Sovereign Shadows: The Architecture of Mossad’s Operation Inside Iran, from the Age of SAVAK to the Ruins of Natanz

KBA13 Insight | Special Investigation | May 2026

The Historical Foundations: Israel and Iran Before the Revolution

The relationship between Israel and Iran was not always defined by the mutual hostility that would come to characterize it after 1979. In the two decades preceding the Islamic Revolution, the two states maintained a quietly productive security relationship that shaped each nation’s intelligence capabilities in ways that would prove consequential long after their formal cooperation ended. Israel’s engagement with Iran was never a partnership of equals in the conventional sense — it was a relationship driven by strategic calculation on both sides, with Israel seeking regional allies in a hostile Arab neighborhood, and the Shah seeking sophisticated intelligence partners capable of shoring up his regime against internal dissent and external communist threat. The collaboration that emerged from this convergence of interests was substantial, institutionally embedded, and remarkable in the depth of access it afforded Israeli intelligence to the innermost workings of the Iranian state.

The formal architecture of this collaboration was built around SAVAK — the Organization of National Security and Information — which Iran established in 1957 under the joint guidance of American and Israeli intelligence officers. After security relations between the United States and Iran grew more distant in the early 1960s and the CIA training team withdrew, Mossad became increasingly active in Iran, “training SAVAK personnel and carrying out a broad variety of joint operations with SAVAK.” This institutional intimacy gave Mossad something that money alone could not buy: an organic understanding of how Iranian security structures were organized, where their vulnerabilities lay, which personalities held real power, and how information moved through the system. Knowledge of this kind does not evaporate when formal cooperation ends; it becomes the foundation on which future operations are built. Al Jazeera

The nature of Mossad’s involvement with SAVAK extended well beyond advisory functions. Israeli officers trained SAVAK interrogators, shared surveillance methodologies, and participated in operations against shared adversaries — primarily communist organizations and Palestinian militants with operational presence in Iran. This collaboration created a generation of Iranian security officials who had been shaped, professionally and intellectually, by Israeli intelligence doctrine. It also created a generation of Israeli intelligence officers who understood Iran with unusual intimacy — who knew its cities, spoke its languages, understood its social structures, and had developed personal relationships with individuals at the heart of the Iranian security establishment. When those individuals were displaced by the revolution, some eventually became resources for a very different kind of operation.

The strategic logic behind Israel’s cultivation of Iran under the Shah was part of a broader regional doctrine sometimes called the “periphery strategy” — the pursuit of alliances with non-Arab states on the margins of the Arab world as a counterweight to the hostility of Israel’s immediate neighbors. Iran under the Pahlavi monarchy fit this template perfectly: a powerful, modernizing state with no fundamental quarrel with Israel’s existence, a shared interest in containing Nasserist pan-Arabism, and a common concern about Soviet influence in the region. Turkey and Ethiopia were the other major pillars of this strategy. But Iran was by far the most significant: its geographic scale, its oil wealth, and its military capacity made it the most consequential potential ally in the region.

The intelligence relationship produced mutual benefits of considerable strategic significance. Israel shared with Iran technical intelligence on Egyptian military capabilities during the years when Cairo posed an existential threat to Tel Aviv. Iran provided Israel with access to monitoring stations near the Soviet border, enabling signals intelligence collection that neither country could conduct alone. The relationship also facilitated commercial and military transactions that enriched both parties: Israeli firms sold agricultural technology and military equipment to Iran, while Iran supplied Israel with oil at a time when Arab states were imposing embargoes. The intelligence dimension of the relationship was inseparable from its commercial and diplomatic dimensions — each reinforced the others, creating a network of interdependence that proved, paradoxically, to be one of the most consequential aspects of Israel’s pre-revolutionary engagement.

What distinguished the Israel-Iran intelligence relationship from comparable partnerships was its depth of personnel. Mossad did not merely operate as a distant advisor to SAVAK; its officers worked alongside Iranian counterparts, developed personal networks within the Iranian security establishment, and in some cases spent extended periods living inside the country. This ground-level engagement created a cartographic knowledge of Iran’s security geography — the locations of sensitive facilities, the social networks around key institutions, the behavioral patterns of officials who would later become targets — that proved invaluable when the relationship’s purpose was inverted after 1979. The intimate knowledge acquired in the service of cooperation became, in the hands of a different regime and a different strategic context, the foundation for penetration.

The Shah’s downfall in 1979 also coincided with a specific moment in Mossad’s institutional development. Under director Yitzhak Hofi and then his successor Nahum Admoni, the agency was expanding its capacity for long-range operations and deepening its analytical focus on threats beyond Israel’s immediate neighborhood. The loss of Iran as a partner was experienced not simply as a strategic setback but as an intelligence emergency: overnight, a country where Mossad had extensive access and deep institutional knowledge became hostile, closed, and in the process of purging everyone associated with the old order. The challenge of reconstituting operational capacity within Iran without the institutional scaffolding that had previously supported it would define Mossad’s operational priorities for the next four decades.

The revolutionary period also produced an unexpected resource: Iranian exiles. Hundreds of thousands of Iranians — military officers, security officials, academics, business people, and members of the secular middle class — fled the Islamic Republic in the years following 1979 and settled in Europe, North America, and Israel’s neighborhood. Many of them possessed detailed knowledge of the country they had left, maintained family and social connections inside Iran, and harbored deep resentment toward the clerical regime that had destroyed their careers, confiscated their property, or killed their associates. For an intelligence service rebuilding its understanding of a country from scratch, these diaspora communities represented an extraordinary analytical and operational resource — one that Mossad began to cultivate systematically even as it processed the scale of what had been lost.

The institutional memory accumulated during the SAVAK years also shaped the particular character of Mossad’s post-revolutionary approach to Iran. Rather than relying primarily on technical intelligence collection — satellite imagery, signals interception, cyber operations — Mossad maintained a consistent emphasis on human intelligence as the primary tool of its Iran campaign. This preference reflects a deep institutional conviction, reinforced by the SAVAK experience, that the most valuable intelligence about any closed society comes from people who live inside it, understand its internal dynamics, and can identify the specific vulnerabilities that technical collection cannot reveal. The human intelligence emphasis would prove to be both the defining characteristic of the Iran campaign and, ultimately, its most consequential feature.

The historical foundation matters because it helps explain the remarkable depth of Israeli intelligence penetration that would become apparent decades later. The Mossad that conducted the 2018 archive theft from a Tehran warehouse, that assassinated nuclear scientists in their cars, that ultimately placed commandos inside Iranian cities in June 2025, was not improvising. It was built on four decades of accumulated institutional knowledge, developed relationships, and operational experience, tracing its roots to the corridors of SAVAK’s headquarters in pre-revolutionary Tehran. The shadow war that the world would observe unfolding in the twenty-first century was not, in this sense, a new conflict. It was the most recent chapter in a competition whose deepest roots lay in the years when Israel and Iran had been allies.

The Revolutionary Rupture: Enemies from Allies

The Islamic Revolution of February 1979 transformed the geopolitical map of the Middle East with a speed and totality that few governments had anticipated, and none had fully prepared for. For Israel, the Shah’s overthrow represented not merely the loss of a strategic partner but the creation of a dedicated, ideologically motivated enemy at the center of the region’s most consequential state. Ayatollah Ruhollah Khomeini had not been ambiguous about his views on Israel: from the earliest days of his political activism in the 1960s, he had denounced the Zionist state as an illegitimate entity whose destruction was a religious obligation. When his movement succeeded in toppling the monarchy, those views became state policy, codified in a constitution that institutionalized hostility to Israel and embedded support for Palestinian liberation as a cardinal principle of the Islamic Republic. The Israeli embassy in Tehran was handed over to the Palestine Liberation Organization within weeks of the revolution’s triumph.

For Mossad, the practical consequences of the rupture were immediate and severe. Officers who had operated under various forms of cover inside Iran were withdrawn. Safe houses were abandoned. Local contacts — Iranians who had collaborated with Israeli intelligence during the SAVAK years — were suddenly in mortal danger, as revolutionary committees began hunting down those associated with the old security apparatus. Some were arrested and executed; others fled; a handful managed to maintain themselves in new identities. The institutional network that Mossad had spent two decades building was shattered virtually overnight, leaving the agency, for the first time in memory, effectively blind inside a major regional state. Rebuilding that network — without formal diplomatic presence, without the cover that a friendly government provides, without any of the infrastructure that had previously supported Israeli operations — became the central operational challenge of the next generation.

The ideological character of the Islamic Republic also transformed the nature of the intelligence target. The Shah’s Iran had been an authoritarian state, but one that Mossad understood and in which it had cultivated contacts at every level. The Islamic Republic was something different: a revolutionary regime whose elites were defined not by the familiar social and institutional networks of the Pahlavi era but by religious credentials, revolutionary credentials, and the dense kinship networks of a clerical establishment rooted in Qom, Mashhad, and the seminary cities of the Islamic world. Penetrating this establishment required a different kind of human intelligence capacity — one that could access social networks that were simultaneously intensely parochial and potentially global in reach, given the transnational character of Shia Islam.

The revolutionary period also crystallized, for Israeli strategic thinking, the nature of the long-term threat that Iran represented. It was not merely that Iran had become hostile; it was that Iran, with its population of sixty million people, its vast oil revenues, its geographic position spanning the Gulf and the Caspian, and its potential nuclear capabilities, could become the pre-eminent regional power and the primary financier of anti-Israel armed groups. The calculation was straightforward: an Iran armed with nuclear weapons and committed to Israel’s destruction would constitute an existential threat that no amount of conventional military superiority could indefinitely contain. From this analysis, with inexorable logic, followed the conclusion that preventing Iran from acquiring nuclear weapons was the supreme strategic priority — and that intelligence operations, rather than conventional military conflict, were the primary tool by which that priority should be pursued.

The years immediately following the revolution were consumed by events that complicated rather than simplified the intelligence picture. The American hostage crisis of 1979-1981 focused international attention on Iran’s new government. The Iran-Iraq War, which began in September 1980 and would last eight years, paradoxically created new intelligence opportunities for both superpowers and for Israel, as the conflict exposed the organizational vulnerabilities of Iran’s military while creating pressure that generated defections and disaffections within the Iranian security establishment. Israeli intelligence, despite the rupture in formal relations, continued to collect against Iran throughout this period, drawing on diaspora sources, on signals intelligence, and on the deteriorating but not entirely extinguished human networks that had survived the revolution.

