On January 3, a US airstrike at Baghdad International Airport killed Qassim Soleimani, the commander of the Iranian Revolutionary Guard Corps Quds Force, as well as several important commanders of Iranian backed proxy forces. This strike was a serious escalation in the ongoing increase in tensions between Iran and the United States since the Trump Administration withdrew from the Iranian Nuclear Deal in 2018. In the aftermath of the strike, Iran and its proxies made public statements vowing retaliation against US forces and their allies in the region for the killing of Soleimani. The first of these retaliatory strikes by Iran took place on January 8 when Iran launched a missile attack on the Al-Assad air base as well as a US base in Erbil. While this may be the sole strike that Iran launches in retaliation for the killing of Soleimani, it is important to consider this may only be the first in a series of Iranian measures to retaliate, and there is also the high risk that Iran will use its asymmetric capabilities to strike back at the US and its allies, such as through cyber attacks and by using its many proxy forces in the Middle East to launch attacks. This report will examine the threat of further direct attacks by Iran, as well as the threat from its proxy forces.
Since the 1980s, Iran has managed to construct a web of proxy client organizations across the greater Middle East in countries such as Iraq, Syria, Yemen, Lebanon, Palestine, Afghanistan, and Bahrain. Through the utilizing of the Islamic Revolutionary Guard Corps - Quds Force, Iran has established an intricate axis of client non-states and intertwined it into the Iranian grand strategy to directly combat adversaries asymmetrically. With the beginnings of Iranian retaliation already being observed via the launching of 15 ballistic missiles toward two American bases in Iraq (Irbil and Al-Asad), Iran has the capability to prolong its plans of revenge across the entirety of the Middle Eastern region via proxy organizations that can threaten supply routes and strategic positionings of American troops and American allied forces. In addition to proxy warfare, Iran has a cyber warfare capacity to directly target American financial and government sites and institutions that can directly impact the lives of Americans. Iran has vowed prolonged revenge against the United States that has the potential to be region-wide and to a degree that increases chances of high threat risks to U.S. personnel stationed across the region as well as Israel, Saudi Arabia, and the Gulf states that house U.S. troops.
One way Iran will significantly coordinate its response against the United States will be through the deployment of the Islamic Revolutionary Guard Corps - Quds Force. Through the structure of the IRGC-QF, Iran is able to intervene and target adversaries in various regional theaters without the deployment of the Iranian conventional military force: Ramazan Corps (Iraq), Levant Corps (Syria, Lebanon, Jordan, and Israel), Rasulallah Corps (Arabian Peninsula), and the Ansar Corps (Afghanistan). With the recent assassination of IRGC-QF Commander Qasm Soleimani, it is to be expected that Iranian retaliation will be conducted through the full mobilization and activation of Iranian proxies and the branches of the IRGC-QF (Ground Forces, Navy, Air Force, Basij, and Quds Force Special Operations). Iran currently possesses the largest ballistic missile arsenal in the Middle East due to North Korean, Chinese, and Russian assistance since the Iran-Iraq War (1980-1988). The utilizing of the Iranian ballistic missile allows Iran to initiate a volley of missile attacks as far as the Eastern Mediterranean Sea and encompasses all strategic energy infrastructure of the Arabian Peninsula and the Gulf States.
