The sleeper cell concept is not a conspiracy theory. It is a documented, historically verified tactic used by multiple states and non-state actors. Iran and Hezbollah have been employing it in the Western Hemisphere since at least the early 1980s, when Hezbollah's Unit 910 — its external operations wing — began establishing presence in Lebanese diaspora communities across Latin America and, over time, North America. The Director of National Intelligence's annual threat assessments have confirmed Iran's ongoing maintenance of networks inside the United States capable of conducting targeted operations. Since 2020, federal authorities have neutralized more than 18 Iran-linked plots on US soil, including assassination attempts against Iranian dissidents and at least one plot targeting former National Security Advisor John Bolton. These are not hypothetical capabilities. They are active programs that have already been deployed against targets in America.

The February 28 activation signal described in an ABC News report — citing a federal law enforcement memo — was described as broadcast via a "new radio station with international reach, designed to bypass the internet and cellular networks to reach clandestine operatives." This is the classic number station format: shortwave radio broadcasts of sequences of letters or numbers that appear meaningless to listeners but carry coded instructions to pre-briefed operatives. Number stations were a Cold War staple used by both the US and Soviet intelligence services. Iran's use of them signals an awareness that internet communications are monitored, and an intent to use communication channels that are harder to intercept and attribute. The FBI memo quoted in the ABC report noted there is currently "no operational threat tied to a specific location" — meaning the signal was intercepted but no specific plot has been confirmed. That gap between "signal intercepted" and "plot confirmed" is where the current threat resides: visible enough to generate high alert, ambiguous enough that it cannot be definitively assessed.

What makes this moment structurally different from prior Iran threat elevations is not the existence of the cells — those have been present for decades — but the change in Iran's strategic calculus. Prior Iranian deterrence from large-scale attacks on US soil was driven partly by rational calculation: the regime knew that a successful mass-casualty attack inside America would likely trigger a US military response that could end the regime. That deterrent calculus no longer applies in the same way. The regime is already under existential military pressure. Its Supreme Leader has been killed. Its military and nuclear infrastructure has been struck by hundreds of US and Israeli weapons. The logic of restraint — "don't provoke the Americans to do something worse" — collapses when the Americans have already done something close to the worst imaginable. A regime fighting for its survival may calculate that domestic terror attacks on US soil are now worth the residual risk, as a demonstration of continuing capability and a tool for pressuring Washington toward a ceasefire.

Not all domestic threat scenarios carry equal probability or consequence. The intelligence community assessment, CIA doctrine, and the historical record of Iranian domestic operations in the West all point to a clear hierarchy of likely threat types — from the most probable (low-sophistication, high-frequency lone actor incidents) to the most consequential (a coordinated, Hezbollah-directed multi-target attack). Understanding this hierarchy matters because it shapes both the appropriate response and the calibration of public concern. Overstating the threat produces panic and distorts policy. Understating it produces complacency and unpreparedness. The honest assessment is that the most likely threats are targeted and low-to-medium casualty; the most dangerous threats are low-probability but genuinely catastrophic.

The Hezbollah Latin America network is not a recent development — it has been building since the 1980s and has been the subject of repeated US Treasury sanctions, DEA investigations, and State Department designations. What has changed in recent years is its scale, organizational maturity, and the formalization of state backing through Venezuela. The DEA's Project Cassandra investigation (2015) documented the full scope of Hezbollah's "Business Affairs Component" — a dedicated financial crimes unit that launders narcotics proceeds through a global network of shell companies, money services businesses, used car dealerships, and free trade zones. The investigation found that Hezbollah's BAC had processed hundreds of millions of dollars annually in narco-proceeds, returning funds to Hezbollah's treasury in Lebanon and ultimately to Iran's IRGC Quds Force.

Venezuela is the geographic nexus of this network in the Western Hemisphere. Under Nicolas Maduro, Venezuela has become what the Foundation for Defense of Democracies calls "a forward operating base for China, Russia, and Iran in the Western Hemisphere." Maduro and senior Venezuelan officials personally lead the Cartel de los Soles — formally designated as a Foreign Terrorist Organization by the US State Department in late 2025. The Cartel provides material support to both Tren de Aragua and the Sinaloa Cartel. Maduro's former spy chief, General Hugo Carvajal, has pleaded guilty to narco-terrorism charges and confirmed that the relationship between Venezuelan state apparatus, Hezbollah, FARC, and Tren de Aragua is not merely symbiotic — it is operationally integrated. The cartel is not just a drug network. It is a state-embedded logistics hub for a broader anti-US axis that includes Tehran, Beirut, Caracas, and elements of the Sinaloa organization operating inside the United States.

