Now in its fourth week, U.S. and Israeli strikes on Iran have introduced a new phase of uncertainty with consequences that extend well beyond the immediate battlefield. While the campaign has sought to degrade Iran’s missile and nuclear capabilities, weaken its regional posture, and potentially embolden domestic opposition, it remains unclear whether these objectives are being achieved. On the contrary, Iran’s continued resistance and calibrated retaliatory actions suggest a protracted confrontation, compounded by broader geopolitical tensions, including rising global oil prices. Amid extensive debate over the strategic outcomes of these operations, one of the most tangible and immediate effects has been a noticeable increase in lone-actor attacks carried out by self-radicalized individuals in Western countries. This article examines these incidents between March 1 and March 13, highlighting emerging patterns and implications for security.
Since the launch of Operations Epic Fury and Roaring Lion on February 28, 2026, the United States and Israel have engaged in sustained military actions against Iran, marking a significant escalation in regional hostilities. While media coverage has mainly concentrated on Iran’s retaliatory measures within the Middle East, the ripple effects of the conflict have reached far beyond the region. Notably, Western countries have experienced a noticeable rise in terrorist incidents linked, either directly or indirectly, to the ongoing confrontation. These attacks generally fall into two patterns. The first consists of coordinated, late-night assaults targeting synagogues, Jewish institutions like schools, and U.S. diplomatic facilities—primarily in Europe and Canada—and resemble previous operations attributed to Iranian intelligence agencies. The second pattern, seen exclusively in the United States, is more aligned with typical lone-actor terrorism, involving self-radicalized individuals acting independently but inspired by the broader geopolitical crisis.
Attacks in Canada and Europe
In Canada, a series of coordinated late-night attacks targeted Jewish institutions and a U.S. diplomatic facility in the Greater Toronto Area between March 6 and March 10. On the night of March 6–7, two synagogues were struck by gunfire, followed by another synagogue shooting on March 9; no casualties were reported in any of these incidents. On March 10, the U.S. Consulate in Toronto was similarly targeted, again without resulting in casualties. Although these attacks display notable similarities in timing, targets, and method, it remains unclear whether they are linked or carried out by different perpetrators.
In Europe, a series of attacks between March 8 and March 13, 2026, targeted both U.S. diplomatic sites and Jewish institutions, reflecting a pattern consistent with politically and ideologically motivated violence. On March 8, an improvised explosive device (IED) detonated outside the U.S. Embassy in Oslo, Norway, damaging the building’s entrance but causing no casualties; authorities subsequently arrested three suspects in connection with the attack. The next day, March 9, an explosion happened outside a synagogue in Liège, Belgium, again causing no casualties but resulting in structural damage. Belgian officials condemned the incident as an anti-Semitic act, and a group calling itself the “Islamic Movement of the Righteous Believers,” also known as the “Islamic Movement of the Companions of the Right,” claimed responsibility; this same group has since claimed at least three additional attacks across Europe. On March 13, a suspected arson attack targeted the entrance of a synagogue in Rotterdam, Netherlands, with no reported casualties; four suspects were detained in a nearby vehicle.
The exact nature and attribution of these attacks still remain unclear. However, current patterns merit careful analysis. Iranian intelligence agencies have a documented history of using local criminal networks in Europe to carry out proxy operations, thereby reducing operational risks and maintaining plausible deniability. The recent incidents show tactical similarities to past attacks linked to such networks, especially in target selection and methods. Meanwhile, the emergence of a group calling itself the “Islamic Movement of the Righteous Believers,” which has claimed responsibility for multiple attacks across various European countries, indicates a level of coordination that could go beyond isolated, self-radicalized individuals. Observers also pointed out that the group’s visual symbols resemble those of established Iran-aligned groups like Hezbollah and Kata’ib Hezbollah. Although these signs are not enough to definitively identify who is behind the attacks, they highlight the importance of considering both the possibility of external coordination and other explanations—such as multiple independent actors using a shared label to appear part of a larger resistance movement. Final conclusions, however, will require further investigation.
Notably, the attacks to date have remained relatively unsophisticated and, particularly in Canada and Europe, do not appear to have been explicitly designed to cause mass casualties. The timing of the incidents—often occurring during late-night or early morning hours when targeted facilities are likely to be unoccupied—along with the absence of fatalities, suggests that these operations may be intended primarily as acts of intimidation, particularly against Jewish communities, rather than as mass-casualty terrorism.
