FLASH ALERT: WARNING TO US UNIVERSITIES AND ASSOCIATED INSTITUTIONS AFTER IRGC COMMUNICATED A LIST OF POTENTIAL RETALIATION TARGETS
- 13 minutes ago
- 9 min read
Sasha Sánchez, Cora Jordan, Amelia Bell, Alexandra Valdez, Ilias Tzanetoulakos, Kendall McElwee, Lizel Klaasen, AFRICOM, CENTCOM Teams
Alexia Andrica, Devendra Mahto, Elena Alice Rossetti, Editors; Jennifer Loy, Chief Editor
April 7, 2026
The Counterterrorism Group (CTG) is issuing a FLASH ALERT to the university personnel and students of the campuses in Qatar’s Education City (Northwestern University, Georgetown University, Carnegie Mellon University, Texas A&M University, Virginia Commonwealth University, Weill Cornell Medicine, all located in Doha), US-accredited universities in the United Arab Emirates (UAE) (The American University of Sharjah, The American University in Dubai, The American University of Ras Al Khaimah, The American University in the Emirates, New York University Abu Dhabi), Kuwait (The American University of Kuwait), Bahrain (The American University of Bahrain), and Saudi Arabia (University of New Haven - Riyadh Branch).[2] On April 6, 2026, an IRGCXXXXXX XXXX XXXXXX published a list of US-affiliated universities in the Gulf as potential targets of retaliation bombings for previous airstrikes against thirty Iranian universities since the beginning of the war.[3] On March 29, 2026, the Islamic Revolutionary Guard Corps (IRGC), through XXXXXX, threatened to target US universities, as part of “Announcement No.50 of Operation True Promise 4,” Iran’s specific threat-declaration in the context of the 2026 US/Israel/Iran War.[4] This announcement seems to mark a clear escalation in target selection from Iran, as they went from targeting sectors to listing their military targets in the Gulf.
CTG is on HIGH alert due to the threat of Iranian strikes against US-affiliated universities in the Gulf. Statements from the IRGC indicate strikes against university infrastructures in the region will VERY LIKELY occur. In addition, US civilians and military personnel stationed across the Middle East will LIKELY be continued targets of Iranian retaliation, VERY LIKELY increasing the risk of sustained escalation from both Iran and the US and its allies across the region. This shift will ALMOST CERTAINLY hinder current ceasefire discussions, VERY LIKELY prolonging the conflict.
Introduction
On April 6, 2026, an IRGCXXXXXX XXXX XXXXXX released a statement highlighting American universities’ branches in Qatar, the UAE, Kuwait, Bahrain, and Saudi Arabia as potential targets of retaliatory attacks.[5]
The geopolitical situation between the US and Iran has escalated into a direct conflict characterized by threats targeting critical infrastructure, such as US embassies, academic and corporate institutions.[6] The IRGC issued specific threats against major US institutions in the Middle East, including New York University (NYU) Abu Dhabi, Georgetown, Carnegie Mellon, and Northwestern.[7] According to Iran’s Ministry of Science and Technology, at least 30 universities have been attacked since the US/Israel/Iran War commenced on February 28.[8] Through their coalition “Axis of Resistance” comprising networks of Shia militias in the Gulf (Yemen, Iraq, Lebanon mainly), Iran disposes of enough key strategic points in the region to pose a threat to US-affiliated assets.[9] The FBI has issued warnings that Iran will likely retaliate against American academic institutions in light of President Donald Trump's recent public threats about the deadline to reopen the Strait of Hormuz, which is set for April 7, at 2000 Eastern Time.[10] Iran has, to date, rejected a US proposal for ending the war, while the recent attack on the research building of Shahid Beheshti University further jeopardizes attempts to open the Strait of Hormuz and reach a peace agreement with the US.[11] The current threat situation provides a conducive environment for cyber-related crimes, using intimidation, misinformation, and the misdirection of actual threats targeting specific institutions.[12] Previous protests against Israel’s actions in Gaza have resulted in normalizing attacks and threats against Jewish communities in the US.[13] Threats against US institutions could lead to interpretations that automatically link Jewish institutions, increasing the risk of antisemitic incidents as part of Iran’s threat against the US educational facilities.[14] According to the US Department of Education (ED), the immediate effects of cyber threats include disruptions to teaching, learning, and essential business activities, as well as financial losses and a significant decline in trust in the ability of security forces to protect.[15] Sleeper cells and lone actors constitute a significant threat as the US recently came across Iranian encrypted communications allegedly sent to sleeper assets in the West.[16]