The most concerning operational implication for the current conflict is simple: the same network that moves cocaine across the US southern border has the capacity and established routes to move people — operatives, weapons components, pre-positioned materiel — across the same border. Hezbollah's goal, in the words of former IRGC analyst Walid Phares, has been precisely to "get to the American and Mexican border." That goal is not aspirational. It has been substantially achieved. The question is whether the people who have crossed — in the estimated 1,750+ Iranian nationals who entered the US illegally during 2021–2024, or in the broader flow of "special interest aliens" from the Middle East flagged by Texas law enforcement — include activated operatives waiting for a signal like the one intercepted on February 28.

The FBI's CI-12 — the Washington, DC-based counterintelligence unit specifically dedicated to tracking Iranian threats on US soil — had approximately a dozen agents and staff fired by Director Kash Patel in the days immediately preceding the February 28 strikes. CNN reported on March 3 that the firings were motivated not by performance failures but by each individual's prior involvement in the Mar-a-Lago classified documents investigation. The operational consequences are straightforward: the unit that would normally be managing real-time tracking of suspected Iranian operatives, coordinating with foreign intelligence services on network mapping, and managing informant relationships within Iranian diaspora communities was depleted at precisely the moment it was most needed. Institutional knowledge about specific individuals, operational methods, and ongoing surveillance does not transfer overnight to replacements.

The DOJ National Security Division context is broader and more damaging. CNN's reporting indicates that the NSD — which prosecutes terrorism and foreign intelligence cases and coordinates between law enforcement and the intelligence community on national security threats — has lost more than half of its employees to firings and resignations since January 2025. The office specifically dedicated to counterterrorism has been particularly hard hit. Senior FBI officials who oversaw counterintelligence and international terrorism efforts have been pushed out. These are the officials who maintain the institutional memory of ongoing investigations, the relationships with foreign liaison services, and the prosecutorial expertise to turn intelligence collection into criminal cases that actually disrupt operational networks.

The DHS partial shutdown adds a third layer to the institutional gap. DHS coordinates the domestic threat picture across federal, state, and local law enforcement, runs the National Terrorism Advisory System, and operates the intelligence fusion center network that is supposed to connect local police departments to federal intelligence on emerging threats. A department operating under a 27-day funding gap, with hiring freezes, deferred contractor payments, and potential staff furloughs, is not operating at full capacity during the period of highest domestic threat in recent memory. Senator Ted Cruz and others have raised the specific concern publicly — that fighting Iranian sleeper cells while DHS is partially shut down is a structural risk that no amount of surge overtime can fully compensate for.

None of this means a major domestic attack is inevitable or even likely. The FBI and JTTF still have substantial capacity, state and local law enforcement are on elevated alert, and the most likely scenarios remain lone-actor and targeted-assassination threats rather than large coordinated attacks. But the calibration matters. The institutional degradation is not a partisan talking point — it is an operational reality that Iran's intelligence services have certainly assessed in their own planning. A sophisticated adversary adjusts its operations based on the perceived defensive capacity of its target. When the defensive capacity is visibly weakened — and when those weaknesses are reported in major US newspapers — the adversary's confidence in its own operations' survivability increases.

The domestic threat landscape is genuinely elevated. It is also genuinely susceptible to manipulation — by politicians seeking to justify policy, by media outlets chasing engagement, and by adversaries who benefit from creating fear disproportionate to actual capability. The responsible analysis requires holding both truths simultaneously: the threat is real and the institutional capacity to address it has been meaningfully degraded, and the most likely scenarios are substantially less catastrophic than the worst-case framings in circulation.

What is confirmed and consequential: MuddyWater pre-positioned inside US networks. An activation signal intercepted. CI-12 gutted days before it was most needed. DOJ NSD depleted. DHS partially shutdown. 18+ Iran-linked plots neutralized since 2020 — demonstrating both the existence of operational capability and the intelligence community's ability, when intact, to detect and disrupt it. Hezbollah-cartel narco-financial integration providing established logistics infrastructure near the US border. Tren de Aragua operating inside multiple US states. These are facts, not speculation.

