X-twitter Youtube
Two Bases, One War - MacDill AFB & RAF Fairford

MacDill Breach & RAF Fairford Plot: Two Bases, One War

  • Classification: Public Release

Bottom Line Up Front (BLUF)

A violent breach at CENTCOM's headquarters and five arrests beside Britain's U.S. bomber base, twelve hours apart. CommandEleven Intelligence documents every 2026 incident at both installations and tests them against the Iran war's rear-area campaign - separating what connects them from what does not.

Bottom Line Up Front

On Saturday 26 September 2026, a civilian with no authorized access breached the perimeter of MacDill Air Force Base in Tampa, the headquarters of U.S. Central Command (CENTCOM) and U.S. Special Operations Command (SOCOM), and fought base security at the Dale Mabry Gate before being detained. Less than a day later, in the early hours of Sunday 27 September, five young British men were arrested beside RAF Fairford in Gloucestershire, the only mainland UK base from which U.S. heavy bombers have been flying strike missions against Iran.

The two events are separated by an ocean and, on current public evidence, by any demonstrated operational link. But they are not unrelated. Both installations are load-bearing nodes of the same war: MacDill is where the Iran campaign is commanded; Fairford is where its long-range bombers launch in Europe. Both have now absorbed repeated security incidents in 2026. And the MacDill incident history includes the most serious attack attempt on a U.S. command headquarters in years – an improvised explosive device left at the base’s Visitor Center on 10 March by a 20-year-old who then fled to China – whose claimed authors explicitly saluted a European sabotage cell.

This dossier documents every publicly reported 2026 incident at both bases, tests them against CommandEleven Intelligence’s working Rear-Area Hypothesis (that the Iran war is being extended, through proxies and deniable fronts, to the home soil of the states hosting its launch points), and sets out where the evidence supports that thesis, where it cuts against it, and what would settle the question.

The short answer: the public record supports a target-selection convergence and a striking set of behavioral similarities, but it does not yet support a common controller. The strongest cross-Atlantic thread is not Iranian at all – it is an ideological “internationalist underground” branding layer that connects the MacDill IED claim to the March 2026 arson in Pardubice, Czech Republic, and which European investigators themselves suspect may be a cover for state activity. The 26 September MacDill breach, on current evidence, looks more like a lone disturbed or opportunistic actor than a probe.

Two Bases, One War: The 2026 Incident Timeline

Timeline of 2026 security incidents at MacDill AFB and RAF Fairford, February to September, with European proxy-sabotage events for context.

Figure 1. The 2026 incident timeline across MacDill AFB, RAF Fairford, and the European proxy-sabotage context. CommandEleven Intelligence original graphic.

Key Judgments

  • KJ1 – [CONFIRMED] Both bases are primary nodes of the U.S. war against Iran and both have been under sustained, elevated threat since February 2026. MacDill houses CENTCOM, which has directed Operation Epic Fury since the U.S.-Israeli offensive began on 28 February. RAF Fairford hosts the B-1B Lancers flying strike missions against Iran, and on 23 July the IRGC publicly named it a legitimate target. MacDill has operated at or above heightened alert since the war’s opening days and went to FPCON Charlie – the second-highest force protection condition – in March.
  • KJ2 – [CONFIRMED] MacDill has suffered at least four distinct security incidents in 2026, only one of which has a demonstrated operational purpose. These are: the 10 March IED at the Visitor Center (Alen Zheng, indicted, in China); the 18 March threatening phone calls that triggered a shelter-in-place (Jonathan Elder, charged, assessed by investigators as a disturbed individual with no link to the IED); the 9 April threat that emptied the MacDill Inn (unattributed); and the 26 September violent perimeter breach (suspect detained, unidentified). The pattern is one serious attack attempt surrounded by copycat, hoax and opportunistic noise – a noise layer that itself consumes force-protection capacity.
  • KJ3 – [ASSESSED, moderate confidence] The RAF Fairford incident is genuinely ambiguous and should not yet be described as a foiled bomb plot. UK Counter Terrorism Policing (CTP) recovered petrol but no explosives from three vans, released all five suspects on bail within about 36 hours, and is openly weighing fuel theft, hostile reconnaissance or a “dry run,” and action by proxies working “knowingly or unknowingly” for a foreign state. Reports that one of the suspects called 999 roughly an hour before a local farmer raised the alarm deepen the ambiguity rather than resolve it.
  • KJ4 – [ASSESSED, moderate confidence] The strongest demonstrable transatlantic link is ideological branding, not command-and-control. The anonymous video claiming the MacDill IED for a “New Weathermen Underground” congratulated the “Earthquake Faction” for the 20 March arson at an LPP Holding defence plant in Pardubice. Czech investigators found that the Earthquake Faction’s web domain was registered the day before the attack and have examined both a false-flag scenario and a possible Russian link. A branded, transnational “anti-war/anti-Zionist underground” that mixes genuine militants with possibly state-steered cut-outs is the most important connective tissue in this dossier.
  • KJ5 – [ASSESSED, moderate confidence] The Rear-Area Hypothesis is supported at the level of targeting and threat intent, but not yet at the level of attribution. Tehran has declared the relevant bases targets, and Iran’s well-documented use of criminal and unwitting proxies in the UK fits the Fairford profile. Secretary of State Rubio’s public assertion of foreign-actor involvement is a significant data point, but UK authorities have not confirmed it, and the MacDill prosecutors reported no immediate evidence that Zheng acted for China or any other state.
  • KJ6 – [ASSESSED, high confidence] The behavioral “rhyme” between the MacDill IED and Fairford is real and analytically important. In both cases young men operated at night against a war node, used a deception element (a separately purchased phone for the warning call at MacDill; counterfeit fuel-company livery on a van at Fairford), and, most unusually, a participant contacted the emergency services himself. Whatever the motive, this self-reporting pattern is atypical of disciplined state-directed operations and more typical of ideologically framed actors who “warn” before acting, or of recruited amateurs whose resolve breaks.
  • KJ7 – [SPECULATIVE] The two late-September incidents falling within roughly twelve hours of each other is most likely coincidence, but it cannot yet be dismissed. Nothing public connects the MacDill breacher to the Fairford five. The value of recording the timing is as a tripwire: if either investigation surfaces shared online ecosystems, handlers, or payment channels, the hypothesis would move sharply.

