At dawn on June 13, 2025, explosions thundered across Tehran’s skies, marking the start of a new chapter in the Israeli-Iranian confrontation—one that broke with the legacy of proxy wars and calibrated airstrikes.
This war did not begin in the skies; it began much earlier, in the shadows—through encrypted phones, silently recruited minds, and digital breaches that infiltrated what Tehran believed were fortified bastions. Iran was stunned not only by the intensity of the strikes but also by their pinpoint accuracy: air defense systems were sabotaged by miniature drones launched from unmarked vehicles; strategic targets were pre-designated and hit with surgical precision; and the operational coordination suggested an adversary deeply familiar with Iran’s internal architecture.
This marked not just the onset of air raids—but the unveiling of a long-brewing intelligence war whose roots ran far deeper.
Israel’s intelligence superiority was not a sudden development. It was the result of years of careful recruitment, infiltration, and the systematic construction of logistical and human networks within Iranian territory. Long known for waging covert wars, Israel in this case elevated intelligence operations to the level of a primary strategic asset—on par with its airpower.
This report opens the classified files on one of the most sophisticated intelligence campaigns in the modern Middle East: How did Israel infiltrate the core of the Iranian security state? Who were its operatives? How were they recruited, trained, and activated? And why did Tehran’s security apparatus fail to intercept them before the opening salvos?
Israel’s penetration of Iran—both in intelligence gathering and operational sabotage—demonstrated the effectiveness and precision of Tel Aviv’s long-game strategy. While echoes of this success were seen in southern Lebanon, where Israel had previously breached Hezbollah’s data infrastructure and mapped command movements and weapons caches, replicating such depth in Tehran and other major cities points to a far more alarming scenario: Iran’s counterintelligence systems failed to prevent deep structural intrusions into its most sensitive institutions.
These operations included tracking IRGC commanders, embedding well-positioned assets inside Iranian cities, and conducting high-impact sabotage missions against air defense batteries, military compounds, and critical installations. These networks were also instrumental in carrying out targeted assassinations.
The Sociology of Recruitment
Israeli intelligence operations leaned heavily on the vulnerabilities of Iran’s border regions and the complexities of its demographic makeup. Provinces like West Azerbaijan, Kurdistan, Khuzestan, and Kermanshah—with their ethnic, linguistic, and socio-political diversities—offered fertile ground for recruitment, particularly among populations harboring grievances against the central government.
From the periphery to the urban core, Tel Aviv established covert urban units operating on latency protocols—so-called sleeper cells—in cities like Tehran and Karaj. These cells maintained discreet links to border regions, allowing secure communication beyond Iran’s domestic telecom infrastructure. In parallel, the Mossad appears to have replicated elements of its 2010 Egypt operation, in which it recruited a university professor and dozens of telecom engineers to intercept communications from government offices and foreign embassies.
The operatives’ backgrounds point to a highly selective recruitment process. Many were skilled technicians, engineers, and specialists in UAV technology, electronic warfare, navigation systems, and secure communications. Their technical competence made them ideal for high-precision sabotage and surveillance missions.
Most shared socio-economic vulnerabilities: severe financial hardship, social isolation, and a lack of ideological or nationalistic allegiance. These conditions made them highly susceptible to recruitment, often through digital platforms. Internal Iranian reports note a recurring profile: individuals deeply engaged with privacy tools, VPNs, encrypted apps, and black-market digital networks—traits that became gateways to their recruitment.
Israeli intelligence exploited these digital habits by posing as research centers or cybersecurity companies offering remote contracts. Operatives were then invited to training programs in countries accessible to Iranian nationals under tourist visas—including a Gulf Arab state and another Muslim-majority country, both of which maintain diplomatic relations with Tehran.
Recruitment and Activation Mechanisms
Initial contact with recruits often began through social media and messaging platforms like Telegram and WhatsApp, later migrating to secure apps such as Signal. Mossad operatives used fictitious logistics and engineering companies with supposed headquarters in Istanbul, Dubai, and Europe to extend seemingly legitimate employment offers tailored to the recruits’ technical specialties.
Some targets were selected with precision—after thorough profiling—while others were approached through broader phishing operations. Iranian authorities now believe that many of the operatives were trained abroad, in countries with economic and diplomatic ties to Tehran that allowed easy access under short-term visas. Investigations are underway to determine whether these countries knowingly hosted Mossad-linked training activities.
Training programs reportedly included GPS tracking techniques, drone assembly, micro-explosives handling, secure communications, and surveillance evasion. Operatives were compensated with initial payments ranging from $3,000 to $10,000, followed by monthly stipends, bonuses, and full logistical coverage. To obscure financial trails, Israel used cryptocurrency and third-party facilitators in other countries.
