They operate in the shadows. We’ll never learn their names or hear about their individual accolades and accomplishments. But we see the results of their work daily in the geostrategic quagmire the US and Israel have been dragged into after making the mistake of attacking Iran.
This is the story of how Iran’s intelligence services, once tied at the hip to the CIA and Mossad, became one of the Epstein Coalition’s most effective and terrifying adversaries.
Iran’s intelligence community is a complex web of interlinked agencies with overlapping responsibilities.
Coordinated via the Council for Intelligence Coordination, chaired by the Ministry of Intelligence & Security (MOIS), agencies wield considerable operational autonomy, and are largely subordinated only to the Supreme Leader, who approves senior MOIS appointments, and is commander-in-chief of the armed forces and its intelligence structures.
MOIS handles both domestic and foreign intel ops, rooting out spies, dismantling informant and collaborator networks, foiling domestic terror, sabotage and separatist plots, and spying on and monitoring enemies abroad.
The military has three major intel subdivisions: the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO), the Artesh (military) Directorate for Intelligence (J2), and Law Enforcement Command (FARAJA).
IRGC-IO operates a parallel domestic and foreign intelligence service, and works with the IRGC’s Quds Force running clandestine military operations and coordinating with allies abroad. J2 does traditional military intel work (border defense, electronic warfare, monitoring of foreign militaries, counterintelligence). FARAJA controls the national police and is responsible for public order, fighting organized crime and smuggling, and street-level intel gathering.
The Judiciary and Ministry of Defense have their own specialized counterintelligence organizations, tasked with internal vetting, rooting out corruption and preventing foreign espionage inside Iran’s legal and military-industrial institutions, from guarding state secrets to protecting defense supply chains.
Iran’s intelligence apparatus essentially had to rebuild from scratch after the 1979 Revolution, with the Shah-era SAVAK heavily compromised, having been founded with direct operational support, funding and training of the CIA and Mossad in the 1950s.
Purging top-level officials, some of whom managed to flee abroad, revolutionary tribunals tried at least 83 lower-level officers (mainly those involved in the torture, sexual abuse and murder of tens of thousands during the shah’s reign).
Technical, counterespionage and analytical personnel were allowed to stay on, helping the fledgling revolutionary government immensely in crushing Iraq-backed opposition and separatist groups, and establishing deep humint networks inside Iraq after Saddam Hussein’s invasion.
A foreign network of intel-linked intermediaries allowed Iran to evade arms embargoes, and even make clandestine weapons and parts purchases from Israel and the US (Iran-Contra).
Shock of the 12-Day War with Israel
After the Iran-Iraq War, the MOIS and IRGC-IO worked systematically to root out and destroy domestic armed opposition and separatist forces, and target their leaders abroad, and build regional alliances, from Hezbollah in Lebanon to the Houthis in Yemen, Assad’s Syria and Shia militias in Iraq.
Evolving into a mature, bureaucratized network of parallel, competing agencies, the intel services boasted an equal share of successes and failures during this period, but the warning signs were there that something was amiss.
In 2021, former intelligence minister Ali Younesi warned that “the Mossad has penetrated the country to such an extent that the authorities should fear for their lives.” Former president Mahmoud Ahmadinejad echoed the warning in 2024, saying Mossad had infiltrated the Iranian intel unit responsible for rooting out Israeli spies.
These concerns proved prescient. On June 13, 2025, a surprise Israeli attack caused arguably the most catastrophic strategic and counterintelligence failure in in modern Iran’s history.
Within hours, Israel assassinated IRGC chief Hossein Salami, Armed Forces Chief of Staff Mohammad Bagheri, Gholam Ali Rashid – head of the joint command center coordinating Army and IRGC operations, IRGC Aerospace Force commander Amir Ali Hajizadeh, and more than a dozen other top military leaders and nuclear researchers.
Worse yet, Iran’s territory was compromised by Israeli commandoes and Mossad agents directly on the ground, who systematically targeted Iranian SAM and radar sites and facilitated Israeli warplanes’ attacks on missile launchers, nuclear sites, and the aforementioned senior leaders.
The June 2025 war was by no means a total intel failure, with the IRGC launching devastating counterstrikes targeting sensitive Israeli assets, from military bases and the Mossad HQ to MIC-linked enterprises and research institutes like Rafael, the Weizmann Institute, and the Negev Nuclear Center, plus critical energy and port infrastructure in Haifa. In less than two weeks, Israel was forced to sue for a ceasefire, its interceptor stocks critically depleted.
These strikes would not have been possible without precision IRGC-IO mapping of Israeli targets, and invaluable live-fire intel on Israeli defenses gathered during the April and October 2024 Operations True Promise I & II, which allowed Iran to map out radar frequencies, reaction times, and interceptor geography to saturate enemy defenses.
Nevertheless, broader damage was done. Iranian intelligence dropped the ball on Israel’s surprise aggression, and needed urgent reforms.
The 2026 War: Rebuilt, Reinforced, Reinvented
Triggering an overhaul of national security and military command structures, expanding cooperation between the MOIS and IRGC-IO, and hardening communications security, the 2025 war also pushed Iran to dust off its Mosaic Defense strategy – created by the IRGC two decades earlier precisely to enable the country to survive enemy decapitation attacks.
In January 2026, on the eve of a new round of aggression, the revamped intelligence apparatus faced a major test: foreign-sponsored civil unrest threatening to escalate into civil war.