Strategic Context: Why These Two Bases

MacDill AFB – the command node

MacDill, on the Interbay Peninsula in South Tampa, is not a conventional flying base that happens to host a headquarters. It is the seat of two combatant commands – CENTCOM, responsible for U.S. military operations across the Middle East, Central Asia and parts of South Asia, and SOCOM, which organizes, trains and equips U.S. special operations forces worldwide – alongside the Joint Communications Support Element and the 6th Air Refueling Wing, which flies KC-135 Stratotankers and is transitioning to the KC-46 Pegasus. [CONFIRMED]

Since 28 February 2026, when the U.S. and Israel launched their joint offensive against Iran, CENTCOM at MacDill has been the operational headquarters of Operation Epic Fury. That makes MacDill the single most symbolically and functionally significant U.S. installation in the war after the Pentagon itself. It also means MacDill personnel have carried the war’s human cost directly: of the six airmen killed when a KC-135 tanker crashed in Iraq on 12 March, three were stationed at MacDill. [CONFIRMED]

Force protection rose accordingly. U.S. Northern Command raised FPCON levels at stateside installations from the war’s first days, and MacDill has been operating under heightened security since the campaign began. [CONFIRMED]

RAF Fairford – the European launch point

RAF Fairford, near Cirencester, is a Royal Air Force station operated as a U.S. Visiting Forces forward operating location, home to the USAF’s 501st Combat Support Wing detachment and long-range bomber rotations. It is the only base on the British mainland from which U.S. heavy bombers have been flying missions in this war. B-1B Lancers and B-52 Stratofortresses have staged there during the Iran campaign. [CONFIRMED]

On 22 July 2026, B-1Bs flew a strike mission against Iran from Fairford. The following day the IRGC – in a statement distributed via its Telegram channel and carried by Tasnim – warned Britain that any base used for attacks on Iranian soil is a legitimate target, singling out the bomber flights from Fairford. [CONFIRMED] – Iranian state-affiliated outlets framed this as Public Relations Announcement No. 46 during the IRGC’s Operation Nasr-2 retaliatory waves. [CONFIRMED as reported; announcement numbering single-sourced]

That warning converted Fairford from a routine rotational site into a named target, and placed British territory explicitly within Tehran’s declared retaliatory envelope.

The shared vulnerability: the rear area

Iran’s asymmetric doctrine, which CommandEleven Intelligence documented across its six-part Iran War Doctrine & Strategy series, relies on imposing costs where an adversary cannot easily defend. The Gulf bases have been attacked directly by missiles and drones throughout the war. Stateside and European bases are beyond that reach for all practical purposes – but not beyond the reach of proxies, sympathizers, criminals-for-hire, and the “unwitting.” The question this dossier tests is whether 2026’s incidents at MacDill and Fairford are evidence of that rear-area extension, or a coincidental cluster of domestic events at two very visible targets.

MacDill 2026: A Chronology of Pressure

Table comparing the MacDill IED, the MacDill perimeter breach and the RAF Fairford arrests across nine observable features.

Figure 2. Observable features across the three principal incidents, as publicly reported by 30 September 2026. CommandEleven Intelligence original graphic.

