AhlulBayt News Agency (ABNA): The intelligence confrontation between Iran and the Zionist regime is no longer limited to the assassination of scientists, attacks on nuclear facilities, and cyber exchanges. Since the beginning of the Gaza war, Tehran has also expanded the battlefield into the society of the Zionist regime, advancing its intelligence operations using a low-cost model for recruiting personnel. A model that begins with a message on Telegram or a fake job offer and then gradually progresses from photographing a street or putting up a poster to monitoring Zionist regime officials and gathering information from military bases and air defense systems.
According to a report by Al Jazeera Net, the significance of this phenomenon lies in the fact that Iran is not necessarily seeking to recruit a professional spy in a sensitive position, but rather establishes contact with a large number of Zionist regime citizens, and despite the failure of a significant portion of these efforts, it hopes that a small number of them will be willing to move from carrying out symbolic missions to actual espionage. In this way, financial problems, social divisions, and ideological motives become channels for intelligence infiltration, whose danger is no less than technical and cyber infiltrations.
The statistics published by the Zionist regime's internal security organization (Shin Bet) on December 31, 2024, serve as the most accurate starting point for examining this trend. This body announced that it had discovered 13 major espionage cases and indictments had been issued against 27 Zionist citizens. The number of those arrested in connection with espionage for Iran also increased by about 400 percent compared to 2023. In the cyber domain, the security apparatuses of the Zionist regime, among thousands of attacks, neutralized about 700 attacks; attacks whose volume had increased fivefold compared to previous years.
On May 20, 2025, Nitsan Shapira, a military and security affairs correspondent for Israel's Channel 12, wrote that these figures had increased to 34 defendants in 19 cases. Citing a security source, he emphasized that this is no longer merely mischief or scattered actions, but has become a direct threat. Because Iranian handlers are trying to move recruited individuals from collecting information and photographing to participating in the preparation of assassination operations within the Zionist regime.
Less than a month later, Efrat Forsher, a police correspondent for the Walla website, in a report published on June 12, 2025, reported the existence of 22 cases and 39 arrested individuals. She added that the security institutions of the Zionist regime suspect that there may be other cases that have not yet been discovered. According to her, financial motivation was the most common factor among the defendants, and at the same time, efforts to recruit teenagers through social networks and entertainment platforms have increased.
By October 6, 2025, Amir Bukhbut, a military and security affairs correspondent and analyst for Walla, raised the number of cases to 30 and the number of defendants to 46. Citing a security source, he wrote that dozens of attempts to recruit Zionist citizens are made daily, and Iran's activity has crossed religious, ethnic, geographical, and social boundaries.
In a report published by Ron Kresey in Yedioth Ahronoth on December 27, 2025, the number of public cases reached 35. Less than two weeks later, Gilad Cohen, a judicial and Jerusalem affairs correspondent for the same newspaper, wrote on January 9, 2026, that 35 indictments had so far been issued against 54 defendants, while only one case had led to a final verdict. Citing one of the officers of the International Investigations Unit, he said that almost no week passes without the arrest of a new defendant.
However, these figures are not final. Shin Bet announced on February 5, 2026, the arrest of two young people from the Jerusalem area who had received money through digital wallets. Then, in March, the case of a reserve soldier of the Iron Dome system was also revealed. Therefore, it can be said that the number of cases has exceeded the figures from the end of 2025, although no new official and consolidated statistics have yet been published.
The Gradual Recruitment Method
Amir Bukhbut describes Iran's method as a gradual model. In this method, the target is not asked to hand over military secrets in the first message; rather, a simple mission is initially offered to them in exchange for money, such as photographing a public building, writing a slogan, buying a mobile phone and SIM card, or moving a package.
After the individual's level of cooperation and readiness is assessed, the missions gradually become more sensitive. From monitoring the home of an official to photographing military bases, collecting geographical coordinates, or finding someone ready to carry out an operation.
This gradual process allows the recruited individual to initially consider their actions as simple and harmless, but over time, their dependence on the handler, as well as their financial dependence, increases. This method also allows Iran to test dozens of people at a low cost and then spend more resources on those who are more obedient or have access to security information.
Various cases show significant differences in the amounts paid. In the case of two soldiers from the "Krayot" area, one of them received $2,500 for providing information about the Iron Dome system, while his accomplice received only $50. In other cases, about $500 in Bitcoin was paid for each mission. Also, according to a Yedioth Ahronoth report, a couple residing in the city of Lod received about $26,000 during their cooperation. This difference in amounts shows that the payment depended on the sensitivity of the information and the individual's readiness to enter higher stages of the operation; a point that Israel's Channel 12 has also emphasized.
Infiltration of Military Centers
According to Zionist regime media, the most dangerous development in this process is Iran's transition from relying on publicly available information to accessing information held by individuals in sensitive job positions.
On October 21, 2024, the Zionist regime's internal security organization (Shin Bet) announced the dismantling of a network of seven Zionist citizens in Haifa and the north of the occupied territories who had carried out hundreds of missions related to military bases and energy facilities. Shin Bet announced that part of the information these individuals had transferred could have helped Iran carry out more accurate missile attacks.
