Holiday Season Threat Assessment: Coordinated Attacks and Soft Target Vulnerabilities

Executive Summary

This forward-looking threat assessment examines potential risks to soft targets and crowded environments during the 2025–2026 holiday season in the United States. High-profile, mass-casualty incidents on New Year’s Day 2025 — including a vehicle-ramming attack in New Orleans and a VBIED suicide incident in Las Vegas — signal an elevated threat environment influenced by ideological extremism, individual grievance-based violence, and suicide-by-spectacle motives. Additionally, the December 2024 vehicle attack at a Christmas market in Germany underscores the global vulnerability of holiday gatherings. Based on open-source intelligence and recent patterns, the most credible threats this season are vehicle-ramming, IED/VBIED incidents, lone actor violence, and active shooter scenarios. Overall threat level: High.

Threat Profiles

Vehicle-Ramming Attacks

Description:
Vehicle-ramming remains a recurring threat to crowded public spaces, particularly during holiday festivities. The January 1, 2025, New Orleans attack, which resulted in 14 fatalities and over 50 injuries, demonstrates that such methods remain accessible and ideologically exploitable. The attacker exhibited months of pre-operational behavior, including site casing and ideological radicalization. Similarly, the December 2024 Magdeburg Christmas market attack killed 5 and injured over 200, using a rental car and exploiting access points for emergency services.

Environmental factors like street festivals, holiday markets, and parades increase vulnerability due to dense foot traffic, minimal vehicle barriers, and predictable gathering patterns. The holiday calendar through early January offers multiple symbolic targets and recurring opportunities.

Likelihood: High
The ease of access to vehicles, minimal technical expertise required, and a recent surge in ideologically driven or grievance-based ramming events make this a highly likely threat.

Consequences:
Vehicle-ramming can cause mass casualties in seconds, with high rates of severe injury and panic. Rapid casualty generation can overwhelm EMS response, cause reputational harm to cities or venues, and disrupt events regionally.

VBIED / Explosive Attacks

Description:
The Las Vegas Cybertruck bombing, while not conclusively labeled terrorism, illustrates how lone actors can adapt consumer vehicles for complex explosive attacks. That this occurred at the symbolic Trump Tower on New Year's Day suggests intent to create maximum psychological and media impact. The attacker was a decorated veteran with no prior law enforcement contact, underscoring the difficulty in pre-attack identification.

Globally, VBIED use persists, with German officials treating the Magdeburg market incident as a potential terrorist event, further reinforcing seasonal vulnerability. U.S. law enforcement has repeatedly warned that holiday periods invite attack attempts combining explosives with crowd targeting.

Likelihood: Medium
While VBIED attacks are technically more complex, the Las Vegas and global incidents show increasing actor capability and willingness. The symbolic and seasonal timing raises the threat level above baseline.

Consequences:
VBIEDs can produce mass fatalities, structural damage, and secondary fragmentation injuries. Blast effects can disrupt multiple city blocks, require mass evacuations, and saturate emergency services. Investigations often extend internationally, complicating attribution and response.

Active Shooter Attacks

Description:
Though overshadowed by the higher-profile vehicle attacks, the active shooter threat remains potent, particularly at enclosed venues such as malls, theaters, and houses of worship. Past holiday periods have seen shooters target gatherings with religious or political overtones. Rising political and social tensions, coupled with lone actor grievance dynamics, sustain this threat category.

Holiday shopping venues, faith-based gatherings (especially Christmas and New Year services), and celebratory public events are particularly at risk. Indicators may be limited, and perpetrators often acquire weapons legally.

Likelihood: Medium
This is a consistent threat, with persistent risk indicators including ideological polarization, declining mental health, and unresolved grievances. The season’s symbolic nature increases the chance of targeted attacks.

Consequences:
Active shooter events can result in high casualties, intense media coverage, and widespread public fear. They frequently result in prolonged police engagements, venue lockdowns, and traumatic community impact.

Lone Actor Violent Extremism

Description:
Both the New Orleans and Las Vegas attackers operated independently and outside traditional terror networks. The New Orleans assailant pledged allegiance to ISIS, while the Las Vegas perpetrator expressed anti-government and psychological distress themes. This points to the enduring threat of ideologically or emotionally motivated lone actors exploiting holidays for symbolic impact.

These actors are often self-radicalized, exhibit warning behaviors (e.g., isolation, grievance narratives), and may use emerging technologies (e.g., generative AI) for planning. Law enforcement may have little to no prior contact with the individuals.

Likelihood: High
Lone actor threats remain the most challenging to detect and interdict. Their accessibility to public spaces, growing use of online radicalization, and recent attack success rates make this a high-likelihood threat during the holidays.

Consequences:
Can range from limited-impact actions to mass-casualty events. Even “low-yield” attacks produce significant fear, drive security costs, and cause reputational damage to cities or events.

Recommendations

Security planners and public safety officials should adopt layered, threat-informed approaches:

• Vehicle-Ramming Mitigation: Deploy temporary vehicle barriers, enforce road closures at gathering points, and designate hardened perimeters at holiday markets and parades.

• Explosive Threats: Increase visible K9 presence, train staff on IED indicators, and leverage DHS's Bomb-Making Materials Awareness Program (BMAP) and TRIPwire network.

• Active Shooter Readiness: Conduct drills, implement bag screening, and utilize DHS’s Emergency Action Plan templates and CISA’s active shooter preparedness guides.

• Lone Actor Detection: Promote “If You See Something, Say Something” campaigns and use behavioral indicators from the DHS Pathway to Violence materials to educate staff.

• Drone Surveillance: Integrate UAS detection and reporting protocols into security planning, especially for outdoor events.

Sources

• FBI Update: Bourbon Street Attack

• FOX5 Las Vegas: Cybertruck Explosion

• ABC News: Magdeburg Attack

• The Guardian: Russia’s Christmas Day Missile Strikes