Incident One – the Visitor Center IED (10–26 March)

This is the gravest incident on either side of the Atlantic, and the only one in which a functioning attack attempt is established on the public record.

  • The placement – According to the federal indictment and statements in court, on the evening of 10 March 2026, 20-year-old Alen Zheng of Land O’Lakes attempted to detonate an improvised explosive device at the MacDill Air Force Base Visitor’s Center, beside the Dale Mabry Gate. The device was left in a secluded spot near the Visitor Center. It did not function. [CONFIRMED – DOJ, MDFL]
  • The warning call – Minutes after the placement, a 911 call reached the Tampa Police Department stating that a bomb had been placed at MacDill, without giving a precise location. MacDill personnel searched but did not find the device. Investigators later tied that call, through phone data, to Zheng – and obtained footage from a Best Buy showing him buying the phone used to make it. [CONFIRMED – U.S. Attorney Gregory Kehoe, as reported by AP/CBS/FOX 13]
  • The flight – The day after the call, Zheng and his 27-year-old sister, Ann Mary Zheng, sold the Mercedes-Benz SUV used to transport the device (to CarMax, per prosecutors) and booked flights to the People’s Republic of China. Both had left from Tampa by 12 March. [CONFIRMED]
  • The discovery – On 16 March – six days after placement – an Air Force service member found the device near the Visitor Center. The FBI’s screening identified possible energetic materials. The Dale Mabry Gate area was closed and traffic diverted to the Bayshore Gate. [CONFIRMED] On the night of 17 March, MacDill raised its posture to FPCON Charlie, a level applied when an incident has occurred or intelligence indicates terrorist targeting is likely. [CONFIRMED] The same day, Joint Base McGuire-Dix-Lakehurst in New Jersey also went to FPCON Charlie over a suspicious package – a reminder that MacDill’s scare sat within a broader, war-driven spike in installation alarms. [CONFIRMED]
  • The arrests and indictments – Ann Mary Zheng returned to the United States and was stopped at Detroit on 17 March. She was indicted for being an accessory after the fact and for evidence tampering. Alen Zheng was indicted on three counts – attempted damage of government property by fire or explosion, unlawful making of a destructive device, and possession of an unregistered destructive device – carrying a five-year mandatory minimum and up to 40 years. A search of his home found components consistent with the device. According to prosecutors, his mother and sister acknowledged to agents that they knew he had planted it; the mother was separately detained by immigration authorities. The indictments were unsealed on 26 March; FBI Director Kash Patel announced that the primary suspect remained in China. [CONFIRMED]
  • The profile – Zheng was an undergraduate accounting student at the University of South Florida from summer 2024 through fall 2025, per WUSF. [CONFIRMED] Crucially, U.S. Attorney Kehoe said investigators had no immediate evidence that Zheng was working for the Chinese government or any other country. [CONFIRMED]
  • The China question – The United States has no extradition treaty with China. A photograph reportedly recovered from Ann Mary Zheng’s phone – an accommodation registration form for a person from abroad – was circulated on X as showing Alen Zheng permitted to stay in China until 2028 at a family home in Fujian Province. [SPECULATIVE – single-source social-media claim, not confirmed by DOJ] Flight to a non-extradition jurisdiction is consistent both with state facilitation and with an ordinary dual-heritage family using its overseas ties to escape prosecution; the latter requires fewer assumptions and is where the public evidence currently rests. [ASSESSED]

Editorial note on technical detail – Consistent with CommandEleven Intelligence’s standing policy, this dossier contains no information on the device’s construction, components or failure mode. That material is not needed to assess the strategic significance of the incident.

The “New Weathermen Underground” claim (23 March)

On the night of Monday 23 March, the Tampa Bay Times’ investigative editor received a roughly three-minute video via Signal. A silhouetted figure speaking through a voice-altering filter claimed responsibility on behalf of a group calling itself the “New Weathermen Underground.” [CONFIRMED – Tampa Bay Times]

What made the video significant was that it contained information not yet public – including the 10 March placement date and the 911 call – which is why the Times handed it to the FBI’s senior Tampa official within minutes of the newsroom reviewing it. [CONFIRMED] According to reporting on its contents, the speaker:

  • acknowledged the device had failed, claimed the group had since fixed the problem, and promised a “newly improved design” in coming days [CONFIRMED as reported]
  • framed the attack as opposition to the Iran war, alongside grievances over immigration enforcement and DHS budget increases [CONFIRMED as reported]
  • repeatedly used “we,” implying more than one participant [CONFIRMED as reported]
  • congratulated the “Earthquake Faction” for a fire at a Czech Republic warehouse earlier in March. [CONFIRMED as reported – Post Millennial/OAN summarizing the Times]

The name deliberately invokes the Weather Underground, the 1970s far-left group that claimed more than two dozen bombings. Whether the “New Weathermen Underground” has any existence beyond this video is [DATA DEFICIT]. Its possession of non-public detail means the video was produced by, or with direct knowledge of, the people involved – not by an opportunist. The threatened follow-on attack did not materialize.