On March 20, 2026, Barhanu Tegnia, a crime affairs correspondent for Israel's Channel 12, revealed the case of "Raz Cohen," a reserve soldier who had served in the Iron Dome missile defense system. According to the indictment, Cohen provided the Iranian side with precise coordinates of military bases, the names of officials in certain positions, and information related to the Iron Dome system, receiving about $1,500 in digital currency in return. The significance of this case is that the defendant was not merely a photographer or an external observer, but through his military service, he had access to one of the most important defense systems of the Zionist regime.
Shin Bet also reported on May 20, 2025, several other cases in which missions were defined to gather information about the Mossad headquarters, energy facilities, Haifa Port, Air Force bases, and even the town where Yisrael Katz, the Zionist regime's Defense Minister, resides.
These targets show that Iran is simultaneously pursuing several objectives: creating a long-term database, examining protection and security mechanisms, and collecting data that could be used in the event of a wider military conflict.
Diverse Backgrounds
The cases related to Zionist citizens accused of cooperating with Iran's intelligence apparatus show that there is no single social pattern for these individuals.
Among the defendants are Jews and Arabs, immigrants from former Soviet republics, residents of Jerusalem, Haredi Jews, active military personnel, and reserve soldiers.
What is most common in these cases is individual vulnerability, ranging from debt and financial problems to the desire for quick income, feelings of marginalization, or ideological motives against the Zionist regime's government. According to Israeli reports, Iran did not create these gaps, but rather sees the society of the Zionist regime as a collection of weaknesses and seeks individuals in every stratum who are more ready to accept risk and cooperate.
Religious and political dimensions are also notable in some cases. Although financial motivation was the main factor in most cases, among the defendants are individuals from anti-Zionist Haredi currents, and some others have justified their cooperation as a form of political protest or ideological stance.
The Combination of Human Espionage and Cyber Infiltration
Recruiting human sources is only part of Iran's strategy, alongside cyber operations and cognitive warfare.
On May 29, 2025, Shin Bet announced that it had neutralized 85 phishing attacks attributed to Iran that targeted security officials, politicians, academics, and journalists of the Zionist regime.
Also, on February 11, 2026, Shin Bet and the Zionist regime's National Cyber Directorate reported hundreds of attempts over the past year to infiltrate Google accounts and messaging apps belonging to officials, military personnel, and defense industry employees.
The goal of these attacks is not merely to steal confidential documents, but to collect information such as addresses, personal connections, daily habits, and movement patterns of individuals; data that can be combined with information obtained from human sources and used in blackmail, recruitment operations, or attack planning.
Social Networks; A Tool for Deepening Divisions
Simultaneously with direct recruitment, Iran also uses social networks to intensify internal divisions within the society of the Zionist regime and create a more favorable environment for infiltration.
A study conducted by Anbal Orbach, a former researcher at the Zionist regime's Institute for National Security Studies, and David Siman Tov, a former military intelligence officer of this regime, shows that Iran's influence networks do not consistently support either the right or the left, and their main goal is to deepen social divisions and weaken the internal cohesion of the Zionist regime.
In a study published in English by the "Institute for the Study of Intelligence Methodology," seven Iranian influence networks active between October 2023 and May 2024 were identified.
This study concludes that these networks have exploited issues such as the prisoners' file, human casualties, declining public trust in the government and security institutions, and also shows that digital influence operations are completely intertwined with information gathering, recruitment, and field direction, using the same digital infrastructure both for disseminating propaganda messages and for direct communication with Zionist citizens and steering them toward carrying out missions.
In an analysis published by Danny Citrinowicz and David Siman Tov on July 21, 2025, it is also stated that since the Al-Aqsa Storm operation on October 7, 2023, Iran has increased its efforts to recruit citizens of this regime for espionage, carrying out field missions, and assisting Tehran in wartime, simultaneously with intensifying media operations against the society of the Zionist regime.
Defensive Superiority
The high number of arrests shows that the Zionist regime has significant capability in intercepting communications, tracking digital wallets, and coordinating between Shin Bet, the police, and military intelligence. But these same figures also reveal another reality: the volume of recruitment efforts is very extensive, and in many cases, arrests occur after individuals have carried out part of the missions and transferred information.
Iran can also quickly replace a compromised agent. Because creating a new user account and sending hundreds of messages to different individuals does not require a complex operational infrastructure. For this reason, Israel's superiority is more defensive in nature. This means that although it succeeds in identifying and dismantling many networks, it cannot prevent all communications or identify from the outset which of the recruited individuals will later become a source with military access.
In conclusion, Iran has been able to transform espionage against the Zionist regime from a complex and elite-limited operation into an activity that can also be carried out through mobile phones and digital currencies. Although Tehran has not yet succeeded in achieving a decisive infiltration of the Zionist regime's security structure, it has shown that technological superiority alone is not enough to close human gaps.
According to Israeli reports, the deeper danger lies in the combination of three components: human source recruitment, cyber infiltration, and psychological operations. A combination that has turned the society of the Zionist regime, with all its gaps, contradictions, and vulnerabilities, into one of the main fronts of the intelligence war.
**************
End/ 345E
