Iran War’s Secondary Effects Shape 2026 US Violent Extremism

Executive Summary

The United States (US) will almost certainly remain at heightened threat from physical threat activities conducted by homegrown and domestic violent extremists (HVEs and DVEs, respectively) during the next twelve months. Since the last installation of this report in July 2025, there has been a substantial increase in mass-casualty attacks and attack plots by Islamic State (IS) supporters, assassinations and attempted assassinations of US government officials and high-profile public figures by anti-government and anti-authority violent extremists (AGAAVEs), and multiple plots by anarchist violent extremists (AVEs) to cause substantial damage to facilities using destructive devices.

Coinciding with these trends, the Iran War will almost certainly have significant ramifications for the violent extremism threat landscape in the US over the next twelve months, even if the war has concluded. Based on Insikt Group’s observations to date, Iranian external operations are less likely to be a significant cause of violent extremist threat activity in the US than HVEs and DVEs motivated by the second-order sociopolitical and economic effects of the war. Iran almost certainly intends to guide or inspire HVEs to conduct physical threats in the US on its behalf. However, Iran-nexus physical threat activities in the US during the war have been largely aspirational, reliant on low-sophistication, financially motivated threat actors, and disrupted by law enforcement in the early planning stages of attacks. This likely suggests Iran lacks the capabilities necessary to guide large-scale HVE attacks in the US at present.

In contrast, the second-order effects of the Iran War will almost certainly add to the list of grievances and causes for mobilization popular among a wide swath of US violent extremists, likely increasing the risk of violent extremist physical threat activities during the next twelve months. Specifically, the war surfaced salient domestic and international political issues that have historically mobilized US violent extremists. These controversies include US military involvement in the Middle East; the relationships among the US, Israel, and other Middle Eastern countries; the state of the US economy; and the involvement of specific US private-sector entities in US foreign policy planning and military operations. In addition to motivating violent extremists, these issues will almost certainly influence US political discourse during the 2026 midterm elections in the US; the election cycle itself will very likely drive additional US violent extremist threats in late 2026 and early 2027.

Public- and private-sector organizations face differing levels of violent extremist threats due to their sector, industry, role, associations, and attack surfaces. While different categories of violent extremists employ various TTPs depending on their ideology and objectives, Insikt Group continues to assess that targeted attacks against facilities and high-profile personnel constitute the predominant violent extremist risks to most organizations. Overall, entities associated with US foreign policy decision-making, immigration enforcement, the Israeli government and military, or the provision of critical infrastructure services very likely face heightened risks from violent extremists. Threat intelligence — including features within the Recorded Future Intelligence Operations Platform — can support organizations’ efforts to identify, analyze, and mitigate threats posed by US-based violent extremists.

Key Findings

During the next twelve months:

Background

Insikt Group’s forecast is predicated on its assessments of open-source information on the activities of HVEs and DVEs in the US, including Recorded Future’s extensive index of HVE and DVE communications on various online platforms. During the past twelve months, Insikt Group researchers curated several hundred HVE and DVE sources, adding them to an extensive index of preexisting sources of this type.

This report defines “homegrown violent extremist,” “domestic violent extremist,” and several categories of HVEs and DVEs based on the US Intelligence Community’s definitions and categorizations of threat actors. Periodically, this report uses definitions adopted by Insikt Group subject-matter experts for analytic utility, or in instances where the US government has not officially defined a particular phenomenon or movement. A full list of terms and definitions used in this report is available in Appendix A.

Homegrown Violent Extremists

The HVE threat to the US is very likely at its most severe level since the mid-2010s, during the period following the Islamic State’s rise to power and 2014 offensive to seize territory in Syria and Iraq. Jihadist Salafi HVEs, specifically IS supporters, very likely remain the most likely HVE threat actors to conduct mass-casualty attacks, despite a very likely resurgent threat from HVEs tied to Iran and its “axis of resistance” groups. While both jihadist Salafi HVEs and Iran-nexus HVEs almost certainly have the intent to conduct attacks in the US, we judge Iran-nexus HVEs have more limited capability to do so, due to a very likely smaller number of HVEs who support Iran or its “axis of resistance.”