Incident Two – the 18 March threat calls and shelter-in-place

On the morning of 18 March, two days after the device was found, MacDill ordered a shelter-in-place and closed its gates for several hours after a threatening call to the base’s main line. [CONFIRMED]

The FBI traced the calls to Jonathan James Elder, 35, of St. Petersburg (also reported as Palm Harbor), living in an assisted-living facility. One call, placed at 8:50 a.m. to a number not affiliated with MacDill, referred mockingly to pipe bombs at the front gate; the 9:11 a.m. call to MacDill’s main line asked how staff had liked “the surprise” at the Visitor Center. [CONFIRMED – criminal complaint] His phone showed he had read news coverage of the device and searched for the base’s number before calling. He had been identified as a person of concern in a 2025 threat assessment, had been the respondent of a since-expired risk protection order, and had himself phoned the FBI’s National Threat Operations Center on 4 March asking for a job. He admitted the calls and described them as meaningless. [CONFIRMED]

Prosecutors and the AP stated there was no connection between Elder and the Zhengs. [CONFIRMED] Elder is best understood as the “echo” of a real attack: a disturbed individual amplifying a live incident. The operational lesson is not his intent but his effect – he generated the single largest disruption of the March sequence.

Incident Three – the MacDill Inn evacuation (9 April)

At just before 8 p.m. on 9 April, MacDill evacuated the MacDill Inn – its roughly 350-room on-base lodging, used mainly by temporary-duty personnel, contractors and official visitors – after an unspecified threat. The threat was declared cleared and operations resumed shortly after 10:30 p.m. [CONFIRMED] No details of the threat, its source, or any arrest have been released. [DATA DEFICIT]

Incident Four – the 26 September perimeter breach

At around 1 p.m. on Saturday 26 September, a civilian without base access breached the MacDill perimeter and “violently engaged” security personnel, according to the 6th Air Refueling Wing’s public affairs office. Both the intruder and one security officer were taken for treatment of non-life-threatening injuries. The Dale Mabry Gate was closed to inbound and outbound traffic from mid-afternoon while the Bayshore Gate stayed open. The base later reported no continuing threat and resumed normal operations. [CONFIRMED]

What is not known is almost everything that matters analytically [DATA DEFICIT]:

  • the intruder’s identity, age and background
  • how the perimeter was crossed – on foot, by vehicle, or through a gap – and exactly where
  • whether the intruder carried anything
  • motive, and whether the confrontation was the goal or the consequence of being intercepted
  • whether charges will be misdemeanor unauthorized entry (18 U.S.C. § 1382, up to six months) or felony assault on federal personnel, or both

Assessment –  A daylight, single-person breach ending in a physical fight at the most heavily used gate of an installation at elevated alert is a poor fit for hostile reconnaissance, which values invisibility, or for a state-directed probe, which would avoid producing a named detainee. It fits better the profile seen repeatedly at U.S. installations: mentally disturbed individuals, intoxicated drivers, or people fleeing police who choose a gate as a confrontation point. [ASSESSED, moderate confidence] This judgment will be revised the moment the individual is identified and charged.

RAF Fairford: The 27 September Interdiction

What happened

Piecing together the police statements and the most reliable reporting:

  • ~00:45 BST, Sunday 27 September – Gloucestershire Police receive a call about three suspicious vehicles travelling toward RAF Fairford. [CONFIRMED – BBC, citing police] The Times, followed by the BBC and the Guardian, reported that this first call came from one of the suspects himself, almost an hour before the public alert that followed. [CONFIRMED as reported; motive unknown]
  • ~01:00–01:40 – A farmer from the village of Whelford, immediately east of the airfield, returns home to find three white vans blocking the road and her driveway, and a large group of hooded, masked men – some reports say up to ten – who scatter in her headlights. She first rings the MoD police at the base and gets no answer, then dials 999 (reported at 1:36 a.m.; she showed CNN a log reading 1:40). Armed police arrive within 10–15 minutes. [CONFIRMED as reported]
  • Overnight – Police declare a major incident, set a roughly 400-metre cordon, and evacuate around 85 homes in Whelford. Army bomb-disposal teams examine the vans with a robot. Five men are arrested, first on suspicion of Explosives Act offences and then on suspicion of preparing an act of terrorism. [CONFIRMED]
  • Sunday – President Trump calls the arrests “fantastic” and says U.S. and UK authorities had been watching the men for some time. UK authorities decline to comment on that assertion. [CONFIRMED – the claim of prior surveillance is unconfirmed by the UK]
  • Monday 28 September – Counter Terrorism Policing names the suspects only as British nationals aged 23 to 25 from London, and releases all five on strict bail after “extensive interviews.” Prime Minister Andy Burnham chairs a Cobra meeting and urges the public not to speculate. Trump says he would not have released them and that the case “might be” linked to Iran. That evening Secretary of State Rubio tells Fox News the incident “clearly involves the hands of a foreign actor,” declining to give details. Iran’s embassy in London condemns attempts to link Tehran to the arrests. [CONFIRMED]
  • Tuesday 29 September – Assistant Commissioner Laurence Taylor, head of UK Counter Terrorism Policing, confirms a quantity of petrol but no explosives was recovered from the vans, and says lines of inquiry include activity by proxies or individuals working, knowingly or unknowingly, on behalf of a foreign state. [CONFIRMED]
  • Wednesday 30 September – Police say investigative scenes around Fairford will be fully closed down. [CONFIRMED]

