How Iran Has Targeted or Threatened US Military Interests Abroad

Iran’s challenge to US military interests overseas has taken several forms: attacks by Iran-aligned armed groups, threats against American bases and personnel, weapons transfers to partner forces, cyber operations and alleged efforts to target Americans abroad. The distinction between Iran itself and organizations it supports is crucial. In many of the best-documented cases, Iranian-backed or Iran-aligned groups carried out the physical attack, while US officials attributed responsibility, support or direction to Iran.

The pattern is therefore broader than attacks on military bases. Since October 2023, Iran-aligned militias have repeatedly attacked US forces in Iraq and Syria, while the Houthis—an Iran-backed movement—have attacked shipping and threatened US naval interests in the Red Sea. Iran has also been accused in US criminal cases of directing assassination and murder-for-hire operations. At the same time, allegations surrounding particular incidents, including the recent events near RAF Fairford in Britain, must remain separate from established cases: British investigators are examining possible Iranian or proxy involvement but have not publicly established that Iran ordered the Fairford incident.

Iran’s preferred model: pressure without conventional war

Iran’s military and security strategy abroad does not generally resemble a conventional campaign in which Iranian forces openly attack US bases.

Instead, Tehran has developed relationships with armed organizations across the Middle East. The US State Department identifies the Islamic Revolutionary Guard Corps-Quds Force as Iran’s principal mechanism for supporting terrorist and militant organizations abroad, including Hezbollah, Hamas, the Houthis and Iran-aligned militias in Iraq and Syria.

That creates an important distinction between Iranian responsibility and Iranian direction or support.

An attack can be carried out by an Iraqi militia, for example, without Iranian military personnel firing the weapon. US officials may nevertheless conclude that the group received Iranian weapons, training, intelligence or other assistance.

The degree of Iranian control varies from organization to organization. Treating every group in the region as a simple Iranian proxy therefore obscures more than it explains.

The major categories of pressure

The categories overlap. A single Iranian strategy can combine weapons supply, proxy attacks, intelligence activity and cyber operations.

Iraq and Syria: the most sustained pressure on US forces

The clearest modern example is the campaign against US forces in Iraq and Syria.

American troops remain in the region primarily for missions connected to counterterrorism and regional security. Their presence has repeatedly made them targets for Iran-aligned armed groups.

Following the outbreak of the Israel-Hamas war in October 2023, attacks increased sharply.

A US Defense Department report recorded at least 170 attacks by the Islamic Resistance in Iraq, an umbrella organization of Iran-aligned militias, against US and coalition forces in Iraq and Syria from October 2023 through the first quarter of 2024. Those attacks included one-way attack drones, rockets and other weapons.

The Pentagon said in January 2024 that US forces had faced 151 attacks in the Middle East since October 19, including attacks by Iranian-supported groups in Iraq and Syria.

This is important because it shows that the threat was not a single isolated incident.

US bases and personnel faced repeated attacks over months, producing an environment in which even relatively small attacks could accumulate into a significant force-protection problem.

Tower 22 showed the potential human cost

The most consequential attack in this period occurred on January 28, 2024.

A one-way attack drone struck a US logistics support facility known as Tower 22 in northeastern Jordan near the Syrian border.

Three US Army Reserve soldiers were killed and more than 40 other American service members were injured. The facility supported US and coalition operations against Islamic State. Approximately 350 US Army and Air Force personnel were deployed there at the time.

US Defense Secretary Lloyd Austin said Iran-backed militias were responsible for the continuing attacks and promised a US response.

The significance went beyond the individual casualties.

An attack that kills American troops creates pressure on Washington to respond, while a response against Iranian interests can in turn create pressure for Iran or affiliated groups to retaliate.

That is one reason proxy warfare can become dangerous even when neither side initially wants a direct US-Iran war.

Al-Asad and the danger of escalation

US bases in Iraq have repeatedly come under rocket and drone attack.

Al-Asad Air Base, which hosts US personnel, was among the installations targeted during the escalation after October 2023. A January 2024 attack was described by US officials as one of the largest attacks on US personnel during that period.

The United States responded with strikes against facilities used by Iran-backed militias.

In January 2024, for example, American forces struck three facilities in Iraq associated with Kataib Hezbollah and other Iran-affiliated groups. The strikes were explicitly described by the Pentagon as responses to attacks against US and coalition personnel.

The resulting cycle illustrates the central strategic problem:

Iran-aligned groups attack US forces → Washington retaliates against those groups → the groups can retaliate again → the risk of direct US-Iran confrontation increases.

The fact that the initial attack may come from a militia does not eliminate the geopolitical consequences for Iran.

Iran has also used direct military force

The distinction between proxies and Iran itself becomes especially important when examining January 2020.