The ideological evolution of the Islamic Republic’s leadership during the 1980s also produced a specific and, from an intelligence perspective, interesting phenomenon: internal factional conflict. The revolutionary coalition that had overthrown the Shah was not monolithic; it encompassed nationalists, Marxists, religious modernists, and clerical traditionalists who held sharply divergent visions of what the new Iran should become. The violent suppression of these factions — particularly the Mojahedin-e Khalq, the Tudeh Party, and Kurdish movements — generated a substantial population of Iranians who had experienced the full brutality of the revolutionary state and who harbored both the motivation and, in many cases, the organizational capacity for continued resistance. These groups became, in subsequent decades, sources of intelligence for multiple foreign services, including Israeli intelligence, despite the complex ethical and operational dimensions of working with organizations that themselves employed violence.

One of the most consequential early post-revolutionary intelligence achievements attributed to Mossad was the handling of General Ali Reza Askari, a senior Iranian military officer who reportedly served as an Israeli asset for several years before defecting in February 2007 after his cover was about to be blown, with The Sunday Times reporting that Askari had been a Mossad asset since 2003. The significance of the Askari case was not merely the intelligence it produced but what it demonstrated about Mossad’s capacity: that even in the post-revolutionary period, with no formal presence in the country and no official access to Iranian government institutions, Israeli intelligence had found a way to develop sources at the highest levels of the Iranian military establishment. The methods by which Askari was cultivated and handled remain classified, but the achievement itself speaks to a persistent and sophisticated human intelligence operation ( Al Jazeera).

The revolutionary rupture also created a new institutional priority within Mossad that would shape the agency’s development for decades. The Iran desk — whatever its official designation within the agency’s classified organizational structure — became one of Mossad’s most heavily resourced and strategically significant divisions. Director Meir Dagan, who led Mossad from 2002 to 2011, made Iran the organizing principle of his tenure: the rise of Iran as a primary threat during the 2000s resulted in a massive expansion of Iran-focused personnel across all departments of the agency. Dagan’s particular contribution was the articulation of a strategic doctrine — the systematic disruption of Iran’s nuclear program through a combination of assassinations, sabotage, cyber operations, and diplomatic manipulation — that gave the accumulated intelligence assets focused on Iran a coherent operational purpose (Iranwire).

The transformation of the relationship with Iran from partnership to enmity also had a profound effect on Mossad’s institutional culture. The generation of officers who had worked alongside SAVAK colleagues, who had operated inside Iran under diplomatic cover, and who had developed the deep familiarity with Persian society that comes only from sustained personal engagement — this generation brought to the emerging shadow war an intimacy with the adversary that is rare in intelligence work. They understood Iranian culture, its social hierarchies, its hospitality norms, its religious cadences, and the particular way that loyalty and obligation were structured in Persian society. This cultural understanding, transmitted through institutional mentorship to younger generations of officers, became one of Mossad’s most significant operational assets — something that could not be replicated by technical collection, however sophisticated.

The 1979 rupture, paradoxically, may have made possible the remarkable operational achievements that followed. A relationship built on formal cooperation and institutional access creates dependencies and constraints; an adversarial relationship, conducted entirely in the shadows, creates different operational disciplines. The necessity of operating without diplomatic cover, without friendly government assistance, without any of the conventional supports of intelligence work, forced Mossad to develop precisely the clandestine methodologies — the network of non-Israeli agents, the reliance on diaspora communities, the infiltration of smuggling networks — that would prove so devastatingly effective in subsequent decades. The revolution that created the threat also, inadvertently, created the operational environment in which the response to that threat would be forged.

Stuxnet and the Weaponization of Digital Warfare Against Iran

The development of the Stuxnet computer virus, deployed against Iran’s uranium enrichment facilities around 2010, represents one of the most consequential events in the history of intelligence operations — not because of its immediate physical effects, though those were significant, but because of the conceptual precedent it established. For the first time in recorded history, a software weapon had been used to cause deliberate physical destruction to industrial infrastructure controlled by a hostile state. The implications extended far beyond the specific context of the Iranian nuclear program: Stuxnet demonstrated that the domain of strategic competition had been irreversibly expanded into the digital architecture of modern industrial civilization, and that the conventional distinction between peacetime espionage and wartime sabotage had been rendered meaningless in the cyber domain. Every nation’s critical infrastructure was now potentially vulnerable to attack through the software systems that controlled it.

The technical sophistication of Stuxnet was, by the standards of malicious software in 2010, extraordinary. The virus was designed to target a highly specific configuration of Siemens S7-315 and S7-417 programmable logic controllers operating frequency converter drives within a particular speed range — a configuration that matched almost precisely the centrifuge arrays at the Natanz uranium enrichment facility. Israel was responsible for the release of the Stuxnet virus in 2010, which was thought to have infected 30,000 computers across at least 14 nuclear facilities in Iran. The weapon’s targeting precision reduced collateral damage while ensuring that the specific systems it was designed to destroy would bear the full weight of its effects. The virus instructed centrifuges to spin at speeds that exceeded their mechanical tolerances, causing physical failures, while simultaneously reporting normal operational parameters to monitoring systems — a deception so complete that Iranian engineers spent months attributing the failures to equipment defects rather than malicious interference. kba13

The strategic elegance of the Stuxnet approach lay in its exploitation of a fundamental vulnerability in the architecture of modern industrial control systems: the assumption that physical security of a facility provides protection against software-based attack. The Natanz enrichment facility was an extraordinarily well-defended physical target. Although the IDF possessed capabilities that could damage and cause cave-ins at Fordow, many of Iran’s nuclear facilities were hardened against conventional attack. Stuxnet circumvented physical security entirely, infiltrating the facility via infected USB drives carried in by technicians or contractors unaware they were serving as vectors for a military-grade cyberweapon. The virus’s ability to propagate through air-gapped networks — systems deliberately disconnected from the internet — via this kind of indirect physical delivery represented a fundamental reconception of what “security” meant for a closed facility (Iran International).

The joint American-Israeli authorship of Stuxnet has been reported extensively by multiple credible sources, including New York Times journalists David Sanger and William Broad, whose 2012 investigation drew on extensive official and unofficial sources from both governments. The operation was reportedly initiated during the George W. Bush administration under the code name Olympic Games and expanded significantly during Barack Obama’s first term. The presidential authorization for a covert cyberwar against Iran’s nuclear infrastructure represented a fundamental policy decision: that conventional military conflict was too risky and too escalatory, that economic sanctions alone were insufficient, and that a third option — covert technological sabotage — could impose meaningful costs on the Iranian program without triggering open warfare. Stuxnet was the operational expression of this strategic judgment.

The long-term effects of Stuxnet on the Iranian nuclear program are disputed among analysts, with estimates of the delay it imposed ranging from a few months to several years. Iranian authorities acknowledged significant damage to centrifuge arrays at Natanz, and IAEA inspection reports from the period document a substantial reduction in the number of operational centrifuges, consistent with the virus’s effects. What is perhaps more significant than the immediate physical damage is the institutional disruption that followed: Iranian engineers and scientists spent considerable time and resources attempting to diagnose the cause of failures that were, by design, disguised as mechanical malfunctions. The psychological impact — the realization that their most secure facility had been penetrated by an invisible adversary — may have been as consequential as the physical destruction.

Iran’s response to Stuxnet accelerated the development of its own cyber warfare capabilities, creating an institutional infrastructure for offensive cyber operations that would subsequently be directed at targets ranging from Saudi Aramco to American financial institutions and Israeli infrastructure. The Islamic Republic’s Cyber Army, operating under IRGC oversight, expanded substantially in the years following Stuxnet’s discovery, drawing on both domestic talent and on the theoretical frameworks that analysis of the virus itself had provided. In a profound sense, Stuxnet educated the adversary it was designed to harm — providing a technical curriculum in advanced malware development that Iran might otherwise have taken considerably longer to acquire.

The discovery of Stuxnet’s existence and attribution, which became public in 2010 through the work of cybersecurity firms including Kaspersky Lab and Symantec, had diplomatic consequences that its architects had presumably weighed. Iran’s ability to present itself as the victim of state-sponsored cyberterrorism — a characterization that was factually accurate, whatever the legitimacy of the underlying strategic rationale — complicated the diplomatic narrative around the nuclear dispute. The Islamic Republic’s representatives at international forums were able to deploy Stuxnet as evidence that Western countries were prepared to violate international norms to advance their strategic objectives, an argument that found receptive audiences in some capitals even among states otherwise unsympathetic to Iranian positions.

The technical lessons of Stuxnet were absorbed and refined in subsequent Israeli cyber operations against Iran. Former Prime Minister Naftali Bennett confirmed that Mossad destroyed over 100 Iranian drones in February 2022. The sabotage of drone production facilities involved operational techniques that combined cyber intrusion with physical logistics in ways that Stuxnet had pioneered conceptually. The ability to interdict Iranian military materiel — not at the point of use in conflicts with proxy forces, but at the point of manufacture inside Iran — demonstrated the extension of the Stuxnet model beyond nuclear infrastructure to encompass the full range of Iranian military industrial capability. Each successive operation refined the methodology and extended the reach(Brandfetch).

The cyber domain also became a critical enabler of Mossad’s human intelligence operations. The ability to intercept Iranian communications — including, as would become apparent in 2025, the internal command communications of Iran’s senior military leadership — provided targeting intelligence that human sources alone could not have supplied with sufficient timeliness and precision. The integration of signals intelligence, cyber operations, and human intelligence into a unified collection and targeting system represents the mature version of the approach that Stuxnet had pioneered in its more primitive form in 2010. By the time of Operation Rising Lion, the boundaries between cyber warfare, signals intelligence, and human intelligence had effectively dissolved into a single operational architecture.

The historical significance of Stuxnet extends well beyond the specific context of the Iran nuclear dispute. It established that states with advanced cyber capabilities could impose high costs on adversaries’ strategic programs without crossing the threshold into conventional military conflict — a form of coercion that was both highly effective and substantially deniable. It created a template that multiple states have since sought to emulate against a variety of targets. And it demonstrated, with compelling clarity, that the distinction between intelligence operations and acts of war had become meaningless in the digital domain. When a software weapon causes physical machinery to destroy itself, the question of whether this constitutes espionage, sabotage, or warfare is not merely semantic — it is a question that international law has yet to resolve and that the Stuxnet operation forced, permanently, onto the agenda of international security.