What is contested or uncertain: Whether the intercepted activation signal has produced actionable operative mobilization. Whether any specific plot against a specific US target is currently in execution. Whether Hezbollah would authorize a mass-casualty attack on US soil given the escalatory risk — even with the changed deterrence calculus post-Khamenei. Iranian analyst Rayan Amiri, himself an Iranian refugee and opponent of the regime, offered a calibration that security analysts broadly endorse: "The sleeper cells linked to the Islamist regime in Iran do exist, but their real scope is far smaller than the terrorist regime claims." Tehran uses the threat of activated networks as a psychological tool — a way of imposing fear and constraint on US policy without necessarily needing to act. The threat and the actual capability are not the same thing.

The most honest summary of the current domestic security picture is this: the probability of a large, coordinated, mass-casualty domestic attack remains low. The probability of a targeted assassination, a lone-actor incident, a cyber attack on critical infrastructure, or a criminal-proxy facilitated attack is meaningfully elevated and rising. The institutional capacity to prevent, detect, and disrupt these threats has been weakened at an inopportune moment. The Hezbollah-cartel infrastructure represents a latent operational capacity that was concerning before the war and is more concerning now. And none of this is being managed with the full institutional resources that would normally be available — because those resources were deliberately reduced in the months before the war that activated the threat.

CJNG is not simply a drug trafficking organization. It is more accurately described as a paramilitary criminal state that controls territory, collects taxes, administers populations, maintains military hardware, and projects force with capabilities that rival small national armies. The DEA confirms it possesses armored vehicles, surface-to-air missile launchers, rocket-propelled grenades, explosive-carrying drones, and .50-caliber Barrett rifles capable of downing military helicopters — as demonstrated in 2015 when CJNG shot down a Mexican Army Cougar helicopter in Jalisco. It has a dedicated special operations group, a strict professional hitman training program, and has fought coordinated multi-state military campaigns against Mexican government forces and rival cartels simultaneously. In March 2025, volunteers searching for missing relatives discovered a CJNG facility outside Guadalajara containing three cremation ovens, 200 pairs of shoes, and hundreds of bone fragments — a facility that functioned as a school for forced recruitment, torture, and desensitization to killing. A Science magazine study estimated CJNG has between 18,000 and 35,000 people under operational control. The Pentagon-briefed JITC-CC director specifically noted that CJNG movements "were unlike those of the Islamic State or al-Qaeda" — meaning their tactical sophistication exceeded conventional terrorist organizations in key respects.

The Iran-Hezbollah dimension of CJNG's network is documented but systematically underreported. Hezbollah has operated across Latin America since the 1980s, using Lebanese diaspora communities as cover for its narco-financial network. The Brookings Institution documented the emerging possibility of a direct Hezbollah-CJNG partnership that would allow cocaine and methamphetamine to flow into Middle Eastern markets while returning proceeds to Hezbollah's treasury and Iran's Quds Force. CJNG's financial arm, Los Cuinis, uses Chinese Money Laundering Networks (CMLNs) — the same financial architecture Iran's IRGC exploits to move money around US sanctions. Canada's February 2025 FTO designation of CJNG specifically noted its links to FARC and the ELN — both organizations with confirmed Hezbollah operational partnerships going back decades. The connection runs: Iran → Quds Force → Hezbollah → Latin American narco-finance → CJNG money-laundering infrastructure → US financial system.

The fact that gives the timing its full strategic weight: CJNG associates, facilitators, and affiliates operate in almost all 50 US states. The DEA states this explicitly in its public cartel profiles. No other cartel has achieved this national penetration. CJNG's franchise model — regional affiliates operating under the CJNG brand in exchange for operational coordination and revenue-sharing — means the organization functions as a distributed network embedded in every major US metro and many rural trafficking corridors. Every US state has CJNG-affiliated individuals who know each other, have established logistics infrastructure, move people and money across borders, and are connected to a global criminal enterprise with paramilitary capabilities and, through the Hezbollah financial network, documented ties to Iran's intelligence apparatus. That is the infrastructure that existed, in all 50 states, on February 27, 2026. And then the war started.

The succession chaos following El Mencho's death is itself a threat variable. El Menchito is serving life plus 30 years in a US federal prison. El Pelon, El Doble R, El Jardinero, and El Sapo are now competing for control. Historically, cartel decapitation operations produce 3–5 years of elevated violence as factions fight for territorial control. But CJNG's franchise model means regional commanders can operate independently without central direction for extended periods. The death of El Mencho does not eliminate CJNG's US operational infrastructure. It throws the organization's command-and-control into transition precisely when the threat environment created by Operation Epic Fury would make that infrastructure most valuable to Iran as a potential proxy activation network.