It is important to highlight that Iranian responses may become concentrated in what is observed as a land bridge from Iran across the Levant called the Wilayat Imam Ali. The Wilayat Imam Ali land bridge is a three section geopolitical component of the Iranian grand strategy to construct a path of proxy networks and routes toward Israel and the Eastern Mediterranean. The northern path of this land bridge includes Northern Iran, Iraqi Kurdistan region, Iraqi city Sinjar, Northeastern Syria, and Lebanon while the central route includes central Iran, central Iraq, Iraqi city Al-Qaim, Syrian cities Abu Kamal and Dayr az Zawr, and Lebanon. The southern section of Wilayat Imam Ali includes Iran, Iraqi town Al-Walid, Syrian town Al-Tanf, Damascus, and Lebanon. As the United States increases the amount of troops in Iraq, as a means to retaliate asymmetrically, Iran can initiate extensive, coordinated proxy warfare that target U.S. bases and installations on multiple fronts rapidly. Iranian proxy warfare can include continual protests and assaults on the American embassy in Baghdad and exploitation of Iraqi Shia grievances for the killing of Soleimani to increase the chances of collateral damage if the United States were to seek retaliation. Some of the main proxy groups that could potentially conduct offenses against the United States include the Iraqi Popular Mobilization Forces, Lebanon Hezbollah, Iraqi Kataib Hezbollah, Yemeni Houthi rebels, and Palestinian Hamas. Another potential response would be seeking to influence the peace treaty within Afghanistan via Iranian rekindling of relations with the Taliban and Liwa Fatemiyoun.
Just as Iran possesses a robust arsenal of short and medium-range ballistic missiles and an extensive network of proxy organizations across the greater Middle Eastern region, so too does Iran have proven cyber warfare capabilities that can be utilized to directly target the United States homeland as it has done in the past. In 2012, Iran hacked into and paralyzed Aramco in addition to wiping 30,000 Saudi computers. Other than attacking Saudi Arabia, Iran has also hacked Western petrochemical and aerospace companies to retrieve technological information to use toward Iranian modernization initiatives. In demonstrating Iranian potential to initiate major cyber attacks in the United States, in 2014, Iran hacked the Las Vegas casino belonging to billionaire Sheldon Adelson, who suggested that the United States should nuke the deserts of Iran to send a warning. Other than the targeting of the casino, in 2011-2012, Iran dispersed denial of service attacks that targeted JP Morgan, Bank of America, Capital One, New York Stock Exchange, and the NASDAQ. In 2013, Iran took control of a dam directly outside New York, which would have allowed Iranians to release the water if the sluice gate was not already disconnected. The most recent attack on an American city was in 2018, when Iranian hackers targeted Atlanta, Georgia with SamSam ransomware that cost millions of dollars to fix. With continual cooperation with North Korea and Russia, Iranian cyber warfare capabilities have modernized significantly to the degree of being able to inhibit significant damage to American strategic infrastructure on the mainland United States.
The Iranian response could be multifront retaliation that incorporates aspects of proxy asymmetrical warfare and conducting cyber attacks against the United States and Middle Eastern countries that house U.S. personnel and assets. Not only does Iran possess cyber warfare systems, so too do Iranian proxies such as the Houthi rebels and Hezbollah. Therefore, the United States can be confronted with multiple cyber attacks not directly from Iran but Iran-aligned non-state actors, which will be incredibly difficult to combat and protect against if targeted by multiple adversaries at the same time or via a prolonged attack in different stages. American industrial companies, federal government agencies, strategic infrastructure such as dams, power plants, and electrical grids, and even cities are all potential targets of Iranian-affiliated cyber attacks. The unintentional targeting of the Ukranian passenger airliner is indicative of the paranoid yet sudden retaliation capabilities of Iran despite it costing 176 innocent lives. With Iran in a heightened state of alert and eagerness for revenge against the United States, it can be expected for collateral damage to be incorporated within the risk analysis when observing confrontations between the United States and Iran.
Iraq has already been a theater for Iranian retaliation against the United States for the killing of Soleimani, due to the Iranian ballistic missile strike on two US bases in Iraq on January 8. However, this is likely not the end of attacks on US bases in Iraq, as even prior to the current escalation of tensions since Soleimani’s death, there were 9 rocket attacks launched at US bases in Iraq before December of 2019.  A further two were carried out in December, with the strike on December 27 at a US base in Kirkuk being the first that killed an American.  These strikes have all been attributed to Iranian backed proxies, with most likely having been carried out by the stronger militias with a history of attacking US forces, such as Kataib Hezbollah and Asaib Ahl al-Haq. These strikes have likely been carried out at the behest of Iran as part of their regional strategy to impose a cost on the United States for imposing tough sanctions on Iran, a strategy which will likely only be escalated by the killing of Soleimani. In the context of Iraq however, it is important to note that Iran has the additional goal of forcing US troops to withdraw from Iraq, and given the large number of proxy forces it has in the country, continuing to target US troops and impose a cost on the US presence in Iraq will continue to be an Iranian goal for the foreseeable future.
