The statistics alone are alarming. Since October 7, 2023, Israeli authorities have arrested over 48 Israeli citizens on espionage charges connected to Iranian intelligence services - a 400 percent increase compared to the previous year. These are not abstract numbers representing theoretical threats. The intelligence gathered by these networks has been directly linked to Iranian missile strikes that damaged Israeli air bases and Hezbollah drone attacks that killed IDF soldiers. Israeli security officials have characterized this campaign as one of the most severe security breaches in the nation’s history.
This behavior goes well beyond traditional espionage activity. Iran has fundamentally transformed its intelligence doctrine, abandoning decades of careful tradecraft in favor of a mass-recruitment model that treats human assets as disposable commodities rather than valuable long-term investments. This shift carries profound implications for Israeli security, regional stability, and Western understanding of Iranian strategic behavior.
The October 7 Hamas massacre created conditions Tehran has exploited ruthlessly. As Israel mobilized for multi-front warfare against Iranian proxies, the Islamic Republic’s intelligence services launched what a parallel offensive conducted not with missiles and drones, but with Telegram messages, cryptocurrency payments, and the systematic exploitation of socially marginalized Israelis. The Shin Bet has reported that Iranian operational efforts “greatly intensified” following the war’s outbreak, with handlers leveraging digital platforms for intimidation, messaging operations, and terrorist recruitment at unprecedented scale.
This essay examines the full scope of Iran’s post-October 7 espionage offensive: the strategic logic driving Tehran’s doctrinal shift, the demographic profiles of recruited assets, the tradecraft employed to compromise Israeli citizens, and most critically the operational consequences when intelligence gathered by these networks is translated into kinetic attacks against Israeli military installations.
The Doctrinal Rupture: From Ideological Recruitment to Transactional Exploitation
Understanding the magnitude of Iran’s current espionage campaign requires appreciating how radically it departs from historical practice. For decades, Iranian intelligence services, primarily the Ministry of Intelligence and Security (MOIS) and the Islamic Revolutionary Guard Corps Quds Force, pursued a traditional recruitment model emphasizing ideological compatibility, extensive vetting, and long-term asset development.
Pre-October 2023, Iranian espionage within Israel operated according to predictable patterns. Handlers targeted Arab citizens presumed sympathetic to Palestinian national aspirations. Complementary networks operated through Palestinians in the territories and Hezbollah operatives in Lebanon. High-profile recruitments occasionally netted businessmen or minor officials with access to sensitive information. Operations remained, in the assessment of Israeli intelligence analysts, “very few and far between, continuous throughout the years but minimal.”
The post-October 7 model bears almost no resemblance to this careful approach. Iranian handlers now target anyone experiencing financial distress regardless of ideological orientation, ethnic background, or religious identity. The most striking feature of recent arrests is the demographic diversity of recruits: Azerbaijani immigrants, ultra-Orthodox Jews, secular Russians, Arab citizens, and native-born Israelis with criminal records have all been swept into Tehran’s expanding networks.
Israel Police National Crimes Unit head Meir Goren confirmed the common thread: “All individuals arrested in recent cases were facing financial challenges and were seeking a quick way to pay their debts.” Intelligence analyst Yossi Melman was characteristically direct in his assessment: “There’s no ideology here; it’s only the money.”
Three factors appear to drive this transformation. First, operational necessity: Iran cannot safely arrange in-person meetings with potential Israeli recruits abroad as it once did, forcing reliance on digital recruitment that favors volume over selectivity. Second, a revenge motive following Israeli assassinations of Hamas political chief Ismail Haniyeh and Hezbollah Secretary-General Hassan Nasrallah - Tehran requires actionable intelligence to strike back effectively. Third, and perhaps most significantly, Iranian handlers have identified and are systematically exploiting fractures within Israeli society that would have been inconceivable a generation ago.
Melman’s assessment merits serious consideration: “This is linked to the social collapse of Israel in recent years. The society has lost its sense of solidarity and cohesion.” Whether one accepts this characterization in full, the evidence suggests Iranian intelligence has identified a genuine vulnerability and is aggressively probing its dimensions.
The Shotgun Approach: Volume Over Quality
Former Mossad Counterterrorism Chief Oded Ailam has described Iran’s current methodology as a “digital marketing approach,” a characterization that captures both the technique’s commercial logic and its fundamental departure from intelligence tradecraft norms. Iranian handlers now contact thousands of Israelis through social media platforms, automated messaging systems, and even direct telephone calls, operating on the calculation that even a one percent response rate will yield actionable assets.