 The Assassination Operation Eliminating Iran’s Nuclear Minds

The systematic assassination of Iranian nuclear scientists between 2010 and 2025 constitutes one of the most sustained covert elimination campaigns in the history of modern intelligence operations. Unlike the targeted killings of terrorist leaders, which have a well-established, if contested, legitimacy in international security discourse, the assassination of scientists working on a state nuclear program occupies deeply contested legal and ethical terrain. These individuals were not combatants in any conventional sense; they were engineers, physicists, and chemists employed by a state institution, living civilian lives in Iranian cities. Their deaths were, from any conventional legal standpoint, assassinations of civilians. The strategic rationale behind their killing — that the Iranian nuclear program represented an existential threat to Israel that justified extraordinary measures — was stated explicitly by the officials who authorized the campaign, but the legal and moral questions it raised have not been definitively resolved.

The campaign’s operational methodology evolved significantly over the fifteen years of its most intensive phase. The earliest assassinations, in 2010 and 2011, employed relatively straightforward methods — motorcycle-mounted gunmen, magnetic bombs attached to vehicles. Mohsen Fakhrizadeh was assassinated in November 2020 by a remotely controlled automatic weapon, without the attackers ever entering the country. The operation reportedly lasted only three minutes. The gunfire system, mounted on a Nissan vehicle, fired 13 bullets from a distance of 150 meters, using artificial intelligence and satellite guidance. This progression — from conventional close-quarters assassination to remotely operated AI-guided weapons systems — traces the trajectory of Mossad’s technological investment in the Iran campaign. The Fakhrizadeh operation in particular represents a qualitative leap: the deployment of a robotic weapon system capable of identifying, tracking, and eliminating a specific individual without any Israeli operative physically present in the country ( Alhurra).

Fakhrizadeh occupied a unique position in the Iranian nuclear establishment. He had led the AMAD Project, Iran’s pre-2003 structured nuclear weapons research program, and was understood by Western and Israeli intelligence to be the individual who could most effectively reconstitute a weapons-oriented research program if the political decision to do so were made. Iranian officials were careful never to confirm his precise role, but the International Atomic Energy Agency had repeatedly sought to question him about specific aspects of the AMAD program that required technical explanation. His removal from the program was therefore not merely a matter of eliminating one scientist among many — it was the removal of the individual who embodied the organizational knowledge and the technical leadership that a weapons program would most need. Former Mossad Director Meir Dagan had characterized this approach explicitly: the “removal of important brains” from the Iranian nuclear project achieved “white defections” — departures of critical human capital that proved as disruptive as any material sabotage ( Al Jazeera).

The five assassinations conducted between 2010 and 2012 — of Masoud Alimohammadi, Majid Shahriari, Darioush Rezaeinejad, Mostafa Ahmadi-Roshan, and the attempted killing of Fereydoon Abbasi, who survived — created a climate of fear within the Iranian scientific establishment that had effects extending far beyond the specific knowledge lost with each individual. Iranian nuclear scientists began requesting personal security details, varying their routes and schedules, and in some cases declining to participate in particularly sensitive research areas that they understood made them targets. The psychological pressure on the remaining scientific workforce — the knowledge that competence and seniority in a particular field of research made one a target for assassination — imposed costs on research productivity and personnel retention that are difficult to quantify but were certainly high.

The operational requirements of the assassination campaign illuminate the depth of the human intelligence network that made it possible. To conduct a targeted assassination in an urban environment — particularly one as security-conscious as Tehran after the earliest killings — requires intelligence of extraordinary specificity. The assassins must know their target’s home address, place of work, and regular commute routes. They must know the security arrangements protecting the target and the specific vulnerabilities in those arrangements. They must have access to reliable local communications and logistics. They must be able to enter and exit the operational environment without detection. Each of these requirements presupposes a network of local assets capable of sustained surveillance, active at specific times and in specific locations, under the direct observation of the IRGC and the Ministry of Intelligence, which were, by this point, conducting intensive counterintelligence operations to identify the sources of the targeting intelligence.

The IRGC’s internal response to the assassination campaign was to reorganize its security arrangements for the nuclear scientific community substantially. Scientists were given personal protection, their movements were restricted, and their communications were subjected to enhanced monitoring. These measures had some effect: the pace of assassinations declined after the intensive period of 2010-2012, and Mossad appears to have shifted its primary operational emphasis from assassination to sabotage during the middle part of the decade. But the deterrent effect of protective measures was never complete. When Hasan Sayyad Khodaei, a member of the IRGC Quds Force responsible for external operations, was shot dead in his car in Tehran in June 2022, the judiciary subsequently announced the execution of Mohsen Langarneshin, convicted of providing logistical and intelligence support for the assassination — a revelation that confirmed the existence of an Iranian local collaborator who had supplied the targeting intelligence despite the IRGC’s security protocols (Alhurra).

The campaign’s resumption in 2025, during and after the June war, represented a return to the most intensive phase of scientific elimination. Israeli strikes fired missiles at the bedrooms of Iranian nuclear scientists and military commanders, and the operations in the early hours of June 13 killed nine nuclear scientists. The use of aerial strikes to target individual sleeping quarters — a precision that required real-time intelligence about each individual’s nighttime location — demonstrates how completely the boundary between intelligence operations and military action had dissolved by this point in the campaign’s evolution. The bedroom coordinates of nine specific scientists were known to Israeli intelligence with sufficient confidence to employ precision munitions against them. This knowledge was almost certainly supplied by human sources within the scientific communities in which those individuals lived and worked (WikipediaIran International).

The question of legal and moral justification for targeted killings of scientists has been addressed, in various forms, by several governments that have conducted such operations. Israel’s position, never formally articulated with respect to specific Iranian operations, is implicit in the strategic doctrine articulated by successive governments: that preventing a nuclear-armed Iran constitutes a matter of national survival that overrides conventional constraints. This position finds support in some strands of just war theory — particularly those that permit preemptive action against imminent existential threats — but sits in considerable tension with international humanitarian law’s protections for civilians not directly participating in hostilities. The scientists were not themselves operating weapons systems; they were developing technical knowledge that might, contingent on future political decisions, be applied to weapons development. The extent to which this constitutes direct participation in hostilities that removes civilian protection is genuinely contested.

Iran’s execution of individuals accused of facilitating Mossad operations against its scientists represents the inverse of this ethical problem. In the weeks since the 2025 war ended, Iranian officials carried out a domestic witch hunt, arresting thousands of individuals in their search for people who spied for Israel. The executed individuals — including the person convicted in connection with the Khodaei assassination and the Kurdish Iranians hanged for their role in the 2023 Isfahan drone attack — were almost certainly guilty of the acts for which they were convicted. But they were also, in many cases, individuals whose recruitment by Israeli intelligence had been facilitated by the specific conditions of oppression, economic desperation, and ideological alienation that the Islamic Republic itself had created. The recursiveness of this dynamic — a state creating the conditions for its own penetration through the very nature of its governance — is one of the most revealing aspects of the entire shadow war (Matzav)

The long-term strategic effectiveness of the assassination campaign remains genuinely uncertain. Iran’s nuclear program has advanced, through all the setbacks imposed by assassinations, sabotage, and sanctions, to a level of technical sophistication that its practitioners of the early 2000s could barely have imagined. The deaths of scientists created temporary disruptions but not permanent incapacitation; the institutional knowledge they possessed was diffused through the programs they led, the students they trained, and the documentation they left behind. The IAEA’s assessment that Iran’s stockpile of enriched uranium, before the June 2025 strikes, was sufficient for ten nuclear weapons suggests that the assassination campaign, for all its operational precision and tactical sophistication, did not achieve the strategic objective of preventing nuclear advancement. It imposed costs; it did not change the fundamental trajectory. This gap between tactical success and strategic outcome is perhaps the most important lesson that the assassination campaign offers to students of covert intelligence operations.

The Great Heist: Stealing Iran’s Nuclear Archive

The 2018 operation in which Mossad extracted over 100,000 documents from a warehouse in Tehran constitutes, by any reasonable measure, one of the most audacious acts of peacetime intelligence collection in modern history. Its achievement was not merely technical — the ability to identify and penetrate a facility where Iran kept the physical archive of its most sensitive nuclear weapons research — but conceptual: the recognition that the documentary evidence of Iran’s past weapons work, if acquired and presented credibly, could serve as a diplomatic weapon of extraordinary force. The operation transformed raw intelligence into geopolitical leverage, a translation that is rarer and more difficult than it might appear and that required not only operational ingenuity but also strategic vision for how the acquired material could be used to maximum effect.

The AMAD Project, whose records formed the core of the stolen archive, represented Iran’s most serious attempt to develop a nuclear weapon in a structured, organized program. The project, which operated from the late 1980s until at least 2003, had reportedly made significant advances on multiple aspects of weapons design — including warhead configurations, delivery vehicle integration, and the development of the neutron initiators that trigger nuclear detonation. Iran had consistently denied the existence of any weapons-oriented research, attributing every aspect of its nuclear program to civilian energy and medical isotope production. The archive contained documentary evidence that comprehensively contradicted this narrative: internal reports, correspondence, experimental data, and technical drawings that established beyond a reasonable doubt the weapons-oriented character of specific research activities. Holding this material was not merely an intelligence asset; it was the physical refutation of a decade of Iranian diplomatic argumentation.

The operational planning required to extract the archive from a warehouse in Tehran reflects a level of advanced intelligence collection that is staggering in its implications. The location of the specific facility, the nature of its contents, the security arrangements protecting it, the timing of access opportunities, and the logistical requirements for removing tens of thousands of documents — all of this had to be established before the operation could be planned, and establishing it required sources with access to information about some of the most closely guarded aspects of Iran’s nuclear bureaucracy. The specific intelligence about the archive’s location was reportedly developed over several years, drawing on multiple source types, and represented the culmination of a sustained collection effort rather than a single operational breakthrough.

The physical execution of the operation — breaking into dozens of safes in a single night and removing their contents — required personnel inside Tehran with sufficient operational freedom to conduct a multi-hour covert action against a facility that, while not as heavily guarded as a nuclear installation, was nonetheless sensitive enough that its exposure would constitute a significant failure of Iranian security. Israeli officials have not confirmed specific details about how the operation was conducted or what cover the operatives used, but the very success of the extraction implies that the personnel involved had both the physical capability to conduct the operation and the social cover necessary to avoid detection before, during, and after it. Whether Israeli citizens, third-country nationals, or Iranian recruits were primarily responsible for the physical extraction remains unclear from public reporting.

The subsequent presentation of the archive material by Prime Minister Netanyahu in April 2018 was a carefully choreographed diplomatic event designed to maximize the material’s impact on international audiences, particularly the Trump administration in Washington. Netanyahu presented selected documents and data in a theatrical press conference, describing Iran’s past weapons research with specificity that required access to technical details only the archive could have provided. The presentation was directly timed to influence the American government’s deliberations about whether to withdraw from the Joint Comprehensive Plan of Action — the 2015 nuclear agreement — which President Trump was then actively considering abandoning. Whether the archive presentation played a decisive role in that decision cannot be established with certainty, but its timing suggests that Mossad’s strategic vision for the operation extended beyond intelligence collection to active influence on allied government policy-making.

