Cluster Analysis
The incident data reveals a pronounced concentration of threat activity in major US metropolitan areas, with Washington DC emerging as a primary target hub (4 incidents including two White House plots and a high-profile shooting). The New York-New Jersey corridor shows significant activity with ISIS-linked plots and IRGC-coordinated operations. A notable secondary cluster spans Western European capitals—London, Amsterdam, Rotterdam, Paris—reflecting the HAYI hybrid warfare campaign's geographic reach. Middle Eastern flashpoints (Dubai, Karachi, Oslo) demonstrate Iranian-linked operations extending to diplomatic soft targets globally, while domestic incidents in Texas, Michigan, and Virginia indicate continued vulnerability of religious institutions and military facilities across the US heartland.
Ideology Analysis
Iranian state-linked actors dominate the threat landscape, with IRGC, MOIS, Kataib Hezbollah, and the HAYI proxy network implicated in approximately 12 incidents spanning kinetic attacks, cyber operations, and assassination plots. ISIS and ISIS-inspired actors account for 4 confirmed incidents, including the completed Norfolk ROTC shooting and thwarted Gracie Mansion IED attempt. Antisemitic targeting appears across multiple ideological streams—both Islamist-attributed (synagogue attacks in London, Houston, Michigan) and unknown attribution cases. Notably, 11 incidents remain under investigation with unknown attribution, representing a significant analytical gap, while criminal-terrorism nexus activity is evident in the Foxtrot Network contract killing plot and Iranian arms trafficking case.
Method Trend Analysis
Firearms remain the predominant attack method (9 incidents), though the dataset reveals concerning escalation in technical sophistication—particularly explosive-laden drone plots targeting the White House and drone incursions at military installations (Barksdale AFB). IED and incendiary device usage appears concentrated within HAYI's coordinated European campaign, suggesting state-provided technical enablement. Lethality remained relatively contained with 27 total fatalities (22 from the Karachi consulate storming) and 54 injuries, though the Temple Israel attack's 31 casualties demonstrates mass-casualty intent. The high proportion of thwarted plots (12 incidents) indicates effective interdiction, yet the persistence of multi-method attacks (vehicle-firearms-incendiary combinations) signals adversary adaptation toward redundant attack modalities.
This platform is based on open-source reporting and should be treated as OSINT. Facts, motivations, affiliations, and legal conclusions may change as investigations proceed. Unless explicitly confirmed by official authorities, all activities, attributions, and linkages should be considered under investigation.