The Intelligence, Security, and Covert-Action Apparatus of the Islamic Republic of Iran: An Institutional Analysis

Exact Research Cutoff Date: July 20, 2026

Scope and Limitations

This report provides an exhaustive, unclassified, public-source analysis of the intelligence, counterintelligence, security, cyber, and covert-action structures of the Islamic Republic of Iran. It examines formal command structures, practical bureaucratic rivalries, intelligence disciplines, and historical evolution. Due to the inherent secrecy of Iranian security institutions and the extreme volatility caused by the 2026 Iran War, this analysis relies heavily on official Iranian statements, public legislation, multilateral investigations, and technically rigorous cybersecurity analysis. To comply with safety protocols, no actionable operational, tactical, or cyber-intrusion methods are detailed.

Executive Summary

The intelligence apparatus of the Islamic Republic of Iran constitutes a sprawling, fragmented, and highly competitive ecosystem designed primarily to ensure the survival of the theocratic regime. Unlike states that maintain a single, unified national intelligence service under strict civilian control, Iran relies on a system of parallel organizations that collect overlapping intelligence, monitor domestic and foreign threats, and police one another. This structural redundancy is intentional; it prevents any single agency from monopolizing information and launching a coup, while providing the Supreme Leader with multiple, competing assessments. The two fundamental pillars of this system are the civilian Ministry of Intelligence (MOIS) and the military-run Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO). While MOIS possesses statutory authority over national intelligence, the IRGC-IO has steadily expanded its mandate since the 2009 domestic protests, acting as the ideological vanguard of the regime. These primary organs are supplemented by the intelligence branches of the regular armed forces (Artesh), the national police (FARAJA), and specialized internal protection organizations. Between 2025 and 2026, the Iranian intelligence apparatus suffered catastrophic counterintelligence failures. A shadow war with Israel culminated in the June 2025 "Twelve-Day War" and the devastating February–July 2026 conflict (codenamed Operation Epic Fury by the United States and Operation Roaring Lion by Israel)1. The 2026 conflict resulted in the targeted killings of Supreme Leader Ali Khamenei, MOIS Minister Esmaeil Khatib, IRGC-IO Chief Majid Khademi, and Artesh Commander Abdolrahim Mousavi3. The resulting power vacuum accelerated the militarization of the state under IRGC Commander-in-Chief Ahmad Vahidi and the newly appointed, yet publicly unseen, Supreme Leader Mojtaba Khamenei7. Despite profound structural weaknesses—including deep factional politicization, severe vulnerability to foreign penetration, and domestic legitimacy crises—Iran’s intelligence apparatus retains potent asymmetric capabilities. Its regional partner networks, overseen by the Quds Force, and its low-cost, high-impact cyber operations, conducted by MOIS and IRGC affiliates, continue to project power globally10. However, the state's reliance on coercive surveillance has alienated the populace, transforming ordinary domestic dissent into a highly securitized intelligence battlefield.

Key Findings

Decimation of Leadership and the "Soft Coup" Dynamic: The 2025-2026 conflicts resulted in the decapitation of Iran's intelligence and military hierarchies. The system is currently operating under emergency succession protocols. With Supreme Leader Mojtaba Khamenei absent from public view, the IRGC has asserted dominance over civilian institutions, leading to internal accusations by hardliners of a "soft coup" orchestrated by pragmatic administrators and military elites9. Institutional Duality and Rivalry: The rivalry between MOIS and IRGC-IO defines the Iranian intelligence landscape. While MOIS handles traditional espionage and foreign intelligence, the IRGC-IO dominates domestic political security and ideological vetting. This rivalry frequently hampers operational effectiveness but guarantees regime coup-proofing. Cyber Maturation and Adaptability: Iranian cyber operations have evolved from basic defacements to sophisticated espionage, ransomware, and destructive wiper campaigns. MOIS-linked actors (e.g., MuddyWater) focus on strategic espionage, while IRGC-linked actors (e.g., Void Manticore/Handala Hack) specialize in disruptive hack-and-leak operations. Notably, Iranian cyber units have demonstrated immense resilience, utilizing satellite internet links to maintain operational continuity during domestic network blackouts in 202611. Unprecedented Counterintelligence Crisis: The repeated, precise assassinations of top scientific, military, and intelligence figures strongly assess an unprecedented level of foreign penetration within Iran’s most secure organizations, notably the IRGC's own protective organs. The inability to protect figures like Ali Khamenei and Majid Khademi indicates systemic vulnerabilities2. Asymmetric Regional Strategy: The IRGC Quds Force operates a vast matrix of regional partners, substituting conventional military power with intelligence-supported proxy warfare. This strategy seeks to impose high costs on technologically superior adversaries through plausible deniability and attrition10.