The approach mirrors commercial customer acquisition strategies. Automated Telegram bots dispatch recruitment messages en masse. Handlers cycle rapidly through contacts, discarding unresponsive targets without investing significant resources. One bot message discovered by Israeli security services read with remarkable candor: “Thank you for contacting the Iranian Intelligence Service. Our experts will contact you shortly.”
A Times of Israel report documented that hundreds of Israelis received direct recruitment calls from Iranian intelligence in late 2025, with handlers offering “competitive salary, comprehensive security” as inducements. The calls originated from identifiable number prefixes: 03-6817 and 03-3067 that Israeli cyber authorities subsequently publicized as part of countermeasures.
Ailam says that “this isn’t a brilliant strategy; it’s just relentless. Send enough messages, and eventually, someone will bite.” He noted that Iranian services have accepted they will lose most recruits to detection, calculating that the intelligence value of those who evade capture justifies the expenditure.
Israeli authorities have identified several demographic categories particularly vulnerable to Iranian recruitment. Immigrants from Azerbaijan and other Caucasus states represent a primary target set, exploited through cultural proximity to Iran, weaker state identification, and Russian-language targeting. Former Israel Interpol head Asher Ben Artzi observed of this community: “These people come from a very closed society; it’s not like native-born Israelis who could never conceive of doing such a thing.”
Youth constitute another vulnerable population, with over 50 percent of identified recruits under 30 years of age. Financial pressures, extensive social media presence, and limited understanding of legal consequences make young Israelis attractive targets. Ultra-Orthodox Jews have proven unexpectedly susceptible, community insularity, limited military service that reduces exposure to security awareness training, and economic pressures within Haredi society all contribute to their vulnerability.
Individuals with criminal backgrounds represent perhaps the most reliable recruitment pool. Handlers explicitly seek those already socially marginalized, calculating that desperation and fewer moral scruples will produce compliance. The case of Vladislav Viktorson: a 30-year-old with prior convictions for sexual offenses against minors who progressed from graffiti to arson to agreeing to commit assassination exemplifies this pattern.
The Haifa Seven: A Case Study in Systematic Compromise
No single case better illustrates the scope and sophistication of Iran’s current espionage campaign than the network Israeli authorities have dubbed the “Haifa Seven.” This cell of Jewish Israeli citizens of Azerbaijani origin conducted over 600 intelligence-gathering missions over approximately two years, systematically documenting Israel’s most sensitive military installations and transmitting the information to Iranian handlers.
The network’s leader, 43-year-old Aziz Nisanov, was recruited through Telegram by a handler using the code name “Alkhan” or “Elkhan Agayev.” Initial contact occurred through a Turkish intermediary who facilitated communication with Iranian intelligence. Nisanov subsequently recruited family members and associates, including his 20-year-old son Yigal Nissan, an IDF soldier who deserted his unit on December 4, 2023, to participate full-time in espionage activities.
The targets documented by the Haifa Seven read like a priority list for Iranian strike planning: Nevatim Air Force Base, home to Israel’s F-35 stealth fighters; Ramat David Air Force Base in the north; the Golani Brigade training facility; Tel Nof and Palmachim air bases; Iron Dome battery positions throughout the country; IDF headquarters at the Kirya in Tel Aviv; Mossad headquarters at Glilot; naval installations at Haifa, Ashdod, and Eilat; and the Hadera power plant.
The cell received approximately $300,000 in compensation, paid through a combination of cryptocurrency transfers and cash delivered by Russian tourists visiting Haifa. Individual missions earned between $500 and $1,200 depending on target sensitivity. The network received specialized equipment from handlers, including a dedicated phone, high-quality cameras, and a laptop with encryption software.
What distinguishes this case from routine espionage is its demonstrable operational impact. Israeli police stated explicitly: “Every missile fired towards the country in the last two years from Gaza, Lebanon, or Iran reached places they photographed and sent to the Iranians.” The connection between intelligence collection and kinetic strikes is not theoretical; it is documented.
The Recruitment Funnel: Psychological Escalation Toward Murder
Iranian handlers employ a systematic escalation process designed to incrementally compromise recruits, making each subsequent request appear as merely a minor extension of previous cooperation. Understanding this methodology is essential for both counterintelligence purposes and public awareness campaigns aimed at potential targets.
The process begins with initial contact and testing, typically compensated at $600 to $1,000. Opening messages arrive through Telegram using fake profiles: “Anna Elena” posed as a left-wing activist, “VIP Employment” offered job opportunities, groups titled “Jobs in the Jerusalem area” promised legitimate work. The pitch is deliberately vague: “Want to earn some easy cash?” or “Do you have any information about the war? We are ready to buy it.”