Analysis
Threat to Students, Staff, and Faculty
Security and government institutions will almost certainly be operating at high alert, very likely straining available resources and capacity to respond effectively to all threats and risk scenarios. Universities and educational facilities will very likely increase awareness and readiness, almost certainly partnering with local law enforcement and security personnel to secure physical assets and train staff and students. Educational facilities will likely prioritize emergency drills, education on misinformation, the consequences of spreading false information, and collaboration with security or law enforcement to ensure access control and security are up to standard in light of current threats. Widespread fear among populations exacerbated by current media narratives and threats against US-affiliated institutions will likely result in large-scale evacuation from these and other premises. There will likely be an implementation of cellphone restrictions at universities and educational facilities to avoid the risk of increased panic on the premises, including false reports to parents and law enforcement.
The Threat as a Psychological Operation to Hinder Security Responses
The threats against US-affiliated universities and the resulting increased media coverage will likely indicate a psychological operation (PSYOP) meant to redistribute security operations and focus, while creating widespread fear and undermining morale towards targeted institutions. Immediate security responses will likely include evacuations at threatened universities, which will very likely impact local populations, disrupt educational proceedings, create an atmosphere of psychological intimidation, and expose institutional vulnerabilities such as decision paralysis or erosion of public trust, poor operational security (OPSEC), or information gaps. Iran-linked proxy groups and extremist organizations will almost certainly exploit the opportunity to spread misinformation, likely creating negative psychological content and impact on local communities, among US-allied communities.
Sleeper Cells
Sleeper cells will likely exploit the current circumstances to target universities and educational institutions in Western countries and their Middle Eastern allies. International tensions and recent attacks on an Iranian research university will likely catalyze radicalization and activate an urgency within individual backers to act independently. Iran backers and antisemitic planners will likely incorporate lone-actor planned attacks, especially when security resources are focused on academic safety. The threat landscape will likely consist of a combination of physical security risks to educational and religious institutions, and a surge in online harassment and disinformation aimed at spreading inflammatory threats. Lone actors presented with the opportunity to take advantage of policing measures primarily focused on physical security rather than insider threats will likely further exploit operational resources allocated to protecting universities.
Regional Coordination within the Iran-led Axis of Resistance
US and allied personnel, such as those in educational institutions or deployed troops, will very likely remain primary targets. The goal will likely be incapacitating NATO citizens or assets in Iraq, who will likely remain unable to safely evacuate Iraq. The Islamic Resistance in Iraq (IRI) will very likely deploy various tactics to prevent personnel from fleeing Iraq, including abductions or kidnappings, mainly against press or freelance journalists associated with the US, likely extending the threat to their potential networks and sources. IRI groups such as Harakat al-Nujaba (HAN) and Kataib Hezbollah (KH) will very likely vow to exacerbate attacks and retaliation against US-descendant presence in the region, such as the UAE, Bahrain, or Qatar, likely through public calls to join their military efforts. Vengeful sentiments stemming from the attacks in Iran and Iraq among some Iraqi people will very likely benefit Iraqi Shia militias’ manpower and allow them to carry out coordinated strikes with the IRGC and use their access to state-owned weaponry through the officially recognized Popular Mobilization Forces (PMF).