Evidence and Confidence Methodology

This report relies on a weighted source-priority matrix. Evidence labels are applied to major institutional or operational assertions to denote confidence levels.

• Officially confirmed: Stated in published Iranian law, constitutional provisions, or official government decrees.
• Confirmed by multiple independent sources: Verified by multilateral bodies, international courts, and high-quality investigative journalism.
• Strongly assessed: Widely accepted by peer-reviewed analysis and reputable cybersecurity vendors based on overwhelming circumstantial or technical evidence, despite Iranian state denials.
• Plausible but not conclusively demonstrated: Supported by logical inference and some documentation, but lacking definitive proof.
• Alleged or disputed: Claimed by foreign governments, defectors, or opposition groups but lacking independent, neutral verification.
• Low-confidence claim: Sourced from highly biased or single-source origins.
• Unknown: Information that remains definitively outside the public domain.

When providing foreign-government attribution, this report uses precise wording such as "The United States government attributed..." rather than presenting the attribution as an undisputed fact. A detailed breakdown of source quality is available in the final appendix.

PART I — Political and Constitutional Command Structure

The Islamic Republic of Iran operates under a dual constitutional structure fusing republican institutions with theocratic absolutism, known formally as Velayat-e Faqih (Guardianship of the Islamic Jurist). This duality fundamentally shapes the intelligence apparatus, creating parallel civilian and military chains of command. The Supreme Leader (Rahbar) holds the ultimate constitutional authority. Officially confirmed by the Constitution, the Supreme Leader dictates national security policy, commands the armed forces, and directly appoints the heads of the IRGC, the Artesh, and the judiciary. Following the February 2026 assassination of Ali Khamenei during Operation Epic Fury, his son Mojtaba Khamenei was elevated to the position by the Assembly of Experts7. However, Mojtaba's prolonged public absence has led to a strongly assessed reality of decentralized, IRGC-dominated collective decision-making, significantly altering the practical flow of intelligence8. The Office of the Supreme Leader (Bayt-e Rahbari) functions as a massive bureaucratic and intelligence clearinghouse. It receives reporting from all agencies and maintains its own security and political-ideological representatives embedded within every military and intelligence organ. Within the elected government, the President (currently Masoud Pezeshkian) is the head of the executive branch. The president's practical power over intelligence is strictly limited. While the president officially appoints the Minister of Intelligence and the Minister of Interior, these choices must be vetted and approved by the Supreme Leader16. The Cabinet implements policy but is subordinate to the Supreme National Security Council (SNSC) in matters of defense. The SNSC is the highest policy-coordination body, bridging the civilian and military domains. Its Secretary (currently Mohammad Bagher Zolghadr, appointed after the March 2026 assassination of Ali Larijani) wields immense practical power over intelligence fusion16. The military command is bifurcated. The Armed Forces General Staff (AFGS) is officially confirmed as the highest military coordinating body, bridging the regular military and the IRGC. The position of AFGS Chief is currently vacant following the death of Abdolrahim Mousavi in February 202618. The Islamic Revolutionary Guard Corps (IRGC) is an ideological military force tasked with protecting the revolution from internal and external threats, commanded by Ahmad Vahidi since March 20269. Parallel to it operates the Regular Armed Forces Command (Artesh), tasked with conventional border defense. The Judiciary is a hardline stronghold whose head is appointed directly by the Supreme Leader. It oversees the Revolutionary Courts, which try national security and espionage cases based almost entirely on intelligence agency dossiers. The Parliament (Islamic Consultative Assembly or Majles) exercises only superficial oversight by approving the intelligence minister's budget and appointment; it is structurally barred from auditing classified operational intelligence activities. The Assembly of Experts and the Guardian Council play roles in leadership succession and political vetting, respectively, ensuring that the broader security apparatus remains ideologically pure. When agencies provide conflicting assessments, the system relies on the Supreme Leader's office to arbitrate. The presence of overlapping agencies ensures that no single entity can monopolize information, but it also generates intense bureaucratic friction.