A destabilized CJNG, with veteran commanders competing for territory and resources and its US affiliate network suddenly lacking clear central direction, is in some ways a more unpredictable domestic threat than a stable CJNG under El Mencho's control. This is the paradox of preemptive decapitation against a distributed franchise network. Whether the administration executed the CJNG strike as deliberate preemptive homeland security positioning — or arrived at the same result through parallel counternarcotics decision-making — the operational consequence is identical: the most capable Iran-adjacent domestic threat network in the United States had its command structure disrupted six days before the threat environment changed fundamentally.

Adams (former CIA targeting officer and national security analyst, former Senior Advisor to the House Select Committee on Benghazi) has been running a continuous intelligence briefing since at least 2023 — most prominently through the Shawn Ryan Show and then, in 2024 and 2025, through broader platforms including Homeland Security Today. Her claims have been controversial and unverified in parts. They have also been repeatedly validated by subsequent events, corroborated in substance by government testimony, and proven to anticipate attack patterns before they occurred.

Since at least 2023, Adams has been delivering what amounts to a running intelligence briefing on the specific attack plans, methodologies, and target profiles of Islamic jihadist sleeper networks inside the United States. Most prominently through the Shawn Ryan Show (which reaches a large national security audience), and then in 2024 and 2025 through broader platforms including Homeland Security Today and major podcast networks. Her claims have been controversial, unverified in parts, and dismissed by some in national security circles. They have also been repeatedly validated by subsequent events, corroborated in substance by government testimony, and proven to anticipate attack patterns before they occurred. The honest assessment is not "believe everything Adams says" or "dismiss her as alarmist." It is that she has been more specific and more accurate about domestic jihadist threat architecture than most official government communications — and the evidence supporting her core framework has accumulated consistently since 2024.

Her central intelligence product describes a coordinated multi-organization plot she contends has been in active development since December 2021, led by Hamza bin Laden — whom the US government claims was killed in 2019, but whom Adams asserts is still alive and serving as Al-Qaeda's current Emir — with support from his brothers and Saif al-Adel. The plot involves coordinating attackers from multiple jihadist organizations — ISIS, Al-Qaeda, AQAP, Al-Shabaab, Taliban elements — into multinational mixed cells of five to ten people each. These cells entered primarily through the Darien Gap, the overland route through Central America that has become the primary irregular pathway for migrants from the Middle East, Africa, and South Asia into the Western Hemisphere. The goal: position all attackers inside the United States for a coordinated, simultaneous, multi-city attack that she characterized in September 2025 as potentially "three times 9/11."

What makes Adams' warnings specifically significant is not any claim to active CIA role. It is that she has been describing a specific, detailed operational picture that has found subsequent corroboration at every significant juncture. Her December 2024 warning about vehicle-based attacks and lone-actor activations preceded the New Orleans Bourbon Street attack (15 killed, January 1, 2025) by less than a month. Her framework about the number of Al-Qaeda-trained fighters on US soil — 1,000-plus in her 2024 estimate — was followed by NCTC Director Kent's December 2025 congressional testimony confirming 18,000 known and suspected terrorists in the country. The NCTC itself issued an operational warning about heightened Al-Qaeda and ISIS domestic attack risk at nearly the same time Adams was describing the threat publicly. The pattern is not coincidence. It is a signal.

Adams' September 2025 appearance on the Clay Travis and Buck Sexton Show, titled "Three Times 9/11," updated her intelligence product with new specifics: the attack had evolved to target 12 airliners simultaneously, had expanded its cell structure through family marriage networks in ways that make traditional HUMINT more difficult, and had exploited what Adams described as America's own evacuation pipelines — the operational channels, including the chaotic Afghanistan withdrawal, that inadvertently provided cover for the movement of operatives who presented as allies, refugees, or translators. The "three times 9/11" characterization was not about body count prediction — it was about the scale of simultaneous coordination that Adams assessed the plot had achieved.

The critical operational question is whether Adams is describing a plot that is real and imminent, a plot that is real but chronologically uncertain, or a framework that is accurate in structure but potentially inflated in specificity. The honest answer is: the government's own behavior is consistent with the first two interpretations. The NCTC Director is testifying about 18,000 terrorists in the country. The NCTC issued an explicit Al-Qaeda/ISIS attack warning. The FBI is running its counterterrorism assets at 24/7 capacity. The DHS threat bulletin after February 28 explicitly cited the possibility of coordinated multi-site attacks. The official threat posture is consistent with Adams' operational picture, even if official communications are more circumspect about specifics. The government knows what it knows. What it says publicly is a different calculation.