The potential use of local criminal actors in the execution of such attacks presents distinct challenges for law enforcement and intelligence agencies. By outsourcing operational responsibilities to locally recruited individuals, state-linked actors can reduce direct risk to their personnel while exploiting existing criminal infrastructures. This model enables remote recruitment—often facilitated through online platforms—and creates a layer of separation between planners and perpetrators. Consequently, even when local operatives are apprehended, they may offer limited intelligence value, as their roles are often compartmentalized and their connections to higher-level coordinators remain obscured.
Attacks in the United States
In the United States, a series of attacks from March 1 to March 12, 2026, reflects a pattern more consistent with lone-actor terrorism, though shaped by diverse ideological influences. On March 1, a gunman opened fire at a crowded bar in Austin, Texas, killing three people and injuring 13 others; the perpetrator, who was later killed by police, reportedly showed pro-Iranian sympathies, including wearing a shirt with the Iranian flag and possessing images of Iranian leaders in his residence. On March 7, two individuals, allegedly inspired by ISIS, carried out an attack using improvised explosive devices (IEDs) at an anti-Islam rally outside the New York City mayor’s residence. On March 12, someone previously convicted of supporting ISIS opened fire on an ROTC class at Old Dominion University in Norfolk, Virginia, killing the instructor and injuring two others before being killed. On the same day, another incident occurred in West Bloomfield, Michigan, where an individual rammed a vehicle into a synagogue; the attacker was later killed by synagogue security. Overall, these incidents show a decentralized threat environment in which self-radicalized individuals, motivated by various ideologies, act independently but within a broader context of heightened geopolitical tensions.
Attacks within the United States have exhibited greater variation in both motivation and execution compared to those observed in Europe and Canada. Of the four incidents, two appear to be more directly connected to the onset of U.S. and Israeli military operations. The perpetrator of the Austin shooting displayed explicit pro-Iranian sympathies, including wearing a shirt bearing the Iranian flag during the attack and possessing multiple images of Iranian leaders in his residence. In the Michigan case, the attacker had reportedly learned shortly before the incident that four family members had been killed in an Israeli airstrike in Lebanon; notably, the Israeli Defense Forces (IDF) stated that one of the deceased relatives was affiliated with Hezbollah in a command capacity.
In contrast, the other two attacks in the United States were clearly connected to ISIS-inspired radicalization. Both attackers expressed ideological support for ISIS: the individuals involved in the New York City attack reportedly mentioned ISIS as their motivation after their arrest, while the perpetrator of the Old Dominion University (ODU) shooting had a prior conviction in 2016 for supporting ISIS. Although the broader geopolitical context may have influenced the timing or framing of these attacks, they still highlight the ongoing and evolving threat posed by ISIS-inspired self-radicalized actors within the United States.
Conclusion
The return of U.S. combat operations in the Middle East has coincided with a noticeable rise in retaliatory and inspired attacks across North America and Europe. These events demonstrate a hybrid threat environment, blending actions carried out by self-radicalized individuals with attacks that may show signs of indirect or proxy involvement by Iranian-linked networks. As the conflict continues—and especially if it escalates—the risk of more attacks in Western countries is likely to stay high.
Addressing this evolving threat landscape presents significant challenges. Lone-actor terrorism, by definition, limits opportunities for preemption due to the absence of structured networks that can be penetrated or monitored. Although self-radicalized individuals may engage with broader ideological communities, they do not necessarily disclose operational intentions, reducing the effectiveness of traditional intelligence methods. At the same time, the potential use of local criminal actors as proxies introduces additional complexity, especially regarding jurisdictional responsibilities and inter-agency coordination. Successfully countering such tactics will require closer cooperation between intelligence agencies and traditional law enforcement bodies.
Ultimately, both parts of the threat emphasize the importance of community involvement. Because of limits in law enforcement resources and authority, early detection of potential threats often depends on public information. Building and maintaining trust between security agencies and the communities they serve is therefore essential. However, this process demands careful balance, as perceptions of overreach or mistakes can quickly damage confidence and hinder cooperation.
Lone-actor terrorism is likely to persist as a feature of the current security landscape, and ongoing geopolitical conflicts, such as the confrontation with Iran, tend to increase its threat. While completely eliminating these threats is unlikely, improving prevention efforts, enhancing institutional coordination, and avoiding actions that could worsen underlying tensions are essential parts of an effective response.