The livery clue

BBC Verify examined a verified image showing a red “Fuel 2You” logo and a mobile number on one of the vans and found no evidence that “Fuel 2You” is a legitimate business or real brand operating in the UK. [CONFIRMED – BBC Verify] Reporting summarized by secondary outlets describes empty fuel drums in the vans and one vehicle bearing markings copied from a local fuel distributor. [SPECULATIVE – secondary reporting of a Mirror account; not confirmed by police]

A counterfeit fuel-delivery livery serves any of the competing explanations: it is exactly what a fuel-theft crew would use to siphon from a large depot unchallenged, and exactly what a hostile team would use to explain vans and fuel near an airfield perimeter at night.

The competing explanations, as police frame them

Counter Terrorism Policing has been unusually explicit that it is keeping multiple lines open:

  • Fuel theft – in a period of sharply higher fuel prices, a gang targeting the base’s fuel supply for profit. The number of vans and the recovered petrol fit this; balaclavas and flight fit any criminal enterprise. **[ASSESSED – plausible]**
  • Hostile reconnaissance or a dry run – testing response times, access routes and alarm behavior ahead of a later attack. The farmer’s account that her call to base police went unanswered is exactly the kind of gap a reconnaissance team would be looking for. [ASSESSED – plausible]
  • Proxy action for a foreign state, knowing or unwitting – the model MI5 has documented repeatedly, in which Iran and Russia hire criminals or recruit via online platforms to carry out tasks they may not fully understand. [ASSESSED – plausible; publicly asserted by the U.S., not confirmed by the UK]
  • Non-state militant or protest-derived action – Fairford has a long history as a focus of anti-war direct action, including the 2003 “Fairford Five” sabotage attempt at the start of the Iraq war. [CONFIRMED – historical precedent]

The transatlantic attribution gap

The most important political fact about Fairford is the gap between Washington and London. The U.S. President and Secretary of State have publicly asserted foreign involvement and prior surveillance; British police have released the suspects and confirmed no explosives. Middle East Eye and others have framed this as a narrative that “fell apart.” [CONFIRMED – that the gap exists]

CommandEleven Intelligence’s reading is more cautious in both directions. Bail within 36 hours and the absence of explosives are not exoneration – British counter-terrorism practice often releases suspects on strict conditions while digital forensics continue, and Taylor described bail as grounded in “experience and strategy.” Equally, a U.S. official’s confidence is not evidence the public can assess. Until one of the two governments shows its working, the foreign-actor claim should be carried as [ASSESSED – asserted by a senior official, unverified], not as fact.

The European Baseline: How Proxy Sabotage Actually Works

To judge whether Fairford looks like state proxy work, it has to be measured against the proxy operations that *have* been proven in European courts. Three reference cases matter.

The Leyton warehouse (Russia/Wagner, 2024)

On 20 March 2024, a warehouse in Leyton, east London, storing generators and Starlink equipment destined for Ukraine was set alight, causing well over £1 million in damage. The ringleader, Dylan Earl, had contacted the Wagner Group on Telegram and told his handler he wanted to carry out a series of “missions.” He and Jake Reeves recruited others – men prosecutors described as amateurs motivated by money they were never actually paid – to set the fire, and planned follow-on arson and a kidnapping in Mayfair. Earl was sentenced in October 2025 to a total of 23 years. [CONFIRMED – UK CTP / Old Bailey]

Relevance – young British men, recruited online, paid (or promised) in cash, using fire rather than explosives against a war-support target, with the state sponsor several steps removed. This is the template against which Fairford should be read.

