Iran’s Cheapest Soldiers Were Already Inside the Gulf

RIYADH — While missiles arc across the Persian Gulf and air defense batteries fire through the night, a quieter conflict is unfolding inside the six nations Iran has sworn to punish. Kuwait announced on March 26 that it had foiled a Hezbollah-linked plot to assassinate senior state leaders, arresting six operatives who had received advanced military training abroad in weapons, explosives, and surveillance techniques. Fourteen more suspects remain at large, including two Iranian nationals and two Lebanese citizens. The plot is the most significant covert operation uncovered in the Gulf since the Iran war began on February 28, and it confirms what intelligence officials across the region have feared since the first American cruise missile struck Isfahan: the war above the skyline is matched by a shadow war below it.

Four Gulf states have now publicly disclosed the disruption of Iranian-linked covert cells since the conflict began. Qatar arrested ten IRGC operatives on March 3. The UAE dismantled a Hezbollah-Iran terror network on March 20. Bahrain has detained individuals leaking military coordinates to Tehran. And Kuwait has uncovered two separate Hezbollah-linked cells in under three weeks. The pattern reveals a coordinated Iranian campaign to wage war from within the borders of the very nations its drones and missiles are striking from without. Analysis of public disclosures, court filings, and intelligence assessments from the Combating Terrorism Center at West Point, the Foundation for Defense of Democracies, and Gulf interior ministries reveals at least 45 individuals detained across four countries, with networks spanning espionage, sabotage, assassination, and real-time battlefield intelligence. The Gulf states spent an estimated $130 billion on air defense systems over the past decade. The threat that may matter most costs Iran almost nothing.

What Was the Kuwait Assassination Plot?

Kuwait’s Ministry of Interior disclosed on March 25-26, 2026, that security forces had arrested six individuals affiliated with Hezbollah who were planning assassinations targeting “symbols and leaders of the state.” The operatives had confessed during interrogation to receiving advanced military training abroad from Hezbollah operatives, including instruction in the use of weapons and explosives, surveillance techniques, and assassination methodologies, according to an official statement carried by the Kuwait News Agency.

The cell’s composition underscores the cross-border nature of the operation. Five of the six arrested are Kuwaiti nationals, while the sixth holds a different nationality that authorities have not publicly specified. More alarming is the scale of the broader network: fourteen additional suspects remain at large outside Kuwait, including five Kuwaiti nationals, five individuals whose Kuwaiti citizenship has been revoked, two Iranian nationals, and two Lebanese nationals. Bloomberg reported on March 25 that Kuwaiti authorities had arrested additional suspects beyond the initial six, bringing the total detained since the war began to more than ten individuals linked to the same network.

The plot carries echoes of Hezbollah’s violent history in Kuwait. In April 1988, hijackers affiliated with Hezbollah seized Kuwait Airways Flight 422 and killed two Kuwaiti passengers. In the 1980s, a series of bombings in Kuwait were attributed to the group. The 2015 Abdali Cell case, in which 26 individuals were convicted of spying for Iran and Hezbollah and stockpiling weapons including explosives, rocket-propelled grenades, and ammunition, demonstrated that the organization maintained active infrastructure within the country long before the current war.

Kuwait expelled Hezbollah’s representatives and proscribed the organization on March 2, 2016, alongside the GCC and the Arab League. A decade later, with Iranian missiles striking Kuwaiti territory, the group’s networks have reactivated with operational objectives that go far beyond intelligence gathering. The shift from espionage to assassination marks a qualitative escalation in Tehran’s shadow campaign against the Gulf states.

How Did Qatar Uncover Two IRGC Spy Cells?

Three weeks before the Kuwait arrests, Qatar announced the detention of ten suspects linked to two separate cells operating on behalf of Iran’s Islamic Revolutionary Guard Corps. The arrests, disclosed on March 3-4, marked the first time Qatar had publicly acknowledged disrupting IRGC operations on its soil, a revelation that strained what had been one of the Gulf’s more complex bilateral relationships with Tehran.