The strike that killed Soleimani also killed Abu Mahdi al-Muhandis, the commander of Kataib Hezbollah (KH) and the deputy commander of the Popular Mobilization Units (PMU). Al-Muhandis was a widely respected figure among the PMU militias and had political backing in Iraq through the Fatah party. While Iran exercises a large degree of control over the Shia militias it supports, given that a key leader of one of the Shia militias was killed it is possible that militias like KH will carry out their own strikes to avenge the killing of al-Muhandis. KH has already vowed to carry out attacks, and has called for suicide bombings to be carried out agaisnt US forces.  In addition, rocket attacks were carried out on US installations on December 28 and 29, with one of these strikes targeting the embassy in Baghdad’s Green Zone, likely by KH. The group also made a statement on January 4 that Iraqi security forces and civilians should stay a thousand meters from US bases, a clear indication that the group plans to continue its rocket attacks on US installations.  It is also important to note that Iraqi cleric Muqtada al-Sadr, who has distanced himself from Iran in recent years has claimed he will reactivate his militia, Mahdi Army which attacked US forces in the past, and called for the formation of an “international resistance coalition” to push the US out of Iraq.  Both of these developments mean that the rocket attacks on US bases in Iraq will likely increase in their frequency and there is the possibility for other methods of attacks being carried out against US forces.
Iran and Syria have long been 'allies' due to their support for Hezbollah. The United States views both countries as State Sponsors of Terrorism as Syria actively supports Hezbollah by sending arms to them. In 2019, Syrian leader Bashar al-Assad visited Iran and was greeted by both the Supreme Leader Ayatollah Ali Khamenei and Major General Qassem Soleimani. Many Syrians had negative sentiments towards Soleimani, however the Assad regime worked closely with him to get weapons and training and has been, according to some experts, been built and supported by Iran. As the years progressed the Assad regime split into those who were more pro-Iran and those who were more pro-Russia, another country active in the region. There are reports that the killing of Soleimani has created even deeper divisions within the government. Due to the recent uptick in Russian activity in Syria, specifically in the Idlib Provinces, there is a risk of increased conflicts as Russia vies for a stronger hold in the region, Iran attempts to keep control through Assad while US troops and Syrian civilians are caught in the middle.
As troops are forced out of Iraq as well, following the request by the Iraqi government, US troops in the region will potentially lose a vital supply chain. This may force the troops to leave Syria as well, leaving the region open to the Islamic State for future grabs as well as uncontested between Russia and Iran.
The Taliban and Iran have had a turbulent relationship for many years. War between the two entities almost began in 1998, when Taliban militants killed an Iranian journalist and 10 diplomats in Mazar-i-Sharif, Afghanistan. Following that attack, Iran initially approved of the American intervention in Afghanistan to end the Taliban’s power. However, following the success of that mission, it’s been reported that Iranian leadership welcomed Taliban leaders and even began extending support to the organization’s fighters.
Following the rise of the Islamic State in Khorasan Province, IS-KP, Iran began to see the Taliban as the lesser of two evils. IS-KP carried out terror attacks on Iran’s parliament in 2017, therefore making the Taliban look even more appealing. Various reports state that Iran then began supplying financial assistance, training, and weapons to the Taliban. In 2018, the US Treasury Department Taliban sanctioned Taliban members involved in suicide attacks, and Iranians for providing material and financial support.
Iran has long denied any involvement with the Taliban, attempting to keep all connections covert, however, various reports and findings have often discovered connections between the two that show Iran views them as a useful proxy source within Afghanistan. Recently, their connection has become much more overt, as Tehran has hosted Taliban leaders during the peace talk process in November 2019. The US Defense Intelligence Agency, DIA, released a statement that describes Iran’s interest with the peace process in Afghanistan primarily being “meant to combat Islamic State’s affiliates in the country and increase Tehran’s influence in any future government in Kabul that emerges”.