Table 1: Principal Iranian Intelligence and Security Institutions

Table 2: Formal versus Practical Reporting Relationships

Table 4: Civilian, Military, Police, Judicial, and Ideological Status

Visual 1: Top-Level Organizational Chart

Code snippet graph TD SL\[Supreme Leader\] \--\>|Direct Appointment| IRGC\[IRGC Command\] SL \--\>|Direct Appointment| Judiciary\[Head of Judiciary\] SL \--\>|Direct Appointment| AFGS\[Armed Forces General Staff\] SL \--\>|Veto/Approval| MOIS\[MOIS Minister\]

Pres\[President\] \-.-\>|Nomination| MOIS Pres \--\>|Chairs| SNSC\[Supreme National Security Council\]

IRGC \--\> IRGC\_IO\[IRGC Intelligence Org\] IRGC \--\> QF\[Quds Force\]

MOIS \-.-\>|Reports to| SL IRGC\_IO \-.-\>|Reports to| SL

SNSC \--\>|Coordinates| MOIS SNSC \--\>|Coordinates| AFGS

(Solid lines denote formally confirmed reporting relationships; dotted lines denote assessed or informal influence.)

PART II — Ministry of Intelligence

The Ministry of Intelligence (Vezarat-e Ettela'at Jomhuri-ye Eslami-ye Iran) is the primary civilian intelligence agency of Iran. Its common Persian abbreviation is VAJA. In historical literature and among exile groups, it is frequently referred to as VEVAK, an acronym derived from its earlier name, Vezarat-e Ettela'at va Amniyat-e Keshvar (Ministry of Intelligence and National Security). Modern Western governments and cybersecurity researchers uniformly use the acronym MOIS20. MOIS was officially established in 1984\. Following the 1979 revolution, the intelligence apparatus was chaotic, consisting of various revolutionary committees (Komitehs) and the remnants of the Shah's secret police, SAVAK. The 1984 legislation consolidated these disparate bodies into a formal ministry to impose order21. The legal basis for MOIS uniquely intertwines statecraft with theology. Officially confirmed Iranian law requires that the Minister of Intelligence be a mujtahid—an Islamic cleric possessing the highest level of theological training, qualified to perform ijtihad (independent legal reasoning)22. This ensures that intelligence operations, including lethal covert actions, are guided by Islamic jurisprudence as interpreted by the state. The minister must also possess no partisan political affiliation. While the president nominates the minister, and the parliament conducts confirmation hearings and questioning, the Supreme Leader holds absolute veto power over the appointment22. Following the assassination of Minister Esmaeil Khatib in March 2026, President Pezeshkian appointed Mohammad Mahdi Tabatabaei as the acting head of the ministry3. The domestic responsibilities of MOIS include counterintelligence, counterterrorism, economic security (monitoring systemic corruption and sanctions evasion), and the protection of classified information. It heavily monitors political opposition, labor syndicates, and ethnic minority activists. Its foreign intelligence responsibilities make it Iran's primary civilian espionage service. MOIS stations intelligence officers under diplomatic cover in Iranian embassies worldwide to recruit assets, steal dual-use technology, and conduct covert operations25. It actively monitors the expatriate and diaspora communities, frequently employing coercion against the families of dissidents remaining in Iran. MOIS shares a deeply fraught relationship with the IRGC Intelligence Organization. While MOIS is officially the lead intelligence agency, it frequently loses bureaucratic battles to the IRGC, which operates with greater impunity26. Internal security and vetting within MOIS are rigorous, yet the organization has suffered notable public controversies. The most severe was the 1998 "Chain Murders" scandal, where rogue MOIS elements assassinated dozens of domestic intellectuals27. Public evidence regarding the exact internal directorate structure of MOIS remains highly speculative. While human rights organizations and defectors occasionally name specific departments (e.g., a "Department for Hypocrites" targeting the MEK), these claims lack independent confirmation and are treated with low confidence in this report. The ministry's known strengths include deep institutional memory, linguistic expertise, and sophisticated cyber-espionage capabilities. Its limitations stem from its vulnerability to IRGC political interference and the enduring domestic distrust generated by its history of severe human rights violations.