The two cells had distinct operational mandates. Seven operatives were assigned to espionage, specifically tasked with surveilling “vital and military facilities” inside Qatar. Investigators recovered high-resolution photography equipment, coordinates of sensitive installations, and encrypted communications devices from the cell members. The remaining three operatives had a more direct brief: sabotage. These three had received training in the use of drones, according to the Qatar News Agency, raising the possibility that they were intended to conduct kinetic operations against Qatari infrastructure from within the country’s borders.

The timing of the arrests carries particular significance. They came just days after Iran launched its first strikes against Qatar on February 28, including attacks that targeted al-Udeid Air Base, the largest American military installation in the Middle East, and Ras Laffan Industrial City, the hub of Qatar’s liquefied natural gas empire. Energy Minister Saad Sherida al-Kaabi subsequently confirmed that 17 percent of Qatar’s LNG exports had been disrupted, with damage that could take three to five years to repair, according to Reuters.

The espionage cell had almost certainly been mapping targets well before the war began. Al Jazeera reported that the arrested operatives admitted during interrogation to their affiliation with the IRGC and confirmed they had been tasked with espionage and sabotage missions. The cell members used encrypted software to transmit images and coordinates back to IRGC handlers, a methodology consistent with Iran’s broader pattern of pre-positioning intelligence assets in countries it considers potential adversaries.

Qatar’s relationship with Iran has historically been more pragmatic than confrontational. The two countries share the world’s largest natural gas field — South Pars on the Iranian side, North Field on the Qatari side — and Doha maintained diplomatic relations with Tehran even during periods of regional isolation. The discovery of IRGC cells on Qatari soil has fundamentally altered that calculus, transforming what had been a relationship of mutual economic convenience into one of existential suspicion. Qatar’s participation in the six-nation ultimatum to Baghdad over Iraqi militia attacks signals the depth of this strategic realignment.

The UAE Network That Hid Behind Shell Companies

On March 20, the UAE’s State Security Apparatus announced it had dismantled a terrorist network funded by Lebanon’s Hezbollah and Iran. The network’s operational model differed markedly from the espionage cells uncovered in Qatar and the assassination plot foiled in Kuwait. Rather than relying on recruited agents or pre-positioned sleeper operatives, the UAE cell embedded itself within the country’s commercial infrastructure, operating under what authorities described as “fictitious commercial cover” designed to infiltrate the national economy.

The network’s dual mandate encompassed both financial and security objectives. In coordination with Hezbollah and Iran, the cell conspired to launder money, finance terrorism, and threaten national security, according to the UAE State Security Apparatus statement carried by Gulf News. The use of shell companies as cover suggests a level of sophistication and longevity that distinguishes this operation from the more recently activated cells in Qatar and Kuwait. Establishing credible commercial entities requires time, capital, and documentation — resources that indicate the network may have been in place for years before the war provided the catalyst for its exposure.

Hezbollah denied the accusations on the same day, calling them “utterly untrue and baseless.” The denial followed a pattern: Hezbollah issued a “categorical denial” of Kuwaiti accusations on March 17, describing them as “entirely baseless fabrications.” The group has consistently denied maintaining operational cells in the Gulf, even as courts in multiple GCC states have convicted its affiliates of espionage, weapons smuggling, and terrorism-related offenses over the past decade.

The UAE’s counter-terrorism infrastructure has evolved significantly since 2014, when Abu Dhabi became the first Gulf state to proscribe Hezbollah. In April 2016, a federal security court convicted three defendants tied to Lebanese Hezbollah. The current operation suggests that despite these earlier disruptions, the group maintained the capacity to rebuild networks within the Emirates, adapting its methods from traditional cell structures to financial integration — a form of hybrid warfare that blurs the line between organized crime and state-sponsored terrorism.

Why Is Bahrain the Gulf’s Most Vulnerable State?

