The Rabbit Hole: Iran’s Reach in the United States

Editor’s Note: On February 28th, the U.S. and Israel launched an air war on Iran, striking multiple targets and killing many of the regime’s top leadership. In response, the Iranian government retaliated through a series of missile and drone attacks on U.S. allies in neighboring countries and obstructing major shipping lanes. The images of the conflict are broadcast in near real-time on national and cable news channels. More than a dozen American service members have been killed since the start of the conflict. And a world of gamified war memes has been unleashed by U.S. government social media accounts. 

While the war’s reverberations are largely felt outside the borders of the United States, the ramifications may soon begin here. The often-used but increasingly tired trope of ‘fight them over there, so we don’t fight them over here’ belies the realities of a long history of Iranian-government-sponsored, supported, and inspired schemes, plots, and attacks in the homeland. In this week’s The Rabbit Hole, we look at past activities by the Iranian government and its intersection with the U.S. criminal justice system to understand how a wounded but still deadly regime may try to respond within America. 

On March 1, less than 26 hours into the U.S.-Israel bombing campaign against the Islamic Republic of Iran, a 53-year-old man wearing a sweatshirt that said, “Property of the Ayatollah,” entered a beer garden within mere minutes of walking distance from the Texas State Capitol Building and the University of Texas at Austin with an AR-15-style rifle. Three people were killed in less than five minutes before police fatally shot the man. The victims who were murdered were all under the age of 31.

Multiple attacks of varying lethality have occurred on U.S. soil since the conflict with Iran began. In Michigan, a 41-year-old man rammed his car packed with flammable liquids and $2,250 worth of fireworks into a synagogue. Four of his family members had died in an apparent Israeli air strike in Lebanon the week before. Early reporting indicates that at least one of those killed was a Hezbollah commander. Like the Austin shooter, the Michigan man appeared not to be on law enforcement’s radar before the attack, save for a passing entry in a government database for his family’s purported overseas terror connections.

In New York City, two men allegedly attempted to detonate homemade explosives during a protest outside of Gracie Mansion, the official mayoral residence. When one of the purported bombers was asked why, he reportedly responded, “ISIS.” In Virginia, an ISIS supporter, who had already been sentenced to over a decade for terrorism charges, killed an ROTC instructor at Old Dominion University before a group of ROTC students heroically subdued him. Finally, in the cyberspace, a group of hackers infiltrated Stryker, a U.S.-based manufacturer of medical equipment, in retaliation for a deadly U.S. strike on an elementary school in Southern Iran.

The war with Iran has led U.S. national security into uncharted territory. Never before has the United States engaged in direct hostilities with a country that has a network of sympathetic terror organizations and supporters as significant as the Iranian regime. With its traditional military assets under fire and its leader of almost four decades assassinated, the Islamic regime has largely turned to asymmetric warfare—so far in the Strait of Hormuz and Persian Gulf states—as a desperate means of survival. 

Iran’s leaders hope that making the economic and political costs of the war as painful as possible for the United States and its allies will pressure the U.S. to end the war, even with Iran’s theocracy still intact. That strategy will likely extend beyond the Persian Gulf, threatening the domestic security of the United States and its allies. Already, on March 6, four men were arrested by British authorities for allegedly spying on Jewish communities in London on behalf of Iran.

Iranian covert operations are not a hypothetical in the United States. Through economic warfare, political influence schemes, and assassination plots, the Islamic regime has tried to exert its power in the U.S. for the past several decades. Up until now, however, many of these operations have been largely unsuccessful, with some falling to the U.S. criminal justice system. These cases now give insight into how Iran runs its international network of terror and the characteristics of attacks that the Islamic Republic may resort to with its survival at stake.

A week into the conflict, the Justice Department made its move against the fleet of oil tankers and containerships Iran uses to facilitate trade while contravening U.S. sanctions. On March 6, the U.S. Attorney’s Office for the District of Columbia filed two civil forfeiture complaints that would seize an eye-popping $14.4 million. The target of the complaints was Mohammad Hossein Shamkhani, the unofficial head of Iran’s oil shipping network and the son of Ali Shamkhani, a top political advisor to Supreme Leader Ali Khamenei and the head of Iran’s National Defense Council. 

