Iran's sleeper architecture didn't vanish when Khamenei died. The intercept, the Austin dead, and the Toronto bullets tell you exactly what it looks like when a 40-year intelligence network executes its deadman switch.
Iran's sleeper architecture didn't vanish when Khamenei died. The intercept, the Austin dead, and the Toronto bullets tell you exactly what it looks like when a 40-year intelligence network executes its deadman switch.
Three data points. Eight days. The same operational fingerprint.
On February 28, the United States and Israel killed Ali Khamenei in a strike on Tehran. He had run the Islamic Republic for 35 years. Within hours of his death being announced, something moved.
U.S. intelligence intercepted an encrypted transmission. It was broadcast from a station that had not previously existed, relayed across multiple countries simultaneously, and designed to reach recipients who already possessed the decryption key. It carried no identifiable sender, traveled outside the internet, and bypassed cellular networks entirely.
Whoever sent this anticipated that every digital channel was already compromised. That's not panic. That's pre-planning.
The federal alert, distributed to law enforcement agencies nationwide, described it as a potential "operational trigger" for "prepositioned sleeper assets operating outside the originating country." The alert noted: "While the exact contents of these transmissions cannot currently be determined, the sudden appearance of a new station with international rebroadcast characteristics warrants heightened situational awareness."
Whoever built this system built it a long time ago. Numbers-station tradecraft — analog broadcast, pre-distributed keys, no internet dependency — is Cold War infrastructure. Iran didn't improvise this in the hours after a missile strike. They had it ready.
One day after Operation Epic Fury began, at 1:39 a.m. on March 1, Ndiaga Diagne drove to Buford's Backyard Beer Garden on West Sixth Street in Austin, Texas. He opened fire with a pistol from his vehicle, then parked, retrieved an AR-15, and continued shooting along the entertainment district. Four people died, including Diagne. Fifteen were wounded.
Newly released footage from a mass shooting at a bar in Austin, Texas, on March 1 shows the suspect pointing a rifle as he walks through a parking lot and officers firing their weapons at him. pic.twitter.com/CpQrweIApM
— Reuters (@Reuters) March 6, 2026
What investigators found tells a story that doesn't fit the lone-wolf template.
At the scene: a Quran in his SUV. Underneath his hoodie — which read "Property of Allah" — a shirt bearing the flag design of the Islamic Republic of Iran. Both weapons legally purchased in San Antonio in 2017.
At his Pflugerville house, searched under warrant: an Iranian flag. Photographs of Iranian regime leaders.
On a social media account investigators believe was his, created October 2024, last post December 2025: pro-Iranian content, antisemitic posts, replies to Iran's Foreign Minister Abbas Araghchi dating to April 2024. He called Netanyahu "EVIL" and Trump a "shameless clown." He called the Islamic Revolution "eternal."
The guns were bought in 2017. The radicalization trail runs back at least to 2024. The attack came one day after the war started. That's not spontaneous.
Diagne, 53, was a Senegalese-born naturalized citizen who had spent time in the Bronx before moving to Texas. He had a history of mental health episodes and a prior domestic violence record. The FBI says he was not on their radar. That is precisely the profile of an asset that survives in place.
The Joint Terrorism Task Force is handling the investigation. The FBI's acting special agent in charge of the San Antonio field office, Alex Doran, acknowledged "indicators on the subject and in his vehicle that indicate potential nexus to terrorism." Investigators are reviewing whether he self-radicalized or received direction. That question is not yet answered.
The same night, thousands of miles north, another operation was underway.
Salar Gholami is a Kurdish-Iranian, a Canadian cruiserweight boxing champion, and one of the most visible anti-regime organizers in the Greater Toronto Area. His gym, Saliwan Boxing on Yonge Street in Thornhill, Ontario, had become a hub for Iranian dissidents and pro-freedom demonstrators. The windows displayed Lion and Sun flags — the pre-Revolution emblem, banned in Iran by the Islamic Republic.
🚨MAJOR BREAKING
— Tablesalt 🇨🇦🇺🇸 (@Tablesalt13) March 1, 2026
An Iranian activists' gym was shot up overnight in Toronto
likely by Iranian sleeper cells ....there are an estimated 700 IRGC agents in Canada, that we KNOW of....
The war expands into Canada! pic.twitter.com/QsyAZjwXXJ
At approximately 3 a.m. on March 1 — one hour after Gholami had organized a rally in Richmond Hill celebrating the U.S.-Israeli strikes — a dark-colored SUV stopped outside Saliwan Boxing. A figure in dark clothing exited, fired seventeen rounds into the gym's entrance, and fled. No one was inside. No one was injured.