Despite the June 17, 2026, memorandum of understanding (MoU) that established a ceasefire between the US and Iran, Iran’s military and intelligence agencies, proxy groups, and sympathizers in the US will very likely continue their efforts to guide physical threat activities on US soil, albeit with a greater focus on maintaining plausible deniability. The Iran War and the deaths of several notable members of Iran’s clerical and military leadership almost certainly removed most of the limits to Iran’s intent to target the US by proxy. However, Iran has not yet publicly demonstrated that it possesses sophisticated capacities to engage in physical threat activities on US soil. Observed plots during the Iran War involving Iran-nexus US-based physical threat actors have been largely aspirational, unsuccessful, and reliant on financially motivated (as opposed to ideologically motivated) threat actors.

While not direct participants in the conflict, IS, al-Qaeda, and other foreign terrorist organizations are likely to leverage second-order developments in the Iran War to further recruitment and radicalization of US HVEs. During the past three years, these groups have almost certainly positioned previous shifts in the Middle East’s geopolitical environment — notably Israeli military activity in Gaza and Lebanon following Hamas’s October 7, 2023, attack in Israel, the 2024 fall of the Bashar al-Assad regime in Syria, and diplomatic normalization of relationships between Israel and Muslim countries — to support influence narratives, generate propaganda, and reach a new generation of potential supporters. IS, which almost certainly remains at the forefront of the global jihadist Salafi movement, influenced a significant uptick in HVE threat activity in the US during the past twelve months, a dynamic that is very likely to continue in 2026 and early 2027.

HVEs of all varieties are very likely to target entities they associate with the US or Israeli government or military, private sector entities they associate with the US or Israeli government, Jewish communities, and large public gathering places. Most observed plots continue to use low-cost means, such as firearms, knives, incendiary devices, and vehicular attacks. Nevertheless, Insikt Group has monitored efforts by HVEs to share information on improvised explosive device (IED) manufacturing in online forums; there are additionally several known cases during the past year of HVEs successfully manufacturing IEDs for use in attacks. In addition, HVEs almost certainly will continue to experiment with novel tactics, techniques, and procedures (TTPs), including the use of 3D-printed weapons, unmanned aerial vehicle (UAV)-borne IEDs, and generative artificial intelligence (AI) for attack planning.

Iran and Axis of Resistance

The Iran War almost certainly increased Iran-nexus physical threat actors’ motivation to conduct attacks, sabotage, arson, and defacement in the US, as a form of Iran’s asymmetric retaliation against the US. The cessation of direct hostilities between Iran and the US is very unlikely to deter Iran-nexus threat actors from carrying out physical threat activities, although, post-MoU, these threat actors are very likely to pursue more covert and less destructive TTPs. In rank order, the most likely targets of these activities are:

There are almost certainly few remaining strategic or ideological barriers to Iran’s aspirations to guide attacks on US soil, even after the June 2026 ceasefire agreement with the US. While the June 2026 MoU stipulates that Iran must “refrain from interfering in [the US’s] affairs,” it is unclear whether Iran would interpret non-interference to include Iran-nexus physical threat activities. Additionally, Iranian security agencies may choose not to abide by the clause, especially given how the conflict empowered hardliner elements within Iran’s security apparatus and granted them significant autonomy in operational decision-making. Tehran also very likely would not interpret the clause as applying to Iran’s “axis of resistance” groups. Regardless, Iran has attempted to solicit HVEs to conduct attacks in the US for decades, even during periods without direct military confrontation with the US. During the Iran War, the US killed several senior religious and military figures within Iran (including Ayatollah Ali Khamenei); the deaths of senior Iranian leaders have historically been harbingers of Iran-nexus physical threat activity in the US. Since the beginning of the Iran War, senior Shi’a Muslim clerics in Iran have issued rulings encouraging Muslims around the world to avenge Khamenei’s death by targeting the US and Israel. Iran has also leveraged online influence operations networks to recruit individuals to carry out attacks in the US, and has very likely inspired attack plots in the US. Iran will very likely attempt to ensure any post-MoU external operations in the US are deniable and avoid mass-casualty attacks or assassinations of high-profile public figures — to avoid provoking the US — but there almost certainly remain no significant ideological or strategic deterrents to Iranian external operations as a whole.

Regardless of its intent, however, Iran likely lacks access to a significant number of US-based, ideologically sympathetic HVEs, limiting its external operations capabilities in the US. During the last decade, Iranian operators predominantly tied to the Islamic Revolutionary Guard Corps (IRGC) attempted to pay members of transnational criminal organizations (TCOs), petty criminals, and other financially motivated threat actors to conduct attacks in the US. Insikt Group’s observations of Iran-nexus physical threat activity post-February 2026 indicate this threat model did not change due to the Iran War. For instance, in April 2026, a commander of the IRGC’s Iraq-based proxy Kataib Hezbollah (KH) and its external operations-focused persona Islamic Movement of the Companions of the Right (IMCR, also known as Ashab al-Yamin and HAYI) allegedly attempted to recruit a Federal Bureau of Investigation (FBI) undercover officer — whom he believed to be a US-based Mexican TCO member — to conduct attacks on several synagogues in the US, offering the undercover officer $10,000 in cryptocurrency.

