@oddhack @cstross It doesn't have to be that complicated. Hundreds of containers can be shipped to "import companies" in all of the major cities. They can be militarized like the Ukrainians have been doing.
Swarm attack major events....concerts, ball games, political rallies. Hit shopping centers at Christmas time. Many many vulnerabilities are out there.
Having an AR-15 is useless at a swarm of $500 drones with eight points of explosives...and you can buy reload powder on every street corner.
Agent A buys a crap house full of it from several locations under false IDs and disappears. Agent B facilitates the attacks and disappears. "Importer" has records of selling to Agent A and Agent B and appears to be the victim in this.