Among the six GCC nations, Bahrain occupies a uniquely precarious position in Iran’s shadow war. The tiny island kingdom, ruled by the Sunni Al Khalifa family, has a population that is approximately 70 to 75 percent Shia, according to estimates from the Brookings Institution and the Congressional Research Service. This demographic reality has made Bahrain the most fertile ground for Iranian proxy recruitment in the Gulf for more than four decades.

Since 2011, Iran and its proxy militias in Lebanon and Iraq have undertaken what the Combating Terrorism Center at West Point describes as “an unprecedented effort to develop militant cells in Bahrain.” The evolution has been alarming: cells that began as “easily detectable groups of amateurs” have matured into “small cells of attackers with overseas training and combat experience and the ability to mount effective IED attacks.” The IRGC’s methodology involves recruiting hardline members of the Shia opposition, transporting them to training bases outside Bahrain, and reinserting them as cell leaders trained in guerrilla warfare and capable of carrying out attacks on public facilities and civilian populations.

The Al Ashtar Brigades, designated by the US State Department as a terrorist organization, remains the most prominent Iran-funded militant group in Bahrain. The group has claimed responsibility for multiple attacks on Bahraini security forces and has explicit links to IRGC weapons and training pipelines. During the current war, Bahrain has endured 385 Iranian strikes according to Bahraini military reporting, and the discovery that internal cells may be providing targeting data to Iranian forces has added an acute intelligence dimension to what was already the Gulf’s most precarious security environment.

Bahrain’s vulnerability extends beyond demographics. The kingdom hosts the US Navy’s Fifth Fleet at Naval Support Activity Bahrain, making it both a high-value intelligence target for Iran and a beneficiary of American security guarantees. The proximity of critical military infrastructure to a population with historical grievances against the ruling family creates a unique challenge that no amount of air defense technology can resolve. The question facing Manama is whether its internal security apparatus can distinguish between legitimate political dissent and Iranian operational activity — a distinction that has eluded Bahraini authorities for decades.

Who Is Filming Iranian Strikes Before They Hit?

Perhaps the most disturbing evidence of Iranian penetration emerged not from official arrest announcements but from social media. Across multiple Gulf states, videos have circulated showing Iranian drone and missile strikes on their targets — filmed from the ground, at close range, and in some cases before official authorities announced any attack had occurred. The Jerusalem Post and The Media Line reported that these videos are uploaded to platforms including X and Instagram immediately after strikes, documenting the moments of impact with a precision that suggests foreknowledge of both the target and the timing.

The operational implications are severe. Filming a strike before it hits requires advance knowledge of the target coordinates, the approximate time of impact, and a position close enough to capture the footage but far enough to survive the detonation. This is not opportunistic bystander footage. It constitutes real-time battlefield intelligence, confirming to Iranian military planners that their munitions reached their intended targets and providing visual damage assessment that can inform subsequent targeting decisions.

Shia cells operating inside Gulf states have been providing Tehran with coordinates of military sites, filming defensive military activities, and documenting the results of Iranian ballistic missile and drone operations, according to reporting by the Jerusalem Post. Several Gulf states, including Bahrain, Kuwait, and Qatar, have arrested individuals on espionage charges linked to this activity. The arrested operatives possessed high-resolution photography equipment, location data for sensitive facilities, and communications devices configured for encrypted transmission to IRGC handlers.

A separate investigation by National Security News revealed how the IRGC has exploited MTN-Irancell’s telecommunications connections in Gulf countries to enhance its targeting chain. The method represents a convergence of signals intelligence and human intelligence that the Gulf states’ security services were poorly configured to detect before the war began. Traditional counter-espionage focuses on foreign nationals with diplomatic cover or intelligence backgrounds. The individuals filming strikes for Iran appear to be residents — in some cases citizens — of the countries they are operating against, making them far harder to identify and far more dangerous to confront.