The London antisemitic arson series (Iran/IRGC, 2026)

From 23 March 2026, a wave of arson attacks hit Jewish community sites in London, including the torching of four Hatzola volunteer ambulances. A previously unknown group – the Islamic Movement of the Companions of the Right (Harakat Ashab al-Yamin al-Islamia) – claimed seven attacks. On 13 July, the UK government assessed that IRGC Quds Force members were “almost certainly” directing the group, banned support for both the IRGC and the group, and simultaneously designated Russia’s GRU Volunteer Corps under the new National Security (State Threats) Act 2026. Home Secretary Shabana Mahmood accused Tehran and Moscow of using proxies and thugs to do their dirty work in Britain. [CONFIRMED]

Relevance – it proves, on the British government’s own assessment, that the IRGC ran a proxy arson campaign inside the UK during this war, using a freshly minted front name. It also shows the new legal architecture – designation that removes the need to prove a direct state link in each prosecution – that the Fairford case could eventually be tested against.

The MI5 threat picture

MI5 Director General Sir Ken McCallum stated in October 2025 that the Service had tracked more than twenty potentially lethal Iran-backed plots in a single year, and has repeatedly described Iranian and Russian services using criminal proxies – from international drug traffickers to low-level crooks. [CONFIRMED – MI5] Russian services in particular recruit on social media, task via encrypted apps and pay in cryptocurrency. [CONFIRMED – MI5]

Relevance – the “knowingly or unknowingly” language Taylor used about Fairford is lifted directly from this operating picture. It is not a hedge; it is a description of how these operations are designed.

Pardubice and the “Earthquake Faction” (March 2026)

Before dawn on 20 March 2026, a deliberately set fire destroyed a warehouse and spread to an administrative building at LPP Holding in Pardubice, east of Prague – a drone, optics and defence firm that had once announced (but, it says, never implemented) cooperation with Israel’s Elbit Systems, and that reportedly supplies Ukraine. A previously unknown group, the Earthquake Faction, claimed it as a strike on “the epicenter of the Israeli weapons industry in Europe,” citing genocide against Palestine, Iran and Lebanon, and posted footage of masked individuals setting the fire. [CONFIRMED]

Czech police traced claim emails to the same domain as the group’s website – a domain registered the day before the attack. Security officials told Seznam Zprávy they were weighing a false-flag operation, and LPP said police were also checking a possible Russian link. Arrests spread across the Czech Republic, Slovakia, Poland and Bulgaria, with at least seven detained, including U.S. nationals, and terrorism charges laid. [CONFIRMED]

Relevance – this is the thread that ties Europe directly to MacDill. The MacDill claimants did not merely share a worldview with the Earthquake Faction; they named and saluted it within days. And the Earthquake Faction itself is exactly the kind of brand – instant, ideologically resonant, transnational, with a recruitment pool that includes Americans – that a state service could seed, steer or simply exploit.

Testing the Rear-Area Hypothesis

The hypothesis, stated

CommandEleven Intelligence’s working hypothesis, developed across the Iran Homeland Threat dossier and the Iran War Doctrine & Strategy series, holds that:

  • Iran’s asymmetric doctrine treats the home soil of states hosting the war’s launch points as part of the battlespace
  • that campaign is executed through deniable layers – criminal proxies, unwitting recruits, ideological front brands, and pre-positioned actors operating on standing conditions rather than live orders – which leave little command trail to intercept
  • adversaries aligned with Iran, particularly Russia, have shared interest in and experience of the same model, and may exploit or amplify it

If that hypothesis is correct, we would expect to see: incidents concentrated on declared targets; young, locally recruited perpetrators; low-sophistication methods (fire, crude devices, reconnaissance); ideological or front-group framing; and poor evidence of direct state tasking in any individual case.

Where the evidence supports it

  • Target selection – Every serious incident in this dossier hits a node of the Iran war: the command HQ, the bomber base, and (in Pardubice) a defence plant publicly linked – accurately or not – to Israel and Ukraine. Fairford was a declared IRGC target two months before the arrests. [CONFIRMED]
  • Perpetrator profile – 20 years old at MacDill; 23 to 25 at Fairford; the Leyton and Pardubice networks similar. [CONFIRMED]
  • Method – Low-cost, low-signature: a crude device, petrol, vans, masks. [CONFIRMED]
  • Front branding – A “New Weathermen Underground” and an “Earthquake Faction” – both appearing from nowhere, both anti-war and anti-Israel, one saluting the other – mirror the IRGC’s use of a new front name for the London arsons. [CONFIRMED that the branding exists; ASSESSED that it mirrors the IRGC pattern]
  • Official intent and assertion – The IRGC’s July warning establishes intent against Fairford; Rubio’s statement asserts foreign involvement. [CONFIRMED that the statements were made]