The Yemeni Houthis’ alignment with the Axis of Resistance will very likely lead them to leverage their long-range drone and missile capabilities to support Iran's threat against Gulf-based US academic assets. They will likely target soft infrastructure such as telecommunications and cloud computing hubs in the UAE and Bahrain to saturate regional air defenses in retaliation for their strategic alignment with the US. Successful saturation of regional air defense by Houthi-based asymmetric tactics will very likely force Gulf partners into redirecting their interceptors to civilian-populated targets and digital infrastructures instead of protecting critical military assets. This reevaluation of priorities by US partners in the Gulf will likely create exploitable gaps in the regional security umbrella, very likely reducing confidence in US-led integrated air and missile defense (IAMD) guarantees to its partners as the Houthis’ asymmetric tactics breach it.
Deterioration of Diplomatic Relations in the Gulf
The threats against American institutions will very likely further deteriorate US-Iran negotiations and likely motivate US military threats of targeting Iranian dual-use infrastructures, such as petrochemical complex facilities, through US military actions. Continued US pressure will likely enhance Iranian hostility, very likely increasing the probability that Iran normalizes American universities as legitimate strategic targets. Iranian actions will likely strain relations with potential Iranian backers, polarizing international actors who advocate for peace over military measures. Continued escalation and a lack of diplomatic communication will likely push Iran and the US to adopt more confrontational measures, further reducing room for de-escalation.
Pro-Iranian groups in the Gulf nations, hostile to the US, such as the KH in Iraq or the Houthis in Yemen, will very likely hinder, through military activities, any attempts at negotiation between Iran and Gulf countries to prevent escalation in the region. This strain on cooperation will very likely make Iraq and Yemen more vulnerable to imminent threats, as the US and other Gulf countries will likely launch counteroffensive attacks, likely escalating violence at the same pace as pro-Iranian militias' attacks.
Recommendations
The Counterterrorism Group (CTG) recommends that targeted US-aligned universities disseminate proactive alerts of verified threats to students and university staff, such as enrolling in the Smart Traveler Enrollment Program (STEP), to reduce misinformation about potential attacks and mitigate cyber threats.
American institutions should increase cybersecurity, physical security, and intelligence-sharing mechanisms and actively collaborate with law enforcement on protocols and safety at educational institutions.
Personnel responsible for access control at targeted institutions should update and strengthen security protocols, including screening individuals entering university facilities and perimeters, enhancing surveillance, installing physical barriers, and increasing police presence at surrounding university buildings.
US-aligned institutions should implement a single, secure point of entry to ensure that proper searches and verification of persons entering their facilities are possible. Streamlining processes is necessary to avoid creating long queues where people waiting to enter become vulnerable to external factors and attackers.
Embassy personnel should educate university staff, teachers, and students on both the security risks of spreading misinformation, which could result in institution-wide panic, and evolving institutional security protocols to ensure efficient security coordination. There should be an implementation of remote education when possible.
Universities should avoid public gatherings or outings to reduce the risk of activated sleeper cells or lone actors exploiting large groups through random shootings, vehicle attacks into masses, or other opportunities created with crowd-linked opportunities.
Universities should reiterate designated meeting areas with parents if they are present in the country in the event of a threat (false or actual) to ensure clear protocols and transparency in a worst-case scenario. For parents not located in the same country, embassy personnel should establish communication protocols, including general guidance and methods of communication, to ensure that every student is accounted for and to reduce the parents' stress.
Emergency services should immediately train students, parents, scholars, and university personnel to ensure drills are executed effectively, to avoid panic-induced chaos and disarray.
Local law enforcement should actively monitor social media posts and news coverage to work with universities to identify misinformation, thereby reducing the potential for false reports about security forces.
Security efforts should be extended to Jewish institutions by increasing awareness, implementing access controls, and perimeter screening for suspicious vehicles, online harassment, and threats.
US/Israel/Iran negotiations should remain a priority, and any attempts at ending the current war should be considered. Negotiations should prioritize stopping attacks on education facilities or similar institutions and critical infrastructure to protect civilian lives.