The Encrypted Signal That Followed Khamenei’s Death

On March 9, 2026, US intelligence agencies disclosed that they had intercepted encrypted communications believed to have originated in Iran that may serve as “an operational trigger” for sleeper assets positioned outside the country. A federal government alert sent to law enforcement agencies cited preliminary signals analysis of a transmission “likely of Iranian origin” that was relayed across multiple countries shortly after the death of Ayatollah Ali Khamenei in the US-Israeli strike on February 28.

The intercepted transmission was encoded and appeared destined for “clandestine recipients” who possess the encryption key, according to the alert reported by ABC News and Anadolu Agency. The signal could “be intended to activate or provide instructions to prepositioned sleeper assets operating outside the originating country.” Federal officials stated there was “no operational threat tied to a specific location” at the time of the disclosure, but the appearance of the encrypted transmissions forced law enforcement into “heightened situational awareness.”

The communications method itself carried significance. The transmission used radio broadcast frequencies that bypassed internet and cellular networks, a technique associated with Cold War-era numbers stations and modern covert communication protocols designed to resist electronic surveillance. Law enforcement agencies were instructed to monitor for suspicious radio-frequency activity as analysts worked to determine whether the broadcasts were linked to operational directives or constituted a less specific form of organizational communication.

The timing of the transmission — immediately following Khamenei’s death — suggests it may have been part of a pre-planned contingency protocol. Iran’s intelligence services, particularly the IRGC’s Quds Force, have historically maintained what Western intelligence agencies describe as “stay-behind” networks in countries across the Middle East, designed to activate in the event of a major escalation or a decapitation strike against Iran’s leadership. The Kuwait assassination plot, the Qatar espionage cells, and the UAE financial network may represent fragments of a much larger activation triggered by the signal that followed the supreme leader’s death.

The Gulf Internal Threat Matrix

The pattern of Iranian covert operations across the GCC reveals not a uniform threat but a differentiated campaign tailored to the specific vulnerabilities of each target state. An assessment of publicly disclosed intelligence operations, demographic factors, historical proxy activity, and critical infrastructure exposure produces a framework for understanding which Gulf states face the greatest internal risk — and where the next disruption is most likely to occur.

The matrix reveals a clear gradient of vulnerability. Bahrain’s combination of a large Shia majority, a proven IRGC recruitment pipeline, and extreme infrastructure concentration on a small island makes it the Gulf state most susceptible to internal disruption. Kuwait and Qatar face high risk due to recent confirmed cell activity and the presence of critical military and energy infrastructure. The UAE’s more advanced surveillance state and diversified geography provide partial mitigation, though the sophistication of the financial network dismantled in March suggests that even the Gulf’s most capable security services face gaps. Saudi Arabia’s risk profile is elevated but partially offset by the Presidency of State Security’s extensive domestic intelligence capabilities and the geographic separation of its Shia population from central government infrastructure.

Oman represents the outlier. Its Ibadi Muslim majority provides limited sectarian leverage for Iranian recruitment, and Muscat’s historically neutral relationship with Tehran has given Iran less incentive to develop covert networks within the Sultanate. Should Oman’s neutrality erode — as it has shown signs of doing under sustained Iranian attacks on neighboring states — this calculus could shift rapidly.

Saudi Arabia’s Presidency of State Security

Saudi Arabia’s response to the internal threat has been shaped by a security architecture that Mohammed bin Salman restructured specifically to confront this category of risk. In July 2017, the Crown Prince created the Presidency of State Security by merging the counter-terrorism and domestic intelligence services under a single institutional roof. The new body consolidated the General Investigations Directorate (the Mabahith, Saudi Arabia’s domestic intelligence agency), the Special Security Force, the Special Emergency Force, security aviation, the National Information Center, and departments responsible for combating terrorism and financial investigation.