The message was the point. Seventeen bullets across the front windows. Surveillance footage. An unambiguous communication to every Iranian dissident in Canada who knows Gholami's name.
Gholami: "This is the result of shaking hands with the mullahs and delaying action. When the Canadian government leaves the door open for them to enter, this will no longer be a safe place even for Canadians themselves."
He told CTV News he counted seventy bullet marks at the scene. He said the timing was deliberate. He said he believes the IRGC was behind it. He held a protest outside the U.S. Consulate later that morning. "They may be able to take my life," he told the crowd. "But they cannot take our honor."
The IRGC was designated a terrorist entity by Canada in June 2024. York Regional Police are still looking for a suspect. No arrests have been made.
Canada's own security services had already seen this coming. In November, CSIS Director Daniel Rogers stated publicly that his agency had been forced to "reprioritize operations to counter the actions of Iranian intelligence services and their proxies" after detecting "potentially lethal threats against individuals in Canada." He said CSIS had, in more than one case, disrupted those threats before they were carried out.
This one got through.
Taken individually, any one of these incidents can be explained away. The intercept is signals intelligence with uncertain content. The Austin shooter had mental health problems. The Toronto shooting could be random criminal activity. Counterterrorism officials are trained to resist pattern-matching on incomplete data.
But the pattern is the story.
Former FBI Assistant Director Chris Swecker stated plainly after the war began: "If ever there's going to be a Hezbollah cell or a Hamas cell act in the United States in a violent way, it's now. Both organizations are Iranian-backed all the way. Both organizations have had a presence in the United States since the 1980s. We know that they have cells here."
The intercept used pre-internet tradecraft that had to have been engineered, tested, and pre-positioned years before February 28. The recipients already held the decryption key. The station had not previously existed. It went live within hours of Khamenei's death.
This is not a terror network improvising. This is a network executing.
Austin happened one day after the war started. Toronto happened the same night. A German lawmaker, Marc Henrichmann, warned the following day: "The Iranian regime has repeatedly demonstrated in the past that it carries out its terror beyond its own borders."
FBI Director Kash Patel placed counterterrorism and intelligence teams on high alert. Texas Governor Greg Abbott activated the Texas Military Department under Operation Fury Shield and deployed the Texas National Guard. The National Counterterrorism Center is coordinating with the FBI and Austin law enforcement. CSIS in Canada has confirmed active monitoring.
On March 9, Iran's Assembly of Experts elected Mojtaba Khamenei, 56, as the new Supreme Leader — the son of the man killed in the strikes. He is only the third person to hold that title since the 1979 Revolution.
He inherits a state in crisis. The January 2026 uprising saw millions in the streets across all 31 provinces. The economy is in freefall. The rial is in collapse. The IRGC's external operations infrastructure is being contested by U.S. and Israeli strikes. The public legitimacy of the Islamic Republic, always fragile, is now openly contested by its own population.
A cornered, wounded network with assets pre-positioned across the Western world and nothing left to lose is not a network that stands down. It's one that executes.
The question facing U.S. and allied intelligence isn't whether the network exists. It's how many nodes haven't moved yet.
The intercept suggests the broadcast was international in scope. Austin and Toronto are two data points. The transmission reached multiple countries. Law enforcement has been instructed to monitor suspicious radio frequencies nationally. "No specific credible threats" are the operative words — but they describe what hasn't been found, not what isn't there.
The Austin investigation has not confirmed a terrorism nexus. The JTTF is working it. If Diagne's social media trail leads to any contact with overseas handlers, or if any of his digital activity in the final weeks before the attack shows a pattern consistent with operational preparation rather than spontaneous radicalization, that changes the picture significantly.
The Toronto shooter has not been identified. A suspect vehicle description is all York Regional Police have released. If the vehicle or shooter surfaces with any IRGC-proximate connection, that is a major story on its own.
The encrypted broadcast's contents remain unknown. If U.S. signals intelligence cracks the transmission, the scope of what was sent — and to how many recipients — will become the central intelligence question of the coming weeks.
Gene Goodwin
Gene Goodwin
The Gracie Mansion explosive device, thrown by two Pennsylvania teenagers with alleged ISIS ties during an anti-Islam protest in New York City, adds a separate but overlapping thread. ISIS and Iran are adversaries doctrinally. But in a threat environment, this activated, the distinction may matter less to the targets than to the analysts.
The Unredacted covers intelligence, national security, and institutional accountability. Nothing here is redacted for convenience.