Executive Summary
The predominant threats to most public and private sector entities from United States (US)-based domestic violent extremists (DVEs) during the next twelve months will likely come in the form of targeted attacks against personnel and sabotage of facilities. These threats likely surpass the risk of DVE mass-casualty terrorist attacks due to their elevated frequency, success rate, and impact on the targeted entitys operations. While certain categories of homegrown violent extremists (HVEs) and some DVEs will almost certainly continue to plan and threaten mass-casualty attacks, recent high-profile assassinations and assassination attempts in the US have very likely increased the probability of DVEs considering limited-scope methods. Violent extremists have almost certainly glorified the alleged perpetrators of these attacks and promoted narratives suggesting that targeted attacks against high-profile public figures more effectively achieve their political and ideological goals than mass-casualty attacks.
To support attack plots and bolster their operational footprint in 2025 and early 2026, HVEs and DVEs will almost certainly continue issuing online threats; stalking, harassing, and physically approaching victims; and conducting sabotage, surveillance, disruptive demonstrations, doxing, and swatting. As in previous years, personnel and facilities associated with racial, ethnic, and religious minorities, the LGBTQIA+ community, US federal, state, local, tribal, and territorial government agencies (particularly judicial and law enforcement agencies), specific private industry sectors (defense contractors, healthcare and pharmaceutical companies, financial and insurance agencies), and critical infrastructure providers are at heightened risk from HVE and DVE threat activities during the next twelve months.
Polarizing geopolitical and domestic political issues especially conflicts in the Middle East involving Israel, the 2024 fall of the Bashar al-Assad regime in Syria, and US immigration enforcement policies will almost certainly continue to mobilize HVEs and DVEs during the next twelve months. While expected tactics, techniques, and procedures (TTPs) associated with US violent extremists are unlikely to significantly change in the short term, DVEs and HVEs are very likely to accelerate adoption of new technologies, such as commercially available unmanned aerial vehicles (UAVs), generative artificial intelligence (AI), end-to-end encrypted communications platforms, cryptocurrencies, and 3D printing, to enhance their operational capabilities.
Rapidly shifting developments in the violent extremist threat landscape in the US and changing priorities of US federal law enforcement and homeland security agencies could place more of the onus on state and local governments and the private sector to manage their own counterterrorism programming. As always, facility security initiatives and hardening soft targets will undoubtedly remain important, but recent incidents and violent extremists growing preference for targeted attacks against high-profile personnel suggest that executive protection is an increasingly crucial aspect of countering violent extremist threats to organizations. Organizations can mitigate threats to executives not only through reactive detection of online threats and negative sentiment campaigns, but also by proactively identifying and removing publicly available information that can be used to target personnel. Physical security teams can query the Recorded Future Intelligence Clouds extensive corpus of sources used by violent extremists to analyze intelligence pertaining to these and other violent extremist threats.
Key Findings
During the next twelve months:
- The US will very likely face a heightened threat from violent extremist physical threat activities due to the enduring influence of the Israel-Hamas conflict; geopolitical developments in the Middle East, Central Asia, and Africa favoring foreign terrorist organizations (FTOs); and the increasing ease of access to and use of new and developing technologies.
- While their preferred targets vary, most violent extremist threat actors are almost certainly interested in threatening US federal, state, and local governments. Critical infrastructure providers, defense contractors, and the education, insurance, healthcare, banking, finance, and maritime industry sectors also very likely face heightened risks.
- Islamic State (IS) supporters will very likely represent the most lethal HVE threat to the US, especially if IS experiences a resurgence in Syria following the 2024 fall of the al-Assad government.
- HVEs with a nexus to Hamas, Hezbollah, the Yemeni Houthis, Iraqi Shia militias, or other Axis of Resistance groups are unlikely to carry out attacks in the US, but they likely have increased motivation to do so and access to expanded facilitative resources due to the USs direct involvement in the Iran-Israel conflict.
- The DVE groups that likely pose the largest threat of conducting violent attacks in the US, such as neo-Nazi accelerationists, anti-government/anti-authority violent extremists (AGAAVEs) motivated by political animus, and anarchist violent extremists (AVEs), are likely to increasingly prefer targeted attacks and assassinations over mass-casualty attack plots.
- Militia violent extremists (MVEs), AVEs, and AGAAVEs harboring political grievances due to US domestic political issues will almost certainly physically threaten judges, public officials, business executives, and other highprofile public figures.