The IAEA’s subsequent engagement with the archive material illustrated both its evidential value and the diplomatic complications it created. Iranian officials contested the authenticity of the documents, claiming the entire archive was a fabrication — a defense that was undermined by the technical specificity and internal consistency of the material, which multiple independent analysts assessed as genuine. The agency used archive-derived information to formulate a series of questions about specific aspects of Iran’s nuclear history that Iranian officials could not adequately answer, effectively forcing Iran to either acknowledge the AMAD Project’s true character or offer implausible explanations for specific technical choices the archive illuminated. The archive seizure helped swing the IAEA in favor of highlighting Iran’s nuclear violations at a moment when the diplomatic situation around the nuclear agreement was already fragile ( Brandfetch )

The archive theft also had an important secondary effect on Mossad’s intelligence capabilities: it provided a comprehensive map of the Iranian nuclear program’s technical achievements, personnel, and institutional architecture as of the archive’s assembly date in the early 2000s. This map was invaluable for identifying the subsequent trajectory of Iranian research — understanding which scientists had worked on which problems, which facilities had housed specific activities, and which aspects of the weapons development program had reached what stages of completion. The archive provided a comprehensive baseline against which subsequent intelligence collection on the program’s evolution could be assessed. In this sense, its value extended well beyond the immediate diplomatic impact of its public revelation.

The warehouse’s existence in the Shorabad district of Tehran — a relatively ordinary commercial neighborhood rather than a secure government compound — reflects a specific Iranian security philosophy: the dispersion of sensitive materials to locations unlikely to attract attention precisely because they are unremarkable. This philosophy of hiding in plain sight is sound in principle, but creates a specific vulnerability: the physical records can be identified and accessed without triggering the security responses that a conventional installation would provoke. The IRGC’s subsequent decision to disperse remaining nuclear documentation more widely and to reduce the physical concentration of sensitive materials at any single location represents an operational adaptation directly driven by the archive theft — another instance of the shadow war’s adaptive cycle in which each successful operation generates countermeasures that shape the next phase.

The 2018 operation also reinforced a broader Mossad doctrine about the relationship between intelligence collection and political effect. The agency’s consistent pattern — conducting operations whose intelligence value is amplified by strategic presentation to allied governments and international institutions — reflects an understanding that the most valuable intelligence is not merely accurate information about the adversary’s capabilities and intentions, but information whose revelation can be used to shape the political environment in ways that advance Israeli security interests. The archive theft was conceived from the beginning not merely as an intelligence operation but as the first act of a diplomatic strategy — a strategy that would not reach its full expression until the IAEA resolutions and Trump administration policy decisions that followed its public disclosure.

The archive heist remains, even in the context of subsequent operations of comparable or greater audacity, the most compelling demonstration of the strategic ambition that animates Mossad’s Iran campaign. It required years of preparation, extraordinary operational courage, and a sophisticated appreciation of how raw intelligence material could be converted into diplomatic leverage. It produced effects that extended from the internal deliberations of the American presidency to the procedural calendar of the UN’s nuclear watchdog. And it demonstrated, with a clarity that subsequent operations would only reinforce, that Mossad’s Iran campaign was not a series of tactical responses to immediate threats but a coherent long-term strategic effort to use intelligence capabilities to impose, cumulatively and systematically, costs that no single operation could have achieved in isolation.

Systematic Sabotage: Explosions, Fires, and Infrastructure War

The pattern of explosions, fires, and unexplained incidents at Iranian nuclear and military facilities in the years between 2019 and 2025 constitutes a campaign of systematic infrastructure warfare that sits at the intersection of intelligence operations and military conflict in ways that defy easy categorization. Taken individually, each incident could be attributed to industrial accident, equipment failure, or the inherent hazards of working with volatile materials in complex industrial environments. Taken together, as a pattern unfolding across multiple facilities, affecting multiple categories of equipment, at a pace and a targeting specificity that defied statistical coincidence, they reveal a sustained, deliberate effort to impose cumulative costs on Iran’s nuclear and military industrial infrastructure through repeated acts of physical sabotage. The campaign’s architects understood what individual incident reports could not capture: that the cumulative disruption to Iranian research timelines, scientific confidence, and institutional morale was far greater than any single incident’s immediate effects.

The Natanz enrichment facility was the most repeatedly targeted installation. In July 2020, a major nuclear site at Natanz was destroyed, and in April 2021, another site was sabotaged, including underground and electricity aspects. Iran accused Mossad of responsibility for the damage. The July 2020 incident involved a fire and explosion that destroyed an advanced centrifuge assembly and testing facility that had been under construction — a building that IAEA inspectors had identified as central to Iran’s plans for expanding its enrichment capacity. The April 2021 incident at Natanz was more technically complex: according to Iranian officials, 300 pounds of explosives were smuggled into the facility in equipment that had been sent abroad for repair — a remarkable supply chain penetration that implied either a compromised maintenance contractor or a level of access to the facility’s procurement logistics that spoke to deep institutional infiltration. A former senior Iranian official subsequently acknowledged that “five major explosions occurred at the Natanz nuclear sites, along with many smaller incidents ” YouTube + 2).

The January 2023 drone attacks on an ammunition factory in Isfahan added a new operational dimension to the sabotage campaign. On the night of January 28-29, 2023, several unidentified drones attacked an ammunition factory in Isfahan, along with other unexplained explosions, including a fire at an oil refinery in Tabriz and reports of explosions in Karaj. The use of drones launched from inside Iranian territory — as distinct from strikes conducted from outside the country — demonstrated the maturation of an operational capability that Mossad had been developing systematically: the ability to deploy weapon systems within Iran, either by smuggling them across borders or by assembling them from locally acquired components, and to operate them remotely against specific targets. The Isfahan site was, according to subsequent reporting, a production facility for the Shahed-136 kamikaze drones that Iran had been supplying to Russia for use in Ukraine — adding a geopolitical dimension that extended the shadow war’s implications well beyond the Israel-Iran bilateral relationship

The pattern of incidents extended across an unexpectedly wide range of facility types: nuclear enrichment sites, centrifuge assembly workshops, missile production complexes, drone manufacturing plants, oil refineries, and military bases housing strategic weapons systems. This breadth was itself strategically significant: it prevented Iran from developing a narrow, facility-specific security response and imposed a generalized anxiety instead across the entire defense industrial sector about the possibility of similar incidents at any installation. The IRGC’s response — tightening physical security, restricting contractor access, and monitoring communications more intensively — consumed resources and created friction within the Iranian defense establishment, reducing efficiency in ways that were difficult to measure but were certainly real.

The sabotage campaign’s logistics are among its most operationally impressive aspects. The Mossad had developed contacts with smugglers — and often with the government intelligence agencies — in all seven nations bordering Iran, and used front companies that legally shipped boxes and crates by sea and on trucks driven legitimately through border crossings. This infrastructure of legitimate-seeming logistics companies provided cover for the movement of materials — explosives, drone components, communications equipment, weapons systems — that could not have been transported through official channels. The exploitation of Iran’s extensive informal trade networks — which exist precisely because international sanctions have driven so much legitimate commerce underground — inverted the sanctions regime’s logic: the same economic pressure that Iran’s trading partners sought to exploit through informal channels became, in Mossad’s hands, a vector for operational logistics.

The political economy of Iran’s border regions provided a particularly useful operational environment. Ethnic Kurdish smugglers in the northwest, Baluchi traders in the southeast, and Azeri networks in the north all maintained long-established cross-border commerce that was beyond the practical capacity of Iranian border control to monitor comprehensively. Iran hanged four members of its Kurdish minority on charges of spying for Israel and collaborating on a plan to sabotage an Iranian defense site in Isfahan — a prosecution that, while reflecting Iran’s legitimate security interests, also illuminated the degree to which minority communities along the country’s periphery had been successfully cultivated as operational resources. These communities shared both practical knowledge of border geography and, in many cases, substantive grievances against a Persian-dominated central state that had historically marginalized their languages, cultures, and economic interests  (ProPublica ).

The specific targeting choices within the sabotage campaign reflect sophisticated intelligence-driven prioritization. Facilities targeted were not selected randomly or opportunistically; they were identified as specifically critical nodes in the Iranian nuclear and military industrial network — installations whose destruction would impose disproportionate delays on specific programs. The targeting of centrifuge assembly workshops rather than the centrifuges themselves, for example, reflected an understanding that disrupting the production pipeline had more enduring effects than destroying already-operating equipment that could be more easily replaced. Similarly, the targeting of drone production facilities for weapons systems being supplied to active conflict zones reflected a strategic calculation that extended the campaign’s objectives beyond the bilateral Israel-Iran context to encompass Iran’s broader role in regional conflicts.

The cumulative psychological effect of the sabotage campaign on Iranian technical and military institutions was considerable and, in some respects, more strategically significant than the physical damage. When explosions and fires recur at facilities that are supposed to be secure, the message is not merely that a specific installation is vulnerable, but that the enemy has penetrated the security environment sufficiently to reach any facility at any time. This generalized sense of vulnerability — the impossibility of knowing which installation would be next, which colleague might be an informant, which piece of equipment might be compromised — creates a climate of institutional anxiety that is corrosive to the trust and operational efficiency on which any complex technical program depends. The Iranian nuclear establishment’s response to this environment — compartmentalization, restricted communication, and reduced information sharing across institutional boundaries — may have imposed costs on research coordination that were at least as great as the physical damage itself.

The sabotage campaign also served a function in the broader strategic signaling dynamic between Israel and Iran. Each successful operation communicated, without requiring verbal articulation, that Israel’s reach extended into the heart of Iran’s most protected spaces — that no facility was beyond reach, no program was invulnerable, and no security measure could guarantee the integrity of Iran’s strategic assets. This communication was directed not only at Iranian decision-makers but at the international community, demonstrating Israeli capability at a moment when diplomatic negotiations about the nuclear program were ongoing, and the credibility of Israeli threats of more direct military action depended on a demonstrated willingness and ability to impose costs through covert means. The sabotage campaign was thus simultaneously an operational disruption, a psychological instrument, and a diplomatic signal — a combination that reflects the strategic sophistication of those who designed it.

