Iran Faces Rising Internal Sabotage Risks as Regime Avoids External Escalation

The Iranian regime has routinely blamed gas leaks for events such as explosions, a practice that serves multiple purposes: avoiding public acknowledgment of security failures, limiting pressure to retaliate, and minimizing domestic perceptions of regime vulnerability. Acknowledging sabotage would highlight the state’s inability to protect critical infrastructure and senior figures, a narrative Tehran is keen to suppress. Nevertheless, the frequency, geographic spread, and targeting patterns of these incidents strongly suggest sabotage and subversion rather than coincidence or negligence.

Iran faces a broad threat landscape beyond its principal adversaries, the US and Israel. Several anti-government groups operate inside Iran, including the Mujahedin-e Khalq (MEK), as well as Baluchi, Arab, and Kurdish separatist networks. These groups maintain an operational tempo that includes regular clashes with Iranian security forces and have both the motivation and, in some cases, the capability to conduct sabotage operations against regime-linked targets.

• As armed opposition groups and protesters, increasingly radicalized by state repression, perceive weaknesses within the regime, attacks on government personnel and institutions are likely to increase.

In the aftermath of the explosions, Iran canceled a planned live-fire naval exercise scheduled for Feb. 1–2 in the Strait of Hormuz. This decision may reflect de-escalatory signaling amid ongoing negotiations with the US. On Feb. 1, Iranian Foreign Minister Abbas Araghchi stated that US Central Command (CENTCOM) had requested professionalism from Iranian forces, implying US pressure regarding the conduct and timing of Iranian military activities. Iran’s compliance may have been intended as a gesture of restraint and good faith.

• Additional explosions or sabotage incidents across Iran remain likely amid continued high tensions. Opposition groups and external adversaries will continue efforts to degrade Iran’s command-and-control architecture, sow internal instability, and shape conditions for potential follow-on military or covert operations.
• The regime’s continued insistence on attributing such incidents to accidents is unlikely to deter these actors and may further embolden them by signaling Tehran’s reluctance to publicly acknowledge or respond to asymmetric attacks.

If sabotage inside Iran continues without clear attribution to the US or Israel, Tehran is likely to absorb the pressure rather than respond externally. The regime’s priority would remain regime survival and escalation control, even at the cost of appearing vulnerable. For clients, this means that isolated explosions or assassinations inside Iran do not automatically translate into immediate regional retaliation or a sharp deterioration in the operating environment.

However, the risk profile changes materially if Iran concludes that a senior figure has been killed by an overt US or Israeli action. In that scenario, retaliation would be likely but selective. Iran would avoid indiscriminate escalation and instead target US or Israeli interests that allow for signaling without forcing a full-scale conflict. Likely targets would include US military assets in Iraq, Bahrain, or Kuwait, as well as maritime activity in and around the Strait of Hormuz.

• For clients, the principal risk is not spontaneous escalation following sabotage, but miscalculation following attribution. The operating environment would remain uneven rather than uniformly hostile, with heightened risk concentrated around military-linked infrastructure, shipping, and high-visibility Western assets rather than across the commercial landscape as a whole. 

Crisis24 provides global expertise and real-time intelligence to help you navigate any threat, at any time. Our medical and security specialists stand ready to guide your preparedness, response, and recovery efforts.