Background
Insikt Groups forecast is predicated on its assessments of open-source information on the activities of HVEs and DVEs in the US, including the Recorded Future Intelligence Clouds extensive index of HVE and DVE communications on various online platforms. During the past twelve months, Insikt Group researchers curated several hundred HVE and DVE sources, adding them to an extensive index of preexisting sources of this type.
This report defines homegrown violent extremist, domestic violent extremist, and several categories of HVEs and DVEs based on the US Intelligence Communitys definitions and categorizations of threat actors. Periodically, this report prefers definitions adopted by Insikt Group subject matter experts for analytic utility, or in instances where the US government has not officially defined a particular phenomenon or movement. A full list of terms and definitions used in this report is available in Appendix A.
Homegrown Violent Extremists
HVEs are very likely to carry out physical threat activities targeting US government and law enforcement installations and personnel, public events, large commercial spaces, houses of worship and religious communities, and counter-protestors and demonstrators. US-based IS supporters will very likely present the most lethal violent extremist threat to the US during the next twelve months, and the continued mobilization factor of the Israel-Hamas conflict will almost certainly drive some Americans to provide support for IS, al-Qaeda, and other FTOs (although organizations other than IS and al-Shabaab al-Qaedas Somalia franchise very likely lack the infrastructure, personnel, and interest in recruiting US persons).
However, while sporadic escalations in the Israel-Hamas conflict will almost certainly influence disruptive protest activities and other physical threats in 2025, most visibly at US universities, threat actors will likely be deterred from overt displays of support for FTOs and plotting mass-casualty attacks due to the almost certain increase in law enforcement resources dedicated to investigating and prosecuting these threats. Instead, extant pro-Hamas networks in the US are very likely to emphasize covert operations, especially those that finance the organization.
In addition, the geopolitical climate likely favors efforts by IS and al-Qaeda affiliates in the Levant, Central Asia, the Sahel, and the Horn of Africa to expand their territorial holdings, conduct increasingly sophisticated and lethal attacks in their areas of operations, and develop connections between their operatives and recruitment networks in Western Europe and North America.
Expanding commercial markets and ease of use of developing technologies particularly UAVs and cryptocurrencies are very likely to bolster HVE operations on behalf of a range of FTOs in 2025. US HVEs almost certainly continue to provide financial assistance to IS, al-Qaeda, and Hamas through cryptocurrencies. For example, Hamas has almost certainly developed a sophisticated network of cryptocurrency wallets and exchanges it uses to funnel funds from its international supporters to its operatives in the Palestinian Territories. HVEs are very likely to continue experimenting with these new technologies for applications in attack plotting, particularly with UAV-borne improvised explosive devices (IEDs) and 3D-printed firearms and weapons components.
Islamic State
The most persistent and lethal violent extremist threat to the US during the next twelve months will very likely come from IS supporters in the US who plan physical threat activities alone or in small groups, rely on minimal external direction from IS, and use less-sophisticated TTPs such as attacks with firearms, bladed weapons, and vehicular assaults. On New Years Day 2025, for example, Shamsud Din Jabbar carried out the first lethal attack in the US connected to IS since 2017, piloting a pickup truck into a crowd in New Orleans, killing fourteen and wounding over 50. The attack followed a notable uptick in IS activity in the US; according to data from the George Washington University Program on Extremism, the US Department of Justice (DOJ) arrested nine IS sympathizers on federal charges in 2024, in comparison to six the year prior. These cases allegedly included major efforts by IS sympathizers to conduct mass-casualty attacks in the US, including an Oklahoma resident arrested in October 2024 for planning to attack an election facility on Election Day and a Canada resident arrested in September 2024 for planning to enter the US and carry out a mass shooting at a Jewish community center in New York City.
Insikt Groups June 2024 assessment that the IS Khorasan Province (ISKP) would become ISs global standard-bearer for external operations and media production was largely accurate. ISKP attack planners, functioning alongside IS logistic networks in Central Asia and Trkiye and Russian-, Uzbek-, and Tajik-speaking supporters in Europe, carried out several major terrorist attacks in 2024. Notably, these included the January 2024 suicide bombings in Kerman, Iran, that killed over 90, as well as the March 2024 mass shooting at the Crocus City Hall in Moscow, Russia, that resulted in hundreds of casualties, including 145 dead. Attack plots connected to the ISKP were also disrupted by security services in the US, France, Germany, Austria, Belgium, and other countries, including a thwarted effort by ISKP supporters residing in Austria to attack a Taylor Swift concert in Vienna in August 2024. These efforts followed a lengthy and almost certainly ongoing campaign spearheaded by the al-Azaim Foundation for Media Production ISKPs media arm to encourage supporters around the world to conduct attacks targeting sports stadiums, large concert halls, and major public events in the US and Europe.
