The Intelligence Agencies
Organizational StructureThe intelligence confrontation between Israel and Iran involves some of the world's most capable spy agencies. Israel's intelligence community is widely regarded as among the best globally, while Iran's agencies operate an extensive network across the Middle East through both state institutions and the IRGC's parallel intelligence apparatus.
Israeli Intelligence Community
MossadInstitute for Intelligence and Special Operations
Israel's legendary foreign intelligence service, responsible for intelligence collection, covert operations, and counterterrorism abroad. Directly subordinate to the Prime Minister. Responsible for some of the most audacious intelligence operations in history, including the capture of Adolf Eichmann, the theft of Iran's nuclear archive, and numerous targeted killings.
Shin Bet (Shabak)Israel Security Agency
Israel's internal security service responsible for counterintelligence, counterterrorism within Israel and the occupied territories, and VIP protection. Has thwarted hundreds of planned attacks and runs an extensive network of informants in Palestinian territories and among Israeli Arab communities.
AmanMilitary Intelligence Directorate
Israel's largest intelligence agency, responsible for military intelligence collection and analysis, national intelligence assessments, and signals intelligence (SIGINT). Produces the national intelligence estimate and oversees Unit 8200. Faced severe criticism after the October 7, 2023 intelligence failure.
Unit 8200SIGINT & Cyber Operations
Israel's elite signals intelligence and cyber warfare unit, often compared to the US NSA and UK GCHQ. Responsible for electronic eavesdropping, code breaking, cyber offensive operations, and developing cutting-edge surveillance technology. Many alumni have gone on to found major Israeli tech companies. Co-developed Stuxnet with the US NSA.
Iranian Intelligence Community
VAJA (MOIS)Ministry of Intelligence and Security
Iran's primary civilian intelligence agency, responsible for foreign and domestic intelligence, counterintelligence, and monitoring dissident groups. Operates extensive networks across the Middle East and has been linked to assassination plots in Europe and Latin America. Monitors Iranian diaspora communities worldwide.
IRGC Intelligence OrganizationSazman-e Ettela'at-e Sepah
The intelligence arm of the Islamic Revolutionary Guard Corps, operating in parallel to VAJA. Reports directly to the Supreme Leader through the IRGC commander. Increasingly powerful and often in rivalry with VAJA. Responsible for monitoring military threats and protecting the regime.
Quds ForceIRGC Extraterritorial Operations
The IRGC's special forces unit responsible for extraterritorial operations and supporting proxy forces across the region. Provides training, weapons, funding, and intelligence to Hezbollah, Hamas, Palestinian Islamic Jihad, Iraqi militias, and Houthi forces. Led by Qasem Soleimani until his assassination in January 2020.
Assassinations & Targeted Killings
2010 – 2026Targeted killings have been a defining feature of the Israel-Iran shadow war. Israel has systematically eliminated key figures in Iran's nuclear program, military leadership, and proxy organizations, while Iran has attempted retaliatory operations with less success. The pace of assassinations accelerated dramatically from 2020 onward.
Iranian Nuclear Scientists Campaign
2010 – 2012A systematic campaign targeting Iran's top nuclear scientists. At least five scientists were assassinated using methods including magnetic bombs attached to cars by motorcycle riders in Tehran traffic. The campaign severely disrupted Iran's nuclear program and forced scientists to operate under heavy security.
Assassination of Qasem Soleimani
Jan 3, 2020US drone strike killed IRGC Quds Force commander Qasem Soleimani at Baghdad International Airport, along with Iraqi militia leader Abu Mahdi al-Muhandis. Soleimani was Iran's most powerful military figure and architect of its proxy network across the region. The killing brought the US and Iran to the brink of war. Iran retaliated with ballistic missile strikes on Al-Asad airbase in Iraq.
Assassination of Mohsen Fakhrizadeh
Nov 27, 2020Iran's top nuclear scientist was killed near Tehran by a remote-controlled robot-mounted machine gun that used AI-assisted facial recognition. The weapon was smuggled into Iran in pieces and assembled on-site. Fakhrizadeh was considered the father of Iran's nuclear weapons program. Iran accused Mossad and vowed revenge, but has been unable to retaliate proportionally.
Assassination of Ismail Haniyeh
Jul 31, 2024Hamas political bureau chief was killed by a bomb pre-planted in his guesthouse room in Tehran, where he was attending the inauguration of Iran's new president. The fact that the operation took place in the heart of Tehran, in a supposedly secure IRGC-protected facility, was a devastating blow to Iran's intelligence credibility and a demonstration of Mossad's penetration of Iranian security.
Assassination of Hassan Nasrallah
Sep 27, 2024Hezbollah's Secretary-General was killed in a massive Israeli airstrike on his underground bunker in the Dahieh suburb of Beirut. The strike used dozens of bunker-buster bombs. Nasrallah had led Hezbollah for 32 years and was one of the most powerful figures in the Middle East. His death, combined with the pager attack weeks earlier, effectively decapitated Hezbollah's leadership.
Killing of Yahya Sinwar
Oct 16, 2024The mastermind of the October 7 attack was killed during an IDF ground operation in Rafah, southern Gaza. Unlike other targeted killings, Sinwar's death came in a chance encounter during building-to-building fighting. Soldiers recognized him after engagement. His death was a major Israeli military objective since October 7, 2023.
Operation Epic Fury Leadership Strikes
Feb 2026During Israel's massive strike on Iran, multiple senior IRGC commanders and military leaders were killed in targeted strikes on command bunkers. The strikes demonstrated that Israeli intelligence had precise, real-time knowledge of where senior Iranian military figures were located, suggesting deep penetration of Iranian communications and/or human intelligence sources within the regime.
Espionage Operations
Intelligence CollectionThe espionage battle between Israel and Iran involves some of the most sophisticated intelligence operations of the 21st century. Israel has demonstrated an extraordinary ability to operate inside Iran, from physically stealing nuclear archives to infiltrating communication networks. Iran has attempted to build spy networks targeting Israel and its allies with mixed results.
Iran Nuclear Archive Theft
Jan 31, 2018In one of the most audacious espionage operations in history, Mossad agents broke into a heavily guarded warehouse in the Shorabad district of Tehran and stole 100,000 documents (half a ton of material) detailing Iran's secret nuclear weapons program, codenamed Project Amad. The documents were smuggled out of Iran and presented to the world by PM Netanyahu in April 2018. The operation proved that Iran had actively pursued nuclear weapons, contradicting its public claims.
Pager Attack — Supply Chain Infiltration
Sep 17–18, 2024Israel compromised Hezbollah's newly purchased communication devices by intercepting the supply chain. Thousands of pagers and walkie-talkies were modified to contain small explosive charges before being delivered to Hezbollah operatives across Lebanon. When simultaneously detonated, the devices killed at least 12 people and wounded over 2,800, including many senior Hezbollah commanders. The operation, which took years of planning, crippled Hezbollah's command and communication infrastructure in a single stroke.
Iranian Spy Networks in Europe
OngoingMultiple Iranian spy networks have been uncovered across Europe, tasked with surveillance of Israeli and Jewish targets, Iranian dissidents, and potential assassination plots. In 2018, a Belgian-Iranian couple was arrested for plotting to bomb an Iranian opposition rally in Paris attended by thousands. Several European countries have expelled Iranian diplomats identified as intelligence operatives.
Mossad's Tehran Network
OngoingThe string of operations inside Iran — from scientist assassinations to the nuclear archive theft to the Haniyeh killing — strongly suggests that Mossad maintains human intelligence sources and operational capabilities deep within Iran's security apparatus. How Israel sustains these networks despite Iran's extensive counterintelligence efforts remains one of the great mysteries of modern espionage.
Cyber Warfare
Digital BattlefieldThe Israel-Iran cyber war represents one of the most active and consequential digital conflicts in history. It began with Stuxnet — the world's first true cyber weapon — and has escalated into an ongoing campaign of attacks and counterattacks targeting critical infrastructure, military systems, and civilian data on both sides.
Stuxnet
2010The world's first cyber weapon. A sophisticated computer worm jointly developed by the US (NSA) and Israel (Unit 8200) under Operation Olympic Games. It specifically targeted Siemens PLCs controlling uranium centrifuges at Iran's Natanz enrichment facility, causing them to spin at incorrect speeds while reporting normal operations to operators.
$ Impact: ~1,000 centrifuges destroyed. Set Iran's nuclear program back an estimated 2 years. Changed warfare forever by demonstrating that cyber weapons could cause physical destruction.
Flame / Duqu
2012Extremely sophisticated espionage malware discovered on computers across the Middle East, primarily in Iran. Flame could record audio, capture screenshots, log keystrokes, and exfiltrate data. Duqu was a related intelligence-gathering tool. Both were attributed to the same team behind Stuxnet.
$ Impact: Massive intelligence collection from Iranian government and scientific networks.
Shamoon (Saudi Aramco)
2012Iran's most devastating cyber attack — a destructive wiper malware that erased data on 35,000 computers at Saudi Aramco, the world's most valuable company. Replaced data with images of a burning American flag. Took weeks to recover. Iran was retaliating for Stuxnet and US-Saudi cooperation.
$ Impact: 35,000 computers wiped. Saudi Aramco offline for weeks. One of the most destructive cyber attacks in history.
Iran vs US Banks
2012–2013Iran launched a sustained DDoS campaign against major US banks including JPMorgan Chase, Bank of America, Citigroup, and Wells Fargo. Called Operation Ababil, it disrupted online banking services for millions of customers. Seven Iranian hackers were later indicted by the US Department of Justice.
$ Impact: 46 major US banks targeted. Millions of customers affected. First nation-state cyber attack on US financial infrastructure.
Israel Water Infrastructure Attack
Apr 2020Iran attempted to hack into Israeli water treatment facilities to increase chlorine levels in the water supply to dangerous levels. The attack was detected and blocked before causing harm. If successful, it could have poisoned water for thousands of civilians. Israel reportedly retaliated by disrupting Iran's Shahid Rajaee port.
$ Impact: Attack blocked. Israel retaliated by shutting down Iranian port systems. Marked a dangerous escalation to civilian infrastructure targeting.
Ongoing Cyber Escalation
2024–2026The cyber war has intensified alongside the conventional military escalation. Iran-linked groups have targeted Israeli hospitals, government databases, and surveillance cameras. Israel has reportedly disrupted Iranian fuel distribution networks, caused power outages, and compromised military communications. Both sides are now integrating cyber operations into their conventional military planning.
$ Impact: Full-spectrum cyber warfare. Civilian infrastructure on both sides increasingly targeted. Integration with kinetic operations.
Covert Operations & Sabotage
Physical DisruptionBeyond assassinations and cyber attacks, both sides have conducted physical sabotage operations targeting infrastructure, weapons facilities, and supply lines. Israel has focused on disrupting Iran's nuclear program and weapons transfers to proxies, while Iran's Quds Force has conducted operations across the region and attempted attacks on Israeli and Jewish targets worldwide.
Natanz Explosions
Jul 2020 / Apr 2021Two separate sabotage attacks on Iran's Natanz uranium enrichment facility. The July 2020 explosion damaged the centrifuge assembly building. The April 2021 attack caused a power failure that destroyed thousands of advanced centrifuges. Iran attributed both to Israel. The April 2021 attack was reportedly carried out by smuggling an explosive device inside equipment delivered to the facility.
Shadow War at Sea
2019 – 2023A largely hidden naval confrontation in the Red Sea, Gulf of Oman, and Eastern Mediterranean. Israel reportedly attacked Iranian weapons-smuggling ships and oil tankers evading sanctions, while Iran targeted Israeli-owned or linked commercial vessels with mines and drone attacks. Dozens of incidents involving ships from both sides, mostly unreported.
Syria Weapons Depot Strikes
2013 – PresentIsrael has conducted hundreds of airstrikes in Syria targeting Iranian weapons transfers to Hezbollah, IRGC military installations, and weapons production facilities. Known as the "Campaign Between the Wars," these strikes have destroyed precision-guided missile factories, weapons convoys, and IRGC command posts. Syria has been the primary battleground of the Israel-Iran proxy war.
Quds Force Global Operations
OngoingIran's Quds Force has attempted numerous operations targeting Israeli and Jewish targets worldwide. These include the 1994 AMIA bombing in Buenos Aires (85 killed), foiled plots in Thailand, India, Georgia, and Kenya (2012), and ongoing attempts to establish operational cells in Latin America and Africa. Most plots outside the Middle East have been disrupted by intelligence services.
IRGC Colonel Assassination in Tehran
May 2022IRGC Colonel Hassan Sayyad Khodaei was shot dead by two motorcycle-riding gunmen outside his home in Tehran. He was reportedly involved in Quds Force operations to target Israelis abroad. The assassination followed the pattern of earlier scientist killings and demonstrated that Israel's operational capability inside Tehran remained intact despite Iranian counterintelligence efforts.
Information Warfare & Psychological Ops
The Battle for NarrativeBoth Israel and Iran wage an aggressive information war, each seeking to shape international narratives, influence public opinion, and demoralize the opposing side. This includes state propaganda, social media manipulation, internet censorship, and sophisticated psychological operations.
Iranian Information Operations
Internet Shutdowns & Censorship
OngoingIran operates one of the world's most restrictive internet censorship regimes. During the 2022 Mahsa Amini protests, Iran imposed near-total internet blackouts for weeks. The regime controls access through the "National Information Network" (NIN), blocking Western social media platforms while monitoring domestic communications. During military escalations, internet access is severely restricted to control the narrative.
State Propaganda Apparatus
OngoingIran maintains extensive state-controlled media including Press TV (English), Al-Alam (Arabic), and IRNA news agency. These outlets present regime-aligned narratives about military capabilities, proxy group activities, and the conflict with Israel. Iranian media consistently amplified exaggerated claims about missile capabilities and defense performance.
Israeli Information Operations
Hasbara & Digital Diplomacy
OngoingIsrael conducts extensive public diplomacy (hasbara) through government spokespersons, social media teams, and coordinated messaging campaigns. The IDF Spokesperson's Unit operates highly active social media accounts in multiple languages. During military operations, Israel presents real-time intelligence to international media to justify strikes. Critics argue this constitutes information warfare designed to manufacture consent.
Social Media Manipulation
Bot Networks & Influence Operations
OngoingBoth sides operate extensive social media bot networks and influence operations. Meta, X (Twitter), and Google have repeatedly removed Iranian-linked fake accounts targeting Western audiences. Israel-linked operations have also been identified. AI-generated content, deepfakes, and coordinated inauthentic behavior have become standard tools. The conflict has become a testing ground for next-generation information warfare techniques.
Sources & References
OSINT & Expert AnalysisPrimary Sources
- Ronen Bergman, "Rise and Kill First: The Secret History of Israel's Targeted Assassinations" (Random House, 2018)
- Kim Zetter, "Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon" (Crown, 2014)
- David E. Sanger, "The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age" (Crown, 2018)
- Kaspersky Lab — Stuxnet, Flame, and Duqu technical analysis
- US Department of Justice — Indictments of Iranian hackers
Analytical Sources
- Institute for the Study of War (ISW) — Iran and proxy group analysis
- Bellingcat — Open-source investigations of covert operations
- The Intercept — Intelligence community reporting
- Mandiant / Google Threat Analysis Group — Iranian cyber group tracking
- Microsoft Threat Intelligence — State-sponsored actor reports
- CrowdStrike — Iranian APT group analysis
News Sources
- New York Times — Intelligence and cyber investigations
- Washington Post — National security reporting
- BBC, Al Jazeera — Regional coverage
- Haaretz, Times of Israel — Israeli perspective
- Reuters, AP — Breaking news and investigations