The Presidency of State Security is headed by Abdul Aziz bin Mohammed Al-Howairini, who holds ministerial rank and reports directly to the king. The agency serves as Saudi Arabia’s official representative to the International Center for Targeting Terrorism Financing, established in 2017 in collaboration with the United States and the GCC. Its mandate encompasses all matters related to state security, from counter-terrorism operations to financial investigations tracing the funding pipelines that sustain proxy networks.

Saudi Arabia has not publicly disclosed arrests of Iranian-linked cells since the war began, a silence that intelligence analysts interpret in two ways. The optimistic reading holds that the Mabahith’s decades of experience monitoring the Eastern Province — home to the majority of Saudi Arabia’s estimated two to three million Shia citizens — has enabled pre-emptive disruption of any networks before they could activate. The less optimistic reading notes that Saudi intelligence agencies have historically avoided public disclosures that might draw attention to internal vulnerabilities, particularly in the Eastern Province where most of the Kingdom’s oil infrastructure is concentrated.

The Brookings Institution has documented Iran’s efforts to exploit Shia grievances in Saudi Arabia’s Eastern Province, where systemic socioeconomic marginalization has persisted since the founding of the Saudi state in 1932. While the majority of Saudi oil reserves are located within the Eastern Province, the Shia minority has historically received disproportionately limited benefit from the country’s petroleum revenues. This creates a recruitment landscape that Iran has periodically attempted to exploit, though independent analysis from the Arab Center Washington DC and Al Jazeera has emphasized that the roots of Shia unrest in the Gulf are primarily local rather than Iranian-directed.

Mohammed bin Salman’s consolidation of the security apparatus under a single authority represents an institutional acknowledgment that the Kingdom’s internal threats require coordinated intelligence, counter-terrorism, and financial investigation capabilities operating under unified command. Whether that architecture has been tested by Iranian proxy operations during the current war remains, for now, a classified question.

The Crackdown Trap

The conventional response to the discovery of Iranian sleeper cells is straightforward: identify, arrest, and dismantle. Every Gulf state that has disclosed cell disruptions has framed its actions within this paradigm of decisive counter-terrorism. The approach is politically satisfying and operationally logical. It is also, in a critical respect, exactly what Tehran wants.

Iran’s proxy strategy in the Gulf has always relied on a fundamental asymmetry that extends beyond the military domain. The IRGC does not need to recruit large numbers of operatives to achieve its objectives. It needs to create an environment in which Gulf governments treat their own Shia populations as potential adversaries. Every mass arrest, every citizenship revocation, every security sweep through a Shia neighborhood reinforces the narrative that Sunni-ruled states regard their Shia citizens as an Iranian fifth column rather than legitimate members of the national community. The crackdown becomes its own recruitment tool.

This dynamic is most acute in Bahrain, where decades of security operations against Shia opposition groups have created a cycle that Western analysts at the Royal United Services Institute have described as a self-reinforcing spiral. Legitimate political grievances are treated as security threats. Security responses generate new grievances. Iran positions itself as the protector of an oppressed community, offering training, funding, and ideological purpose to individuals whose primary motivation may be domestic rather than geopolitical.

The evidence supports this reading. The West Point Combating Terrorism Center’s analysis of Bahraini militant cells found that the evolution from amateur networks to sophisticated operational units was driven in part by the security environment itself. As Bahraini authorities intensified their response, the remaining operatives became harder to detect, more operationally experienced, and more deeply committed to their cause. The cells that survived the crackdowns were, by definition, the most capable and the most dangerous.

Saudi Arabia faces a version of this dilemma in the Eastern Province, where the distinction between legitimate Shia political activism and Iranian-directed espionage has never been clean. The Kingdom’s military performance during the current war has demonstrated unexpected institutional capacity, but internal security presents a fundamentally different challenge. A Patriot battery can distinguish between a friendly aircraft and an incoming ballistic missile. A security service cannot always distinguish between a citizen who opposes government policy and a citizen who is transmitting coordinates to the IRGC. The cost of getting that distinction wrong — in either direction — is measured in lives.