The ubiquity of the American economy and its technology, banking, and commerce sectors allows the U.S. government to impose far-reaching sanctions that can cripple a nation’s economy. Ever since the Islamic regime signaled its intent to develop a nuclear weapon, Iran has faced a sustained architecture of sanctions imposed by the U.S. and many of its allies in the West. The level of sanctions makes it practically impossible for Iranian companies to do business in the U.S. and the rest of the world that depend on U.S.-based economic institutions, save for China. So when an Iranian company tries to, or uses a front company based in another country, in an effort to avoid U.S. scrutiny, the U.S. government comes for the money when it can.

With Shamkhani’s fleet of oil tankers, federal investigators uncovered a system of dozens of shell companies based in other countries used to ship sanctioned Russian and Iranian oil. Shamkhani was detailed enough to categorize each vessel into “green,” “gray,” and “black,” with the colors corresponding to the level of risk that a vessel could be targeted by sanctions. “Green” vessels had clean accounting records and were considered able to operate openly in international trade, whereas “black” ships could be directly tied to Iran. According to one seizure notice, Shamkhani’s fleet was profitable in the billions of dollars, $14.4 million dollars of which was seized from accounts at U.S. banks. His father, Ali, was killed in the same strike that assassinated Ayatollah Khamenei.

The other side of the sanctions architecture means that not only can Iranian companies not do business with the U.S., but American companies can’t sell to individuals or organizations in Iran. In the banking world, this has led to cases in which two defendants essentially acted as an exchange bank, allegedly processing checks into large amounts of U.S. currency from people in Iran. Others have reportedly gone to great lengths to funnel American products to Iran that are both mundane and practical, including DNA lab equipment, oil drill rigs, microwave components, cloud infrastructure, oil tankers, computer parts, and cosmetic supplies. U.S. companies that knowingly run afoul of or are negligent in enforcing sanctions can face stiff criminal or civil enforcement.

Attempts to infiltrate U.S. industry have also been more nefarious, with direct ties to Iranian intelligence, its formal military, or the Islamic Revolutionary Guard Corps (IRGC). In 2025, a former IRGC officer living in the U.S. admitted to using his position at a U.S. company, where he worked on a contract with the Federal Aviation Administration, to turn over sensitive data about U.S. air traffic control systems to Iranian intelligence. Another case from 2021 heightened concerns about Iran’s nuclear program when a man smuggled mass spectrometers, which are used in nuclear physics to examine the isotope composition of nuclear material, through Canada, the United Arab Emirates, and into Iran. Last month, three Iranian men living in the U.S. were indicted in California for an alleged scheme to steal trade secrets from Google and other U.S. companies. It was not immediately clear if the Iranian government was involved, but the three had reportedly traveled to Iran and accessed pictures of sensitive company data.

While never hesitating to attempt overt assassination plots on U.S. political figures, Iran has also tried its hand at subtler election interference. In 2020, two hackers for a company that had worked with the Iranian government before reportedly tried to infiltrate 11 state-run election websites, at least one of which was successful, allowing the hackers to download information on more than 100,000 U.S. voters. The hackers also reportedly orchestrated a campaign of phishing attempts on the Trump campaign and Republican members of Congress that sent false messages that Democrats were attempting to commit systemic election fraud. Democratic voters were targeted, as well, as the hackers allegedly sent out emails to tens of thousands of registered voters posing as members of the Proud Boys and threatening violence if they did not vote for President Trump.

Again in 2024, a group of hackers backed by the IRGC’s Quds Force targeted the Trump campaign through email phishing attempts. One of the infiltration attempts into the Trump campaign was successful enough that the hackers uncovered and then subsequently leaked internal campaign communications and a vetting memo on then-vice presidential candidate J.D. Vance. The hackers reportedly created email accounts posing as campaign officials, the wife of a Supreme Court Justice, think tank scholars, and staff at a fake nonprofit organization, among others.

The uptick in cases filed under the Foreign Agent Registration Act in the wake of Special Counsel Robert Mueller’s investigation into Russian activities around the 2016 election also implicated Iran. Kaveh Lotfolah Afrasiabi, a political science professor, was charged in 2021 with operating as a foreign agent on behalf of Iran in order to lobby U.S. government officials and sitting members of Congress over Iran’s nuclear program. Afrasiabi maintained his innocence, but a criminal complaint described him simultaneously advising members of Congress over policy related to Iran’s nuclear program while also giving counsel and receiving money from Iran’s mission to the United Nations. President Biden pardoned him in 2023 as part of a prisoner swap between the U.S. and Iran.

