OPINION — Israel’s intelligence penetration of Iran played out in dramatic form over the course of the 12-day war this summer, but Iran is running an aggressive recruitment and spying operation of its own targeting Israel. And while the two espionage campaigns are not comparable in scale, scope, or success, Israel’s domestic security agency was sufficiently concerned that in the wake of the war it partnered with the country’s national public diplomacy directorate to launch a media campaign warning Israelis against spying for Iran.
Over the course of the war, Israeli intelligence treated Iran like its backyard playground, recruiting sources, both Iranian citizens and citizens of neighboring countries, and inserting its operatives to gather intelligence on the country’s most secret nuclear facilities, scientists, and officials. These efforts enabled covert operations, including the construction of remotely controlled missile and drone systems inside central Iran, that struck Iranian targets from within at the very outset of the 12-day war. Iranians recruited by Israel even helped smuggle “technologically modified vehicles” into the country, which were used to target Iranian air defense positions and clear a path for Israeli aircraft entering Iranian airspace.
In the weeks since the war ended, Iranian officials have carried out a domestic witch hunt, arresting thousands of individuals in their search for people who spied for Israel. Iran even executed one of its own nuclear scientists, alleging he spied for Israel. Now, Iran aims to turn the tables on Israel by increasing its own network of people in Israel recruited to spy for Iran.
It is now clear, however, that at the same time Israeli intelligence was recruiting sources and operatives in Iran, Iran was doing the same in Israel, just to a much smaller effect. While Iranian efforts to infiltrate and surveil targets in Israel date back to at least 2013, Israeli intelligence organizations have documented a significant surge in Iranian efforts to recruit both Israeli and non-Israeli citizens to spy for Iran, beginning in early 2020. Unlike Israel’s penetration of key Iranian intelligence and nuclear agencies, Iranian espionage in Israel remains at the edges, probing at the margins in its attempts to penetrate Israeli intelligence and society. These typically involve digital recruitment targeting Israelis in financial straits.
At first, Iran only tasked its recruits to collect basic information on the location of Israeli military bases and Israeli leaders, and to post anti-government signs and graffiti in public places to brew domestic dissent. Indeed, in the days before the 12-day war, Iranian officials boasted that the regime’s spy networks in Israel acquired sensitive documents about Israel's nuclear program. Iran’s minister of intelligence, Esmail Khatib, said that “complete nuclear files were obtained, along with documents related to [Israel’s] connections with the U.S., Europe, and other countries, as well as intelligence that strengthens Iran’s offensive capabilities.”
But starting in mid-2024–between the Iranian missile and drone attack on Israel in April and the ballistic missile attack in October– the Iranians started tasking recruits not only to carry out acts of espionage but also arson and even murder plots targeting Israeli scientists, journalists, security and military leaders, and senior politicians. Israeli officials described the spike in the number of plots as “unprecedented.” Israel Police Superintendent Maor Goren said, “If we go check the last years – the last decades – we can count on two hands how many people got arrested for this.”
While none of the murder plots came to fruition, Israeli authorities report that several came very close to being carried out and were thwarted at the last minute. And unlike pure espionage cases, which often take time to develop, some of the murder plots were being planned as soon as 9 days after initial recruitment. In other cases, Israeli authorities only discovered a cell of persons of Azeri descent who had been carrying out espionage operations as a team, some two years after they started spying on Israel. They were spotted when they moved from spying on military sites to conducting surveillance of a senior Israeli military figure they were told to kill.
The Cipher Brief brings expert-level context to national and global security stories. It’s never been more important to understand what’s happening in the world. Upgrade your access to exclusive content by becoming a subscriber.
The Washington Institute’s Iranian External Operations Map, which tracks Iranian plots abroad, has documented at least 31 plots carried out by Iranian-recruited Israelis in Israel. These recruits have sprayed graffiti and lit fires across Israel, in addition to collecting basic information on military bases, government officials, and nuclear scientists to send back to their handlers in Iran. However, Iranian efforts to recruit Israeli spies have not led to a single successful assassination or targeted attack in Israel. Iran conducts its recruitment primarily online via Telegram, WhatsApp, and social media platforms, although there are a few instances of Iranian handlers approaching potential recruits in person while abroad. Recruitment efforts appear to rely heavily on financial incentives while also exploiting existing social cleavages. Out of the 31 cases carried out by Israeli perpetrators documented by the Washington Institute, 20 involved some type of monetary compensation, usually via cryptocurrency.
While the Israeli perpetrators in 25 out of the 31 cases knew, or at least suspected, that they were working on behalf of the Iranians, many rationalized their actions as falling short of full-blown espionage. The tasks assigned to these individuals varied widely. Some were given relatively harmless assignments, such as tagging graffiti or putting up posters, while others appeared to be amateurish or unskilled in their roles. However, not all the recruits were unsophisticated. Several engaged in more serious activities, including intelligence collection and attempts to recruit others– sometimes even targeting their own family members to expand the network.
