Full Report
Three days into the Iran war, Iran’s Islamic Revolutionary Guard Corps said the quiet part out loud: The Revolutionary Guard’s Qods Force has long carried out plots around the world and now intended to deploy those capabilities against the U.S. homeland. The United States, a Qods Force statement carried on Iranian television warned, “will no longer be safe”…
Analysis Summary
# Threat Actor: IRGC-Qods Force (IRGC-QF)
## Attribution & Identity
- **Actor Name:** Islamic Revolutionary Guard Corps - Qods Force (IRGC-QF)
- **Primary Attribution:** Islamic Republic of Iran (State-sponsored)
- **Known Associations:**
- Iranian Intelligence and Security agencies
- Terrorist proxies (undisclosed by name, but identified as a general cadre)
- Criminal "cutouts" (hired for deniability)
- **Aliases:** Qods Force, Quds Force, IRGC-QF
## Activity Summary
- **Current Objective:** Threatening the U.S. homeland and Americans abroad following the outbreak of war.
- **Threat Proclamation:** On May 3, 2026, the IRGC-QF issued a televised statement declaring that the U.S. "will no longer be safe" and that "happy days are over."
- **Recent Operations:** While the article notes a lack of successful reported homeland plots in the immediate two months of the conflict, it highlights that Iranian-linked plots have been thwarted globally during this period.
- **Historical Context:** Investment in a long-standing "homeland option," intended to provide strike capabilities within the United States.
## Tactics, Techniques & Procedures
- **Proxy Warfare:** Utilizing external terrorist groups to execute operations for plausible deniability.
- **Criminal Outsourcing:** Hiring criminal elements as "cutouts" to carry out kinetic attacks or surveillance.
- **Global Plotting:** Executing plots in third-party countries to pressure the U.S. and its allies.
- **Psychological Operations:** Use of state media and televised warnings to incite fear and signal intent.
- **Surveillance of Targets:** Long-term "investment" in identifying pathways and targets within the U.S.
## Targeting
- **Sectors:** Government, Law Enforcement, Defense.
- **Geography:** United States (Homeland), and global interests where Americans reside.
- **Victims:** High-profile individuals, government officials, and potentially soft targets (referred to as "homes").
## Tools & Infrastructure
- **Malware:** Not specifically mentioned in this kinetic-focused report.
- **Hardware:** Drone technology (noted as being supplied via Chinese factories to Iran).
- **Infrastructure:**
- Iranian State Television (for dissemination of threats).
- Foreign drone manufacturing facilities.
- Defanged Reference Check: hxxps[://]threatbeat[.]com/adversaries/between-intent-and-capability-assessing-the-lack-of-iranian-attacks-on-the-u-s-homeland/
## Implications
- **Strategic Intent:** Iran maintains a "homeland option" as a deterrent and a retaliatory mechanism.
- **The Gap:** There is currently a notable gap between Iran’s stated *intent* (expressed through public threats) and their *demonstrated capability* (lack of successful homeland attacks in the current conflict window).
- **Threat Assessment:** The threat remains high/elevated. The absence of current attacks may be due to successful disruptions by federal authorities (FBI/DHS) rather than a lack of intent by the actor.
## Mitigations
- **Heightened Situational Awareness:** State and local law enforcement should remain on "elevated threat" alert as advised by the FBI.
- **Inter-Agency Cooperation:** Continued mobilization of the FBI and DHS to address and disrupt potential sleeper cells or criminal cutouts.
- **Critical Infrastructure Protection:** CISA recommendations for critical organizations to prepare for potential cyber outages or kinetic disruptions.
- **Supply Chain Security:** Monitoring and sanctioning the procurement of drone parts and dual-use technologies.