Testing tasks appear entirely innocuous. One recruit received approximately $1,000 simply to visit a public park and check whether a black bag had been buried at a specific location. Another was paid to place a cigarette package containing a note in a trash can. A third bought a bottle of Arak and left it at designated coordinates. These tasks serve dual purposes: they verify the recruit’s willingness to follow instructions and establish a pattern of compliance that can be leveraged for escalation.
Stage two involves propaganda and psychological operations, compensated at $500 to $2,000 per task. Recruits spray graffiti with divisive messages: “We are all together against Bibi” or “Bibi brought Hezbollah here.” They post banners reading “Children of Ruhollah” a reference to Ayatollah Khomeini in public spaces. They hang posters calling for civil revolt. The 20-one-year-old ultra-Orthodox recruit Elimelech Stern progressed to delivering packages containing severed animal heads and dolls with knives, threatening messages designed to terrorize Israeli civilians.
Proven recruits advance to stage three, intelligence collection, earning $500 to $1,200 per mission. The Guliyev couple, Rafael and Lala, both 32, of Azerbaijani origin living in Lod, conducted extensive surveillance of Mossad headquarters, the Moldovan consulate, Israel Electric Corporation facilities, Haifa Port, the Hadera water pumping station, Tel Aviv bomb shelters, and even the graves of October 7 victims. They were paid to track a female academic at the Institute for National Security Studies at $600 per day, with instructions suggesting she was targeted for physical harm.
Stage four introduces sabotage and operational tasks at $2,000 to $7,000 compensation. Viktorson set fire to cars near Tel Aviv’s Yarkon Park, burned forests, and agreed to commit assassination. Roy Mizrahi and Almoog Attias escalated from graffiti to arson, acid sabotage, attempted bomb-making, and installing surveillance cameras aimed at Defense Minister Israel Katz’s residence.
The final stage involves assassination missions, offered at $60,000 to $1,000,000. Seventy-three-year-old businessman Moti Maman was smuggled into Iran twice via Turkey, where handlers discussed targets including Prime Minister Netanyahu, Defense Minister Gallant, and Shin Bet Chief Ronen Bar. Maman demanded $1 million upfront, which Iran refused, and ultimately received only €5,000 for his meetings before his arrest. The Beit Safafa cell operating from East Jerusalem was offered $53,000 to assassinate a nuclear scientist and a major city’s mayor. A separate recruit was offered $60,000 to murder a Weizmann Institute scientist and his family and burn down their house; he hired four Arab Israeli criminals and attempted the assassination on September 15, 2024, fleeing only when a security guard was present at the residence.
From Intelligence to Impact: The Golani Base Strike
The operational consequences of Iranian espionage reached their most devastating expression on October 13, 2024, when a Hezbollah drone struck the Golani Brigade Training Base near Binyamina. The attack occurred at approximately 7:00 p.m., precisely when soldiers would be gathered in the dining hall for their evening meal. Four IDF soldiers were killed: Sergeant Alon Amitay, Sergeant Omri Tamari, Sergeant Yosef Hieb, and Sergeant Yoav Agmon, all 19 years old. Over 58 additional soldiers were wounded, eight of them seriously.
Israeli police confirmed that the Haifa Seven had photographed the Golani Training Base and were “given maps of strategic sites by their handlers, including of the Golani Brigade base.” The strike’s timing - precisely when soldiers would be congregated for dinner - suggests intelligence of unusual precision. While Israeli authorities have not issued a formal statement explicitly confirming operational causation, the circumstantial evidence connecting espionage to attack is substantial.
This was not an isolated incident. On October 1, 2024, Iran launched approximately 180 ballistic missiles at targets systematically documented by the Haifa Seven: Nevatim Air Force Base, Ramat David Air Force Base, and the Glilot complex housing Mossad headquarters. Two hangars at Nevatim were heavily damaged. Following the strike, the cell was tasked with assessing damage accuracy, providing Iran with battle damage assessment to improve future targeting.
Six days after the Golani attack, a Hezbollah drone struck Prime Minister Netanyahu’s private residence in Caesarea. Netanyahu and his wife were not present. Police and Shin Bet are actively investigating whether the Haifa Seven surveilled this target as well.
The strategic implications extend beyond individual strikes. The Haifa Seven documented Iron Dome battery positions throughout the country, information potentially enabling Iranian planners to calculate interception corridors and design attack trajectories to maximize penetration. Energy infrastructure including the Hadera Power Plant and Reading Power Plant was photographed and catalogued. Naval installations at three ports were compromised. The homes and family routines of senior security officials were documented for potential targeting.