PART III — IRGC Intelligence Organization

The Islamic Revolutionary Guard Corps Intelligence Organization (Sazman-e Ettela'at-e Sepah) is the paramount political-security organ within Iran, commonly abbreviated as IRGC-IO29. The IRGC has possessed intelligence components since the 1980s, but the IRGC-IO was formally elevated to an independent organization in 2009 under the direct initiative of Supreme Leader Ali Khamenei. This structural reform was a direct response to the 2009 Green Movement protests. The Supreme Leader strongly assessed that MOIS had failed to anticipate or effectively suppress the unrest, necessitating a purely ideological, militarized security apparatus free from civilian governmental oversight29. The IRGC-IO reports nominally through the IRGC Commander, but practically maintains a direct, unfiltered reporting line to the Office of the Supreme Leader. Its primary mission is domestic political security. It views internal dissent not as civic action, but as foreign-backed subversion ("soft war"). It aggressively monitors opposition groups, journalists, dual nationals, and civil society activists, functioning as the ultimate bulwark against internal counterrevolution14. Its foreign-intelligence responsibilities are generally limited to counterespionage and tracking diaspora elements perceived as immediate threats, operating in parallel with its cyber-related responsibilities. The IRGC-IO coordinates heavily with IRGC provincial commands and relies on the Basij paramilitary network for neighborhood-level informants. It also works in tandem with the Quds Force to protect the regime's regional flanks. The IRGC-IO possesses vast investigative and detention authority. Operating in close symbiosis with the Revolutionary Courts, the IRGC-IO manages its own autonomous detention facilities (such as Ward 2A in Evin Prison). Intelligence investigators from the IRGC-IO frequently dictate judicial outcomes, rendering the courts an extension of the security apparatus29. During protests and political crises, the IRGC-IO leads the crackdown, coordinating arrests and internet censorship. The organization's influence has expanded exponentially due to its absolute institutional loyalty to the Supreme Leader and its rigorous ideological screening. Hardline distrust of elected institutions (such as the presidency) drives the Supreme Leader to entrust sensitive political cases to the IRGC-IO rather than MOIS26. The IRGC-IO actively monitors government officials and civilian ministries, further entrenching its supremacy. The deaths of IRGC-IO Chief Mohammad Kazemi in 2025 and his successor Majid Khademi in 2026 due to Israeli airstrikes created significant leadership vacuums, reflecting the acute vulnerability of even this highly protected organization6.

Visual 2: IRGC Intelligence Structure

Code snippet graph TD SL\[Supreme Leader\] \--\> IRGC\CMD\[IRGC Commander\] SL \--\> IRGC\IPO\[IRGC Intelligence Protection Organization\]

IRGC\CMD \--\> IRGC\IO\[IRGC Intelligence Organization\] IRGC\CMD \--\> QF\[Quds Force\] IRGC\CMD \--\> Basij\[Basij Resistance Force\]

IRGC\IO \-.-\>|Informal Direct Reporting| SL IRGC\IPO \-.-\>|Monitors| IRGC\CMD IRGC\IPO \-.-\>|Monitors| IRGC\_IO

PART IV — IRGC Intelligence Protection Organization

The IRGC Intelligence Protection Organization (Sazman-e Hefazat-e Ettela'at-e Sepah), commonly abbreviated as IRGC-IPO, must be explicitly distinguished from the IRGC Intelligence Organization (IRGC-IO). Foreign reporting frequently confuses the two due to translation nuances, but their missions are entirely distinct31. The Iranian concept of "Intelligence Protection" (Hefazat-e Ettela'at) translates practically to internal security and counterintelligence. The IRGC-IPO does not spy on the public, civil society, or foreign governments. Its sole mission is to spy on the IRGC itself. The IRGC-IPO conducts rigorous personnel vetting, administers polygraphs, and surveils commanders to detect infiltration or ideological deviation. It is responsible for protecting classified programs, including the security of commanders, communications networks, and sensitive weapons projects. It coordinates closely with military justice and the Supreme Leader’s representatives embedded within the IRGC to root out corruption or espionage31. The confusion in foreign reporting often stems from personnel overlap; for example, the late Majid Khademi served as the head of the IRGC-IPO before simultaneously taking control of the IRGC-IO6. The merging of external political policing and internal military counterintelligence under a single figure highlighted severe regime paranoia regarding infiltration following the profound security failures of the 2025-2026 conflicts.

