Intelligence & Cyber Warfare

The Shadow War — Espionage, Assassinations, Cyber Attacks & Covert Operations

~25 min read Updated March 2026 7 Sections Decades of Covert Warfare

Quick Facts: Intelligence Operations

Israel's Mossad
External intelligence — responsible for targeted operations worldwide
Unit 8200
Israel's SIGINT unit — one of the world's most advanced cyber forces
Stuxnet
2010 — first known cyber weapon destroyed 1,000 Iranian centrifuges
Assassinations
Multiple Iranian nuclear scientists killed 2010-2020
IRGC Intelligence
Iran's primary intelligence and covert operations arm
I

The Intelligence Agencies

Organizational Structure

The intelligence confrontation between Israel and Iran involves some of the world's most capable spy agencies. Israel's intelligence community is widely regarded as among the best globally, while Iran's agencies operate an extensive network across the Middle East through both state institutions and the IRGC's parallel intelligence apparatus.

Israeli Intelligence Community

MossadInstitute for Intelligence and Special Operations

Israel's legendary foreign intelligence service, responsible for intelligence collection, covert operations, and counterterrorism abroad. Directly subordinate to the Prime Minister. Responsible for some of the most audacious intelligence operations in history, including the capture of Adolf Eichmann, the theft of Iran's nuclear archive, and numerous targeted killings.

Founded1949
MissionForeign intelligence
Personnel~7,000 (est.)
Reports ToPrime Minister
DirectorDavid Barnea (2021–)
Motto"By way of deception"

Shin Bet (Shabak)Israel Security Agency

Israel's internal security service responsible for counterintelligence, counterterrorism within Israel and the occupied territories, and VIP protection. Has thwarted hundreds of planned attacks and runs an extensive network of informants in Palestinian territories and among Israeli Arab communities.

Founded1949
MissionInternal security
FocusCounter-terror, CI
Reports ToPrime Minister

AmanMilitary Intelligence Directorate

Israel's largest intelligence agency, responsible for military intelligence collection and analysis, national intelligence assessments, and signals intelligence (SIGINT). Produces the national intelligence estimate and oversees Unit 8200. Faced severe criticism after the October 7, 2023 intelligence failure.

Founded1950
MissionMilitary intelligence
Sub-UnitUnit 8200 (SIGINT)
Reports ToIDF Chief of Staff

Unit 8200SIGINT & Cyber Operations

Israel's elite signals intelligence and cyber warfare unit, often compared to the US NSA and UK GCHQ. Responsible for electronic eavesdropping, code breaking, cyber offensive operations, and developing cutting-edge surveillance technology. Many alumni have gone on to found major Israeli tech companies. Co-developed Stuxnet with the US NSA.

Part OfAman (IDF)
MissionSIGINT & Cyber
PersonnelSeveral thousand
NotableStuxnet, tech alumni

Iranian Intelligence Community

VAJA (MOIS)Ministry of Intelligence and Security

Iran's primary civilian intelligence agency, responsible for foreign and domestic intelligence, counterintelligence, and monitoring dissident groups. Operates extensive networks across the Middle East and has been linked to assassination plots in Europe and Latin America. Monitors Iranian diaspora communities worldwide.

Founded1984
MissionNational intelligence
Personnel~30,000 (est.)
Reports ToPresident / Supreme Leader

IRGC Intelligence OrganizationSazman-e Ettela'at-e Sepah

The intelligence arm of the Islamic Revolutionary Guard Corps, operating in parallel to VAJA. Reports directly to the Supreme Leader through the IRGC commander. Increasingly powerful and often in rivalry with VAJA. Responsible for monitoring military threats and protecting the regime.

Part OfIRGC
MissionMilitary / Regime intel
Reports ToSupreme Leader
FocusExternal threats, dissidents

Quds ForceIRGC Extraterritorial Operations

The IRGC's special forces unit responsible for extraterritorial operations and supporting proxy forces across the region. Provides training, weapons, funding, and intelligence to Hezbollah, Hamas, Palestinian Islamic Jihad, Iraqi militias, and Houthi forces. Led by Qasem Soleimani until his assassination in January 2020.

Part OfIRGC
MissionProxy warfare / foreign ops
Former HeadQasem Soleimani (d. 2020)
ProxiesHezbollah, Hamas, Houthis
II

Assassinations & Targeted Killings

2010 – 2026

Targeted killings have been a defining feature of the Israel-Iran shadow war. Israel has systematically eliminated key figures in Iran's nuclear program, military leadership, and proxy organizations, while Iran has attempted retaliatory operations with less success. The pace of assassinations accelerated dramatically from 2020 onward.