Iranian intelligence has also been hijacking private security cameras throughout Israel to assess missile impact sites in real time. The former Israeli Cyber Directorate deputy director warned citizens to turn off or change passwords on home surveillance cameras, noting Iran is attempting to access CCTV systems to improve missile precision in tactics mirroring Russian operations against Ukraine.
Thwarted Assassinations: The Targets Who Survived
The full scope of Iranian assassination planning against Israeli leadership becomes apparent only when examining the plots that security services managed to disrupt. The target list reveals a comprehensive effort to decapitate Israel’s political and security establishment.
Beyond the Netanyahu, Gallant, and Bar plots involving Moti Maman, Iranian handlers directed assassination attempts against former IDF Chief of Staff Lieutenant General (res.) Aviv Kochavi. Hezbollah planned to kill Kochavi using a remote-detonated explosive device; Israeli security services disrupted the plot in its “final stages” in September 2024.
Former Defense Minister Moshe Ya’alon was targeted in an attack that proceeded to execution. Even prior to the war, on September 15, 2023, Hezbollah operatives detonated a Claymore-type directional mine in Tel Aviv’s Yarkon Park. The device failed to inflict casualties, but the operation demonstrated Iran’s willingness to attempt assassination on Israeli soil.
Current Defense Minister Israel Katz faced multiple threats. The Mazrahi-Attias cell placed powerful explosives near his home and installed surveillance cameras at the residence entrance before their arrest. National Security Minister Itamar Ben-Gvir was targeted by a five-person cell that conducted extensive surveillance but could not penetrate his security detail.
The Beit Safafa cell operating from East Jerusalem planned to assassinate both a nuclear scientist and a major city’s mayor. Cell leader Rami Alian, a 23-year-old Palestinian, received approximately $7,000 in cryptocurrency compensation and was found with $13,000 in cash at the time of arrest. The cell had attempted to acquire weapons, created fake police license plates, and planned to target an IDF soldier with a grenade.
Religious man Asher Binyamin Weiss from Bnei Brak used a GoPro camera to film a nuclear scientist’s home and vehicle; the footage was forwarded to handlers explicitly for assassination planning. Weiss also set vehicles on fire, threw pipes onto roads, and posted hundreds of inciting posters throughout central Israel calling for civil revolt.
Israeli Countermeasures: Deterrence Through Exposure and Prosecution
The Shin Bet has adopted an unprecedented transparency strategy in response to the espionage wave, deliberately publicizing arrests, fake profiles, and recruitment methods that would traditionally remain classified. Security analyst Ahron Bregman explained the logic: “They’re publicizing their efforts. They’re letting people know that they’re there, they’ll catch them.”
Public disclosures have included screenshots of identified Iranian Telegram profiles released in January and August 2024; comprehensive lists of recruitment channels including “Tears of War,” “BringHomeNow” (a fake hostage advocacy group exploiting families’ anguish), “VIP Employment,” and the remarkably brazen “IRAN INTELLIGENCE SERVICE”; and videos in Persian with Hebrew subtitles warning Iranian operatives of consequences.
A December 2023 Shin Bet video message declared directly to Iranian handlers: “Through our unlimited control, we have closely monitored your empty efforts to establish contact with Israeli citizens. ... We warn you, playing with fire has difficult and dangerous implications.”
Prosecutors have systematically escalated charges from standard espionage to “Aiding the Enemy in Wartime,” one of the most severe offenses in Israeli law, carrying a potential death penalty or life imprisonment. The benchmark case establishing sentencing parameters was Moti Maman, sentenced to 10 years in February 2025. Judge Beni Sagi stated the sentence “should reflect a significant element of deterrence and convey a clear and distinct message regarding the punitive price,” adding that penalties must “gradually become more severe.”
When charging the two IDF reservists Yuri Eliasfov and Georgi Andreyev, the former had filmed classified Iron Dome operations during his military service, Superintendent Sarit Peretz emphasized prosecutors were pursuing “the most serious offense in the law book, the penalty for which is life imprisonment or death.”
A dedicated Wing 21 at Damon Prison near Haifa now houses Iranian spy suspects under isolated, “exceptionally strict conditions.” Deputy Commissioner Zohar Tsarfati described the unprecedented nature of the population: “We’re dealing with a completely different population from anything we’ve known before. ... These are Israeli citizens, born and raised here, some of whom led normal lives but chose to switch sides.”