A screenshot of a digital statement from the Islamic Movement of the Companions of the Right (IMCR), featuring text and imagery that conveys a direct threat against U.S. President Donald Trump and his family.
Figure 1: April 20, 2026, IMCR statement threatening US President Donald Trump and his family. (Source: Recorded Future)

Especially after the June 2026 MoU, Iran will very likely seek to bolster its ability to recruit HVEs and other physical threat actors in the US and the West by leveraging proxy groups in its “axis of resistance” to ensure plausible deniability. IMCR, which the FBI assesses is a component of KH, claimed responsibility for approximately twenty rudimentary, non-lethal attacks in the United Kingdom (UK), Canada, and Europe between March and May 2026. The group also almost certainly had aspirations to conduct an attack in the US, publicly threatened US President Donald Trump and members of his family (Figure 1), and attempted to recruit US-based persons to conduct attacks on its behalf. However, it is unclear what proportion of these attacks involved HVE recruits rather than financially motivated physical threat actors. European authorities have assessed that most of IMCR’s recruits lacked an apparent ideological motivation. In addition to IMCR, the FBI claimed that a March 12, 2026, attempted truck ramming and shooting at a synagogue in West Bloomfield, Michigan, was conducted by a Hezbollah supporter and inspired by the group’s pronouncements following the beginning of the Iran War.

Islamic State

There has been a notable increase in IS-related arrests in the US during the past twelve months, very likely indicating an enhanced threat from IS-supporting HVEs. From June 1, 2025, to June 1, 2026, the FBI arrested at least twelve US-based individuals who were charged with allegedly supporting IS, a substantial increase from the two cases in the previous twelve-month period.

The almost certain cause of the increase — itself a notable data point regarding the HVE threat to the US — was an October 31, 2025, multistate sweep that resulted in charges against six individuals in Michigan, New Jersey, and Washington who allegedly conspired to conduct an attack on behalf of IS.

Federal law enforcement claims the co-conspirators communicated with a broader, international network of IS supporters using encrypted messaging applications, and purportedly planned to provide material support to IS by either traveling overseas to join the group or conducting attacks in the US. Five Michigan-based co-conspirators allegedly planned to conduct a mass-casualty shooting targeting restaurants, clubs, or bars in Detroit, modeled on the 2015 IS attack on the Bataclan theatre in Paris, France. An FBI investigation reportedly found the suspects had acquired several firearms and ammunition, and discussed conducting their attack either on Halloween (which they referred to using the codeword “pumpkin”) or on New Year’s Eve (referred to as “fireworks”).

In addition to the disrupted multistate IS conspiracy, US law enforcement also claims to have foiled several other efforts by IS-supporting HVEs to conduct attacks on the US during the last twelve months:

IS-supporting HVEs’ enhanced efforts in the US almost certainly correspond to a broader global push by IS to plan attacks in the West during the past twelve months. During this timeframe, Insikt Group has observed IS maintain lines of communication with and among its supporters by developing an elaborate web of propaganda repositories, social media and forum platforms, and messaging outlets, backstopped by Tor mirrors, privacy-maximizing domain registrars and hosts, and end-to-end encryption. In addition to regularly distributed, official media products like Amaq News Agency breaking news updates, weekly al-Naba magazines, audio and video releases from IS’s “provinces,” and audio messages from IS’s senior leadership, HVEs have also frequently distributed content from IS and its supporters encouraging HVEs to conduct physical threat activities in the West, providing instructions on manufacturing weapons, and glorifying IS-linked attackers. IS-supporting HVEs across the world have also experimented with new technologies for planning attacks — particularly the use of unmanned aerial vehicle-borne IEDs.