The period between 2019 and 2025 also witnessed a significant expansion in the geographic scope of the sabotage campaign. Incidents occurred not only at Natanz and Isfahan, the nuclear program’s primary centers, but at facilities across Iran — in Tehran, Tabriz, Karaj, and smaller cities whose names had not previously appeared in reporting on the nuclear program. This geographic expansion reflected both the growing operational reach of Mossad’s human network inside Iran and a deliberate strategic choice to impose costs across the breadth of the Iranian defense industrial base rather than concentrating exclusively on nuclear-related targets. The effect was to engage Iranian security services across multiple theaters simultaneously, complicating their ability to prioritize counterintelligence resources and preventing the concentration of protective effort that a narrower campaign would have permitted.

The Art of Recruitment: How Mossad Builds Its Human Network Inside Iran

The recruitment of human intelligence sources inside a hostile state represents the most fundamental challenge in intelligence operations, and Mossad’s ability to develop and sustain an extensive network of agents within Iran — a country whose security services have been specifically focused on detecting and eliminating Israeli intelligence penetration for four decades — represents its most consequential institutional achievement. Understanding how this recruitment is accomplished requires moving beyond the cinematic stereotypes of espionage — the midnight approach, the briefcase of cash, the dramatic moment of commitment — to examine the patient, methodical, and deeply human processes through which ordinary people are persuaded, over extended periods, to undertake extraordinary and potentially fatal risks on behalf of a foreign intelligence service. The sociology of this recruitment, in the specific context of contemporary Iran, reveals as much about the Islamic Republic’s failures of governance as it does about Mossad’s operational ingenuity.

Former Israeli intelligence officer Oded Ailam, who served with Mossad for 24 years, explained that Iran is not a homogeneous country — only 40% of its population of 90 million are Persian — which makes it extremely difficult for the government to control the population, with surveillance systems having “enormous gaps” that “can’t be compared to what the Stasi did in the GDR.” This demographic reality is foundational to understanding the scale of the recruitment opportunity that Iran presents. The country’s significant Azeri, Kurdish, Baluchi, Arab, and Turkmen populations inhabit geographic peripheries where the central state’s surveillance architecture is thinner, where cross-border connections to communities in neighboring countries are normal and commercially necessary, and where historical grievances against Persian political dominance create a reservoir of alienation that foreign intelligence services have consistently sought to exploit (Wikipedia ).

The ideological disillusionment of a substantial portion of the Iranian population — particularly among younger generations who have grown up under the Republic rather than choosing it — represents perhaps the most significant structural driver of Mossad’s recruitment success. Ailam noted that there are “many dissatisfied people in Iran,” with large parts of society impoverished, while “the mullahs have poured billions into terror organizations like Hezbollah” rather than investing in the country’s development. The compound effect of economic sanctions, government corruption, inflation, social restrictions, and the suppression of political dissent has produced a population in which disillusionment with the regime is widespread and in which the risk calculus for recruitment — trading the hazards of collaboration with a foreign intelligence service against the indignities of daily life under the Islamic Republic — is meaningfully different from what it would be in a state whose population broadly identified with its government’s aims.

The specific vulnerability created by the regime’s treatment of its own security forces is particularly important. Sanctioned environments often produce uneven economic pressure across institutions. Security elites may retain privileges while mid-level officers may not, creating resentment gradients that produce recruitment opportunities. The IRGC and the Ministry of Intelligence employ tens of thousands of personnel at various levels of seniority, and the gap in material circumstances between senior commanders and their subordinates creates precisely the kind of institutional friction that a skilled recruiter can exploit. An IRGC lieutenant who has watched senior commanders accumulate personal fortunes while his own family struggles with inflation may be a very different kind of recruitment target from the ideologically committed revolutionary that the Guards’ official image projects ( The Jerusalem Post ).

The tradecraft of recruitment as practiced by Mossad’s case officers follows a methodology well documented in the intelligence literature, but it takes on specific contours in the Iranian context. A former senior Mossad officer described it as “a process of gradual erosion. You start with a minor request, an insignificant task. Then another. These are trial runs. If they perform well, you assign them something larger, more meaningful.” The initial request might be as innocuous as providing publicly available information about a specific topic, or making introductions to particular individuals, or describing the organizational structure of a specific institution. These requests serve multiple purposes simultaneously: they assess the recruit’s access and competence, they create a record of collaboration that provides leverage if the individual subsequently attempts to withdraw, and they habituate the recruit to the experience of providing information across a secure channel — normalizing the relationship in ways that make deeper collaboration psychologically easier ( Al Jazeera).

The question of motivation is central to any analysis of recruitment, and the Iranian case presents a particularly complex motivational landscape. Mossad’s own analysis of its recruits distinguishes between ideological motivations — opposition to the Islamic Republic as a political system — and material motivations, primarily financial compensation. Recruitees were either Iranians or people of other nationalities, “recruited either with financial incentives or because of opposition to the regime.” In practice, these motivations are rarely cleanly separable; an individual may be simultaneously disillusioned with the regime and grateful for financial compensation that addresses genuine economic hardship, without it being useful to categorize them as primarily ideological or primarily mercenary. The most reliable agents are typically those whose motivations are genuine and enduring, because opportunistic recruitment for purely financial reasons can create agents who may prove unreliable when risks increase or a better financial offer appears.

The role of the diaspora community in Mossad’s Iran recruitment strategy represents one of the most significant operational innovations of the past two decades. Mossad published Farsi-language online recruitment advertisements in 19 countries around the world, with Germany seeing each advertisement, and specifically solicited information from family members of Iranian nuclear scientists. This open-source recruitment — highly unusual for an intelligence service — reflects a specific judgment about the digital environment: that millions of Iranians maintain contact with relatives inside Iran, that many of those diaspora Iranians harbor deep hostility toward the regime, and that social media platforms provide a low-cost mechanism for identifying and approaching potentially motivated individuals at a scale that traditional intelligence tradecraft cannot replicate. The approach trades the security that covert contact offers for the volume that public solicitation enables — a trade-off that makes sense in an environment where the sheer scale of potential recruits outweighs the risk of exposure.

The protection of recruited sources is a critical component of Mossad’s recruitment proposition, particularly given the consequences of exposure in Iran. Ailam noted that Mossad “promises protection for its spies in Iran, and will bring them and their families to safety if necessary — when someone works for us, we take care not only of them but also of their family.” This commitment to exfiltration — the extraction of agents and their families from Iran if their covers are compromised — serves both a humanitarian and a strategic function. Humanitarianly, it represents a genuine moral obligation that responsible intelligence services acknowledge, however imperfectly they discharge it. Strategically, the credibility of the exfiltration promise is itself a recruitment tool: potential agents are more likely to accept the risks of collaboration if they believe that exposure will result in extraction rather than abandonment.

The compartmentalization of Mossad’s agent network inside Iran is a critical operational security feature that has limited the damage from individual exposures. Operational compartmentalization means trainees and operatives work under various covers, with apprenticeship periods before full deployment. Individual agents typically know only what is operationally necessary for their specific assignments: they know their handler, their communication protocols, and the specific tasks they have been assigned, but they do not know the identities or locations of other agents in the network. When the Ministry of Intelligence claims to have dismantled Mossad’s network — as it did in 2024 — the claim is almost certainly true in the limited sense that specific agents have been identified and arrested, but false in the broader sense that the network as a whole has been neutralized. The modular architecture of the network means that damage to one component does not propagate to others (Iranwire ).

The evolution of Mossad’s recruitment apparatus over the forty-year shadow war reflects a consistent deepening and sophistication of approach. The earliest post-revolutionary recruitment relied primarily on diaspora contacts and defectors. Over time, as the operational requirements of the sabotage and assassination campaigns became clearer, recruitment expanded to include individuals with specific technical access — nuclear facility workers, military logistics personnel, weapons production employees, and, ultimately, members of the security services themselves. The revelation that a Mossad asset had, by 2021, risen to lead Iran’s own unit for countering Mossad operations represents perhaps the most dramatic illustration of how completely this recruitment ambition had been realized: former President Ahmadinejad acknowledged that the leader of a unit established specifically to counter Mossad was himself exposed as an Israeli agent in 2021, and that around twenty Iranian operatives had been acting as double agents. The adversary’s own counterintelligence apparatus had been penetrated. In the annals of intelligence history, this stands as a remarkable achievement (Al Jazeera)

The Foreign Legion: Iranian Recruits as Mossad’s Most Lethal Weapon

The conceptual shift that transformed Mossad’s Iran operations from a conventional intelligence campaign — collection, analysis, occasional disruption — into the sustained paramilitary enterprise evident in the June 2025 war was the development of what senior Israeli officials have called the “foreign legion”: a network of non-Israeli agents, primarily Iranian citizens and nationals of neighboring states, recruited and trained by Mossad to conduct operations inside Iran that were previously the exclusive province of Israeli operatives. This shift, which Mossad Director David Barnea substantially accelerated after assuming leadership of the agency in 2021, reflects a fundamental strategic judgment: that the operational environment inside Iran had become too hostile and too closely monitored for Israeli nationals to operate safely, and that the growing pool of motivated and recruitable Iranians provided an alternative that was simultaneously safer, more scalable, and ultimately more capable of the sustained, geographically dispersed operational tempo that the campaign now required.

The operational logic of the foreign legion is straightforward, but its execution is extraordinarily demanding. An Iranian citizen operating on behalf of Mossad carries none of the distinctive characteristics — language difficulty, cultural unfamiliarity, physical appearance — that mark a foreign operative in a hostile environment. They can communicate without an accent, navigate social environments without the stiffness that marks someone performing an unfamiliar cultural role, and maintain long-term cover stories consistent with their actual biographical histories. They can travel within the country without the scrutiny applied to foreigners, maintain family and social relationships that provide genuine and unimpeachable cover, and access institutional environments — government offices, military facilities, scientific institutions — that are, by definition, closed to outsiders. Against these advantages must be weighed the risks: an Iranian caught working for Israeli intelligence faces execution, as do, potentially, family members implicated in their activities.

Present and former officials said the recruits fell into two categories: some gravitated to traditional espionage, gathering intelligence and passing it on to their handler; others expressed a willingness to carry out violent operations, including attacks on nuclear scientists. The distinction between these categories matters: the intelligence-gathering recruits form the permanent substrate of the network, providing the targeting information and access that makes operational action possible, while the operationally active recruits — those willing to conduct physical sabotage, plant explosive devices, or participate in directed killings — are a smaller, more carefully selected, and more intensively trained subset. The preparation of an operationally active recruit begins with the same gradual escalation that characterizes all Mossad recruitment, but extends to weapons handling, explosive device operation, surveillance and counter-surveillance techniques, and the specific skills required for whatever mission the individual has been prepared to conduct ( Al Jazeera ).