Kent's December 11 testimony before the House Homeland Security Committee was the most consequential public terrorism briefing since the post-9/11 threat assessments. It was delivered alongside DHS Secretary Kristi Noem and FBI National Security Branch Operations Director Michael Glasheen. The three officials presented a threat picture that, taken together, amounts to a comprehensive indictment of the domestic security architecture that was constructed — or more accurately, dismantled — during the previous administration's four years. But the NCTC director's specific number is the one that carries operational weight: 18,000 known and suspected terrorists, in the country, right now, who entered under the Biden administration.

Kent was precise about what 18,000 means and does not mean. These are individuals NCTC positively identified through its database of known and suspected terrorists — people who appeared in intelligence reporting, watchlists, foreign partner databases, or other derogatory holdings before or shortly after arriving in the US. They include approximately 2,000 Afghans brought to the US under Operation Allies Welcome, the Biden-era program that resettled more than 88,000 Afghans following the disastrous withdrawal. Of those 88,000, Kent testified that 2,000 have been identified as having ties to terrorist organizations. He noted the vetting process was functionally impossible: proper vetting required 18 months to two years. Biden's program compressed that timeline to days or weeks. "Biden threw all of that out the window," Kent testified.

The remaining approximately 16,000 known and suspected terrorists in the country entered through various legal pathways — refugee programs, visa applications, asylum requests, parole programs — during a period when immigration screening systems were under maximum stress and when the administration had removed multiple layers of vetting requirements that prior administrations maintained. Kent's 18,000 figure explicitly excludes a separate and significant category: the unknown number who crossed the southern border illegally. During 2021–2024, an estimated 2–2.7 million individuals from countries lacking reliable documentation entered the United States — a figure Kent cited in his testimony. The subset of that number who may have terrorism ties but cannot be positively identified is, by definition, unknown. Kent was explicit: "The number one threat that we have right now, in my view, is the fact that we don't know who came into our country in the last four years of Biden's open borders."

The operational consequence of 18,000 known terrorists in the country is not 18,000 active plots. Most of these individuals have no active operational tasking, no handler contact, and no current plot to execute. Radicalization is not the same as operational activation. Presence is not the same as mobilization. The distinction between a person who has ties to a jihadist group and a person who is planning an attack tomorrow is the core challenge of domestic counterterrorism — and it requires continuous, well-resourced intelligence and law enforcement work to maintain. The problem Kent was articulating is not that 18,000 attacks are imminent. It is that the intelligence and law enforcement community cannot adequately monitor, assess, and disrupt potential operational activity from 18,000 individuals with terrorism ties — not with the degraded institutional capacity described in Section IV, not with the FBI CI-12 unit gutted, not with the DOJ National Security Division at half-strength, and not with DHS operating under a partial shutdown.

The Thanksgiving 2025 attack is the operational proof of concept. Rahmanullah Lakanwal, 29, arrived in 2021 through Operation Allies Welcome. He was vetted to serve as a soldier in Afghanistan — a tactical-level vetting that, as Kent testified, the Biden administration treated as sufficient justification for permanent US residency. On November 26, 2025, Lakanwal allegedly opened fire on two National Guard members near the White House. Army Specialist Sarah Beckstrom, 20, died from her injuries the following day. Staff Sergeant Andrew Wolfe, 24, remains in critical condition. Lakanwal faces first-degree murder charges. He was one person, from a pool of 2,000 Afghans with identified terrorism ties — and a pool of 18,000 total known and suspected terrorists whose whereabouts, current radicalization status, and operational intentions the NCTC, FBI, and DHS are now working to assess simultaneously.

The mathematics of the problem are unforgiving. If 1% of 18,000 known and suspected terrorists are actively operational at any given moment, that is 180 active threat subjects. If 0.1% are at advanced planning stages for an attack, that is 18 potential active plots. The FBI's counterterrorism capacity, even at full strength, can maintain intensive surveillance and active case management on perhaps several dozen subjects simultaneously. The gap between the threat population and the investigative capacity to assess it is the operational environment the United States is operating in as Operation Epic Fury continues, Hezbollah activation signals are intercepted, and CJNG successor factions compete for control of the cartel's all-50-states US infrastructure. This is not a theoretical threat landscape. It is the actual one. As of March 13, 2026.