A screenshot of the website homepage , displaying propaganda imagery and extremist messaging.
Figure 2: Front page of an English-language, pro-IS website registered in October 2025 (Source: Recorded Future)

Based on the patterns of IS-nexus HVE attacks during the past several years, we expect IS-related attack plots targeting large public gatherings and events, hospitality industry facilities, and Christian and Jewish religious facilities will likely increase between approximately October 31, 2026, and January 15, 2027. During the last twelve months, the volume of US IS-related arrests increased during this time period as IS supporters elsewhere in North America, Western Europe, and Australia almost certainly demonstrated their interest in conducting attacks during the “holiday season.” For example, a December 14, 2025, IS-linked attack on a Hanukkah celebration in Bondi Beach, Australia, killed fifteen and wounded at least 40. Four days after the Bondi Beach attack, IS released an article in an edition of al-Naba magazine claiming to have inspired the attack, and urged its supporters to conduct future attacks targeting Jewish and Christian holiday celebrations around the world.

Al-Qaeda

During the past twelve months, al-Qaeda has almost certainly increased its overtures to Americans, encouraging them to conduct attacks in the US on its behalf. However, we still judge al-Qaeda to have a substantially more limited following among US jihadist Salafis than its competitor, IS. Therefore, the frequency and lethality of al-Qaeda-supporting HVEs’ physical threat activities will very likely be lower than those of IS-supporting HVEs.

Throughout late 2025 and early 2026, al-Qaeda in the Arabian Peninsula (AQAP), the organization’s Yemen-based franchise, issued several multimedia publications under the aegis of its flagship English-language magazine Inspire. Since June 2025, at least six Inspire-branded videos, magazines, and short guides detailed violent extremist attacks in the US, the UK, and Australia (even those without tangential connections to al-Qaeda or jihadist Salafism), lauded their perpetrators, encouraged future attacks, and provided instructions on attack TTPs and methods. In conjunction with other al-Qaeda media products, the Inspire publications have almost certainly attempted to leverage popular societal narratives in the US — particularly anti-Israel or pro-Palestinian sentiment — to promote violent extremist attacks against US interests or on US soil.

US federal law enforcement reported one case of al-Qaeda-related HVE activity in the last twelve months. Andrew Scott Hastings, a now-discharged US Army National Guard aircraft powertrain repairer, allegedly attempted to mail 3D-printed firearms components to an individual he believed to be a member of al-Qaeda. In an al-Qaeda online communications channel, Hastings also reportedly offered to send participants classified US Army weapons manuals and training equipment, and stated he was interested in constructing a nuclear weapon. Hastings was charged on September 22, 2025.

Domestic Violent Extremists

DVE subcategories’ differing selections of targets and TTPs have trifurcated the DVE threat landscape in the US, making comparisons between threat actors difficult. White supremacist and neo-Nazi violent extremists remain the most likely DVEs to conduct mass-casualty attacks; AGAAVEs are most likely to conduct targeted attacks against high-profile public figures and executives; and AVEs are most likely to conduct arson, defacement, and sabotage against property and facilities. As a result, the most relevant DVE threats to an organization or entity are likely contingent on its sector, industry, and attack surface. During the next twelve months:

In July 2025, Insikt Group assessed that several categories of DVE threat actors were “likely to increasingly consider conducting targeted, limited-scope attacks against an expanding range of public and private sector personnel,” particularly high-profile government officials, public figures, and business executives. Consistent with this assessment, in September 2025, a lone shooter assassinated political commentator Charlie Kirk at a rally in Orem, Utah. In April 2026, another lone attacker — who allegedly authored a manifesto stating their intent to assassinate multiple US government officials — opened fire on the White House Correspondents’ Association Dinner (WHCAD), before being subdued by US Secret Service personnel.

In making decisions about target selection, DVEs are almost certainly considering a range of domestic political and geopolitical issues, focusing on particular public- or private-sector entities because of their perceived relationship to the issue at hand. In 2025, opposition to US military operations in Iran, the US-Israel relationship, US immigration enforcement policy, and information in files related to the investigation of Jeffrey Epstein were all almost certainly among the paramount issues motivating DVEs to conduct physical threat activities in the US. The Iran War is almost certainly surfacing many of these issues, and its second-order effects throughout 2026 will very likely correlate with DVE physical threat activities motivated, in part, by these drivers.

White Supremacist and Neo-Nazi Violent Extremists

Lone actors and small cells of white supremacist and neo-Nazi violent extremists — particularly neo-Nazi accelerationists — will almost certainly continue to plan and conduct physical threat activities in the US, including mass-casualty attacks. While the overall threat from these actors likely continues to diminish following 2024 law enforcement actions that resulted in the arrest and convictions of prominent neo-Nazi accelerationist leaders and ideologues, movement adherents almost certainly continue to leverage instructional and ideological material produced by these arrested leaders to plan attacks. Most importantly, the dissemination and adoption of neo-Nazi accelerationist content by DVEs and other threat actors will almost certainly continue to influence their target selection, resulting in a persistent, elevated threat to US critical infrastructure; federal buildings; politicians, law enforcement, and judicial officials; racial, ethnic, and religious minorities; and members of the LGBTQIA+ community.