Where the evidence cuts against it

  • No demonstrated tasking at MacDill – Prosecutors found no immediate evidence of state direction behind Zheng. His fleeing to China is more simply explained by family ties than by a handler. [CONFIRMED / ASSESSED]
  • The MacDill claim is left-wing and domestic in idiom – The video’s grievances – Iran war, immigration enforcement, DHS budgets – read as a U.S. far-left framing, not Iranian messaging. It fits CommandEleven Intelligence’s Domestic Threat Landscape finding on rising left-wing violent extremism as well as, or better than, it fits an IRGC operation. [ASSESSED]
  • No explosives at Fairford – The one physical finding – petrol and a counterfeit fuel livery – is at least as consistent with theft as with attack. [CONFIRMED]
  • The self-reporting anomaly – Disciplined state operations do not phone in their own activity. [ASSESSED]
  • The 26 September breach fits none of it – Daylight, one person, a fist-fight at a busy gate. [ASSESSED]
  • Sequencing – CommandEleven Intelligence’s “Europe as the Leading Indicator” thesis – that European incidents tend to precede comparable U.S. ones – is not supported by this cluster: the MacDill IED (10 March) preceded Pardubice (20 March), and the MacDill breach (26 September) preceded Fairford (27 September). We record this as a counter-data point rather than a refutation; the thesis concerns ideological and target-category patterns over longer periods, and two pairs of dates cannot test it. [ASSESSED]

Analysis of Competing Hypotheses

Analysis of Competing Hypotheses matrix scoring nine evidence items against four explanations for the incident cluster.

Figure 3. Analysis of Competing Hypotheses across nine public evidence items. CommandEleven Intelligence original graphic.

We tested four explanations for the cluster as a whole:

  • H1 – Iran-directed proxy operation – Iran, through the IRGC-QF or its criminal networks, tasked the actors.
  • H2 – State-exploited “internationalist” network – A transnational ideological underground (New Weathermen / Earthquake Faction) carried out the actions, with a state – Iran, Russia or both – seeding, steering or exploiting it at arm’s length.
  • H3 – Autonomous anti-war militancy – Ideologically motivated actors acting on their own, drawing inspiration from each other and from the war, with no state involvement.
  • H4 – Criminal or disturbed lone actors – Each incident is independent: theft, mental illness, opportunism.

On the nine items scored, H1, H2 and H3 each carry one inconsistency; H4 carries three. No single hypothesis dominates, and the scoring is sensitive to how much weight one gives Rubio’s unverified statement. Three conclusions follow:

  • H4 is the weakest explanation for the cluster, but the strongest for the 26 September MacDill breach taken alone – The breach should be analyzed separately until facts emerge. [ASSESSED]
  • H2 and H3 are separated by a single question: who is behind the brands? If the Earthquake Faction’s domain, payment trail or communications lead to a state service, the cluster moves decisively to H2. [ASSESSED]
  • H1 in its pure form – direct Iranian tasking of each incident – is not supported by any public evidence at MacDill, and is asserted but not shown at Fairford. [ASSESSED]

CommandEleven Intelligence’s net judgment – the evidence best fits a hybrid of H2 and H3 – an ideologically branded, transnational anti-war militancy that is real in its membership, whose brands are cheap enough to be created or co-opted by state services, operating against the same set of targets that Tehran has declared. That is a version of the Rear-Area Hypothesis, but a more diffuse one than a single IRGC-run campaign. [ASSESSED, moderate confidence]

The Self-Reporting Anomaly

The Self-Reporting Anomaly

The single most striking similarity between MacDill and Fairford deserves separate treatment because it is rarely discussed and it has operational consequences.

At MacDill, the person who placed the device telephoned 911 within minutes to say a bomb had been placed – without saying where. At Fairford, according to The Times and the BBC, one of the suspects dialed 999 almost an hour before the farmer’s alert. [CONFIRMED as reported in both cases]

There are four candidate readings:

  • The “Weather Underground” warning tradition – The original Weathermen routinely phoned warnings before their bombings to avoid casualties while still achieving disruption. A group consciously styling itself the “New Weathermen” may have adopted the same practice. This fits MacDill well. [ASSESSED]
  • Disruption as the objective – A call that triggers a search, a gate closure or an evacuation achieves effect at near-zero risk. In a war where the adversary prizes cost-imposition, the alarm itself can be the payload. [ASSESSED]
  • Defection of an unwitting or reluctant recruit – A proxy who discovers, on the night, what he has been drawn into may try to stop it or protect himself – exactly the scenario Taylor’s “knowingly or unknowingly” formula anticipates. This fits Fairford as currently reported. [SPECULATIVE]
  • Deliberate response-testing – A call can be used to time how quickly police arrive and where they deploy. [SPECULATIVE]

Implication for force protection – in both cases, a warning call did not produce a find – MacDill’s search missed the device for six days, and the farmer’s call to Fairford’s own police went unanswered. The self-reporting pattern exposes a shared weakness in how installations process vague, early warnings. That is a finding worth more than any attribution.