5+ Nuclear Scientists Killed
3 Senior Leaders Killed (2024)
0 Successful Iranian Retaliations

Iranian Nuclear Scientists Campaign

2010 – 2012

A systematic campaign targeting Iran's top nuclear scientists. At least five scientists were assassinated using methods including magnetic bombs attached to cars by motorcycle riders in Tehran traffic. The campaign severely disrupted Iran's nuclear program and forced scientists to operate under heavy security.

Target: Nuclear Program Method: Magnetic bombs, shooting Attributed: Mossad (unconfirmed) 5+ scientists killed

Assassination of Qasem Soleimani

Jan 3, 2020

US drone strike killed IRGC Quds Force commander Qasem Soleimani at Baghdad International Airport, along with Iraqi militia leader Abu Mahdi al-Muhandis. Soleimani was Iran's most powerful military figure and architect of its proxy network across the region. The killing brought the US and Iran to the brink of war. Iran retaliated with ballistic missile strikes on Al-Asad airbase in Iraq.

Target: IRGC Quds Force Commander Method: MQ-9 Reaper drone strike Executed: US (with Israeli intel) Near-war, Iran missile retaliation

Assassination of Mohsen Fakhrizadeh

Nov 27, 2020

Iran's top nuclear scientist was killed near Tehran by a remote-controlled robot-mounted machine gun that used AI-assisted facial recognition. The weapon was smuggled into Iran in pieces and assembled on-site. Fakhrizadeh was considered the father of Iran's nuclear weapons program. Iran accused Mossad and vowed revenge, but has been unable to retaliate proportionally.

Target: Head of Nuclear Weapons Program Method: Remote-controlled AI gun Attributed: Mossad Nuclear program disrupted, Iran vowed revenge

Assassination of Ismail Haniyeh

Jul 31, 2024

Hamas political bureau chief was killed by a bomb pre-planted in his guesthouse room in Tehran, where he was attending the inauguration of Iran's new president. The fact that the operation took place in the heart of Tehran, in a supposedly secure IRGC-protected facility, was a devastating blow to Iran's intelligence credibility and a demonstration of Mossad's penetration of Iranian security.

Target: Hamas Political Chief Method: Pre-planted bomb in Tehran Attributed: Mossad Iranian security humiliated, ceasefire derailed

Assassination of Hassan Nasrallah

Sep 27, 2024

Hezbollah's Secretary-General was killed in a massive Israeli airstrike on his underground bunker in the Dahieh suburb of Beirut. The strike used dozens of bunker-buster bombs. Nasrallah had led Hezbollah for 32 years and was one of the most powerful figures in the Middle East. His death, combined with the pager attack weeks earlier, effectively decapitated Hezbollah's leadership.

Target: Hezbollah Secretary-General Method: Massive bunker-buster airstrike Israel (confirmed) Hezbollah decapitated, regional power shift

Killing of Yahya Sinwar

Oct 16, 2024

The mastermind of the October 7 attack was killed during an IDF ground operation in Rafah, southern Gaza. Unlike other targeted killings, Sinwar's death came in a chance encounter during building-to-building fighting. Soldiers recognized him after engagement. His death was a major Israeli military objective since October 7, 2023.

Target: Hamas Military Leader / Oct 7 Architect Method: Ground combat encounter IDF (confirmed) Key war objective achieved

Operation Epic Fury Leadership Strikes

Feb 2026

During Israel's massive strike on Iran, multiple senior IRGC commanders and military leaders were killed in targeted strikes on command bunkers. The strikes demonstrated that Israeli intelligence had precise, real-time knowledge of where senior Iranian military figures were located, suggesting deep penetration of Iranian communications and/or human intelligence sources within the regime.

Target: IRGC Senior Leadership Method: Precision airstrikes on bunkers Israel (confirmed) IRGC command structure disrupted
III

Espionage Operations

Intelligence Collection

The espionage battle between Israel and Iran involves some of the most sophisticated intelligence operations of the 21st century. Israel has demonstrated an extraordinary ability to operate inside Iran, from physically stealing nuclear archives to infiltrating communication networks. Iran has attempted to build spy networks targeting Israel and its allies with mixed results.