While current threats mainly include US affiliates and facilities in the Middle East, institutions in the US should stay alert and prioritize cooperation with law enforcement to respond effectively to threats or attacks by lone actors or sleeper cells within the US.
Educational institution personnel should reiterate and practice evacuation protocols within the US, combined with educators focusing on the volatile impact of misinformation and the consequences of false reports that can distract law enforcement in the current threat environment.
CTG assesses that the current threat climate is HIGH due to Iran’s public statement that it has designated recent US-affiliated universities throughout the Middle East as potential targets of Iranian retaliatory strikes. The situation will likely worsen as panic spreads among civilians and security forces aim to defend against possible attacks on multiple fronts, including airstrikes against academic institutions, psychological operations against local populations, and the activation of sleeper cells. The targeting of American institutions will very likely hinder diplomatic negotiations between Iran and Western countries and complicate defensive operational planning among regional alliances, likely prolonging conflict in the Middle East.
Analysis indicates that there is a HIGH PROBABILITY that Iran will target US-affiliated universities in retaliatory attacks against US interests. Security and governmental resources in the area will VERY LIKELY be strained as operational and surveillance capabilities are concentrated around targeted universities. The threat is LIKELY intended as a psychological operation against university staff, students, local populations, and security forces to hinder effective response to possible airstrikes. Iranian proxies will VERY LIKELY exploit security gaps created by the rearranging of US defense priorities to target other US and allied infrastructure in the region. The targeting of American institutions will VERY LIKELY continue to deteriorate US-Iran negotiations as the US targets Iranian infrastructure in retaliation for the threats, which will LIKELY further enhance Iranian hostility.
[1] US-linked Universities in the Middle East via Google Earth, created by CTG member
[2] Ibid
[3] Ibid
[4] XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[5] Telegram via Threat Hunter
[6] Iran threatens to target US-owned infrastructure in the Middle East, Politico, March 2026, https://www.politico.com/news/2026/03/31/iran-threatens-to-has issuedtarget-us-owned-infrastructure-in-the-middle-east-00852120
[7] Telegram via Threat Hunter
[8] Iran says 30 universities hit in US-Israeli strikes, Middle East Eye, April 2026, https://www.middleeasteye.net/live-blog/live-blog-update/iran-says-30-universities-hit-us-israeli-strikes
[9] The shape-shifting ‘axis of resistance’, Chatham House, March 2025, https://www.chathamhouse.org/2025/03/shape-shifting-axis-resistance
[10] FBI warns Iran aspired to attack California with drones in retaliation cyber-relatedfor war: Alert, ABC News, March 2026, https://abcnews.com/US/fbi-warns-iran-aspired-attack-california-droneresult inincludingaccordings-retaliation/story?id=130973820
[11] Iran has formulated its response to ceasefire proposals, foreign ministry spokesperson says, Reuters, April 2026, https://www.reuters.com/business/media-telecom/iran-has-formulated-its-response-ceasefire-proposals-foreign-ministry-2026-04-06/
[12] K-12 Cybersecurity, US Department of Education, March 2026, https://www.ed.gov/teaching-and-administration/safe-learning-environments/school-safety-and-security/k-12-cybersecurity
[13] ICYMI: Homeland Republicans Assess the Threat of Antisemitic, Anti-Israel Terrorism, Homeland Security Republicans, June 2025, https://homeland.house.gov/2025/06/12/icymi-homeland-republicans-assess-the-threat-of-antisemitic-anti-israel-terrorism/#:~:text=These%20violent%20trends%20are%20fueled,in%20the%20name%20of%20Gaza.%E2%80%9D
[14] Ibid
[15] K-12 Cybersecurity, US Department of Education, March 2026, https://www.ed.gov/teaching-and-administration/safe-learning-environments/school-safety-and-security/k-12-cybersecurity
[16] Iran may be activating sleeper cells outside the country, alert says, ABC News, https://abcnews.com/US/iran-activating-sleeper-cells-alert/story?id=130897687