After the United States killed Quds Force commander Qasem Soleimani in Baghdad, Iran launched ballistic missiles against Iraqi facilities hosting US personnel.

This was a direct Iranian military action rather than an attack conducted through a proxy organization.

The episode demonstrated that Tehran has the capability and willingness, under certain circumstances, to attack locations associated with US forces directly.

It also showed the risks involved.

Iran could retaliate against US interests without immediately launching a conventional war against the United States, while Washington could respond without necessarily entering a full-scale conflict.

That narrow space between deterrence and escalation has remained a defining feature of the relationship.

The Red Sea expanded the battlefield

Iran’s influence over threats to US interests abroad is not confined to Iraq and Syria.

The Houthis in Yemen have become a major part of the picture.

The movement has launched attacks against commercial and military shipping in and around the Red Sea, particularly since the Gaza war began. Washington has repeatedly described the Houthis as an Iran-backed organization and has conducted military operations against Houthi missile and drone capabilities.

This matters to the US military because maritime security is itself a strategic interest.

American naval forces have been deployed to protect shipping and respond to threats. In January 2024, the Pentagon said US forces were conducting defensive operations in the Red Sea and Gulf of Aden while also responding to attacks from Iran-backed groups elsewhere in the region.

Iran therefore does not need to attack a US airbase directly to impose military costs on Washington.

Supporting an armed group capable of threatening shipping can force the United States to deploy ships, aircraft, air defenses and personnel to protect a much wider area.

Weapons transfers extend Iran’s reach

Another part of the strategy is the transfer of weapons and technical expertise.

US officials have repeatedly accused Iran of supplying missiles, drones and other military technology to regional armed groups.

The FBI has also described a 2024 operation in which a US military vessel intercepted foreign nationals allegedly transporting Iranian-made weapon components toward Houthi forces in Yemen. Two US Navy SEALs died during the operation.

Weapons transfers matter because they allow Iran to increase the capabilities of organizations operating outside Iranian territory.

They can also provide a degree of separation.

An Iranian missile launched from Iranian territory is unambiguously a direct Iranian action. A weapon supplied to a partner organization and subsequently used by that organization creates a more complicated chain of responsibility.

Cyber operations create another battlefield

The threat is not exclusively physical.

US agencies have attributed cyber activity against American organizations to Iran-based actors.

In a 2024 joint advisory, the FBI, Cybersecurity and Infrastructure Security Agency and Department of Defense Cyber Crime Center warned that Iran-based cyber actors were exploiting US and foreign organizations, including entities in the education, finance, healthcare, defense and government sectors. The agencies assessed that some of the activity was associated with the Iranian government and involved obtaining network access that could subsequently facilitate ransomware operations.

A later US government advisory also documented IRGC-affiliated cyber activity targeting industrial control systems and other organizations, including dozens of US victims in sectors such as water, energy, manufacturing and healthcare.

For the military, cyber risk is particularly important because modern armed forces depend on civilian infrastructure.

Power, telecommunications, transportation, cloud services and industrial systems can all have consequences for military readiness.

Cyber operations therefore give Iran another way to impose costs without physically attacking a US base.

Assassination plots represent a different kind of threat

Iran’s alleged activities against US interests have also extended beyond conventional military targets.

In March 2026, a US federal jury convicted Asif Merchant, whom the Justice Department described as an IRGC operative, of murder-for-hire and terrorism offenses. Prosecutors said he had been sent to the United States in 2024 to arrange the killing of a US political figure or government official, allegedly as retaliation for Soleimani’s death. The planned attack was disrupted by US law enforcement.

Another case involved an alleged plot against a US citizen of Iranian origin living in New York. The Justice Department charged an Iranian asset and two US-based associates in 2024, alleging that the Iranian operative directed surveillance and planned a murder-for-hire operation.

And in December 2024, US prosecutors charged an IRGC officer over the alleged orchestration of the 2022 murder of an American citizen living in Iraq. Prosecutors alleged the killing was part of an Iranian campaign of retaliation following Soleimani’s death.

These cases demonstrate why US authorities describe the Iranian threat as extending beyond traditional military targets.

They also require careful wording: an allegation in an indictment is not itself proof of guilt, whereas the Merchant case has progressed further, with a federal conviction.

What about Europe?

Europe has increasingly appeared in the wider security picture.

US and European governments have previously accused Iranian intelligence or IRGC-linked operatives of conducting surveillance, assassination planning and other hostile activity on European soil.

The US State Department has documented cases involving alleged Iranian intelligence activity in countries including Germany and Türkiye, while also citing a 1996 US federal court finding that Iran and the IRGC were liable for the Khobar Towers bombing that killed 19 US service members.