While other ideological substrates and manifestations of white supremacist and neo-Nazi violent extremism remain active in the US, neo-Nazi accelerationist DVEs are likely the only subcategory of the movement that pose a significant risk of conducting mass-casualty attacks. Neo-Nazi accelerationism’s influence has continued despite US law enforcement’s disruption of major DVE organizations like the Atomwaffen Division and the Terrorgram Collective — mainly through these organizations’ literature, which neo-Nazi accelerationists have almost certainly continued to promote and distribute. Core accelerationist texts such as the Terrorgram Collective’s instructional guide series, James Mason’s SIEGE, and Mike Ma’s Harassment Architecture, among others, remain in high demand among neo-Nazi accelerationist DVEs and other physical threat actors.

Artwork with the words Accelerate your hate and a drawing of a soldier with neo nazi sign for eyes holding a gun
Figure 3: Image from a manifesto purportedly authored by the perpetrators of the May 18, 2026, shooting at the Islamic Center of San Diego (Source: Recorded Future)

Many neo-Nazi accelerationist influencers have very likely adopted the doctrine of defensive accelerationism, arguing that the best way to achieve the movement’s goals (engineering the collapse of Western society and replacing it with a white supremacist society) is to form paramilitary groups, train for future military confrontation in a post-collapse environment, and conduct clandestine, targeted attacks against infrastructure and government facilities, while abjuring mass-casualty attacks targeting civilians. Nevertheless, several incidents in 2026 show that these influencers and their ideas likely lack traction among some circles of movement adherents, particularly younger neo-Nazi accelerationists. Most notably, on May 18, 2026, two almost certain neo-Nazi accelerationists conducted a shooting at the Islamic Center of San Diego, killing three. An almost certainly legitimate manifesto authored by these perpetrators referred to the authors as neo-Nazi accelerationists, cited many of the works listed above, and highlighted previous neo-Nazi accelerationist attackers as influences.

In addition, Neo-Nazi accelerationist ideologies very likely continue to influence attempts by DVEs to carry out the movement’s longstanding objective of disrupting US critical infrastructure, specifically the US power grid. On February 19, 2026, an individual drove a rental car into a power grid substation in Boulder City, Nevada, before administering a fatal self-inflicted gunshot wound. In an investigation, law enforcement found the suspect was in possession of several copies of neo-Nazi accelerationist and other DVE literature, including several works encouraging targeting power grid substations as a means to achieve the collapse of society. Investigators also recovered several firearms and materials that could be used to produce an IED.

Neo-Nazi accelerationist ideology, aesthetics, and TTPs also continue to influence physical threat actors who participate in the Com, an international online network of threat actors dedicated to a range of physical and cyber threat activities. While not all of the Com’s participants can be classified as DVEs due to their apparent lack of sociopolitical motivations, DVE threat actors participating in the Com have conducted small-scale physical threat activities using TTPs common among DVEs, including targeted violent attacks against individuals, arson, defacement, swatting, and doxing. In late May 2026, members of several neo-Nazi accelerationist groups who participate in the Com ecosystem — including Maniacs Murder Cult (Маньяки - Культ Убийства, also MMC or МКУ), No Lives Matter, and ETERSSA — joined forces with other physical threat actor groups to form an alliance they refer to as the “World Terror Coalition.” During the past twelve months, this group has claimed responsibility for rudimentary attacks and plots in several countries, including several January 2026 arsons and hoax threats conducted by a 17-year-old in Fort Worth, Texas.

Anti-Government Violent Extremists

Individual AGAAVEs motivated by partisan animus almost certainly constituted the most significant DVE threat to high-profile public figures during the last year. The heightened physical threat environment facing these individuals — particularly US federal government officials — will almost certainly continue to engender instances of online threats, harassment, swatting, doxing, physical approaches, and targeted attacks. In January 2026, the US Capitol Police reported that it investigated 14,938 threats targeting members of Congress in 2025, an increase of approximately 160% over the previous year. A report from the National Counterterrorism Innovation, Technology, and Education Center (NCITE) found 133 federal cases in 2025 involving individuals who threatened public officials. If the trend continues based on data from the last six months, these numbers will almost certainly continue to rise in 2026.