Figure 1: September 5, 2024, graphic from al-Azaim Foundation for Media Production encouraging attacks in the United States (Source: Recorded Future)
While US-based IS supporters have represented a persistent threat despite ebbs and flows in the organizations health overseas, ongoing geopolitical developments that are very likely favorable to IS will likely enhance its ability to inspire and direct plots in the US. The fall of the Assad regime in Syria, ongoing Turkish military operations in the north of the country, and a decrease in foreign assistance (through funds and military support) to the Kurdish-led Syrian Democratic Forces (SDF) will very likely create opportunities for IS in Iraq and al-Sham (ISIS) to exploit security vacuums and threaten areas in east and northeast Syria. The threat of an ISIS resurgence in 2025 would almost certainly be exacerbated by major terrorist attacks against the new Syrian government, or alternatively by a prison break operation to free captive ISIS fighters and supporters in the SDF-managed al-Hawl and al-Roj prison camps. In the immediate term, an ISIS resurgence would almost certainly provide a propaganda boost for the groups international supporters. In the medium term, it could create opportunities for ISIS to relaunch its external operations capabilities and target the US.
Al-Qaeda
Al-Qaeda very likely has a limited degree of support among American jihadist Salafi HVEs and is very unlikely to gain much more support due to the ongoing influence of its competitor, IS. In 2024, the US Intelligence Community assessed that al-Qaedas central command had reached its operational nadir. While some of the groups franchises enjoyed substantial success during the past twelve months, the strongest al-Qaeda franchises will likely remain focused on their areas of operation and are unlikely to devote significant resources to attacking the West in the short term. Nevertheless, the activities of specific al-Qaeda affiliates in 2024 and early 2025 portend an expanded threat to the US:
- In early 2025, Al-Shabaab launched a military operation in the Shabelle and Hiiraan regions of Somalia to recapture areas it held prior to a 2022 counterterrorism operation by the Somali Armed Forces. This ongoing operation will very likely position al-Shabaab to threaten the capital city, Mogadishu, as well as the Somalian governments control over large swaths of the country. A revanchist al-Shabaab with significant territorial control in Somalia would almost certainly threaten US interests in the Horn of Africa and the Middle East; the group also likely has the means and intent to threaten the US homeland by externally guiding attack plots.
- In late 2023, Al-Qaeda in the Arabian Peninsula (AQAP) restarted its English-language Inspire series, which provides directions and information for English speakers on conducting terrorist attacks in the West. A February 2024 video specifically called for HVEs in the US to conduct local attacks because of the USs support for Israel in its conflict against Hamas. In June 2025, a video message from AQAP leader Saad bin Atef al-Awlaki encouraged HVEs to assassinate US political leaders, including President Trump and Vice President JD Vance.
- On May 29, 2025, US Africa Command (AFRICOM) Commander General Michael Langley warned that Jamaat Nusrat al-Islam wal-Muslimin (JNIM), an al-Qaeda franchise in the Sahel that has gained a substantial territorial footprint in the region, could have the capacity to attack the homeland. However, Insikt Group has not identified intelligence suggesting JNIM has displayed an interest in extraterritorial attack capabilities.
US-based IS and al-Qaeda supporters will almost certainly continue to use low-budget, low-sophistication, but lethal, methods of attack such as firearms, bladed weapons, and vehicular assaults, as well as retain their focus on targeting US government and law enforcement agencies, major public events, large commercial facilities, and targets associated with Jewish or Christian communities in the US. However, due to their increasing affordability, commercial availability, and ease of use, jihadist Salafi attack planners are also very likely to experiment with UAV and UAV-borne IEDs as attack TTPs. During 2024, jihadist Salafi propaganda frequently promoted the use of drones in conducting attacks, with some unofficial outlets providing guidance to supporters on how to operate them. A successful UAV-borne IED attack plot, whether in the US or overseas, would almost certainly demonstrate a proof of concept and supercharge jihadist Salafi HVEs interest in UAVs.
Hamas
Mass-casualty terrorist attacks in the US with a nexus to Hamas or other Palestinian Territories-based FTOs (including Palestinian Islamic Jihad [PIJ], the Popular Front for the Liberation of Palestine [PFLP], and others) remain very unlikely in the short term. These organizations have not demonstrated a capability or interest in conducting large-scale attacks in the US, although their ongoing conflict against Israel has almost certainly inspired US violent extremists without tangible ties to the organizations to conduct violence. Since Hamass October 7, 2023, al-Aqsa Flood terrorist attack in Israel, the Israel Defense Forces (IDF) have almost certainly decimated Hamass leadership, particularly within the Izz ad-Din al-Qassam Brigades, the organizations military wing. Because of the element of inspiration, large-scale attack plots perpetrated by Hamas supporters in the US cannot be ruled out, although most violence with a direct link to the group is very likely to be small-scale and sporadic, and only occur at protests or demonstrations where Hamas supporters confront counter-demonstrators or law enforcement.