Iran Nuclear Archive Theft

Jan 31, 2018

In one of the most audacious espionage operations in history, Mossad agents broke into a heavily guarded warehouse in the Shorabad district of Tehran and stole 100,000 documents (half a ton of material) detailing Iran's secret nuclear weapons program, codenamed Project Amad. The documents were smuggled out of Iran and presented to the world by PM Netanyahu in April 2018. The operation proved that Iran had actively pursued nuclear weapons, contradicting its public claims.

Method: Physical break-in, document theft Mossad (confirmed by Israel) JCPOA undermined, sanctions reimposed

Pager Attack — Supply Chain Infiltration

Sep 17–18, 2024

Israel compromised Hezbollah's newly purchased communication devices by intercepting the supply chain. Thousands of pagers and walkie-talkies were modified to contain small explosive charges before being delivered to Hezbollah operatives across Lebanon. When simultaneously detonated, the devices killed at least 12 people and wounded over 2,800, including many senior Hezbollah commanders. The operation, which took years of planning, crippled Hezbollah's command and communication infrastructure in a single stroke.

Method: Supply chain infiltration Israel (widely attributed) Hezbollah comms destroyed, 2800+ wounded

Iranian Spy Networks in Europe

Ongoing

Multiple Iranian spy networks have been uncovered across Europe, tasked with surveillance of Israeli and Jewish targets, Iranian dissidents, and potential assassination plots. In 2018, a Belgian-Iranian couple was arrested for plotting to bomb an Iranian opposition rally in Paris attended by thousands. Several European countries have expelled Iranian diplomats identified as intelligence operatives.

Method: Embassy-based networks, sleeper agents VAJA / Quds Force Diplomatic expulsions, arrests

Mossad's Tehran Network

Ongoing

The string of operations inside Iran — from scientist assassinations to the nuclear archive theft to the Haniyeh killing — strongly suggests that Mossad maintains human intelligence sources and operational capabilities deep within Iran's security apparatus. How Israel sustains these networks despite Iran's extensive counterintelligence efforts remains one of the great mysteries of modern espionage.

Method: HUMINT networks inside Iran Mossad Ongoing Iranian security humiliation
IV

Cyber Warfare

Digital Battlefield

The Israel-Iran cyber war represents one of the most active and consequential digital conflicts in history. It began with Stuxnet — the world's first true cyber weapon — and has escalated into an ongoing campaign of attacks and counterattacks targeting critical infrastructure, military systems, and civilian data on both sides.

Stuxnet

2010

The world's first cyber weapon. A sophisticated computer worm jointly developed by the US (NSA) and Israel (Unit 8200) under Operation Olympic Games. It specifically targeted Siemens PLCs controlling uranium centrifuges at Iran's Natanz enrichment facility, causing them to spin at incorrect speeds while reporting normal operations to operators.

$ Impact: ~1,000 centrifuges destroyed. Set Iran's nuclear program back an estimated 2 years. Changed warfare forever by demonstrating that cyber weapons could cause physical destruction.

Flame / Duqu

2012

Extremely sophisticated espionage malware discovered on computers across the Middle East, primarily in Iran. Flame could record audio, capture screenshots, log keystrokes, and exfiltrate data. Duqu was a related intelligence-gathering tool. Both were attributed to the same team behind Stuxnet.

$ Impact: Massive intelligence collection from Iranian government and scientific networks.

Shamoon (Saudi Aramco)

2012

Iran's most devastating cyber attack — a destructive wiper malware that erased data on 35,000 computers at Saudi Aramco, the world's most valuable company. Replaced data with images of a burning American flag. Took weeks to recover. Iran was retaliating for Stuxnet and US-Saudi cooperation.

$ Impact: 35,000 computers wiped. Saudi Aramco offline for weeks. One of the most destructive cyber attacks in history.

Iran vs US Banks

2012–2013

Iran launched a sustained DDoS campaign against major US banks including JPMorgan Chase, Bank of America, Citigroup, and Wells Fargo. Called Operation Ababil, it disrupted online banking services for millions of customers. Seven Iranian hackers were later indicted by the US Department of Justice.

$ Impact: 46 major US banks targeted. Millions of customers affected. First nation-state cyber attack on US financial infrastructure.

Israel Water Infrastructure Attack

Apr 2020

Iran attempted to hack into Israeli water treatment facilities to increase chlorine levels in the water supply to dangerous levels. The attack was detected and blocked before causing harm. If successful, it could have poisoned water for thousands of civilians. Israel reportedly retaliated by disrupting Iran's Shahid Rajaee port.