We assess that the AGAAVE threat landscape will continue to be dominated by lone actors, as opposed to small cells or organized AGAAVE groups (such as MVEs), and that the majority of these actors will be motivated by political animus against the current US president, his administration, or government personnel perceived to be aligned with the administration. However, depending on its nature and outcome, the forthcoming 2026 midterm elections may change these dynamics. On a very limited scale, Insikt Group has observed several largely dormant MVE groups engaging in public-facing activities over the last twelve months; their willingness and capacity to conduct a wider range of physical-threat activities over the next year will likely be contingent on specific political outcomes.

AGAAVEs Motivated by Partisan Animus

In 2026, AGAAVEs motivated by partisan animus — particularly those opposed to the current US presidential administration and government — will almost certainly continue to conduct targeted physical threat activities against US government officials. Aside from the September 2025 assassination of Charlie Kirk and the 2026 WHCAD shooting, AGAAVEs in this category frequently attempted to physically harm US government officials during the last twelve months:

Several secondary and tertiary effects of the Iran War will likely augment the frequency of AGAAVE threats to public officials. First, polling data suggests that US involvement in the Iran War is unpopular with a significant swath of the US population; levels of disapproval will very likely intensify if the ceasefire fails and the conflict continues, and will almost certainly intensify if there are further deployments or casualties among US military personnel. The war has negative ramifications for the US economy, particularly regarding oil and gas prices and the affordability of consumer goods. Finally, the war is intrinsically linked to several controversial political issues in the US, such as the US’s foreign policy involvement in the Middle East, its relationship to Israel, and the separation of war powers within the US government. These factors will almost certainly engender a greater degree of public disapproval for US government officials — particularly those directly involved in aspects of the war’s prosecution — thereby increasing the likelihood of AGAAVEs physically targeting those officials.

Moreover, the nature and results of the 2026 midterm elections in the US will likely affect the motivations of AGAAVE threat actors. During previous US election cycles, individual AGAAVEs motivated by partisan animus were the most likely threat actors to conduct physical threat activities targeting election-related personnel, facilities, and infrastructure immediately before, during, and immediately after elections. Insikt Group continues to assess that the following circumstances likely entail indicators and warnings of AGAAVE physical threats around the midterm.

Militia Violent Extremists

Most MVE groups in the US very likely remain locally organized. Despite the early 2025 releases from prison of several leaders of nationwide MVE groups involved in the January 6, 2021, attack on the US Capitol building, the organizations they led — including the Oath Keepers and Proud Boys — have almost certainly not returned to their former strength or frequency of activity. Overall, MVEs generally mobilize to conduct physical threat activities in situations where they perceive the US government is acting inadequately or unjustly on perceived issues of importance, such as Second Amendment rights, immigration enforcement, or land management. During the past year, many MVEs have very likely viewed current US government policies on these issues as adequate and just, and thus have refrained from physical threat activities.

Militia, armed with weapons and wearing Hawaiian shirts and jeans.
Figure 4: Members of the Virginia Kekoas at a January 2026 protest in Virginia (Source: Social media)

However, these dynamics may change as a result of the 2026 midterm elections, particularly if the Democratic Party takes control of one or both houses of Congress or wins significant seats or control of state and local legislatures previously held by Republicans. Insikt Group has observed mobilizations of some MVE threat actors following the 2025 special state and local elections. Notably, since a special election in Virginia in November 2025 that elected a Democratic governor, lieutenant governor, and attorney general to seats previously held by Republicans, the Virginia state government has considered gun control regulations. This led to armed protests in January 2026 by the Virginia Kekoas militia, in which the group’s members wore Hawaiian shirts and displayed imagery popularized by the “Boogaloo” movement five years earlier (Figure 4). Moreover, in May 2026, several self-identified Proud Boys members counter-protested demonstrations at Newark, New Jersey’s Delaney Hall, a US Immigration and Customs Enforcement (ICE) detention facility. These demonstrations — and their clustering in and around states that held gubernatorial elections in 2025 — suggest that MVE networks would likely consider the implications of a potential power shift during the 2026 midterm elections as sufficient motivation to expand their threat activities.

Anarchist Violent Extremists

US AVEs are likely escalating their use of TTPs designed to cause significant damage to the property, facilities, and personnel of public- and private-sector entities. While substantially less likely than other DVEs to plan attacks intended to cause large numbers of human casualties, during the past twelve months, AVEs almost certainly demonstrated increased intent to use IEDs and destructive devices in attacks against facilities. Opposition to US immigration enforcement policies was almost certainly a major driver of AVE activity throughout 2025 and early 2026, and AVE attack plots frequently targeted US government agencies involved in immigration enforcement alongside private-sector entities that AVEs perceived as supporting those agencies. The Iran War and AVEs’ perceptions of its downstream effects on the US-Israel relationship will very likely motivate AVE threat activities in the US.

