Criminal proxies, public targeting videos, and loosely organized intermediaries give Tehran deniability while creating unpredictable security risks
Iranian threats against American and Israeli leaders have expanded beyond presidents, military commanders, and senior policymakers to include members of their families. The immediate question is how much of the rhetoric represents psychological warfare and how much reflects preparations for actual operations.
Iranian state television broadcast a three-minute video this week targeting Barron Trump, the 20-year-old son of US President Donald Trump. Titled “Where To Kill Barron Trump?” the video purported to show information about locations associated with him, his security arrangements, and his movements. Produced by media affiliated with the Islamic Revolutionary Guard Corps (IRGC) and aired on Iran’s Channel 3, the footage claimed that a $10 million bounty had been offered for his killing.
The purported bounty and alleged surveillance have not been independently verified, and no public evidence has emerged linking the broadcast to an operational Iranian assassination team. The US Secret Service said Tuesday that it was aware of the footage and investigates anything that could be perceived as a threat to its protectees, while declining to discuss protective intelligence.
The Barron Trump video followed an earlier production released by the IRGC-affiliated Tasnim news agency focusing on First Lady Melania Trump. That broadcast, reportedly titled “Where to Kill Melania Trump?” presented alleged details about her movements and potential weaknesses in her security. Reports about the Melania video did not indicate that a comparable multimillion-dollar bounty had been offered.
On Monday, Aug. 24, Israeli Prime Minister Benjamin Netanyahu added another allegation.
“Iran targeted one of my sons. Iran tried to kill, to murder one of my sons,” Netanyahu told Israel’s Channel 14.
Netanyahu did not initially identify whether he was referring to Yair or Avner Netanyahu or say when or where the alleged attempt occurred.
Newsmax reported Wednesday that Yair Netanyahu, the prime minister’s 35-year-old elder son, was the alleged target. Citing an unnamed US law enforcement source familiar with the matter, the outlet said Israeli intelligence learned in December 2025 that suspected Iranian operatives were in the Miami area conducting surveillance of his home and movements.
Israeli officials alerted US authorities and instructed Yair Netanyahu to leave Florida immediately, according to Newsmax. He reportedly returned to Israel without collecting his belongings and has remained there. US and Israeli authorities have not publicly confirmed his identification as the alleged target or the operational details in the report.
Israeli media had previously reported that the security establishment had known about the alleged threat for months and that details were subject to military censorship. Iran’s mission to the United Nations did not respond to a Reuters request for comment.
Netanyahu made the disclosure while responding to reports that the Shin Bet security agency had declined to provide protection for political rival Gadi Eisenkot ahead of Israel’s Oct. 27 election. Netanyahu said the alleged threat against his son demonstrated that security protection was “not a luxury” and that appropriate protection should be provided to every candidate for prime minister.
Iran has a documented history of pursuing targets overseas.
In 2022, the US Justice Department charged IRGC member Shahram Poursafi with attempting to arrange the murder of former US National Security Adviser John Bolton. Prosecutors said the operation was likely intended as retaliation for the January 2020 killing of IRGC Quds Force commander Qasem Soleimani.
European governments have also accused Iran of using criminal networks as intermediaries. Sweden’s security service has accused Tehran of using criminal groups to target Israeli and Jewish interests, while the British government sanctioned the Swedish-based Foxtrot network in 2025 over attacks allegedly carried out on Iran’s behalf.
In June 2026, the UK joined 22 other countries in condemning Iranian state-linked attacks, intimidation, kidnappings, and assassination plots overseas. A British parliamentary briefing published that month said UK security agencies had tracked more than 20 potentially lethal Iran-backed plots during the preceding year and identified dissidents, journalists, Israelis, and Jews among Iran’s targets.
The current US-Israeli war with Iran may have increased Tehran’s incentive for retaliation. The conflict began with large-scale strikes on Feb. 28 that killed Supreme Leader Ayatollah Ali Khamenei and senior Iranian military officials, expanding the list of figures Iran may seek to avenge.
Daniel Byman, a professor in Georgetown University’s School of Foreign Service with a concurrent appointment in its Department of Government, told The Media Line that the escalation had increased Iranian incentives for retaliation. He cautioned against treating every public threat as evidence of an imminent attack.