Iranian intelligence uncovered a layered command structure within the network. Tasks were directed by a “primary officer,” followed by a handler identified in open-source reports as “Amir,” who assigned missions and coordinated field activity. This reflects a high degree of vertical control and operational specialization.
Amir’s tasks ranged from photographing public infrastructure and profiling personnel at nuclear facilities to installing tracking devices and conducting sabotage. This progression allowed handlers to test operatives’ loyalty, capabilities, and discretion over time.
Crucially, operational cells were siloed from one another to prevent compromise across the network. While Iranian authorities successfully dismantled some units prior to the latest conflict, the broader network remained intact. One notable case involved Mohsen Langarneshin, a young engineer who led a team responsible for the 2022 assassination of Colonel Hassan Sayyad Khodaei. He was captured and executed in April 2025, but his case revealed extensive training in Nepal and Georgia—and months of unmonitored activity inside Iran.
Operational Tasks and Objectives
The mission portfolio assigned to these operatives reflects the audacity and reach of Israeli intelligence. Primary objectives included intelligence collection on IRGC bases, air defense systems, nuclear and missile facilities, and the mapping of strategic sites through drone reconnaissance and concealed cameras.
A second operational tier focused on the smuggling of encrypted communication tools, sensor arrays, and drone parts into Iran. This was carried out through a blend of Iranian and foreign operatives, including smuggling syndicates from neighboring countries.
Once inside Iran, the materials were distributed to underground workshops in multiple cities. These sites served as drone assembly points and safehouses for explosives and surveillance gear. The operatives used these tools to sabotage communication grids, disrupt surveillance networks, and deploy drones from concealed launch points to strike military targets—damaging air defense capabilities in particular.
Israeli handlers provided forged passports and counterfeit IDs to ensure mobility, while communication relied on satellite phones and cross-border roaming networks to bypass state surveillance.
Smuggling routes passed through Iran’s northern and western borders—including Azerbaijan, Kurdistan, Kermanshah, Ilam, and Khuzestan—while transit hubs included Georgia, Malaysia, and two Arab and Muslim states. To avoid detection, logistics were disguised as personal parcels—food, cosmetics, and clothing—delivered under aliases using closed communication circuits.
One key figure was Esmail Fekri, a 1992-born technician recruited online. He conducted two reconnaissance missions targeting military installations in Tehran and was executed on June 26, 2025.
Interrogations and Intelligence Gaps
Iranian state outlets Tasnim and Nournews focused on celebrating the Ministry of Intelligence’s partial success in exposing the networks, releasing selectively edited video confessions and limited reporting. Coverage remained restrained, offering only curated details.
Independent newspapers such as Hamshahri and Shargh, however, adopted a more critical lens. Their reporting underscored the socio-economic conditions that made technically skilled youth susceptible to foreign recruitment—citing unemployment, lack of psychological support, and governmental neglect.
Iranian security agencies appear to have improved their understanding of Israeli methods and network architecture. This has allowed them to disrupt a number of cells, such as the five-man Esfahan unit, which was intercepted while planning to target a sensitive facility using smuggled components during the most recent conflict.
Strategic Implications and Outlook
These revelations expose a structural fracture within Iran’s intelligence architecture. A fundamental institutional duality—between the IRGC’s independent intelligence branch and the Ministry of Intelligence (Ettela’at)—has created fragmentation, poor coordination, and conflicting priorities. Risk assessments are outdated. Preventive strategies remain underdeveloped.
This was not a routine espionage success. It revealed a systemic intelligence failure—rooted in Iran’s inability to modernize its security institutions in the face of a rapidly evolving threat landscape.
Israel’s doctrine of invisible deterrence has matured. It relies not on rapid escalation, but on patient infiltration—on converting a state’s social fragmentation and economic grievances into tactical assets. Digital fluency and poverty are now entry points, not obstacles. And the battlefield has moved from the frontlines to databases, chatrooms, and latency protocols.
Despite its rich intelligence legacy, Iran remains unable to establish a centralized, interoperable intelligence agency capable of resolving inter-agency rivalries. Its reliance on Eastern allies—Russia and China—remains largely rhetorical, offering little tangible technological or operational support.
Israel, meanwhile, continues its methodical advance. Its weapons are no longer just aircraft and missiles, but algorithmic precision and intelligence topographies mapped from within.
For Tehran, the most pressing question may not be how to respond to what has already happened—but how to confront what remains undiscovered.