The geographic reality of Iran’s borders proved, as noted earlier, a critical enabler of the foreign legion’s logistics. Israeli officials who have worked with Mossad on logistics noted that “bringing equipment in and out is relatively easy,” and that Mossad used front companies that legally shipped boxes and crates by sea and on trucks through border crossings. The physical materials required for paramilitary operations — explosives, weapons, communications equipment, remotely operated systems — could not be sourced from Iranian commercial channels without attracting attention, but could be imported through the informal trade networks operating throughout the border regions. The “infrastructure agents” who received and stored this materiel — a category of agent distinct from both intelligence collectors and active operatives — represented a third layer of the network, providing the logistical backbone on which the operational activities of the more active components depended. Al Jazeera

The scale of the foreign legion operation, preparatory to June 2025, exceeded anything that Mossad had previously attempted. A documentary by Israel’s Channel 13 reported that one hundred Mossad operatives were deployed inside Iran to install and operate smuggled heavy missile systems. These operatives — virtually all of them Iranian citizens or nationals of neighboring countries — had positioned and operated the weapon systems used to disable Iranian air defenses in the opening phase of the June conflict. Iranians recruited by Israel even helped smuggle “technologically modified vehicles” into the country, which were used to target Iranian air defense positions and clear a path for Israeli aircraft entering Iranian airspace. The integration of these ground-based operations with the aerial assault — timed with precision that required real-time communication between the operatives on the ground and the Israeli Air Force command structure — demonstrates an extraordinary level of operational coordination.

The specific story of S.T., reported in detail by ProPublica based on interviews with Israeli officials, provides the most granular available account of how individual recruits functioned within this system. S.T. was reportedly a young Iranian from a working-class family near Tehran who had been arrested by the Basij militia during his student years and subjected to torture. This experience — the personal encounter with state violence in its most immediate and physical form — provided the motivational substrate for his subsequent recruitment. After his release, he was approached through channels that ProPublica’s reporting does not detail, and over time was gradually drawn into a relationship that began with providing only minor information and escalated to active participation in operations. By June 2025, he was commanding a commando team attacking an anti-aircraft battery on the outskirts of Tehran — a journey from tortured student to paramilitary operative that encapsulates the entire recruitment arc of the foreign legion program.

The protection offered to recruits — the promise of exfiltration and resettlement if their covers are compromised — is not merely a recruitment proposition but an operational necessity. An agent who believes that exposure means death without recourse, who has no pathway to safety beyond continued concealment, will eventually reach a point where the risks of continued operation become unbearable. An agent who believes that success creates a pathway to a genuinely different life — resettlement in a Western country, financial security for their family, freedom from the social and political restrictions of the Islamic Republic — has a rational long-term incentive to perform reliably and to maintain the relationship with their handler even through the periods of highest operational risk. Mossad’s consistent adherence to its exfiltration commitments, as evidenced by multiple cases in which agents were indeed extracted and resettled, has made those commitments credible in a way that matters for ongoing recruitment.

The counterintelligence challenge that the foreign legion poses to Iran’s security services is qualitatively different from the challenge posed by foreign operatives. Against a foreign operative, counterintelligence can focus on the specific indicators of foreignness — distinctive behavioral patterns, communication anomalies, financial flows from abroad, unexplained international travel. Against an Iranian citizen who has been recruited over years and whose cover story is consistent with their actual biography, the indicators are far more subtle and the detection far more difficult. The interrogation of arrested individuals who are subsequently found to have no direct knowledge of other network members — because compartmentalization has ensured that they genuinely do not know — produces intelligence of limited value for rolling up the broader network. The Washington Institute reported that Iranian officials carried out a domestic witch hunt after the 2025 war, arresting thousands of individuals in their search for people who spied for Israel — a response that, while reflecting genuine security urgency, is as likely to destroy innocent lives and damage social trust as it is to identify the actual agents who remain, presumably, in place.

The demographic profile of Mossad’s recruits in Iran, insofar as it can be inferred from publicly available cases, reflects the agency’s systematic exploitation of specific institutional vulnerabilities. Kurdish Iranians hanged for the 2023 Isfahan operation, a young student radicalized by Basij torture, security officials whose disillusionment with the regime overcame their institutional loyalties — these profiles suggest a recruitment strategy that targets the specific social groups where alienation from the Islamic Republic is most intense and most likely to create durable motivations for collaboration. The methodology is neither random nor opportunistic; it reflects a sustained analytical effort to identify, across Iran’s diverse social landscape, the individuals and communities where the conditions for recruitment are most favorable.

The foreign legion represents, in strategic terms, a force multiplier of enormous significance. Rather than being limited by the number of Israeli operatives willing and able to operate in the world’s most hostile intelligence environment, Mossad can draw on a pool of potentially recruitable Iranians whose size is constrained not by supply but by the agency’s own vetting, training, and management capacity. The growing unpopularity of the Islamic Republic — documented by independent polling organizations despite the obvious difficulties of conducting reliable survey research in Iran — suggests that this pool is not shrinking. The conditions that made the foreign legion possible in 2025 remain in place, and in some respects have intensified, in the aftermath of a war whose costs were borne disproportionately by an Iranian population that had not chosen it.

 Operation Rising Lion: The Culmination of Decades of Preparation

Operation Rising Lion, launched in the early morning hours of June 13, 2025, was not a response to an immediate provocation. It was the culmination of a strategic campaign that had been building for decades — a campaign whose intelligence dimensions had been described in the preceding sections of this essay and whose military execution was enabled, in fundamental ways, by the intelligence architecture that those dimensions had created. Understanding the operation as a military event, divorced from its intelligence context, is to misunderstand it entirely. The strikes were not merely an air campaign supplemented by some ground activity; they were an air campaign whose success depended entirely on intelligence support of extraordinary depth, provided by a human network that had been developed inside Iran over many years and activated, in its full operational capacity, for the first time on a single night.

The pre-operational intelligence collection required to support June 13 was itself an achievement of the first order. To prepare for Operation Rising Lion, Mossad and the military intelligence agency Aman stepped up their tracking of Iran’s military leaders and nuclear teams, with Barnea significantly expanding the Tzomet division that recruits and trains non-Israeli agents. The tracking of individual targets — military commanders, nuclear scientists, IRGC generals — required sustained human surveillance in the specific urban environments where those individuals lived and worked: their neighborhoods, their routes to work, their security routines, and the specific architectural details of the buildings in which they slept. This targeting intelligence was compiled over months, maintained current against the target’s evolving security arrangements, and delivered to Israeli Air Force planners with sufficient precision to enable strikes on individual bedrooms at specific times of night. Al Jazeera

The operational sequence of June 13 unfolded in a coordinated pattern that reflected the integration of multiple intelligence streams into a single operational architecture. In the hours before the first Israeli aircraft entered Iranian airspace, the foreign legion operatives positioned inside Iran executed the sabotage actions on which air superiority depended. Anti-aircraft batteries protecting Tehran and the nuclear facilities were disabled by the teams that Mossad had positioned and equipped. An Israeli official said Mossad had smuggled precision weapons and established a covert drone base near Tehran, which were used to disable air defenses, securing air superiority for Israeli aircraft. The simultaneous execution of dozens of ground sabotage actions across a country the size of Iran, coordinated with the timing of an aerial assault whose first waves began within minutes of the ground operations, represents a command and control achievement that required months of preparatory communications, rehearsal, and operational security management. Al Jazeera

The cyber deception operation that accompanied the ground and aerial assault demonstrated the maturation of capabilities that Stuxnet had initiated fifteen years earlier. Israeli cyberwarriors sent a fake message to Iran’s top military leaders, luring them to a phantom meeting in an underground bunker that was then demolished in a precision strike, killing twenty, including three chiefs of staff. The ability to send a fake message that Iran’s most senior military commanders would trust — a message convincing enough to cause these individuals to assemble at a specific location at a specific time — required not merely technical penetration of Iran’s military communications systems but an understanding of internal communication protocols, authentication mechanisms, and command culture sufficient to construct a message that would pass as genuine under the scrutiny of suspicious professionals. This is not a technical achievement alone; it is a combined technical and human intelligence achievement, requiring insiders who understood the specific form and content of legitimate military communications. Al Jazeera

The targeting of nuclear scientists during the operation went beyond the air strikes on their residences. Experts consulted by the New York Times concluded that all working centrifuges at Natanz and Fordow were likely destroyed, and the Isfahan research center involved in nuclear weapons development was also damaged. The precision of the strikes — the ability to attack centrifuge arrays inside hardened underground facilities while causing limited collateral damage to surrounding infrastructure — reflected intelligence about the precise layout of those facilities that could only have come from individuals who had been inside them. IAEA inspectors had visited some of these facilities, but the specificity of information required to plan precision strikes against particular equipment arrays within underground installations exceeded anything that inspection reports would have provided. Iran International

The assassination of thirty Iranian generals and nine nuclear scientists in a single night — achieved through a combination of aerial strikes on residences and the targeted elimination of individuals who had been lured to specific locations — represents a decapitation strike of unprecedented scope in modern military history. The military planning required to identify thirty specific individuals, establish their nighttime locations, confirm those locations in real time, and deliver precision munitions to thirty separate addresses in a coordinated time window speaks to an intelligence infrastructure of extraordinary depth and currency. The human sources who provided this targeting intelligence — who knew the home addresses, security arrangements, and current locations of Iran’s most senior military commanders — must have been embedded within the institutional networks where those individuals were known and their movements could be monitored.

The Iranian military’s inability to respond effectively to the June 13 strikes reflected not merely the degradation of its air defense systems by the Mossad ground teams but a deeper command and control disruption that the intelligence campaign had engineered. The deception operation that killed the three chiefs of staff and seventeen senior officers removed the individuals who would have directed the military response at precisely the moment when that direction was most urgently needed. The loss of the secure communications system — whose penetration had enabled the fake meeting message — meant that surviving commanders could not communicate confidently with subordinates without fear that their communications were being monitored and potentially manipulated. The result was the command paralysis that operational military planners designate as the desired effect of a successful decapitation strike: not the physical destruction of the institution but the temporary dissolution of its capacity for coherent collective action.

