The US killed Soleimani. What will Iran do next?

Militia attacks? Cyberattacks? An attack on a high-level American? Maybe.

In his speech declaring a kind of victory over Iran on Wednesday, President Donald Trump said “Iran appears to be standing down,” implying the threat America faces from the Islamic Republic is over.

But it ain’t over yet.

Militia attacks targeting American forces and US interests in the Middle East, such as Saudi oil fields or the Strait of Hormuz. A large-scale cyberattack that could hurt the world oil market and impact the presidential election in November. And possibly a years-long effort to assassinate high-level US government targets.

Experts say these are some of the ways Tehran might further retaliate for the US killing of Qassem Soleimani. Abdollah Araghi, a senior Iranian military commander, said Thursday — just two days after Iran attacked two US military sites in Iraq — that the country will exact a “harsher revenge soon.”

That could just be bluster, of course. Even if it isn’t, it doesn’t mean a new attack is imminent. Several experts I spoke to said Tehran has plenty of time — years, even — to strike the US again.

But nearly everyone I spoke to said Iran will almost certainly attack the US again at some point. “There’s enough anger and emotion that Iran will want to do something, or at least it’ll try,” Ilan Goldenberg, the Defense Department’s Iran team chief from 2009 to 2012, told me.

Here’s what that could look like, from a small-scale strike to one of America’s leaders killed.

Iran could use proxy forces to kill Americans

For decades, Iran has used militia forces and other proxies throughout the Middle East to spread influence and attack enemies like Israel and Saudi Arabia. Using these groups gives Tehran an extra degree of separation to deny any involvement, whether that’s launching rockets at embassies or bombing oil fields.

Experts are unanimous that Iran will stick with that tried-and-true practice to hit back at the US.

“Tehran is likely to continue to work through its proxies in the region to attack the US and its partner interests, as well as global commercial interests like energy,” Becca Wasser, an Iran expert at the Rand Corporation, told me. “These attacks will be designed to remain well below US thresholds, have maximum ambiguity to make it difficult to trace back to Iran, and will largely take place in the Middle East rather than farther afield.”

We’ve seen Iran’s clients wreak havoc in the region before.

In 2006, Hezbollah, an Iran-backed terrorist group in Lebanon, and Israel battled in a month-long war where the militant group fired more than 4,000 rockets into Israel and Israeli forces fired around 7,000 bombs and missiles into Lebanon.

About 160 Israeli troops and civilians died, according to the Israel Ministry of Foreign Affairs, along with about 1,100 Lebanese — most of them civilians, per Human Rights Watch, a US-headquartered advocacy organization. It also reports about 4,400 Lebanese were injured, and around 1 million people were displaced.

Marwan Naamani/picture alliance via Getty Images

But that’s not all. Iran could encourage terrorist organizations or other proxies to strike inside Saudi Arabia, the United Arab Emirates, and other Gulf nations. Last year, it planned and executed drone strikes on two major Saudi oil facilities deep inside the kingdom, convulsing world markets.

It’s unclear how much appetite Iran might have for that in the short term, though.

“For a while, Iran probably believed Trump was conflict-averse for wanting to get the US out of the region, and not into another war. The strike on Soleimani really called into question that belief,” Eric Brewer, who worked on Iran issues in Trump’s National Security Council, told me. “That’s probably leaving the Iranians wondering which Trump is going to show up on any given day.”

However, there are already signs of Iranian proxies using violence. Small rockets landed in Baghdad’s heavily fortified Green Zone on Wednesday. There were no casualties, but it was a sign that regional militias — with direct or indirect Iranian support — can still target Americans.

Iran, then, doesn’t need to do too much to work through proxies to get back at the US. It just has to do what it’s done up until now. That’s why top Trump officials, including Defense Secretary Mark Esper, call out the proxy issue in their messaging about confronting Iran.

Iran could launch a devastating cyberattack

Iran has shown time and time again that it has very sophisticated cyber capabilities.

Starting in 2011, for example, it attacked more than 40 American banks, including JPMorgan Chase and Bank of America. As a result, the banks had trouble serving their customers and customers had trouble using the bank’s services.

In 2012, Iran released malware into the networks of Saudi Aramco, a major oil company, which erased documents, emails, and other files on around 75 percent of the company’s computers — replacing them with an image of a burning American flag.

And there’s no reason Iran couldn’t use its cyber prowess again to hit America. Beau Woods, a cyber expert at the Atlantic Council, explained to me how Tehran might do so.

In the short term, Iran may choose to deface US government websites and begin to probe other online US government properties for vulnerabilities. This has seemingly already happened: The website for the Federal Depository Library Program was hacked last week, and for a time it showed a message in support of Soleimani as well as an image of Trump getting punched in the face.

The attack wasn’t technically a big deal, and it could have been carried out by an amateur hacker with or without Iranian government approval. “These attacks are largely a distraction,” said Woods, “but it takes a toll on the American psyche if there are US websites that brag about how great Iranian hackers are.”

In the medium term, Iran may try to disrupt the US election in November, Woods also noted. Tehran has already shown an ability to interfere in America’s democracy.

Last May, the prominent cybersecurity firm FireEye released information about social media accounts, created between April 2018 and March 2019, coming out of Iran that were purposely impersonating Americans and even Republican candidates for Congress. In some cases, the fake users weighed in on the Trump administration’s tough policy toward the Middle Eastern country, such as its decision to designate an elite Iranian military unit as a terrorist organization that April.

With Iran’s knowhow and 11-month lead time, experts say there’s a good chance Iran could find a way to interfere with the election.

Stephanie Keith/Getty Images

Iranian officials may also decide they want to target a specific American city to make it harder for the local government to, well, govern. In 2018, two Iranian hackers launched a ransomware attack on Atlanta that made it harder for local officials to do routine things like collect taxes or account for who paid their water bill. “I’ve got friends there who work in the government who said the attack was devastating for providing services to their citizens,” Woods told me.

In the long term, Iran may try to pull off a massive attack on America’s defense-industrial companies or even critical infrastructure like the electrical grid or energy sectors. “Iran likely has a foothold in a fair bit” of these places, said Woods. The good news, though, is that it could take years for Iran to pull off a cyberstrike of that magnitude.

“We probably wouldn’t see anything for a little while at the state-capability level,” Woods continued. However, he noted, if Iran already has plans or ready-to-go capabilities, then the timeline may be shorter.

The question, then, is how Trump would respond. The US reserves the right to use military force after a cyberattack, or launch a massive cyberstrike of its own. Indeed, likely in coordination with Israel, the US unleashed the Stuxnet digital weapon on Iran’s nuclear program, causing many centrifuges to fail.

But it’s unclear if Trump will ask for bombs to drop should Iran choose to attack online. “A cyberstrike won’t elicit a US military response, but I guess it depends how dramatic it is,” Goldenberg, who is now at the Center for a New American Security, told me.

Iran will work to force US troops out of the Middle East

On Wednesday, the day after Iran retaliated for the Soleimani killing, Iranian President Hassan Rouhani said his nation’s final act will be to get all US forces out of the region. It’s unclear how broadly Iran defines that, but it’s likely Tehran means it wants the US out of the Middle East altogether and not just Iraq.

As a start, though, Tehran will work through its political allies in Baghdad to diplomatically send American fighters back home.

Iran has already had some success in this regard. Iraq’s parliament passed a nonbinding resolution on Sunday calling for America’s roughly 5,000 troops to leave the country as a result of the Soleimani strike. Trump brushed off an immediate exit and went as far as to say he would impose harsh sanctions on the country if it forced out US troops.

But then confusion reigned on Monday. A letter from US Marine Brig. Gen. William Seely to Iraqi Lt. Gen. Abdul Amir that became public detailed plans for “repositioning forces over the course of the coming days and weeks to prepare for onward movement.”

“We respect your sovereign decision to order our departure,” the letter continued.

But Esper and Army Gen. Mark Milley, the Joint Chiefs chair, both denied there was a change in US policy and claimed the letter was sent to the Iraqi government by “mistake.” However, it does appear that US forces will be relocating to safer areas inside Iraq and elsewhere in the Middle East.

Haydar Karaalp/Anadolu Agency/Getty Images

Iran doesn’t want to ruin this momentum, Goldenberg told me, so there’s a good chance Iran will not do anything too provocative in Iraq for the time being. “Iraqis just want their country back at this point,” he said. “They hate being stuck in the middle, on the chessboard where the US and Iran are fighting.” If Iran restrains itself, it will have more clout with Baghdad to seek America’s military expulsion.

Iran’s realistic kick-the-US-out-of-the-region options may be limited to Iraq, as the US has thousands of troops stationed throughout the Middle East, including in countries that are adversarial to Tehran.

But for now, it seems, Iran’s anti-US military efforts may lead to a period of relative calm.

Iran may try to kill a prominent American official

Experts say Iran may seek a reciprocal retaliation for Soleimani’s death — killing a high-level US government official like a four-star general or an ambassador — but that’s a lot harder to pull off than any of the above options.

“We are monitoring them,” a White House official told me on the condition of anonymity to discuss a sensitive matter, “but it’s doubtful they will do anything stupid.”

What’s more, Iran isn’t particularly good at the top-level assassination. In 2011, for example, an Iranian operative tried to kill the Saudi ambassador to the US in a swanky Washington restaurant. The plan, however, was foiled and Tehran didn’t get the dramatic kill it hoped for.

Should Iran try something like this again — only this time targeting an American — it would take years to pull off, experts say. Between gaining the resources, training, and evading global law enforcement, any movement on this plot would likely be slow and deliberate.

By that point, the US may have already responded to lower-level threats, making Iranian leaders think twice before greenlighting a headline-making assassination.

“Over time, Iran may gradually raise the stakes of its activities, butting up to US red lines but not crossing them, in order to test US reactions and resolve,” says the Rand Corporation’s Wasser. “Think of it as Iran dipping a toe in the water and pulling it out to see if anyone noticed, over and over again, until its whole leg is in the water.”

Which means it’s unlikely Iran would make the biggest splash, surely requiring a US response. But there’s no question that Iran — whether with proxies, cyber, or even politics — can do a lot to hurt the Trump administration and America down the line.