Several attempted and successful AVE attack plots during the past twelve months showcase the increasingly destructive TTPs employed by AVE threat actors:

Evidence photograph showing a collection of improvised explosive device components and extremist propaganda literature arranged on a surface,
Figure 5: Bombmaking station (left and center) and ideological material (right) allegedly recovered during December 2025 investigation of the Turtle Island Liberation Front (Source: Department of Justice)

During the remainder of 2026 and early 2027, controversies regarding US immigration enforcement policy will very likely mobilize AVEs to conduct a range of physical threat activities, including assault and obstruction during protests, as well as targeted acts of arson, sabotage, defacement, and destruction of US government and private-sector facilities. In 2025 and early 2026, domestic political issues related to immigration enforcement likely outpaced geopolitical developments in the Middle East (particularly regarding Israel) as the primary drivers of AVE threat activities. The presence of AVE threat actors at anti-immigration enforcement protests — such as reports by New Jersey and federal officials that “national extremist groups” were participating in May 2026 demonstrations outside the Delaney Hall ICE detention facility in Newark — very likely indicates an enhanced risk of violence during these protests.

Other Domestic Violent Extremists

DVEs motivated predominantly by concerns with developing technologies, particularly generative AI and its supporting infrastructure, will very likely pose a threat to facilities and personnel associated with AI service providers and specific local US government officials in the next twelve months. DVEs harboring anti-AI or anti-data center sentiments may more closely meet the definitional criteria for extant DVE categories— particularly white supremacist and neo-Nazi violent extremists, AVEs, and environmentally motivated violent extremists (EVEs). Notably, in April 2026, two separate incidents (an incendiary device attack and a shooting) targeted the residence of OpenAI chief executive officer (CEO) Sam Altman. The perpetrator of the incendiary device attack, also alleged to be responsible for a security incident at OpenAI’s headquarters, authored several articles on a website detailing the attacker’s concerns about AI development. Local government officials with scheduled votes to approve data centers were also targeted throughout 2026 with death threats, swatting, doxing, and other physical threat activities.

Outlook

Overall, the most probable violent extremist threats to most public- and private-sector organizations operating in the US are targeted attacks against these organizations’ senior leaders, and low-sophistication but persistent physical threats to their facilities. However, the specific nature of the threats an organization is likely to face depends on its sector, industry, role, associations, and physical attack surface. Based on observed violent extremist threat activity during the past twelve months, several characteristics (listed in Table 1) very likely increase the risk of an organization operating in the US being targeted by violent extremists.

Entities at Heightened Risk from Violent Extremist Threats
Public Sector
Private Sector

Law enforcement, intelligence, military, or immigration enforcement agencies

Agencies led by highly visible or politically controversial elected officials, the officials themselves, and their staff

Agencies implementing or deliberating highly divisive or politically controversial policies, such as immigration, elections, gun control, abortion access, or land management

Companies perceived to be supporting US law enforcement, intelligence, military, or immigration enforcement agencies

Companies perceived to have a relationship with the Israeli government, the IDF, or Israel-based private-sector entities, or whose leaders have publicly voiced support for Israel or its policies, or are perceived to be Jewish

US critical infrastructure service providers, particularly energy and transportation companies

Generative AI service providers or companies managing supporting infrastructure for generative AI, particularly data centers

Table 1: Entities meeting these criteria are very likely at heightened risk from violent extremist threats

The Iran War almost certainly exacerbated the complex and heightened violent extremist threat environment the US already faced prior to February 2026. The war has almost certainly eliminated most strategic or ideological deterrents to Iran targeting the US through violent extremist proxies, a type of threat activity that Iran has employed against the US since the early 1980s. Despite reports during the first weeks of the war that Iran was preparing to guide violent extremist attacks on US soil through highly sophisticated means — such as activating HVE “sleeper cells” through radio signals or targeting the US with UAV-borne IEDs launched from boats off the US coast — no Iran-nexus HVE plot of this scope or magnitude has yet come to fruition.

Instead, known Iran-nexus physical threats on US soil have used a similar playbook to its activities before the war: soliciting financially motivated, low-sophistication threat actors to conduct arson, sabotage, and rudimentary attacks on facilities, or to assassinate senior US officials and Iranian dissidents residing in the US. This likely suggests limits on Iran’s capability to guide or inspire large-scale HVE attacks in the US.

