuals in Western countries. This article examines these incidents between March 1 and March 13, highlighting emerging patterns and implications for security.
