Israel’s air assault on Iran has focused largely on degrading the Islamic Republic’s military and would-be nuclear capabilities.

In the space of several days, Israel has totally or partially destroyed at least two nuclear sites, destroyed numerous air defense capabilities in a number of cities and killed at least 14 nuclear scientists and several senior leaders of the Iranian Islamic Revolutionary Guard Corps.

The Israeli operation has compromised how Iran can wage conventional warfare – through the use of military hardware, missiles, drones and aircraft. It has also likely curtailed any progress Iranian scientists had made in enriching uranium to a weapons-level grade, at least in the short-term.

But conventional military weapons are only one tool in Tehran’s arsenal. As a researcher who studies how Iran partners with militant groups, I know Iran still has the means to target its enemies. Despite the degradation of its military capabilities, Iran can leverage proxies, criminal organizations abroad, and cyberattacks to hit Israeli, and possibly U.S., targets.

Forward deterrence doctrine

The Islamic Republic is well suited for asymmetric warfare, or conflict between two countries that have different conventional capabilities and that is below the threshold of conventional war.

It fits a central tenet of Iran’s forward deterrence policy. In short, the doctrine holds that Iran should target its adversaries before their threat reaches the country’s borders. As Supreme Leader Ali Khamenei said in 2019, Iran “must not limit ourselves within our own borders. It is our duty to recognize and confront threats that lie beyond our walls.”

The “forward deterrence” doctrine was seeded from the early days of Iran’s Islamic Republic after the 1979 revolution.

Notably, forward deterrence originated from a need to cultivate proxies to target Saddam Hussein during the brutal eight-year war Iran fought against Iraq in the 1980s. To that end, Iran raised, equipped and trained groups like the Badr Corps to support its fight against Hussein, and it continues to support the militia and its political arm to the present day.

In more recent years, Iran has cultivated violent non-state actors like terrorist and rebel groups as well as criminal gangs to target adversaries – both the U.S. and Israel, but also regional rival Saudi Arabia. These non-state groups are primarily coordinated through the Revolutionary Guard’s Quds Force, its extraterritorial missions arm founded in 1988.

Recent Israeli strikes have degraded both Iran’s conventional military capability and killed members of Revolutionary Guard leadership. Israel also allegedly hit a Quds Force nerve center in Tehran, and it’s unclear if its leader, Esmail Qaani, is dead.

Meanwhile, operations earlier in the Israel-Gaza conflict have diminished the ability for some of Tehran’s proxies – notably Hezbollah in Lebanon and Hamas in Gaza – to respond.

Yet Tehran’s overall capacity for asymmetric retaliation has not been completely diminished. While it’s unclear how large the Quds Force is, by its very nature, its operatives are spread throughout the region. As a hierarchical, bureaucratic organization, it likely has a robust succession plan.

And its existing programs, directives and operatives will remain in place to be deployed or activated.

Kidnappings and assassinations

Of primary concern to policymakers in Israel and Washington will be the potential targeting of U.S. and Israeli assets abroad through Iran’s use of criminal organizations and proxies, as well as via Quds Force and Ministry of Intelligence operatives deployed throughout the world.

Since the Islamic Republic’s inception, it has targeted perceived enemies and political dissidents in assassinations perpetrated by these proxies and government operatives. In 1980, a former Iranian diplomat turned dissident, Ali Akbar Tabatabai, was assassinated in Maryland by a purported Iranian intelligence-linked network, one of the first known Iranian-backed killings on U.S. soil. In 1991, the intelligence ministry was accused of orchestrating the assassination of former Iranian Prime Minister Shapour Bakhtiar in France, reflecting Tehran’s policy of eliminating opposition leaders in exile.

A more recent example is Masih Alinejad, a New-York based critic of Tehran’s treatment of women, who U.S. prosecutors say has been the target of numerous kidnapping and assassination plots involving both Iranian operatives and an Eastern European organized crime group hired by Tehran.

Iran also reportedly cooperates with criminal groups in Europe, working with them to surveil Israeli targets in France, Germany and the U.K.

U.S. nationals have also been targeted directly. Iranian intelligence operatives were said to be behind the abduction of former FBI agent Robert Levinson in March 2007, for example.

And in 2022, a member of Iran’s Quds Force was indicted in the U.S. for plotting to assassinate former National Security Advisor John Bolton.

The size and number of operatives abroad of both the Quds Force and the Ministry of Intelligence’s operatives are classified, but estimates put the Ministry of Intelligence at around 30,000 personnel and the Quds Force at anything from 10,000 to 21,000.

The contours of Iran’s proxy network

Regionally, a key aspect of Iran’s forward deterrence doctrine has centered on the so-called “Axis of Resistance,” which includes groups like Hamas, Hezbollah and the Houthis. These forces have targeted U.S. and Israeli interests abroad, including in a number of high-profile terrorist attacks.

Characterizing the Axis of Resistance as mere proxies of Iranian foreign policy oversimplifies matters. In reality, the Axis comprises a complex network of strategic partnerships with ideologically aligned but autonomous groups – each with its own agenda, local support base, and relationship with Tehran.

Since its inception in the early 1980s, Lebanon’s Hezbollah has been seen to be Iran’s most reliable proxy when attacking U.S. or Israeli targets. Hezbollah’s external operations arm, Islamic Jihad Organization, was thought to be responsible for the 1983 U.S. embassy and Marine barracks bombing in Beirut, which left over 300 dead, collectively.

Similarly, prosecutors in Argentina believe Iran sponsored and Hezbollah carried out the 1994 bombing of a Jewish community center in Buenos Aires which left 85 dead. Similar efforts have been disrupted in Azerbaijan, Bulgaria and Thailand.

While Hezbollah had amassed a large arsenal and regional strength over the last two decades, its capabilities have been severely hampered by recent Israeli efforts, which saw many of the group’s top brass killed. And it is notable that Hezbollah has not launched any strikes on Israel’s north in concert with Iran’s efforts to counter Israel’s most recent offensive.

Unlike Hezbollah – or Hamas – the Houthis in Yemen remain largely undiminished in regards to their offensive capabilities.

On June 13, the Houthis launched missiles against Israel in response to the attack on Iran.

The Houthis have the capability to severely disrupt shipping in the Red Sea and Strait of Hormuz – a crucial waterway for global shipping.

For months after October 2023, the Houthis targeted commercial ships in the Red Sea. These attacks drove up shipping costs and led to U.S. and other navies escorting ships, exchanging fire and finally a U.S.-led bombing of Houthis in late 2023 and early 2024.

Finally, Iran also has alliances with a series of smaller proxies in Iraq and Syria that could be deployed against U.S. diplomatic and military targets in the region. One such group was behind the deadly bombing of a U.S. military base in Jordan that killed three U.S. soldiers in January 2024.

Iran’s cyberwarfare options

Another potential avenue of retaliation for Iran is a cyberattack – conducted either directly or through a proxy group.

Cybersecurity firm Radware noted a reported 700% spike in malicious online activity in the two days following the launch of the recent Israel operation, which it blamed on Iranian state actors and pro-Iranian hacker groups.

Cyberoperations are embedded in Iran’s broader forward deterrence doctrine.

Over the years, Tehran has built up a network of hacking groups to conduct reconnaissance, disinformation, data theft, sabotage and influence operations. Meanwhile, Iran is increasingly integrating AI tools into its cyberarsenal – making operations more agile, effective and less costly. After the Oct. 7, 2023, attack by Hamas, for example, Iranian-backed cyberactors used AI tools to generate propaganda imagery aimed at influencing Israeli public sentiment.

Then, following Iran’s April 2024 drone strike on Israel, Iranian-backed cyberactors employed AI to create fabricated video clips and images falsely depicting rockets and subsequent explosions launched into the night. These visuals were shared via platforms like X and were aimed at amplifying fear among Israelis.

A new dimension in the conflict

As the conventional warfare between Israel and Iran continues to downgrade Tehran’s military capabilities, the risk of asymmetric retaliation grows.

And Iran’s network of operatives, proxies and cyber actors may be harder to hit than stationary launching sites and military headquarters. They remain active and capable, even amid military degradation and leadership losses.

The more Tehran is pressured through direct strikes, the more likely it is to turn to these unconventional warfare tools. Although less visible, Iran’s unconventional warfare arsenal is a potentially dangerous dimension of this conflict.

The views, conclusions, and recommendations in this article are the authors’ own and do not reflect those of the U.S. government.