Similarities and Differences at a Glance

Table comparing the MacDill IED, the MacDill perimeter breach and the RAF Fairford arrests across nine observable features.

Force Protection and Policy Considerations

CommandEleven Intelligence does not take an institutional position on specific government decisions, but the incidents surface several issues that practitioners and policymakers are already debating.

  • Perimeter, not just the gate – Both the 26 September breach and the Fairford approach happened at or beyond the edge of the controlled area. The Visitor Center – outside the gate and open to the public by design – was the chosen point for the March device. Soft outer layers of hard installations remain the exposed surface. [ASSESSED]
  • Warning-call handling – Two warning calls in this dossier did not lead to timely discovery or response. Protocols for vague bomb warnings, and for civilian reports reaching base police at night, merit review. [ASSESSED]
  • The hoax and copycat tax – Elder’s calls, the MacDill Inn evacuation and a broader surge of suspicious-package alerts across U.S. bases imposed repeated shutdowns. An adversary does not need to plant a device to achieve the effect; it needs only to amplify the fear of one. [ASSESSED]
  • Host-nation friction – The Fairford attribution gap between Washington and London is itself a strategic vulnerability. Public divergence between allies over whether a plot existed rewards the actor, whoever it is. [ASSESSED]
  • Legal tools – The UK’s 2026 State Threats Act designations were built precisely for proxy cases where a direct state link is hard to prove. Whether Fairford is ever prosecuted under them will be a test of that architecture. [ASSESSED]
  • Flight risk – The Zheng siblings were out of the country within 48 hours of placing the device and before it was even found. Speed of exit to non-extradition jurisdictions is an under-examined weakness in domestic terrorism response. [ASSESSED]

Indicators and Warnings to Watch

These are the developments that would move CommandEleven Intelligence’s assessment, in either direction:

  • Identification of the 26 September MacDill intruder – any history of extremist engagement, overseas travel, or links to anti-war networks would reopen the question; a psychiatric or criminal-only history would close it.
  • Fairford charging decisions – whether any suspect is charged under the Terrorism Act or the State Threats Act, rather than for theft or public-order offences.
  • Fairford digital forensics – any evidence of online recruitment, cryptocurrency payment or a handler abroad would strongly support the proxy line.
  • Earthquake Faction prosecutions – any finding in the Czech, Slovak, Polish or Bulgarian cases on who registered the group’s infrastructure or funded it.
  • Further “New Weathermen” communications – or any U.S. arrest of a second participant in the MacDill plot.
  • Chinese response to U.S. requests regarding Alen Zheng – cooperation, silence or public refusal.
  • IRGC or Iranian-media reaction – any claim, praise or propaganda use of either incident.
  • Incidents at other named bases – RAF Lakenheath, RAF Mildenhall, Diego Garcia or U.S. stateside bomber and tanker bases supporting the campaign.

What This Dossier Does Not Claim

To protect the credibility of the analysis, we state plainly what is *not* being argued:

  • It does not claim that the 26 September MacDill breach and the 27 September Fairford arrests were coordinated, or that their near-simultaneity is meaningful. No public evidence links them.
  • It does not claim that Alen Zheng acted on behalf of China, Iran or any state. U.S. prosecutors have said they have no immediate evidence of that.
  • It does not claim that a bomb plot at Fairford has been established. No explosives were found, and the suspects are on bail and presumed innocent.
  • It does not claim that the New Weathermen Underground and the Earthquake Faction are operationally linked – only that one publicly saluted the other.
  • It does not treat U.S. officials’ statements of foreign involvement as proven.
  • It does not reproduce any technical detail of the MacDill device.

All individuals named are charged or suspected only; every defendant is presumed innocent unless and until proven guilty.

Companion CommandEleven Intelligence Coverage

Sources

Picture of CommandEleven Intelligence Desk

CommandEleven Intelligence Desk

Threat Level l1
Reliability Level a
Credibility Level 1

Linked Entities

Operational Theater

Area of Responsibility Map
Picture of CommandEleven Intelligence Desk

CommandEleven Intelligence Desk

The CommandEleven Intelligence Desk // CommandEleven is a specialized geopolitical and security consulting firm providing strategic insight and tactical advantage in non-permissive environments. Managed by a directorate of seasoned intelligence analysts, military professionals, and regional specialists, the firm utilizes formalized analytical frameworks—including PMESII-PT and the Intelligence Cycle—to deliver high-fidelity risk assessments and crisis resolution. Since its formation, CommandEleven has maintained a zero-trust architecture for global HUMINT operations and tactical asset management across contested theaters.
All Posts