$ Impact: Attack blocked. Israel retaliated by shutting down Iranian port systems. Marked a dangerous escalation to civilian infrastructure targeting.

Ongoing Cyber Escalation

2024–2026

The cyber war has intensified alongside the conventional military escalation. Iran-linked groups have targeted Israeli hospitals, government databases, and surveillance cameras. Israel has reportedly disrupted Iranian fuel distribution networks, caused power outages, and compromised military communications. Both sides are now integrating cyber operations into their conventional military planning.

$ Impact: Full-spectrum cyber warfare. Civilian infrastructure on both sides increasingly targeted. Integration with kinetic operations.

V

Covert Operations & Sabotage

Physical Disruption

Beyond assassinations and cyber attacks, both sides have conducted physical sabotage operations targeting infrastructure, weapons facilities, and supply lines. Israel has focused on disrupting Iran's nuclear program and weapons transfers to proxies, while Iran's Quds Force has conducted operations across the region and attempted attacks on Israeli and Jewish targets worldwide.

Natanz Explosions

Jul 2020 / Apr 2021

Two separate sabotage attacks on Iran's Natanz uranium enrichment facility. The July 2020 explosion damaged the centrifuge assembly building. The April 2021 attack caused a power failure that destroyed thousands of advanced centrifuges. Iran attributed both to Israel. The April 2021 attack was reportedly carried out by smuggling an explosive device inside equipment delivered to the facility.

Target: Natanz Nuclear Facility Method: Explosives / equipment sabotage Attributed: Israel Thousands of centrifuges destroyed

Shadow War at Sea

2019 – 2023

A largely hidden naval confrontation in the Red Sea, Gulf of Oman, and Eastern Mediterranean. Israel reportedly attacked Iranian weapons-smuggling ships and oil tankers evading sanctions, while Iran targeted Israeli-owned or linked commercial vessels with mines and drone attacks. Dozens of incidents involving ships from both sides, mostly unreported.

Target: Shipping / weapons transfers Method: Limpet mines, drones, naval forces Both sides (mostly unacknowledged) Dozens of ship attacks

Syria Weapons Depot Strikes

2013 – Present

Israel has conducted hundreds of airstrikes in Syria targeting Iranian weapons transfers to Hezbollah, IRGC military installations, and weapons production facilities. Known as the "Campaign Between the Wars," these strikes have destroyed precision-guided missile factories, weapons convoys, and IRGC command posts. Syria has been the primary battleground of the Israel-Iran proxy war.

Target: IRGC / Hezbollah in Syria Method: Airstrikes (hundreds) Israel (mostly unconfirmed) Iranian force buildup disrupted

Quds Force Global Operations

Ongoing

Iran's Quds Force has attempted numerous operations targeting Israeli and Jewish targets worldwide. These include the 1994 AMIA bombing in Buenos Aires (85 killed), foiled plots in Thailand, India, Georgia, and Kenya (2012), and ongoing attempts to establish operational cells in Latin America and Africa. Most plots outside the Middle East have been disrupted by intelligence services.

Target: Israeli / Jewish targets globally Method: Local cells, Hezbollah operatives Quds Force / Hezbollah AMIA bombing, multiple foiled plots

IRGC Colonel Assassination in Tehran

May 2022

IRGC Colonel Hassan Sayyad Khodaei was shot dead by two motorcycle-riding gunmen outside his home in Tehran. He was reportedly involved in Quds Force operations to target Israelis abroad. The assassination followed the pattern of earlier scientist killings and demonstrated that Israel's operational capability inside Tehran remained intact despite Iranian counterintelligence efforts.

Target: IRGC Colonel / Quds Force operative Method: Drive-by shooting in Tehran Attributed: Israel Iran vowed retaliation
VI

Information Warfare & Psychological Ops

The Battle for Narrative

Both Israel and Iran wage an aggressive information war, each seeking to shape international narratives, influence public opinion, and demoralize the opposing side. This includes state propaganda, social media manipulation, internet censorship, and sophisticated psychological operations.

Iranian Information Operations

Internet Shutdowns & Censorship

Ongoing

Iran operates one of the world's most restrictive internet censorship regimes. During the 2022 Mahsa Amini protests, Iran imposed near-total internet blackouts for weeks. The regime controls access through the "National Information Network" (NIN), blocking Western social media platforms while monitoring domestic communications. During military escalations, internet access is severely restricted to control the narrative.