The Pentagon released a report on Tuesday, January 7, specifically focusing on Iran’s relationship with the Taliban. The report emphasized that in the current climate, it is possible Iran could increase its support of the organization. Taliban spokesmen have stated that US-Iran tensions will not hinder ongoing peace talks with the US, as an agreement has already been finalized. However, considering that some of the major stipulations for a peace agreement between the two entities is a decrease in violence, and a ceasefire, it is not likely that this process will be unaffected. If tensions escalate and Iran increases their involvement with the Taliban, attacks on US forces may rise and therefore harm progress made on a peace agreement.
Hezbollah has responded by stating that the time has come for Iran’s “axis of resistance” to retaliate against the US in order to avenge Soleimani’s death. Sayyad Hassan Nasrallah, the current leader of Hezbollah announced that the reports stating Soleimani was planning an attack on the US embassy were false and that President Trump “is lying to his people.” According to Nasrallah, Iran’s allies are already working to avenge Soleimani’s death although it will be a “long road”, and that the allies are also continuing towards their ultimate goal of expelling US forces from the region.
While Hezbollah itself is a powerful Iranian ally, it is currently held in the grips of the civil unrest that has been ongoing in Lebanon since October 2019. Hezbollah is currently trying to maintain its power in Lebanon and therefore, is not at liberty to avenge Soleimani’s death the way it otherwise would be capable of. Particularly, an attack by Hezbollah could result in sanctions on Lebanon by the US which would further Lebanon’s collapsing economy. Any attack by Hezbollah would have to be untraceable or anonymous. Hezbollah should not be counted out however, because they have managed to do this in the past. In the 1980’s, Hezbollah attacked Americans in Lebanon in retaliation for US-support for the Iran-Iraq war under the alternative name of other Islamic extremist groups.
Given this assessment, CTG CENTCOM fully believes that Iran and its proxies will continue to conduct further attacks in response to the killing of Qassim Soleimani. AOCs operating in the region as a whole should continue to monitor the situation and increase security measures to be capable of responding to attack by these forces. CTG CENTCOM will continue to monitor the responses of Iran and its proxies and report on any escalating threats.
The Counterterrorism Group (CTG)
 Seligman, Lara and Gramer, Robbie, Iran Launches Attack on U.S. Bases in Iraq, Foreign Policy, January 7, 2020
 Jones, Seth, G., War by Proxy: Iran’s Growing Footprint in the Middle East, CSIS, March 11, 2019
Seal of the Army of the Guardians of the Islamic Revolution, by MrInfo2012, licensed under Creative Commons.
 Iran has vowed revenge on the US after Trump's airstrike killed its top military commander. Here's how it could happen., Business Insider, January 2020, https://www.businessinsider.com/iran-airstrike-qassem-soleimani-how-iran-could-take-revenge-2020-1
 After Soleimani killing, Iran’s proxy war to impact Afghanistan and Pakistan, Deutsche Welle, January 7, 2020,
 Saudi foreign minister calls Iran most dangerous nation for cybersecurity, CNBC, February 2018, https://www.cnbc.com/2018/02/18/iran-most-dangerous-nation-for-cyber-attacks-says-saudi-foreign-minister.html
 Iran Has Already Hacked the U.S. At Least 4 Times - and Could Do It Again, Vice News, January 2020, https://www.vice.com/en_us/article/bvgxkd/4-times-iran-has-hacked-the-us-before-and-could-do-it-again