Consider the case of father and son, Bassem and Tahrir Safadi, residents of the Druze village of Mas'ade, who were arrested for spying on behalf of the Islamic Revolutionary Guard Corps Quds Force. At the request of his father, Tahrir would allegedly collect information on IDF movements in the Golan Heights and report to Hussam as-Salam Tawfiq Zidan, a journalist at Al-Alam News Network, an Iranian state-owned news outlet. Zidan, who lived in Damascus and worked for the Palestine division of the Quds Force, is accused of requesting Bassem and Tahrir to take photos of troops, tank movements, equipment, and more.
One of the most serious plots Israel thwarted is the 2024 assassination plot against Prime Minister Benjamin Netanyahu, former Defense Minister Yoav Gallant, and former Shin Bet Director Ronen Bar. Moti Maman, a businessman with connections to Turkey and Iran, allegedly travelled to Turkey and Iran twice to meet with Iranian intelligence officials to further the plots against Netanyahu, Gallant, and Bar. Maman was also allegedly directed to intimidate Israeli civilians working for Iran who had failed to complete their missions, to find Russians or Americans who could be tasked with assassinating Iranian dissidents in the United States and Europe, and to attempt to recruit a Mossad officer to act as a double agent. Before leaving Iran for the second time, Maman received 5,000 euros from the Iranian intelligence agents for attending the meetings. According to the Shin Bet, Iranian officials viewed the assassination plots as acts of revenge for the killing of Hamas leader Ismail Haniyeh.
In total, The Washington Institute has documented 39 known Iranian plots in Israel from 2013-2025, 31 of which involved Israeli nationals, the rest involved Palestinians or other non-Israeli citizens. Several of these plots had multiple perpetrators, bringing the total number of Israeli participants in those 31 cases to more than 45 individuals. According to the National Public Diplomacy Directorate, indictments have been filed against 35 Israeli citizens involved in these cases. The age of the perpetrators ranges from 13 to 73, with over half in their teens or twenties. The individuals recruited came from a range of backgrounds, such as Azerbaijani or the Caucasus region, and the targets of their espionage efforts included both security infrastructure and broader social vulnerabilities, including the Iron Dome, government officials, Muhane Yehuda market, IDF bases, nuclear scientists and facilities, and malls and hospitals. The wide breadth of targets illustrates how Iranian intelligence sought to exploit financial, ideological, and personal incentives to build influence inside Israel.
Subscriber+Members have exclusive access to the Open Source Collection Daily Brief, keeping you up to date on global events impacting national security. It pays to be a Subscriber+Member.
Iranian Minister of Intelligence Esmail Khatib described Iranian espionage and sabotage plots in Israel as a key part of Iran’s broader war against Israel. "The Zionist regime must confront a strategy of internal aggression within itself,” he said a month after the 12-day war concluded, “and just as our armed forces' effective missiles compelled them to halt [the war], all intelligence and security agencies are also exerting effort, and in recent days, you have seen they were forced to conduct briefing sessions to counter the infiltration of intelligence services within the Zionist regime."
In response to Iranian recruitment efforts in Israel, the Shin Bet, in partnership with the National Public Diplomacy Directorate, launched a nationwide public-awareness campaign titled “Easy Money, Heavy Price,” to warn Israelis against spying for Iran. Running across radio, online platforms, and social media, the campaign warns that even modest payments from Iran, roughly $1,500, can result in severe consequences. The ads note that some who accepted money from Iran are now in prison, and that assisting Tehran can carry penalties of up to 15 years in jail.
Still, it's important to contextualize these plots. None came close to matching the level of operational complexity, strategic impact, or tradecraft displayed by Israel in its operations against Hezbollah or Iran. While Israel slowly vets and trains its potential recruits, the Iranians engage in shotgun recruitment online, with few recruits going to meet their handlers in places like Turkey or for training in Iran. The two sides are operating on completely different levels of intelligence capability and sophistication. Nevertheless, the Israeli authorities have treated these cases with appropriate seriousness, underscoring the potential long-term threat posed by Iran. “The war has not ended. We are in a state of temporary pause,” the head of the IRGC’s intelligence organization, Brigadier General Majid Khademi, warned last week. Iranian Intelligence Minister Khatib made his plans clear, calling for an “aggressive internal strategy” against Israel so that Israeli security agencies are forced to “confront a strategy of internal aggression” by Iranian agents within Israeli territory.
Alongside Israel’s demonstrated ability to penetrate Iran, the country’s security agencies now believe they will have to step up their game to counter Iranian spying in Israel. The public media campaign is surely just the beginning of a broader counter-espionage effort. What they have seen in the past year, Israeli officials maintain, represents a far greater espionage threat than anything they have seen before.
The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals.
Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.
Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief
