In June 2025, Tehran woke up to the shock of an unprecedented blow: the assassination of some of its top military commanders, including the Chief of Staff of the Armed Forces, Major General Mohammad Bagheri, and the Commander of the Revolutionary Guard Corps (IRGC), Major General Hossein Salami, along with the death of the IRGC Aerospace Force Commander, Major General Amir Hajizadeh, and his senior staff during the initial hours of the Israeli attack.
Just days later, IRGC Intelligence Chief Brigadier General Mohammad Kazemi and several of his aides were also eliminated.
As time passes, more details continue to surface. On July 13, Iran’s official Fars News Agency revealed that Israel, on the fourth day of the war, targeted a high-level meeting of Iran’s Supreme National Security Council. The gathering included the heads of the executive, legislative, and judicial authorities. Entrances and exits to the underground meeting hall in a fortified building west of Tehran were bombed with heavy munitions to block escape routes and cut off ventilation, mirroring leaked details about Israel’s reported plan to assassinate Hezbollah Secretary-General Hassan Nasrallah.
Attendees managed to escape through an emergency hatch, but several were wounded, including Iranian President Masoud Pezeshkian. Authorities are now investigating possible direct human infiltration that enabled Tel Aviv to pinpoint the exact timing and location of the meeting.
This incident exposed another moment of vulnerability at the highest levels of Iran’s sovereign decision-making circle. The strikes were not just military escalations in a sudden war; they were a stark announcement of a long-prepared Israeli intelligence victory, rooted in two decades of infiltration and espionage. The central question now is: how extensive are the intelligence networks that enabled Israel to carry out such high-precision operations in the heart of Tehran?
Layers of Penetration
What stands out is the nature of the targets, the precision of execution, and the diversity of tactics used: some attacks employed drones, others used explosive devices inside vehicles, and some relied on assassination teams and airstrikes. This variety exposed multiple layers of collaborators embedded within Iran’s institutions, making it nearly impossible to predict the pattern of future strikes or prevent them from recurring.
Field data indicates that Mossad did not rely solely on technology but built human networks planted around key leaders. These networks enabled tracking of movements, gathering sensitive information on meetings, motorcades, vehicles, safe houses, and alternative command centres.
Israel’s Accumulated Intelligence Advantage
The June 2025 assassinations were just the peak of a long “shadow war.” For more than a decade, Mossad has intensified its operations inside Iran, targeting nuclear scientists, enrichment sites, and IRGC operatives.
It has carried out assassinations of nuclear experts like Masoud Alimohammadi, Dariush Rezaeinejad, and Mostafa Roshan early in the last decade; stole half a ton of Iran’s nuclear archive documents in 2018; assassinated prominent scientist Mohsen Fakhrizadeh in 2020; and gunned down IRGC Quds Force Colonel Hassan Sayyad Khodaei near his Tehran home in 2022, claiming he oversaw plots to kidnap or assassinate Israelis in Cyprus and elsewhere. Mossad’s reach continued with the assassination of Hamas leader Ismail Haniyeh in his room at an IRGC facility in Tehran in 2024.
These operations demonstrate how systematically Israel has built the capacity to strike deep inside Iran, shifting the battlefield from military fronts to the streets of Tehran. This should have triggered deep reviews and structural reforms of Iran’s security apparatus to identify vulnerabilities and plug leaks.
In this context, James Olson — the former head of counterintelligence at the CIA — reminds us in his book How to Catch a Spy that the best counterintelligence strategy is to penetrate enemy spy services and recruit the officers running infiltration networks. Deterrence in espionage is not built on defense alone but on offensive initiative.
Fragmented Agencies, Conflicted Mandates
Iran faces a major dilemma: multiple, overlapping security agencies with conflicting jurisdictions. Instead of a unified central intelligence service, tasks are split among the Ministry of Intelligence (Ettela’at), the IRGC Intelligence Organisation, and additional agencies within the police, judiciary, Basij, and army.
Although the Ministry of Intelligence was founded in 1984 to merge the rival agencies that emerged after the revolution — and was empowered by law to gather foreign intelligence, conduct counterintelligence, and foil internal and external plots — it has failed to contain this fragmentation.
Over the past two decades, the IRGC’s rise has further complicated this landscape. By law, the Intelligence Minister must hold a high level of Shi’a religious credentials, turning the ministry into a bureaucracy under executive branch oversight while competing for influence with the IRGC’s intelligence wing, formed after the 2009 protests.
While the two institutions are supposed to complement each other, their relationship has always been marred by rivalry.
Former IRGC Commander and Expediency Discernment Council Secretary Mohsen Rezaei once commented on sabotage at the Natanz nuclear facility and the killing of Fakhrizadeh by calling for a “purge” of Iran’s intelligence community. Meanwhile, ex-Intelligence Minister Mahmoud Alavi (2013–2021) blamed the IRGC for the assassination, accusing it of failing to protect senior officials, and alleged Mossad infiltration of the IRGC’s ranks.
Ali Younesi, Intelligence Minister under President Khatami (1999–2005), blamed the failures on the proliferation of parallel organisations, inter-agency rivalry, and the politicisation of security, with excessive focus on domestic dissent instead of guarding against external threats.
This structural disunity has prevented the building of a coherent counterintelligence system. Each body seeks to expand its turf, even if it creates confusion in roles and leaves exploitable gaps — gaps that Mossad has repeatedly used to its advantage, according to Iranian analysts.
It’s no surprise, then, that infiltration operations continue to succeed or that suspected moles move freely between institutions without detection. A prime example is Ali Reza Akbari, a former deputy defence minister executed in 2023 for espionage, who rose through high-level positions despite prior security warnings, showing that those proclaiming unwavering loyalty to the regime can be its weakest link due to reduced oversight and close access to power.
Long-Term Tenure: The Case of Hossein Taeb
The tenure of Hossein Taeb, who led IRGC Intelligence from its founding in 2009 until 2022, illustrates a deeper problem: the absence of institutional turnover in sensitive security leadership. For more than a decade, Taeb’s tenure was shaped by a period of heightened external challenges, especially with Mossad’s operations expanding inside Iran.
While long-term leadership can provide stability, it can also breed repetition and reduce an agency’s ability to adapt to evolving threats. Extended tenures create entrenched internal networks that can weaken internal oversight and professional evaluation.
This leadership inertia doesn’t just enable foreign infiltration; it also stalls technological upgrades and doctrinal updates — all while the adversary, Mossad, continually refreshes its tools and methods.
Iran’s Security Response
In response to Israel’s deep strikes inside its territory, Iran’s security agencies launched a massive internal security crackdown, akin to a state of emergency. Thousands of security personnel were deployed across Tehran and other major cities. Permanent checkpoints were set up at neighbourhood entrances and main roads. Authorities seized mobile phones to detect suspicious communications or political content. They announced the dismantling of networks cooperating with Mossad and began pursuing digital activities that could aid infiltration. At least five people previously convicted of collaborating with Mossad were executed.
The Ministry of Intelligence and IRGC Intelligence jointly claimed the seizure of about 10,000 small drones in Tehran alone, the dismantling of a drone and explosives workshop in Isfahan, and the arrest of 18 people connected to a factory for offensive and surveillance drones in Mashhad. They also raided a large covert workshop in Rey for building mini drones and timed bombs, arrested agents launching drones from the northwest mountains overlooking Tehran, and detained 50 people in Sistan and Baluchestan for alleged espionage and terrorism.
A report by the rights group HRANA documented the arrest of more than 1,500 people in two weeks, including hundreds accused of undermining national security or supporting Israel through social media. Charges included “spreading misleading content,” “sharing attack images,” “espionage,” and “operating drones.”
The sweep also extended to Iran’s Jewish and Baha’i citizens, accused of foreign ties, and raids and phone confiscations targeted Afghan migrants suspected of gathering information. The Interior Ministry reported that 772,000 Afghans returned to their country this year — a figure that rose alongside forced deportations justified by alleged Afghan involvement in espionage.
While these actions are presented as fortifying internal security during an intense intelligence clash, they have not yet dismantled the networks responsible for the assassinations or leaks about senior leadership meetings, raising doubts about whether these measures address the root causes of infiltration rather than just its symptoms.
In parallel, Iran’s parliament tried to pass legislation that would increase penalties for “collaboration with hostile states,” categorising it as “corruption on earth” — a charge punishable by death. But the Guardian Council blocked the bill, citing vague definitions and a lack of clarity on which body defines an “enemy.” The government also expanded digital restrictions, blocking foreign apps, throttling internet speeds, and monitoring telecoms traffic, including ordinary text messages.
Conclusion: A Crossroads for Iranian Security
The recent confrontation with Israel reveals that Iran’s challenge is not just about stopping a breach here or there — it’s about redefining its entire security doctrine to keep pace with an evolving threat that combines technology, human networks, and digital influence.
The precise assassinations and attacks on sovereign meetings highlight a deep gap in detection and deterrence capabilities — a gap that short-term crackdowns alone cannot fill. While authorities have detained dozens of people accused of collaboration, questions remain about the real masterminds and the scale of the high-level breaches.
At the same time, the nature of the fight is deeply unequal: Israel enjoys robust support from Western intelligence services and state-of-the-art technology, while Tehran lacks equivalent external backing. Nonetheless, Iran must rationally develop its security apparatus, avoiding reactive solutions.
Going forward, Iran faces a dual imperative: safeguarding its security and sovereignty while maintaining the people’s trust in its institutions. This balance can only be achieved through a long-term strategy rooted in learning from past failures, empowering capable professionals, and dedicating resources to build a genuinely effective counterintelligence framework.
In the end, sovereignty is not measured only by territorial control but by a state’s ability to protect its elites and citizens from infiltration — and to adapt to new threats without compromising internal stability.