From the Abdali Cell to Operation Epic Fury

The current wave of cell disruptions did not emerge from a vacuum. Iran’s proxy infrastructure in the Gulf has been built, discovered, dismantled, and rebuilt in a cycle that spans more than four decades. Understanding this history is essential to assessing whether the networks exposed since February 28 represent the full extent of Iranian penetration or merely the fraction that Gulf intelligence services have managed to detect.

The first major wave of Iranian proxy activity in the Gulf followed the 1979 Islamic Revolution, when Tehran actively sought to export its revolutionary model to neighboring states. Bahrain, with its Shia majority, was the primary target, but Kuwait also experienced significant Hezbollah-linked violence during the 1980s, including the bombing of the US and French embassies in 1983 and the hijacking of Kuwait Airways Flight 422 in 1988. These operations were conducted by Hezbollah operatives acting on Iranian strategic direction, establishing a pattern of proxy warfare that Tehran has maintained — with varying intensity — for more than forty years.

The second major wave coincided with the Arab Spring in 2011, when popular uprisings across the Middle East created opportunities for Iranian intelligence to recruit among disaffected Shia communities. The Abdali Cell in Kuwait, uncovered in 2015, represented the most significant discovery of this period. Twenty-six individuals, all Kuwaiti Shia except one Iranian national, were convicted of spying for Iran and Hezbollah. Authorities recovered a substantial weapons cache including explosives, rocket-propelled grenades, and ammunition. By January 2016, all 26 had been convicted of acts aimed at undermining Kuwait’s national security.

The GCC’s collective response to the Abdali Cell included designating Hezbollah as a terrorist organization in March 2016, a step that formalized what had been an ad hoc approach to the group’s activities. The Arab League followed with its own designation. Individual states intensified surveillance and intelligence sharing, and several expelled Hezbollah-affiliated individuals. These measures disrupted existing networks but did not eliminate the underlying recruitment and operational pipelines that connected Gulf Shia communities to IRGC and Hezbollah handlers.

The current war represents a third wave, qualitatively different from its predecessors. Previous proxy operations were conducted during peacetime or periods of elevated tension. The cells exposed since February 28 are operating during an active military conflict, with Iranian missiles and drones striking Gulf territory daily. The operational tempo has shifted from long-term intelligence gathering to real-time battlefield support, target acquisition, and — in the case of the Kuwait plot — direct kinetic action against Gulf leaders. The intra-Gulf competition that has historically complicated intelligence sharing is being overridden by the shared recognition that Iran’s shadow war threatens all six member states simultaneously.

What Comes Next for Gulf Internal Security?

The six GCC states now face a set of security challenges for which their institutional architectures were only partially designed. Air defense systems, missile interceptors, and naval patrols address the external dimension of Iran’s war. The internal dimension — sleeper cells, proxy networks, financial fronts, and radicalized citizens — requires a fundamentally different set of capabilities centered on human intelligence, community engagement, financial surveillance, and counter-radicalization rather than radar systems and missile batteries.

Three immediate priorities have emerged from the disclosures of the past four weeks. The first is intelligence sharing. The GCC states have historically guarded their domestic intelligence products with a jealousy that rivals their competition over sovereign wealth fund rankings and Vision 2030 benchmarks. The discovery that Iran is simultaneously operating cells across four member states has created pressure for a level of counter-terrorism coordination that the region has never achieved. The joint statement issued on March 25 by the UAE, Qatar, Saudi Arabia, Kuwait, Bahrain, and Jordan — condemning Iran’s attacks and calling on Iraq to halt militia operations — represents a diplomatic expression of this emerging consensus, but operational intelligence sharing remains far more difficult to implement than communiqués.

The second priority is financial counter-terrorism. The UAE network that operated under fictitious commercial cover demonstrates that Iran’s proxy infrastructure extends beyond traditional espionage into the economic fabric of Gulf states. Tracing and disrupting the financial pipelines that sustain these networks requires cooperation between intelligence agencies, financial regulators, and the private sector — a form of whole-of-government response that few Gulf states have institutionalized.

The third priority is the most politically sensitive: addressing the legitimate grievances that create recruitment opportunities for Iranian proxies. Bahrain’s Shia majority, Kuwait’s Shia minority, and Saudi Arabia’s Eastern Province community all have documented histories of political marginalization that predate any Iranian interference. The challenge for Gulf governments is to pursue security operations against genuine Iranian agents while simultaneously demonstrating that Shia citizens are full members of the national community whose rights and interests the state is committed to protecting. The emerging Saudi-Israeli cooperation in the current war adds a sectarian dimension to this balancing act that could further complicate community relations if not managed with exceptional care.

Iran’s shadow war inside the Gulf will outlast the missile barrages and drone swarms that dominate the headlines. When the last ceasefire is signed and the Strait of Hormuz reopens, the covert networks that survived the current crackdowns will still be in place — waiting, watching, and reporting back to handlers who view the Gulf states not merely as adversaries to be struck from afar but as societies to be subverted from within. The Gulf spent a decade preparing for Iran’s missiles. The war that may determine the region’s future is the one being fought in its own neighborhoods.

Frequently Asked Questions

How many Iranian-linked operatives have been arrested in the Gulf since the war began?

At least 45 individuals have been detained across four GCC states since February 28, 2026. Kuwait has arrested more than 16 Hezbollah-linked operatives, Qatar detained 10 IRGC-linked suspects, the UAE dismantled a Hezbollah-Iran financial network with an undisclosed number of arrests, and Bahrain has detained several individuals on espionage charges. The actual number is likely higher, as Saudi Arabia and Oman have not publicly disclosed any arrests.

What is the difference between IRGC cells and Hezbollah cells in the Gulf?

IRGC cells operate directly under Iran’s Islamic Revolutionary Guard Corps, typically focusing on espionage, infrastructure surveillance, and sabotage targeting military and energy facilities. Hezbollah cells are linked to the Lebanese militant group and often focus on financial operations, assassination planning, and political subversion. Both types receive direction and funding from Tehran, but they operate through different command structures and recruitment networks. The Qatar cells were IRGC-directed, while the Kuwait and UAE operations were Hezbollah-linked.

Which Gulf state is most vulnerable to Iranian proxy penetration?

Bahrain faces the highest internal risk due to its Shia majority population of 70 to 75 percent, a proven IRGC recruitment and training pipeline through the Al Ashtar Brigades, extreme infrastructure concentration on a small island, and proximity of the US Fifth Fleet naval base. Kuwait and Qatar also face high risk based on recent confirmed cell activity and the presence of critical military and energy infrastructure that constitutes high-value intelligence targets for Iran.

Has Saudi Arabia arrested any Iranian-linked cells during the current war?

Saudi Arabia has not publicly disclosed any arrests of Iranian-linked cells since the war began in February 2026. The Kingdom’s Presidency of State Security, which consolidates counter-terrorism and domestic intelligence under a single authority, has maintained operational silence on internal security operations. Intelligence analysts note that Saudi security agencies have historically avoided public disclosures that might highlight vulnerabilities in the Eastern Province, where most Saudi oil infrastructure and the Kingdom’s Shia population are concentrated.

What was the encrypted activation signal intercepted after Khamenei’s death?

On March 9, 2026, US intelligence disclosed the interception of encrypted communications originating from Iran that appeared intended to activate prepositioned sleeper assets outside the country. The signal was transmitted via radio broadcast frequencies bypassing internet and cellular networks, and was encoded for recipients possessing specific encryption keys. The transmission was detected shortly after Ayatollah Khamenei’s death in the US-Israeli strike on February 28. Federal officials stated there was no operational threat tied to a specific location but the broadcasts forced heightened monitoring across multiple countries.