“The current war has greatly increased Iran’s motivation for different forms of terrorism, including assassinations,” Byman said. “Iran attempted several plots in the past in response to the killing of figures like Qasem Soleimani, and the scale of the US and Israeli killings in Iran is far, far greater than what we saw in the past.”
He pointed to a possible countervailing factor: “US and Israeli operations also demonstrate a thorough penetration of Iranian intelligence networks. It is possible that the networks used for foreign assassination attempts are also penetrated …”
Byman said he could not know that for certain.
“Highly publicized plotting, such as videos regarding the president’s family, are more likely intimidation and trolling attempts, as this will lead to increased security, making an actual plot harder,” he said.
Public threats, though, are only one part of Iran’s evolving overseas model.
Danny Citrinowicz, a senior researcher in the Iran and the Shi’ite Axis Program at Israel’s Institute for National Security Studies (INSS), said the scale of Iran’s losses means the drive for retaliation is unlikely to disappear even if diplomacy eventually reduces the military confrontation.
The Iranians are now in the revenge business
“The Iranians are now in the revenge business,” Citrinowicz told The Media Line. “This is not something that is going away. The Iranians, regardless of what will happen in terms of an agreement, yes or no, will seek revenge for Khamenei, I think, for the foreseeable future.”
Citrinowicz said Iran’s increasing reliance on criminals and other intermediaries offers Tehran deniability but also creates vulnerabilities.
“Their modus operandi is very unique. They are using third-party elements because they want to create a distance between them and the operation itself,” he said.
“The good thing for them is that they’re distancing themselves from any activity that happens. The bad thing is that you’re hiring people that are not experienced in this kind of work, and the signature they create helps local authorities discover that,” Citrinowicz said.
“I’m not underestimating their ability to do things, but I think the modus operandi is helping security services to track what the Iranians are trying to do,” he added.
Byman reached a similar conclusion from a different angle.
Most of these plots fail, but at a relatively low cost to Iran
“Iran’s shift to using criminal networks makes detection harder in some ways, but these networks are also more likely to betray Iran and are more amateurish,” he said. “Most of these plots fail, but at a relatively low cost to Iran.”
Outsourcing allows an operation to be disrupted without exposing large numbers of Iranian intelligence personnel or directly linking Tehran to an attack.
Irina Tsukerman, president of Scarab Rising, said the distinction between propaganda and operations is not absolute. She spoke to The Media Line before Wednesday’s report identified Yair Netanyahu as the alleged target.
“Given Iran’s established record of surveillance, kidnapping plots, assassination attempts, and planned attacks against Israelis abroad, Netanyahu’s claim is plausible enough to warrant serious attention, although there is not enough public information to determine how advanced the alleged operation became,” Tsukerman told The Media Line.
She cautioned that sophisticated-looking targeting videos are not proof of physical surveillance or an active assassination cell.
“Some information presented in state media may originate from social media, commercially available databases, hacking, open-source research, exaggeration, or fabrication, so the existence of an elaborate video does not demonstrate that an assassination team has been deployed,” she said.
The danger, Tsukerman argued, can develop after the material is released.
“Criminals can respond to the prospect of money, ideological sympathizers can volunteer assistance, and Iranian intelligence can later identify useful individuals who began acting without receiving instructions from Tehran,” she explained.
Propaganda can become part of an operational environment even when the original broadcast was produced primarily for intimidation
“Under those circumstances, propaganda can become part of an operational environment even when the original broadcast was produced primarily for intimidation.”
That distinction also complicates the frequently used concept of Iranian “sleeper cells.”
Tsukerman said the term can suggest organized teams living covertly in Western countries while awaiting direct instructions from Tehran. Recent investigations instead point to looser systems in which intelligence officers, criminals, locally recruited individuals, foreign nationals, and other intermediaries perform separate tasks.
Such networks can still leave detectable traces. Surveillance of a target, unusual financial transfers, recruitment attempts, weapons acquisition, and communications with known Iranian intermediaries can form an identifiable pattern when intelligence and law enforcement agencies combine information across jurisdictions.