Facing protests since late December triggered by US Treasury machinations to collapse Iran’s currency, exiled ‘crown prince’ and CIA cutout Reza Pahlavi announced the destabilization campaign’s active phase on January 8-9, calling for coordinated, synchronized demonstrations and mass civil disobedience.
Within 48 hours, 3,117 people were dead, among them 2,427 civilians and members of the security services, with police and armed insurgents engaging in firefights in the streets, and thugs burning down over 400 government buildings, plus mosques, churches, police stations, private homes and other infrastructure.
Israeli and US sources later claimed “over 30,000” casualties, both to justify looming aggression, and to compare the violence to Israel’s brutal war in Gaza.
But the Iranian intelligence services’ lightning reaction – including large-scale mobilization of its own assets and civilian networks, activation of the National Information Network (emergency intranet), and a speedy crackdown on Starlink after realizing unrest was being coordinated using the satellite internet service, quickly helped stop violence from spreading into a counterrevolution.
On February 28, the US and Israel attacked Iran, once again in the middle of negotiations, and with a ferocity greater than ever, with the explicitly stated aim of regime change. Within the first hours, Supreme Leader Ali Khamenei, the heads of the Armed Forces, the Ministry of Defense and other top leaders were killed.
On the war’s eve, Khamenei warned would-be aggressors that Iran would “not be intimidated” into submission, and wouldn’t start a war, but deal a “decisive blow” on the enemy if it dared attack. He also warned explicitly that any new conflict “would be a regional war.”
Just before the attack, Khamenei’s security team urged him to evacuate his home to a fortified compound, but he refused, saying he would meet the aggression together with Iran’s people, who were not afforded such luxuries. Dying a martyr’s death (a powerful concept in Shia political theology dating back to Husayn ibn Ali and the 680 Battle of Karbala), Khamenei’s martyrdom consolidated Iranian society and its regional alliances, and rallied many otherwise neutral Iranians in support of the government.
MOIS and IRGC-IO reorganization and preparation efforts had paid off. Decentralized continuity of government and military command was achieved, and Iran’s response was swift:
1. IRGC and Army forces launched, massive, coordinated missile and drone strikes targeting US assets across the Gulf focusing on radars, quickly blinding Patriot and THAAD batteries and easing further attacks (at least 20 bases were targeted in quick succession).
The scale and ferocity of these attacks, made possible thanks to painstaking intel gathering, was something CENTCOM never fully recovered from, forcing it to keep the majority of its forces out of the Gulf, and naval assets out of reach of Iranian counterstrikes.
2. Targeting proved so precise that Iranian drones started targeting luxury hotels in Dubai and Manama secretly hosting US servicemembers cowering there after being evacuated from their bases.
It was later revealed that this was made possible in part by monitoring US troops’ phones using commercially available ad location tracking data, photos and videos posted to social media and even fitness trackers that broadcasted their whereabouts.
3. Iran also activated human intelligence assets inside Israel, with Israeli media later reporting that authorities had arrested and jailed at least 70 people accused of spying for Iran, from Air Force technicians to Iron Dome-affiliated personnel, an IDF vet working for a “secret unit” and even civilians filming local infrastructure and sending the info to Iranian agents.
4. Iranian intelligence also proved able to predict and preempt US policy responses once the war bogged down – hence Iran’s lack of fear in the face of Trump’s escalating threats, and its maximalist positions in negotiations.
From open-source media and think tank reports on exhausted US weapon stockpiles, to state-to-state intel sharing, logistics tracking and battlefield monitoring (calculating the number of interceptors the US was using against cheap drones and older missiles), Iran was able to quickly figure out just how critically low US offensive and defensive weaponry had plummeted, perhaps even before Trump did.
5. Singling out and repeatedly striking Amazon Web Services infrastructure in the UAE and Bahrain signaled that Iranian military intelligence was aware of the extent of AWS’s use in the Pentagon’s Palantir-run automated AI war planning and kill chain systems (which ultimately proved unable to predict or counteract their human opponents’ behavior anyway).
6. Military intelligence also worked with technical experts to analyzed downed enemy hardware in real time, studying it to refine Iran’s electronic warfare countermeasures.
7. MOIS-linked cyber actors, including the Handala hacktivist collective, launched a string of successful and highly embarrassing hack attacks targeting US and Israeli officials, breaching FBI chief Kash Patel’s Google accounts, wiping data and doxxing employees of US MIC-linked corporations, including Lockheed Martin, and compromising nearly 200 IDF and senior Israeli officials.
The success of these operations in influencing the outcome of the conflict so far speaks for itself, with Washington now trapped in a quagmire, with no obvious way out except to accept all of Tehran’s demands, and Israel’s government quitting the war and launching a major reshuffle at the Mossad – whose incoming director has sacked his deputy chief, the head of the Intelligence Directorate and its Iran desk. Former Mossad chief David Barnea has publicly thrown under the bus over the disaster.
The bloodletting also spread to the US intelligence apparatus, with National Counterterrorism Center head Joe Kent resigning in direct protest of the war in March, citing Israel’s outsized influence on US decision-making, and Director of National Intelligence Tulsi Gabbard quitting in June after being systematically excluded from key decisions on Iran.
Regime change in Iran is something Israel and Benjamin Netanyahu specifically have been plotting and dreaming about literally for generations, starting with the 1996 “Clean Break” memo on a new Middle East.
The plot has failed, with Iran’s leadership revitalized, support for the government stronger than ever, the state’s foreign and defense strategy vindicated, and Tehran in control of the Hormuz Strait – its strongest position geopolitically yet. All this would not have been possible without the silent, largely unseen work of the country’s intelligence services.