Ultimately, Israeli and US airstrikes damaged the nuclear facilities at Natanz, Isfahan, and Fordow extensively. Iran’s uranium enrichment facilities were seriously damaged, according to Foreign Minister Abbas Araghchi and the IAEA. Experts concluded that all working centrifuges at the sites were likely destroyed. The material achievement was significant but not, as subsequent analysis would establish, decisive: Iran retained the technical knowledge and, in dispersed locations, portions of its enriched uranium stockpile. The program had been set back — by estimates ranging from several months to two years — but not terminated. The most consequential damage was human rather than physical: the loss of thirty-nine senior military and scientific personnel whose combined experience and knowledge represented an institutional resource that could not be immediately replaced. Iran International

The American dimension of the operation — the direct US military participation that began on June 22, when B-2 bombers and Tomahawk missiles struck Fordow, Natanz, and Isfahan — shifted the character of the conflict from a bilateral Israeli covert action to a multilateral military campaign. US MQ-9 Reaper drones had been circling over Tehran and Shiraz throughout the earlier phase to facilitate precision targeting, and the American strikes represented a natural escalation of a partnership that had been operational throughout the earlier phase. President Trump’s characterization of the targeted facilities as “totally obliterated” was contested by Iranian officials and subsequently qualified by US intelligence assessments, but the political message it conveyed — American commitment to preventing Iranian nuclear capability — added a diplomatic dimension to the operation that extended its effects beyond the immediate military outcome. App Store

The aftermath of Operation Rising Lion left the strategic situation in the Middle East profoundly changed but not resolved. Iran retained its capacity for reconstitution; its motivations for nuclear development had, if anything, been intensified by the attack; and the network of proxy forces through which it projects power in the region remained substantially intact. The shadow war that had preceded June 2025 was, in many respects, the more strategically consequential conflict: the patient accumulation of intelligence penetration, the systematic disruption of specific capabilities, and the shaping of the political and military environment that made the June operation possible. Military historians will write extensively about the twelve-day war; intelligence historians will write, with at least equal significance, about the forty-year campaign that made it possible.

The Limits of Covert Power: Iran’s Counterintelligence Response and the Future of the Shadow War

The history of Mossad’s campaign against Iran is also, necessarily, a history of its limits — the places where the logic of intelligence operations ran up against strategic realities that covert action could complicate and delay but not ultimately change. Iran’s nuclear program has advanced, through four decades of assassinations, sabotage, cyber attacks, and international sanctions, to a level of technical sophistication that its practitioners of the early 2000s could barely have imagined. The centrifuges destroyed at Natanz in 2020 and 2021 were rebuilt and replaced with more advanced models. The scientists killed between 2010 and 2025 were mourned and then succeeded by new generations trained in the institutional frameworks their predecessors had established. The archive stolen in 2018 documented a program that had already advanced beyond what those documents contained. Intelligence operations imposed costs; they did not reverse a trajectory driven by the strategic determination of a state with ninety million people and substantial material resources.

Iran’s counterintelligence response to Mossad’s penetration underwent several significant evolutions over the course of the shadow war, each driven by the specific lessons imposed by the previous phase of Israeli operations. The initial response to the assassinations of nuclear scientists was security-focused: personal protection details, varied routes, restricted communications, reduced exposure. The 2021 identification of Reza Karimi as the suspected saboteur of the Natanz facility — an insider who had enabled the smuggling of 300 pounds of explosives into a nominally secure installation — prompted a deeper review of personnel vetting and access control procedures throughout the nuclear establishment. Iranian Intelligence Minister Esmail Khatib declared the dismantling of Mossad’s infiltration network “the most important achievement” of his ministry’s performance — a declaration that proved premature but reflected genuine efforts at systematic counterintelligence reform. Foreign Policy

The institutional politics of Iranian counterintelligence were themselves a source of vulnerability that Mossad appears to have exploited systematically. When Hossein Taeb was removed from his position as head of IRGC Intelligence after thirteen years, the change was widely interpreted as reflecting dissatisfaction with his handling of Israeli-linked operations and assassinations. His successor, Mohammad Kazemi, was seen as representing a strategic pivot toward deeper focus on infiltration and counterintelligence. The institutional competition between IRGC Intelligence, the Ministry of Intelligence (MOIS), and the Intelligence Bureau of the Supreme Leader — three distinct organizations with overlapping jurisdictions and competing bureaucratic interests — created information silos and coordination failures that a sophisticated adversary could exploit. In a genuinely unified counterintelligence apparatus, the penetration of one organization’s leadership would not necessarily compromise the others; in an environment characterized by institutional rivalry and restricted information sharing, the penetration of any single node could have cascading effects. Foreign Policy

The revelation that the unit Iran established specifically to counter Mossad operations had its own leader exposed as an Israeli agent in 2021 illustrates the paradox of counterintelligence in a deeply penetrated environment. To counter foreign penetration, you must staff the counterintelligence function with individuals who have access to sensitive information about the nature and extent of the penetration — individuals who are, by definition, attractive recruitment targets for the very adversary they are supposed to be countering. If the vetting process that screens counterintelligence personnel is itself compromised, the counterintelligence function becomes not a defense against penetration but an accelerant of it. The recursive quality of this problem — the counterintelligence unit infiltrated by the service it is trying to counter — represents the ultimate expression of Mossad’s operational achievement. Al Jazeera

The scale of Iran’s post-2025 security crackdown — with thousands of individuals arrested in the months following the June war — reflects both genuine urgency and the structural limitations of a reactive counterintelligence response. Mass arrests produce genuine intelligence through interrogation, but they also produce large numbers of false positives: individuals arrested on the basis of associational suspicion rather than specific evidence, whose processing consumes investigative resources and whose detention damages the social fabric of scientific and military communities that the state needs to function. The execution of dozens of individuals — including, by Iranian official accounts, multiple members of the Mossad network, but also, inevitably, some innocent individuals caught in a security apparatus operating under extreme pressure — illustrates the brutality of this approach and its attendant costs.

Iran’s structural inability to address the social conditions that make large-scale recruitment possible represents the fundamental constraint on its counterintelligence effectiveness. A former Mossad officer noted the many dissatisfied people in Iran, with large parts of society impoverished while billions are invested in foreign proxies rather than in domestic development. The economic stagnation produced by sanctions, compounded by governance failures and corruption, has created the motivational conditions for recruitment that no amount of security apparatus intensification can fully counter. Improving counterintelligence through surveillance and enforcement is addressing a symptom rather than the underlying condition; the underlying condition is a state whose relationship with its own population has generated a reservoir of alienation large enough to supply a foreign intelligence service’s recruitment needs indefinitely. Wikipedia

The future trajectory of the shadow war depends, in large measure, on how the balance of these structural forces evolves. On the Israeli side, the intelligence capabilities that enabled the 2025 operations will be maintained and refined; the institutional investment in Iran-focused personnel and methodology accumulated over four decades does not diminish simply because a specific operation has been executed. On the Iranian side, the reconstitution of the nuclear program — in dispersed locations with enhanced security — will proceed alongside the prosecution of what is likely to be a sustained and brutal counterintelligence campaign. The fundamental asymmetry of the conflict — between a state whose intelligence capabilities have systematically exceeded those of its adversary and a state whose governance failures have created the conditions for its own penetration — is unlikely to change rapidly.

The technological evolution of the conflict also deserves specific attention. The artificial intelligence systems employed in the targeting of Mohsen Fakhrizadeh, the drone capabilities deployed by both sides, and the cyber operations that shaped the June 2025 conflict all reflect a technological competition that is accelerating. Iran’s investment in domestic cyber warfare capabilities — driven partly by the lessons of Stuxnet and partly by the operational requirements of its own offensive activities against Israeli and Western targets — will produce a more capable adversary in the digital domain. The arms race in autonomous systems, applied to both intelligence collection and direct action, will reshape the operational environment in ways that are difficult to predict but certain to be significant.

The role of the United States in the shadow war will also evolve in ways that reflect the broader dynamics of American strategic competition in the Middle East. The CIA-Mossad collaboration on Iran targeting, which reached its most overt expression in the June 2025 conflict, is embedded in a bilateral relationship that extends across multiple administrations and is institutionally durable even when politically contested. The specific modalities of that collaboration — what intelligence the US provides, what operations it supports directly or tacitly, where it imposes constraints on Israeli action — will shift with American domestic politics and with the evolving strategic judgment of the administration in office. But the fundamental alignment of American and Israeli interests in preventing Iranian nuclear weapons capability, which has driven the collaboration for twenty years, is unlikely to dissolve.

The moral and legal questions raised by forty years of assassinations, sabotage, and covert warfare — conducted largely outside the frameworks of international law that are supposed to govern state behavior — will not be definitively resolved in academic or judicial forums. But they deserve serious engagement. The campaign described in this essay has involved the killing of civilians — scientists, not combatants — the destruction of civilian infrastructure — research facilities, not weapons systems — and the systematic subversion of a foreign state’s internal security through the cultivation of its own citizens as agents. Each of these activities can be justified within particular strategic frameworks; none of them is unambiguously legal under existing international law; and the precedents they establish are available to all states, including those whose use of similar methods would be regarded as threatening rather than reassuring by the same governments that have tacitly condoned Israel’s conduct.

The shadow war between Israel and Iran is not over. The June 2025 strikes degraded Iran’s nuclear infrastructure without eliminating the knowledge base, the institutional capacity, or the political determination that drives the program. The network of agents that Mossad has spent decades building inside Iran was damaged by the post-war crackdown but not destroyed; the structural conditions that enable recruitment persist. The technological competition between the two states’ intelligence services will continue to produce new tools and new vulnerabilities. And the fundamental strategic question that has driven the conflict from its origins — whether Iran will acquire nuclear weapons capability, and what costs Israel is prepared to impose to prevent it — remains, despite everything that has been described in this essay, unresolved. The shadow war continues; its next chapter is already being written.

Operation Epic Fury: The Assassination of Khamenei and the 2026 Iran War

The period between the ceasefire of June 24, 2025, and the resumption of hostilities on February 28, 2026, was not a period of peace — it was a period of preparation. The intelligence operations that had characterized the preceding decades did not pause with the ceasefire; they accelerated, adapting to a new operational environment defined by a weakened but unbroken Iranian state, a devastated but not destroyed nuclear infrastructure, and a domestic political situation in Iran that, for the first time in forty-six years, appeared to offer genuine possibilities of fundamental change. In late 2025, large protests began in Iran because of an economic crisis and rising prices — the biggest since the Iranian Revolution in 1979 — and the government used violence to suppress them, with estimates of deaths ranging from 3,117 to 32,000. The scale of this internal crisis — the largest popular challenge to the Islamic Republic’s legitimacy since its founding — created an intelligence and strategic environment that Mossad’s director David Barnea assessed as potentially decisive. His assessment produced a plan that would result in the most consequential single operation in the shadow war’s history.

