Iran’s Revolutionary Guard built a covert network of foreign operatives to spy on Israeli targets and prepare attacks abroad, but Israeli intelligence exposed key figures and disrupted major operations.
By Hezy Laing
The targets could hardly have been more different: an Israeli embassy, a synagogue, Jewish community leaders and a major international oil pipeline. Yet all featured in an Iranian-directed operation uncovered in Azerbaijan, exposing how Tehran sought to use foreign operatives to threaten Israeli interests far beyond its borders.
On April 20, 2026, the Mossad, Shin Bet and IDF revealed details of the network, identifying it as part of Unit 4000, the Special Operations Division of the Islamic Revolutionary Guard Corps (IRGC) Intelligence Organization. The announcement described a coordinated effort to target Israeli officials, gather intelligence on strategic installations and prepare attacks against Israeli interests around the world.
Iran’s network of foreign operatives
The IRGC is Iran’s powerful military organization, separate from the country’s regular armed forces. Its Intelligence Organization conducts espionage and covert operations, with Unit 4000 serving as its special operations division responsible for activities outside Iran.
Unlike conventional military units, Unit 4000 relied on covert networks of operatives both inside and outside Iran. Its commander, Rahman Moghaddam, was responsible for building and managing this network, using foreign agents to collect information and prepare operations without requiring Iranian personnel to carry out every task themselves.
According to Israeli intelligence, operatives were instructed to gather information on Israeli political leaders, security officials, military installations, ports and Israeli ships around the world. This approach gave Tehran the ability to pursue targets in countries far beyond its immediate borders while relying on local collaborators for surveillance and logistical support.
Azerbaijan: a plot against Israel and a major oil pipeline
One of the most serious discoveries came in Azerbaijan, where local security authorities uncovered a cell preparing attacks against Israeli and Jewish targets. The planned targets included the Israeli Embassy in Baku, a synagogue, a leader of Azerbaijan’s Mountain Jewish community and the Baku-Tbilisi-Ceyhan oil pipeline.
The pipeline transports oil from Azerbaijan’s Caspian fields through Georgia and Turkey to the Mediterranean. It is an important international energy corridor, and its disruption could have consequences far beyond the region.
Azerbaijani authorities said their investigation uncovered an effort to smuggle more than seven kilograms of C-4 explosives into the country on IRGC instructions. Israeli officials separately disclosed that members of the cell had obtained explosive drones and were gathering information about potential targets through surveillance and photography.
The investigation led to arrests and helped Israeli intelligence expose the wider command structure behind the operation. It also demonstrated how Iran sought to use local operatives to prepare attacks against targets in countries where its own personnel might attract greater scrutiny.
Espionage around a major NATO air base
The investigation also revealed connections to a separate espionage operation in Turkey. In January 2026, Turkish authorities arrested six suspects, including one Iranian national and five Turkish citizens, over alleged espionage for Iran.
According to Turkish prosecutors, the suspects had contact with IRGC intelligence officers and gathered information about sensitive military installations, including Incirlik Air Base in southern Turkey. The investigation also involved allegations concerning the movement of armed drones through Turkey for use in other countries.
Israeli reporting identified Mahdi Yekeh-Dehghan as a key figure directing the wider network, including activities in Azerbaijan and connections to the Turkish operation. The case illustrated the breadth of the threat: Iranian intelligence was allegedly using local contacts not only to monitor Israeli interests but also to collect information about Western military facilities.
Israel strikes the network’s leadership
The Israeli intelligence investigation identified several senior figures behind the network. Moghaddam commanded Unit 4000, while Majid Khademi headed the broader IRGC Intelligence Organization and stood above him in the command structure. Another senior operative, Mohsen Suri, was responsible for meeting and coordinating with terror cells outside Iran.
Israeli authorities identified all three among the senior figures killed during the broader military campaign against Iran, although they were reportedly killed in separate strikes. Their deaths represented a significant blow to the leadership associated with the overseas operation.
There is, however, uncertainty surrounding Moghaddam. An August 2026 investigation by Iran International, citing sources familiar with the unit’s activities, claimed that he had survived and was directing new operations targeting shipping and ports in East Asia. His fate therefore remains disputed.
<
h2>A crippled network/h2>
The exposure of Unit 4000 revealed the reach of Iran’s intelligence apparatus and the danger posed by its use of foreign operatives. Israel’s ability to identify the network’s commanders, expose its overseas activities and strike senior figures dealt a significant blow to Tehran’s operations.