While post-October 7 developments and Hamass conflict with Israel continue to almost certainly motivate sympathies for Hamas among American violent extremists, the primary means of interaction between US Hamas supporters and the organizations command and control structure almost certainly continues to be through financing efforts. The group has almost certainly created a complex network of cryptocurrency donation portals, exchanges, and wallets, from which they have generated tens of millions of US dollars from foreign donors, including from the US. These networks have likely replaced the role of brick-and-mortar US-based charitable organizations that, for decades, have allegedly provided funds from US donors to Hamas, PIJ, PFLP, and other Palestinian FTOs.
Axis of Resistance
The US missile strikes targeting Iranian nuclear facilities on June 21 and 22, 2025, likely increased the risk of HVE and DVE supporters of Iran and its Axis of Resistance groups, such as Hezbollah, the Houthis, Iraqi Shia militias, and others, conducting physical threat activities on US soil, although these groups are still unlikely to carry out a mass-casualty terrorist attack in the US during the next twelve months. While Irans military and intelligence agencies are likely to enhance their efforts to recruit assets in the US to carry out targeted attacks against US political figures and dissidents in the aftermath of the strikes, these efforts will very likely be constrained by US law enforcement investigations, the relative structural weakness of Axis of Resistance groups, and the almost certain disinterest of many US-based HVE and DVE groups in supporting Iran. Several factors during the next twelve months, including public incitement of attacks on US soil by Iranian officials or future US military activity against Iran, could augment these threats, although the most likely scenario is US HVEs and DVEs attempting to provide financial and material support to these groups on their own.
Irans proxies have not publicly indicated their interest in recruiting or directing Americans to conduct attacks on their behalf in the US since October 7, 2023. However, Irans military and intelligence agencies, particularly the Islamic Revolutionary Guard Corps (IRGC), have almost certainly continued their efforts to recruit and incite overseas threat actors to conduct targeted attacks and assassinations against high-profile US politicians and Iranian dissidents on US soil. Irans motivation to revitalize these efforts, several of which have been identified and disrupted by US law enforcement, likely increased in the immediate aftermath of US directly attacking Iran, although the subsequent ceasefire and cessation of US military activity in Iran will very likely decrease Irans appetite for remotely guiding terror plots in the medium-to-long term, if the ceasefire holds. There is no evidence to suggest that the IRGC exclusively recruits ideologically motivated violent extremists for these efforts (many of their assets have been participants in criminal organizations who are financially solicited to conduct attacks), and Iran will very likely attempt to exploit threat actors in the US with common ideological causes to conduct attacks on their behalf.
Hezbollahs ability to conduct extraterritorial attacks outside of Lebanon was almost certainly diminished by the leadership losses the organization suffered during Israeli strikes in 2024, particularly its secretaries general Hassan Nasrallah and Hashem Safieddine and military leaders Fuad Shukr and Ibrahim Aqil. Notably, Aqil was a senior member of Hezbollahs Islamic Jihad Organization, which has historically been responsible for planning external operations, including in the US. Ongoing Lebanese government efforts to demilitarize Hezbollah will likely further reduce the groups capabilities and interest in attacking the West. In 2024, there were sporadic instances of US HVEs attempting to provide material support for Hezbollah by joining the organization, although in these cases Hezbollah almost certainly indicated they were uninterested in taking on US or Western foreign fighters.
Likewise, the Houthis have not demonstrated the intent, capability, or interest in conducting terrorist attacks in the US, preferring to target commercial vessels in the Red Sea and, on occasion, Israel. On March 5, 2025, the US Department of State redesignated the Houthis as an FTO just before the launch of Operation Rough Rider, a US military campaign of airstrikes against the organization in Yemen. During the next twelve months, there are likely to be instances where US HVEs donate or otherwise provide material support to the Houthis. In this case, it would be unclear whether this trend would represent an increase in this activity, as the provision of material support to the Houthis was not illegal (and therefore not subject to prosecutions and investigations) in the US prior to their March 5, 2025, designation.
To read the entire analysis, click here to download the report as a PDF.
Source: RecordedFuture
Source Link: https://www.recordedfuture.com/research/us-violent-extremists-shifting-focus-targeted-physical-threats-2025