The intelligence preparation for what would become Operation Epic Fury — the February 28, 2026, strikes that killed Supreme Leader Ali Khamenei — represents the apex of the integrated HUMINT-SIGINT-TECHINT methodology that had been developed over four decades. Mossad had access not only to the electronic devices owned by Khamenei’s inner circle for nearly two decades, but also to nearby mobile communications towers, thereby enabling the denial of cell phone signals and delaying early warning to Iranians until the last minute. Israel’s hacking of Tehran’s extensive network of surveillance cameras allowed it to monitor the Supreme Leader’s pattern of life in the lead-up to the strike. The granular intimacy of this surveillance — a foreign intelligence service monitoring the daily movements of a supreme leader through the cameras his own government had installed across his capital city — represents the culmination of the technological investment and human network development described throughout this essay. The information that ultimately enabled the strike, however, was human: the knowledge that Khamenei felt least vulnerable during daylight hours, that he would be arranging a specific meeting at the presidential palace with his inner circle, and photographic evidence of his death in the immediate aftermath — all of this came from human sources embedded within the innermost circles of the Islamic Republic ( MunaeemMunaeem ).

The plan that Mossad Director Barnea presented to the Israeli government and subsequently to Trump administration officials in January 2026 went beyond targeted killing to encompass a theory of political change. Barnea devised a plan to overthrow the Islamic Republic of Iran by galvanizing the Iranian opposition after several days of US-Israeli strikes and assassinations, prompting them to riot and rebel against the government, leading to its collapse. This would include decapitating the leadership of Iran and intelligence operations leading to a mass uprising. The plan’s ambition was not merely the elimination of specific individuals but the creation of a political vacuum so profound and so rapidly produced that the Iranian state would lose its capacity for coherent governance before it could reconstitute leadership. The “Venezuela model” — rapid decapitation followed by the elevation of a manageable insider — was explicitly discussed as the template. The fundamental difference between the Venezuelan and Iranian contexts, which would become apparent in the weeks following February 28, was that Iran possessed institutional structures — the IRGC, the clerical establishment, the Revolutionary judiciary — that were far more resilient than Maduro’s personalistic system ( Dornsife College).

On 28 February 2026, Ali Khamenei, the Supreme Leader of Iran, was assassinated in an Israeli air attack. Three separate gatherings of Iranian regime officials were hit within half a minute of each other in the opening strike. The simultaneity of the three strikes — an operational coordination that required real-time intelligence about the location and timing of gatherings that the Iranian security establishment had every reason to keep secret — demonstrated how completely Mossad’s penetration of Iranian communications had rendered the Supreme Leader’s movements legible to his adversaries. The IRGC-controlled Fars News Agency announced that Khamenei’s daughter, son-in-law, grandchild, and daughter-in-law were also killed. The deliberate targeting of family members — a choice that carried significant moral weight and generated international condemnation — reflected a strategic judgment that eliminating the immediate kinship network would compound the psychological and political impact of the Supreme Leader’s death. IDF Spokesperson Brigadier General Effie Defrin stated that months of joint US and Israeli “strategic and operational deception” of satellite imagery had led up to the war — a deception operation that ensured Iranian intelligence could not read Israeli preparation from surveillance data in the days before the strikes. Al Jazeera + 2

Iran’s immediate response demonstrated that the Islamic Republic’s retaliatory capacity, while degraded by the June 2025 strikes, had not been eliminated. In retaliation, Iran launched hundreds of drones and ballistic missiles at Israel, US military bases in the region, and at neighboring Arab countries including Bahrain, Jordan, Kuwait, Oman, Qatar, Saudi Arabia, and the United Arab Emirates. Iran and its proxies launched strikes on Iraq’s Kurdistan. A drone struck Britain’s Akrotiri military base on Cyprus, and missiles were shot down over Turkey while civilian infrastructure was struck in Azerbaijan. The geographic breadth of Iran’s retaliatory strikes — encompassing targets in at least a dozen countries — reflected a deliberate strategic choice to impose costs as widely as possible, complicating the political calculus for America’s regional partners and testing the solidarity of a coalition that Washington had assembled hastily around an operation whose planning had not been fully shared with allies. The closure of the Strait of Hormuz — through which approximately twenty percent of globally traded oil passes — was perhaps the most strategically significant Iranian countermeasure, imposing immediate and severe costs on the global economy in ways that were specifically designed to generate international pressure for a ceasefire. Al Jazeera

The assassination of Ali Larijani on March 17, 2026 extended the decapitation campaign to what had become, in the political vacuum following Khamenei’s death, the most influential figure in the Iranian political system. Larijani was described as the de facto leader of Iran after Khamenei’s assassination, and was the number one target and the most senior official killed after the Supreme Leader himself. Larijani’s significance lay not merely in his formal positions — he had served as parliament speaker, nuclear negotiator, and Security Council secretary — but in his role as the institutional memory of the Islamic Republic’s political elite: a figure who understood how the system worked, who held relationships across its factional divides, and who, had he survived, might have been capable of organizing a coherent political response to the leadership crisis. His elimination, like Khamenei’s, required intelligence about his location and movements that reflected the persistent depth of Mossad’s human network even in the chaotic weeks following the February 28 strikes. Factually

The succession crisis that followed Khamenei’s assassination revealed both the fragility and the resilience of Iranian state institutions. Iran appointed Khamenei’s son, Mojtaba Khamenei, as his successor, and military, security, political, and judicial authorities renewed their pledge of allegiance to Khamenei’s office and the theocratic establishment, even though the new supreme leader had not been seen or heard from outside several written statements attributed to him. The speed of the succession — the formal elevation of Mojtaba within days of his father’s death — demonstrated the Islamic Republic’s institutional capacity for rapid political self-organization under existential pressure. The anticipated mass uprising that Barnea’s plan had projected did not materialize at scale: several weeks into the war, no large-scale uprising against the regime had manifested, possibly as a result of the explicit calls by opposition leader Reza Pahlavi urging Iranians to “leave the streets and remain at home” and wait for his “final call” before rising up. Trump acknowledged the reluctance of protesters to take to the streets given their lack of weapons and the fact that Iranian security forces were machine-gunning civilians. Wikipedia + 2

The regime change ambition that had animated the February 28 strikes confronted, in the weeks that followed, the limits of intelligence-enabled military power as an instrument of political transformation. Trump noted challenges in identifying a viable successor to Khamenei, stating that US-Israeli decapitation strikes had killed many individuals previously considered as potential moderate and pragmatic alternatives, hindering efforts to implement the “Venezuela model.” The very success of the assassination campaign — the systematic elimination of Iran’s senior leadership over the preceding months — had paradoxically reduced the pool of potential interlocutors through whom a managed political transition might have been organized. Iran’s institutions, deeply rooted in the Revolutionary Guard, the clerical hierarchy, and the Basij paramilitary networks that controlled territory, proved more durable than the individual leaders who had been killed. The IRGC continued to take the lead on military operations, wield significant economic power, and maintain armed control on the streets through the paramilitary Basij and other forces — an institutional persistence that rendered the decapitation strategy insufficient as a mechanism of regime change. Dornsife CollegeWikipedia

A conditional ceasefire was declared on April 8, 2026, with talks mediated by Pakistan. The ceasefire — fragile, contested, and repeatedly threatened by continued strikes and retaliatory actions — created space for diplomatic engagement that both sides needed: Iran because its economy and military infrastructure were severely strained, the United States because the global economic consequences of the Strait of Hormuz closure were generating political pressure domestically and from allied governments. Iran’s latest proposal to the US was to postpone talking about the country’s nuclear program, even though Trump and Netanyahu’s foremost public reasoning for starting the war was to make sure Iran would never have a nuclear weapon. Tehran said it would never seek nuclear weapons, but would not ship out its stockpile of enriched material or stop enrichment on Iranian soil, as the country had paid a huge price to obtain the technology, in the form of decades of sanctions and killings of its scientists. The impasse encapsulated the fundamental paradox of the entire forty-year shadow war: the campaign had imposed enormous costs on Iran’s nuclear program but had not succeeded in changing the political determination that drove it. WikipediaWikipedia

As of May 2026, the shadow war that began in the corridors of SAVAK’s Tehran headquarters in the 1960s has entered its most overt and most destructive phase. The 2026 Iran war disrupted global travel and trade, halted flights in and out of the Middle East, and led to shipping reroutes to avoid the Strait of Hormuz and the Red Sea. Gasoline costs fifty percent more in the United States than it did before the Iran war. The intelligence campaign that this essay has traced — from Stuxnet to the archive heist, from the assassination of nuclear scientists to the foreign legion’s operations in June 2025, from the surveillance of Khamenei’s movements through his own city’s cameras to the precisely timed strikes of February 28 — has achieved tactical successes of extraordinary sophistication while leaving the fundamental strategic question unresolved. Iran’s nuclear knowledge persists; its institutional capacity for reconstitution, however damaged, has not been destroyed; and the social conditions that make recruitment possible — economic deprivation, political alienation, generational disenchantment with the Islamic Republic — show no signs of abating under the pressure of a war that has intensified all three. The intelligence war continues, and its final chapter has not yet been written. Al Jazeera

About The Author

Kamaruzzaman Bustamam Ahmad

Prof. Kamaruzzaman Bustamam Ahmad (KBA) has followed his curiosity throughout life, which has carried him into the fields of Sociology of Anthropology of Religion in Southeast Asia, Islamic Studies, Sufism, Cosmology, and Security, Geostrategy, Terrorism, and Geopolitics. Prof. KBA is the author of over 30 books and 50 academic and professional journal articles and book chapters. His academic training is in social anthropology at La Trobe University, Islamic Political Science at the University of Malaya, and Islamic Legal Studies at UIN Sunan Kalijaga Yogyakarta. He received many fellowships: Asian Public Intellectual (The Nippon Foundation), IVLP (American Government), Young Muslim Intellectual (Japan Foundation), and Islamic Studies from Within (Rockefeller Foundation). Currently, he is Dean of Faculty and Shariah, Universitas Islam Negeri (UIN) Ar-Raniry, Banda Aceh, Indonesia.

See author's posts

Artikel Terkait

Analisis Konflik Iran–Israel–Amerika Serikat : Geopolitik, Intelijen, dan Risiko Eskalasi Geografi Iran dan Ilusi Penaklukan: Mengapa Amerika dan Israel Sulit Menang Perang Isaiah Berlin, Zionisme, dan Arsitektur Kekerasan: Membaca Gaza, Iran, dan Lebanon dalam Geopolitik Israel Kontemporer Aceh, Nation-State, dan Komparasi Global: Bali, Yogyakarta, Brunei, Singapura, dan Israel dalam Dialektika Demokrasi dan Agama Dune dan Perang Timur Tengah: Trump, Netanyahu, dan Shai-Hulud yang Akan Menelan Mereka