 NYC on heightened terror alert after Iranian commander’s killing, Politico, January 2020, https://www.politico.com/states/new-york/city-hall/story/2020/01/03/nyc-on-heightened-terror-alert-after-iranian-commanders-killing-1242598
 Iran admits unintentionally shooting down Ukrainian airliner, The Guardian, January 2020, https://www.theguardian.com/world/2020/jan/11/iran-admits-shooting-down-ukrainian-airliner-unintentionally
 US suspects Iran is behind increasingly sophisticated rocket attacks on US bases in Iraq, CNN, December 2019, https://www.cnn.com/2019/12/09/politics/us-iran-rocket-attacks/index.html
 American Contractor Killed in Rocket Attack in Iraq, The New York Times, December 2019, https://www.nytimes.com/2019/12/27/us/politics/american-rocket-attack-iraq.html
Iran Location, by Rei-artur, licensed under Creative Commons
 Hezbollah Brigades official reportedly calls volunteers for suicide bombings, The Long War Journal, January 2020, https://www.longwarjournal.org/archives/2020/01/hezbollah-brigades-official-reportedly-calls-volunteers-for-suicide-bombings.php
 Iraqi militia warns security forces to stay away from U.S. bases: Al Mayadeen, Reuters, January 2020, https://www.reuters.com/article/us-iraq-security-kataib/iraqi-militia-warns-security-forces-to-stay-away-from-u-s-bases-al-mayadeen-idUSKBN1Z30K9
 Iraq’s Sadr calls for ‘global’ legion of Iran-backed militias, Rudaw, January 2020, https://www.rudaw.net/english/middleeast/iraq/060120201
Assad meets Khamenei in first Iran visit since Syrian war began, Reuters, February 2019, https://www.reuters.com/article/us-mideast-crisis-syria-assad/assad-meets-khamenei-in-first-iran-visit-since-syrian-war-began-idUSKCN1QE24G
 Soleimani's killing ignites Russia-vs.-Iran schism in Syria, Fox News, January 2020, https://www.foxnews.com/world/soleimani-killing-syria-russia-iran
 Iraq asks U.S. to make plans to withdraw forces, NBC News, January 2020, https://www.nbcnews.com/news/world/iraq-asks-u-s-make-plans-withdraw-forces-n1113391
 Iran's Soleimani transformed Syrian war in Assad's favor, Y Net News, January 2020, https://www.ynetnews.com/article/Skbqk7Gl8
 In Afghanistan, U.S. Exits, and Iran Comes In, New York Times, August 2017, https://www.nytimes.com/2017/08/05/world/asia/iran-afghanistan-taliban.html
 Iran and the Taliban: A Tactical Alliance?, Besa Center, January 2019, https://besacenter.org/perspectives-papers/iran-taliban-tactical-alliance/
 U.S. Treasury sanctions target Taliban, Iranian backers, Reuters, October 2018, https://www.reuters.com/article/us-usa-afghanistan-sanctions/us-treasury-sanctions-target-taliban-iranian-backers-idUSKCN1MX239
 In Afghanistan, U.S. Exits, and Iran Comes In, New York Times, August 2017, https://www.nytimes.com/2017/08/05/world/asia/iran-afghanistan-taliban.html
 Tehran Hosts Taliban Leaders for Afghan Peace Talks, Vox News, November 2019, https://www.voanews.com/middle-east/tehran-hosts-taliban-leaders-afghan-peace-talks
 Iran supports the Taliban with weapons, training, and money, Pentagon report says, Task & Purpose, November 2019, https://taskandpurpose.com/iran-supports-taliban
 US, Iran tensions will not interrupt Afghan peace process: Taliban, The Frontier Post, November 2019, https://thefrontierpost.com/us-iran-tensions-will-not-interrupt-afghan-peace-process-taliban/
 Hezbollah: It’s Time for Iran’s Allies to Start Working to Avenge Soleimani. Reuters. January 2020. https://www.reuters.com/article/us-iraq-security-hezbollah/hezbollah-its-time-for-irans-allies-to-start-working-to-avenge-soleimani-idUSKBN1ZB0LJ
 Hezbollah’s Revenge: Can Iran’s Powerful Proxy Retaliate for Soleimani Without Destroying Lebanon? Haaretz, January 2020, https://www.haaretz.com/middle-east-news/.premium-hezbollah-s-revenge-can-iran-s-proxy-retaliate-without-destroying-lebanon-1.8382611