Yet, these cases demonstrate that Iran had little to no impact on influencing U.S. politics despite its intelligence services’ seemingly best attempts. Academic researchers and U.S. intelligence agencies were quick to discover its misinformation campaign in 2020, leading social media companies to limit Iran-created content. Although hackers successfully obtained access to embarrassing material from the Trump campaign in 2024, U.S. media companies—weary of the material’s origin—almost unilaterally refused to report its details. The fact that Iran was behind the hack of a major presidential campaign drowned out the story about the contents of the vetting material on Vance. And as far as Afrasiabi, any efforts Iran allegedly hired him to lobby for, such as lowering sanctions or reaching a more favorable nuclear deal, were essentially wasted, given the conflict today.

This piece is part of our weekly Sunday Series we call The Rabbit Hole where we choose a single federal court docket, filing, or topic and dive deep into the details. You can read past issues on topics ranging from news deserts to the lack of consistent funding for court-appointed defense attorneys on our site. Normally, these Rabbit Hole pieces are behind a paywall to reflect the time and expense associated with their reporting. However, we occasionally make an exception to that rule, like the piece today. If you are not currently a paying member but you’d like to support independent journalism like this, please consider becoming a paid subscriber or making a one-time donation.

Iran’s most insidious threat is its indifference to resorting to violence. After a U.S. drone strike assassinated Qassem Soleimani, the powerful leader of the IRGC’s external Quds Force, in 2021, Iran assembled a hit list of all of the U.S. officials it deemed responsible, including high level officials, such as President Trump, former Secretary of State Mike Pompeo, ex-Chairman of the Joint Chiefs of Staff General Mark Milley, and former National Security Advisor John Bolton. It was a threat that Matt Olsen, the Justice Department’s assistant attorney general for national security during the Biden administration, called “extraordinarily serious” in 2024.

U.S. lawmakers responded to the threat by increasing the money appropriated to the Pentagon and Department of State to $150 million per year dedicated to protecting former U.S. officials on Iran’s hit list. One senior former Pentagon official told Politico, “The Iranians are not good, but they’re very enthusiastic. And of course, they’ve only got to get lucky once.”

On the afternoon of July 28, 2022, a member of the Azerbaijani faction of the Russian mob peered through the windows of a Brooklyn home belonging to Masih Alinejad, an Iranian dissident and a presenter at Voice of America Persian News Network. Alinejad, however, wasn’t there: she had fled the home just minutes before, sensing that something was amiss. According to a criminal complaint, the Azerbaijani hitman had watched her house for two days straight. 

With Alinejad not around the house, the Azerbaijani man drove away before an NYPD officer pulled him over for failing to stop at a stop sign. On the rear seat of the mobster’s car was an AK-47. He initially denied that the gun was his and told officers that he had actually gone to Alinejad’s house in order to rent a room, but the game was up. He later pleaded guilty to attempted murder and testified against two high-ranking members of the Russian mob, who were both sentenced in October 2025 to 25 years in prison for their roles in the plot. It was one of at least three assassination plots orchestrated by the Iranian government that targeted Alinejad.

Iranian intelligence frequently employs criminal organizations to do the regime’s bidding. In Europe, members of the Hells Angels motorcycle gang were hired to intimidate dissidents and Jewish communities. In 2020, Iranian intelligence hired a private investigator to monitor Alinejad for months, while they strategized how to kidnap her to Venezuela without detection by U.S. authorities. And on March 6, an Iranian intelligence agent was convicted of a 2024 murder for hire plot to assassinate Alijenad, as well as a major U.S. political figure who was likely President Trump. The agent had reportedly driven around Brooklyn with a confidential source for the FBI, looking to recruit people for the assassination from local nightclubs. Instead, the FBI arranged for the Iranian agent to meet with undercover FBI agents, whom he paid $5,000 to carry out the plot.

Yet again in 2024, the IRGC’s Quds Force hired Farhad Shakeri, an Afghan man who had moved to Tehran to work in Iran’s oil industry after a stint in New York, to allegedly arrange Alinejad’s assassination. According to a criminal complaint in the case, the IRGC promised to pay Shakeri $1.5 million to kill Alijenad, so he purportedly turned to two friends he met in New York State prison to carry out the hit. In return for $100,000, the men were allegedly set to kill Alinejad, surveilling her house and stalking her at public speaking events.

The plot apparently hit a snag, however, when Shakeri allegedly did not pay the two American men $10,000 up front for the assassination. According to a criminal complaint, the two men texted after months of stalking Alinejad, “I’m screaming my head off ryt now” and “I’m so frustrated son I’m like ready to jump out the window” (SIC). Then, Shakeri appeared to get cold feet shortly after when he contacted the FBI for five voluntary interviews over the phone, apparently hoping that giving them information about the plot to kill Alinejad would allow an acquaintance incarcerated back in the U.S. to shave time off their sentence.

Shakeri reportedly told the FBI that he had been approached by a senior IRGC member named “Majid Soleimani,” who asked him to arrange the plot. Shakeri was apparently reluctant, at first, to turn the two men’s names over to the FBI, but eventually did, likely allowing agents to retrace their steps in the months before following Alinejad’s movements. He then reportedly went on to tell FBI agents that the IRGC member “Soleimani” had tried to pay him $500,000 for the assassination of two Jewish businesspeople in New York City. 

Shakeri also said that, despite having little success to show yet, the IRGC official had later asked him to stop his plot to kill Alinejad and the two Jewish businessmen and begin surveilling President Trump to attempt to assassinate him instead. “Soleimani” purportedly told Shakeri that “we have already spent a lot of money [on plots to assassinate Trump] [s]o the money’s not an issue.”

The final target that the IRGC reportedly discussed with Shakeri was to orchestrate a mass shooting attack targeting Israeli tourists in Sri Lanka in October 2024. Sri Lankan authorities arrested a man whom Shakeri had allegedly hired to surveil the Israeli consulate and a tourist location. Shakeri purportedly recruited the man to carry out the mass shooting after knowing him from prison. The targets that Shakeri described were consistent with other Iranian plots: Jewish communities, Persian dissidents, and officials of adversarial governments.

Iranian operations in the U.S. have been both persistent and arguably haphazard so far. The tactic of relying on third parties to carry out the regime’s dirty work reduces risk to its intelligence assets and has comparatively fewer drawbacks if operations fail. Driving around to clubs in Brooklyn in hopes of hiring hitmen is not the stuff of a John Le Carre novel or a sophisticated intelligence network, especially when the FBI has monitored your every turn.

But the war comes at a perilous time for the FBI’s counterterrorism apparatus and the Justice Department’s National Security Division, which has both lost considerable experience and leadership to firings, reassignments, and resignations. And in an era of lone wolf attacks, Iran does not need to so much as seek out shady hitmen at a nightclub, as much as push a discontent person angry at the state of the U.S. and its foreign policy over the edge. And sometimes, as it appears to be the case in the Austin terror attack, there need not be a forcing hand from the Iranian government but simply a cocktail of anger over events overseas to rile up an individual with a history of mental illness.

Iran and its proxies have traditionally used the United States as a logistics hub, using our financial systems to move money, its operatives to steal sanctioned equipment, and the occasional assassination plot to satisfy hardliners in the regime. But Iran’s past calculus was low-grade operations in the United States, enough to keep the FBI busy but not large enough to trigger serious military consequences. With the latter now already a reality, the Islamic Republic has less to lose by orchestrating bolder attacks. 

With increasingly fewer reasons to self-constrain their actions, operations may shift to prioritize large-scale terror attacks as the regime tries to maximize the pain the U.S. and its allies face during the war. The question becomes whether, under sustained pressure, its operatives and supporters will still have the capacity. Nevertheless, it does not take a team of trained and coordinated operatives to puncture the American public’s sense of security. An armed man who loads his trunk with fireworks and drives directly into a synagogue and a school can have the same effect. 

If the past is a guide to the future, Iranian-backed and inspired operations will be a healthy mix of everything, everywhere, and all at once. 

-30-

This piece is part of our weekly Sunday Series we call The Rabbit Hole where we choose a single federal court docket, filing, or topic and dive deep into the details. You can read past issues on topics ranging from news deserts to the lack of consistent funding for court-appointed defense attorneys on our site.

If you are reading Court Watch for the first time here because you were forwarded the piece, you can subscribe here to get our free weekly Friday roundup of federal court documents in your inbox and our member-supported Rabbit Hole every Sunday.

Finally, if you’d like to support independent journalism like this, please consider becoming a paid subscriber or making a one-time donation.