Method: NIN, shutdowns, filtering Millions disconnected during crises

State Propaganda Apparatus

Ongoing

Iran maintains extensive state-controlled media including Press TV (English), Al-Alam (Arabic), and IRNA news agency. These outlets present regime-aligned narratives about military capabilities, proxy group activities, and the conflict with Israel. Iranian media consistently amplified exaggerated claims about missile capabilities and defense performance.

Method: State media, social media bots Narrative control, capability exaggeration

Israeli Information Operations

Hasbara & Digital Diplomacy

Ongoing

Israel conducts extensive public diplomacy (hasbara) through government spokespersons, social media teams, and coordinated messaging campaigns. The IDF Spokesperson's Unit operates highly active social media accounts in multiple languages. During military operations, Israel presents real-time intelligence to international media to justify strikes. Critics argue this constitutes information warfare designed to manufacture consent.

Method: Social media, press briefings, OSINT International narrative shaping

Social Media Manipulation

Bot Networks & Influence Operations

Ongoing

Both sides operate extensive social media bot networks and influence operations. Meta, X (Twitter), and Google have repeatedly removed Iranian-linked fake accounts targeting Western audiences. Israel-linked operations have also been identified. AI-generated content, deepfakes, and coordinated inauthentic behavior have become standard tools. The conflict has become a testing ground for next-generation information warfare techniques.

Method: Bot networks, deepfakes, AI content Public opinion manipulation, confusion
VII

Sources & References

OSINT & Expert Analysis

Primary Sources

  • Ronen Bergman, "Rise and Kill First: The Secret History of Israel's Targeted Assassinations" (Random House, 2018)
  • Kim Zetter, "Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon" (Crown, 2014)
  • David E. Sanger, "The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age" (Crown, 2018)
  • Kaspersky Lab — Stuxnet, Flame, and Duqu technical analysis
  • US Department of Justice — Indictments of Iranian hackers

Analytical Sources

  • Institute for the Study of War (ISW) — Iran and proxy group analysis
  • Bellingcat — Open-source investigations of covert operations
  • The Intercept — Intelligence community reporting
  • Mandiant / Google Threat Analysis Group — Iranian cyber group tracking
  • Microsoft Threat Intelligence — State-sponsored actor reports
  • CrowdStrike — Iranian APT group analysis

News Sources

  • New York Times — Intelligence and cyber investigations
  • Washington Post — National security reporting
  • BBC, Al Jazeera — Regional coverage
  • Haaretz, Times of Israel — Israeli perspective
  • Reuters, AP — Breaking news and investigations
Disclaimer: Intelligence operations are by nature secretive. Many attributions in this page are based on credible journalistic reporting, government statements, and expert analysis, but some details remain unconfirmed. Operational claims by both Israel and Iran should be evaluated critically. This page presents the best available open-source analysis.

Frequently Asked Questions

What is Stuxnet?

Stuxnet was a sophisticated computer worm discovered in 2010, widely attributed to a joint US-Israeli operation (codenamed Olympic Games). It targeted Iran's Natanz uranium enrichment facility, destroying approximately 1,000 centrifuges by causing them to spin out of control while displaying normal readings to operators. It is considered the world's first known cyber weapon and revolutionized the concept of digital warfare.

How does Mossad operate against Iran?

Mossad, Israel's external intelligence agency, conducts a wide range of operations against Iran including targeted assassinations of nuclear scientists, sabotage of nuclear facilities, intelligence gathering through human assets and signals intelligence, and covert operations to disrupt Iran's weapons programs. Notable operations include the 2018 theft of Iran's nuclear archive from a Tehran warehouse and the systematic targeting of key figures in Iran's nuclear program.

What is Unit 8200?

Unit 8200 is Israel's signals intelligence (SIGINT) unit, part of the Israel Defense Forces Intelligence Directorate. It is one of the world's most advanced cyber intelligence organizations, responsible for electronic surveillance, code breaking, and offensive cyber operations. The unit is widely believed to have been involved in developing Stuxnet and other cyber weapons. Many of Israel's top tech entrepreneurs are Unit 8200 alumni.

Has Iran carried out operations against Israel?

Yes. Iran has conducted intelligence and covert operations against Israel through the IRGC's Quds Force and its proxy network. Operations include the 1992 attack on the Israeli embassy in Buenos Aires, the 1994 AMIA bombing in Argentina, attempted attacks on Israeli diplomats in multiple countries, cyber operations against Israeli infrastructure, and coordination of proxy attacks through Hezbollah, Hamas, and other allied groups.

Related Topics