The historical record is important because it shows that threats to US interests connected to Iran are not confined to the Middle East.

At the same time, each incident requires its own evidence. A previous Iranian operation in Europe does not establish Iranian responsibility for every later suspicious event.

The Khobar Towers case remains a key historical reference

On June 25, 1996, a truck bomb exploded outside the Khobar Towers housing complex in Saudi Arabia, killing 19 US Air Force personnel.

The US government subsequently attributed responsibility to Saudi Hezbollah and linked the organization to Iran. A US federal court later found Iran and the IRGC liable.

Iran has denied responsibility.

The case remains significant because it demonstrates the longstanding US concern that Iranian security structures can use partner organizations to attack American personnel outside Iran.

It also illustrates why attribution can remain politically and legally complicated years after an attack.

Why the Fairford allegations need separate treatment

The current RAF Fairford investigation fits into this broader context—but it should not simply be added to the list of proven Iranian attacks.

British police arrested five men near the base in September 2026 and later arrested a dual UK-Iranian national in connection with the investigation. Police said they were considering multiple lines of inquiry, including whether individuals might have been acting for a foreign state. Iran has denied involvement.

British Prime Minister Andy Burnham subsequently said there were strong indications of Iranian involvement, while investigators continued examining the case.

The distinction matters because the investigation has not publicly established all of the critical links between the suspects, any foreign actor and the Iranian government.

The arrests themselves establish that British authorities believed there was sufficient cause for a serious investigation. They do not, by themselves, establish who ordered the alleged activity.

The threat is broader than physical attacks

Looking across these cases, the Iranian challenge to US interests abroad has several layers.

At the highest level, Iran can use its own military forces, as it did in the 2020 missile strikes.

Below that, Iran can support armed organizations that attack US troops or threaten American interests.

It can provide weapons and technology that increase the reach of those organizations.

It can employ cyber capabilities against government and civilian networks.

And US authorities have brought cases alleging that Iranian intelligence or IRGC personnel have pursued Americans or US officials through clandestine operations.

These methods create different kinds of pressure.

A drone attack threatens lives immediately. A cyber intrusion can remain hidden for months. A proxy attack can impose military costs while complicating attribution. An assassination plot can target individuals far from any battlefield.

Why attribution is the hardest question

The central analytical problem is determining how much control Iran exercised over a particular operation.

There is a substantial difference between:

• An Iranian military unit directly carrying out an attack.
• An Iran-aligned organization independently choosing to attack US forces.
• Iran providing weapons or funding to a group that later attacks.
• Iranian officials directing a specific operation.
• An individual claiming to act for Iran without authorization from Tehran.

Those distinctions affect how Washington assesses responsibility and how it chooses to respond.

They also matter for journalism.

Calling every attack by an Iran-aligned organization an “Iranian attack” can erase meaningful differences in evidence and command relationships. Conversely, ignoring documented Iranian support can understate Tehran’s role in building the capabilities used against US interests.

The most accurate description is often the more precise one.

What the pattern means for US military bases

The strategic consequence is that American installations abroad have to prepare for more than conventional attack.

A base may need to consider drones, rockets, cyber intrusion, espionage, sabotage, insider threats and intelligence collection at the same time.

That helps explain why a suspected security incident near RAF Fairford can have consequences disproportionate to the physical evidence publicly disclosed so far.

The US military does not have to conclude that Iran has ordered an attack before taking protective action. A credible possibility that a strategically important base has become a target can justify changing aircraft deployments or increasing security.

The withdrawal of US bombers from Fairford therefore should be understood as a force-protection decision, not as proof that the Fairford suspects were acting for Iran. Reuters reported that the Pentagon confirmed the bombers had returned to US bases while emphasizing that long-range US strike capability remained available.

The larger strategic calculation

Iran’s approach creates a difficult problem for Washington because the United States has to decide where the threshold for retaliation lies.

If the US responds to every attack by a partner group as though Iran itself had launched it, the risk of a direct confrontation increases.

If Washington consistently treats proxy attacks as separate from Iran, Tehran and its partners may conclude that the costs of indirect pressure are manageable.

That tension has shaped US policy for decades.

The evidence shows that Iran and organizations aligned with it have repeatedly threatened or attacked American interests abroad. What the evidence does not show is that every suspicious incident involving US personnel or facilities is necessarily directed by Tehran.

That distinction is particularly important now.

The most consequential question is therefore not whether Iran has the capability or history to threaten US interests abroad—it clearly does. The harder question in any individual incident is the chain of responsibility: who planned the operation, who supplied the means, who gave the order, and how much control Tehran actually exercised. Until investigators establish those links, the prudent assessment is to take the threat seriously without turning suspicion into a settled attribution.