The July 2025 “Easy Money, Heavy Price” campaign, a partnership between the Prime Minister’s Office, Shin Bet, and the National Public Diplomacy Directorate, deploys radio, online, and social media messaging: “For 5,000 shekels, is it worth ruining your life?” The campaign emphasizes that typical payments average approximately $1,500 while penalties reach 15 years imprisonment.
Municipal coordination has intensified dramatically. Bat Yam Mayor Tzvika Brot announced in December 2025 that “millions of Israelis” including himself had received Iranian recruitment texts, revealing that a double-digit number of students in one high school admitted to contact with Iranian handlers. Shin Bet agents are now meeting with mayors and school principals across central Israel to develop awareness campaigns targeting youth before Iranian handlers can reach them.
Strategic Implications and Policy Recommendations
Iran’s post-October 2023 espionage campaign represents something genuinely new in the annals of state-sponsored intelligence operations. The mass-recruitment model replacing careful cultivation, financial coercion supplanting ideological persuasion, and disposable assets substituting for long-term agents together constitute a doctrinal transformation with implications extending well beyond Israeli security.
The strategy’s effectiveness is undeniable. The Haifa Seven alone conducted hundreds of reconnaissance missions feeding targeting data for strikes that killed four Israeli soldiers and damaged critical military infrastructure. Intelligence gathered by these networks contributed to the most significant Iranian missile attack on Israeli territory in history. Assassination plots reached advanced planning stages against the prime minister, defense minister, intelligence chief, and former military leaders.
Yet the approach carries inherent vulnerabilities that Israeli countermeasures are systematically exploiting. The same volume that guarantees some operational success ensures extensive exposure: 45 arrests across 25 cases in roughly 18 months represents an unsustainable attrition rate for any intelligence service, regardless of resources. The recruits’ profile; financially desperate, criminally compromised, socially marginalized, produces unreliable assets prone to confession and cooperation with authorities once detained.
Former Mossad official Oded Ailam’s assessment captures both the threat and its limitations: “The cost of ‘customer acquisition’ is virtually zero, while the potential damage is immense.” Iranian intelligence has accepted a model where most recruits will be caught, calculating that those who evade detection will provide sufficient return on minimal investment.
This analysis suggests several policy implications. First, Western intelligence services should anticipate Iranian adoption of similar mass-recruitment methodologies against their own populations. The digital infrastructure enabling this campaign: Telegram bots, cryptocurrency payment rails, social media platforms with minimal content moderation; is globally accessible. Iranian handlers have demonstrated a willingness to contact thousands of potential recruits; there is no reason to assume they will limit this approach to Israeli targets.
Second, the demographic vulnerabilities Iranian handlers have identified and exploited, immigrant communities with weak state identification, financially distressed youth, individuals with criminal backgrounds, exist in every Western society. Awareness campaigns and community outreach efforts similar to those Israel is now implementing deserve consideration elsewhere.
Third, the connection between espionage and kinetic attacks demonstrated in the Golani Base strike and October 1 missile barrage underscores that intelligence collection is not an abstract threat. Information gathered by recruited assets translates directly into casualties. This operational linkage should inform both sentencing guidelines for espionage convictions and public communication about the stakes involved in cooperating with hostile intelligence services.
Fourth, cryptocurrency’s role as the primary payment mechanism for Iranian espionage operations highlights ongoing regulatory gaps in digital asset oversight. The ease with which handlers transferred funds to recruits. $300,000 to the Haifa Seven alone, demonstrates that current anti-money laundering frameworks remain inadequate for addressing state-sponsored illicit finance.
The invisible front has become visible. Israeli security services have demonstrated both the capability to detect and disrupt Iranian networks and the willingness to pursue aggressive prosecution and public exposure strategies. Whether these countermeasures prove sufficient to deter an adversary treating human assets as expendable commodities remains the central strategic question.
What is certain is that Iran has fundamentally altered its approach to intelligence operations against Israel, accepting costs and casualties that would have been inconceivable under the previous doctrine. This transformation reflects both desperation, Tehran’s inability to project conventional military power effectively against Israeli targets, and opportunism, exploiting social fractures and economic pressures within Israeli society that the October 7 attacks and subsequent war have exacerbated.
The war between Israel and Iran is not limited to exchanges of missiles and drones, proxy operations in Lebanon and Gaza, or covert actions against nuclear facilities. It encompasses a systematic campaign to compromise Israeli citizens, gather actionable intelligence, and translate that information into attacks killing Israeli soldiers and threatening Israeli leaders. Understanding this dimension of the conflict, and developing effective countermeasures against it, will prove essential to Israeli security and regional stability in the years ahead.
