The assessment — drafted before Saturday’s large-scale attacks on Iran that killed Khamenei and other senior figures — said Tehran and affiliated groups “probably” pose a threat of targeted violence, while judging a large-scale physical assault on U.S. soil to be unlikely. In the near term, DHS assessed that the more immediate risk comes from low-level cyber operations by Iran-aligned “hacktivists,” including website defacements and distributed denial-of-service (DDoS) attacks targeting U.S. networks and critical infrastructure.