Thus, while the Iran War will likely not represent a “paradigm shift” in the US violent extremism landscape, it almost certainly will exacerbate existing trends. During the past year, IS supporters have very likely increased their operational tempo and interest in planning attacks in small groups; AGAAVEs motivated by partisan animus have almost certainly continued to pursue targeted attacks against high-visibility political figures, and AVEs have continued an increasingly destructive campaign of targeting entities they associate with US immigration enforcement policy. Despite pursuing different ideological goals, TTPs, and targets, these groups and other US violent extremists almost certainly thrive in sociopolitical environments with high degrees of division over the US’s foreign and domestic policy objectives, dissatisfaction with the economic state of affairs in the US, and broad societal acceptance of the idea that large-scale policy changes are only achievable through the use of force. In the medium to long term, the predicted domestic political and economic ramifications of the Iran War will almost certainly expand these perceptions among the US populace, and likely heighten violent extremists’ recruitment and mobilization capabilities.

Threat intelligence can assist organizations in mitigating the risks of violent extremist physical threat activities. Monitoring HVE and DVE primary-source communications informs the identification of ongoing threats, TTPs, and targets; the tracking of new violent extremist groups, communications platforms, sources, and online infrastructure; and the following of violent extremists’ narratives, influence operations, and reactions to ongoing events. Moreover, various features of the Recorded Future Intelligence Operations Platform — such as advanced queries for thousands of DVE and HVE communications sources, Intelligence Cards® for violent extremist threat actors, the Geopolitical and Identity Intelligence modules for attack surface monitoring, and Insikt Group intelligence reports — facilitate observation, analysis, and management of violent extremist threats.

Appendix A: Glossary of Terms

Except where otherwise noted, Recorded Future’s definitions and categories of violent extremism are adapted from US Intelligence Community documents, including:

Homegrown violent extremist (HVE): “An individual who advocates, engages in, or is preparing to engage in or support terrorist activities in furtherance of a foreign terrorist organization’s objectives, but who is acting independently of foreign terrorist direction.”

Jihadist Salafis: HVEs who believe in the use of violence or armed force to achieve the fundamental goals and objectives of the Salafi movement: most importantly, the restoration of the Islamic religion to its practice during the time of the Prophet Muhammad and his earliest followers, the rejection of perceived alternative or aberrant practices of the religion, and the reestablishment of Islamic systems of governance.


Domestic violent extremist (DVE): “An individual based and operating primarily in the United States without direction or inspiration from a foreign terrorist group or other foreign power and who seeks to further political or social goals wholly or in part through unlawful acts of force or violence. This assessment does not evaluate the actions of individuals engaged solely in activities protected by the First Amendment or other rights secured by the Constitution of the United States.”

White supremacist violent extremist: DVEs with “ideological agendas derived from bias … related to race or ethnicity,” who “believe in the superiority of the white race.”

Neo-Nazi violent extremist: DVEs with “ideological agendas derived from bias … related to race or ethnicity,” who “believe in the superiority of the white race” and promote the actions, ideology, governance model, leaders, or propaganda of Nazism or seek to establish a Nazi-inspired governing structure in the US.

Neo-Nazi accelerationist: Neo-Nazi violent extremists who believe that terrorist violence is necessary to hasten the destruction of Western civilization and its replacement with white supremacist societies.

White supremacist active club: A group of white supremacist DVEs who train in hand-to-hand combat and other activities to violently confront ideological opponents.

Anti-government/anti-authority violent extremist (AGAAVE): DVEs “with ideological agendas derived from anti-government or anti-authority sentiment, including opposition to perceived economic, social, or racial hierarchies; or perceived government overreach, negligence, or illegitimacy.”

Militia violent extremist (MVE): DVEs “who take overt steps to violently resist or facilitate the overthrow of the US government in support of their belief that the US government is purposely exceeding its Constitutional authority and is trying to establish a totalitarian regime” and may “oppose many federal and state laws and regulations, particularly those related to firearms ownership.”

Anarchist violent extremist (AVE): DVEs “who oppose all forms of capitalism, corporate globalization, and governing institutions, which are perceived as harmful to society.”

Explore expert insights, reports, and tools to strengthen your cybersecurity strategy.

/research/us-violent-extremists-shifting-focus-targeted-physical-threats-2025
/research/iran-handala-physical-threats
/research/palestine-action-operations-and-global-network
View all resources