PART V — IRGC Quds Force

The IRGC Quds Force (Niru-ye Qods, translating literally as the Jerusalem Force) is officially confirmed as the extraterritorial and unconventional warfare branch of the IRGC10. Commanded by Brigadier General Esmail Qaani, the Quds Force reports directly to the IRGC Commander and the Supreme Leader32. It is a hybrid organization that functions simultaneously as a special operations military command, a covert-action paramilitary agency, and a strategic intelligence service10. Its mission encompasses foreign military assistance, intelligence collection in support of overseas operations, and the cultivation of regional logistical and political networks. The Quds Force trains, equips, and advises foreign armed groups to project Iranian power and establish strategic deterrence against Israel and the United States. Analytical precision requires distinguishing the nature of these relationships:

• Proxies: Groups heavily reliant on and highly responsive to Quds Force directives, offering Iran high operational control (e.g., certain Iraqi Shia militias like Kata'ib Hezbollah).
• Partners/Allies: Groups possessing independent domestic agendas and mass popular support, operating in strategic alignment with Iran but not strictly as subordinates (e.g., Lebanese Hezbollah).
• Supported Armed Groups: Entities receiving weapons and intelligence for shared tactical goals, but retaining complete operational autonomy (e.g., the Houthis in Yemen, Hamas in the Palestinian territories).

The Quds Force maintains a dominant role in Iraq, Syria, and Lebanon, facilitating the movement of advanced munitions. It utilizes Iranian embassies to station intelligence liaisons, frequently resulting in jurisdictional friction with MOIS diplomats10. By substituting conventional military power with intelligence-supported partner warfare, the Quds Force represents the vanguard of Iranian regional strategy.

PART VI — Basij Intelligence and Security Structures

The Basij Resistance Force (Sazman-e Basij-e Mostazafan) is a paramilitary volunteer mobilization force operating under the formal command of the IRGC. The Basij is organized comprehensively at the national, provincial, local, workplace, university, school, and neighborhood levels. Its primary role encompasses ideological mobilization, moral policing, and protest suppression. While not an intelligence agency in the traditional sense, the Basij provides the regime with a pervasive, neighborhood-level surveillance apparatus. Basij bases act as the eyes and ears of the IRGC-IO, providing localized human intelligence (HUMINT) regarding social unrest, illicit behavior, and political dissent. During protests, the Basij coordinates with FARAJA and IRGC provincial commands to identify activists and protect state institutions. It is crucial to distinguish between formal Basij cadres, who receive specialized training and weapons, and ordinary citizens who join simply to secure university admissions or public-sector employment. Not every Basij member performs intelligence work. Furthermore, because local informants are often motivated by ideological zeal, petty local grievances, or economic incentives, Basij intelligence is notoriously noisy. While local social knowledge supports regime security by mapping the geography of dissent, it simultaneously produces a high volume of false reports, political bias, and unreliable intelligence.

PART VII — Regular Armed Forces Intelligence

The intelligence system of the regular Iranian armed forces, known collectively as the Artesh, focuses strictly on conventional military threats. The Armed Forces General Staff (AFGS) oversees the Joint Staff intelligence structures, which integrate reporting from Army, Navy, Air Force, and Air Defense Force intelligence units. These entities conduct operational and battlefield intelligence, foreign military analysis, and strategic warning. The Artesh controls Iran's network of overt military attachés deployed to embassies abroad. It maintains significant capabilities in signals intelligence (SIGINT) and electronic intelligence along Iran's borders and maritime domains33. The Artesh possesses its own Intelligence Protection Organization, completely distinct from intelligence collection or military police. Similar to the IRGC-IPO, the Artesh IPO is tasked with operational security, personnel vetting, and preventing foreign espionage within the conventional military ranks. It operates alongside political-ideological supervisors representing the Supreme Leader. The relationship between the Artesh and the IRGC is characterized by enduring mistrust. The clerical establishment views the Artesh with mild suspicion due to its origins in the Shah's era. Consequently, IRGC intelligence components frequently monitor Artesh commanders. This parallel structure is designed to improve regime resilience by preventing military coups, but it practically creates severe duplication, fragmented intelligence reporting, and intense bureaucratic rivalry33. The February 2026 death of Artesh Commander Abdolrahim Mousavi during foreign airstrikes deeply disrupted the AFGS command structure5.

PART VIII — Law Enforcement Command and Domestic Security

The national police force of Iran recently transitioned its organizational terminology from the Law Enforcement Force (LEF / NAJA) to the Law Enforcement Command of the Islamic Republic of Iran (Farman-dehi-ye Entezami-ye Jomhuri-ye Eslami-ye Iran), abbreviated as FARAJA34. Under the command of Brigadier General Ahmad-Reza Radan, FARAJA operates under the Ministry of Interior but receives operational directives from the AFGS and the Supreme Leader34. FARAJA maintains several components that blur the line between ordinary criminal intelligence and political-security intelligence:

• Public Security Police (PAVA): Monitors guilds, social movements, and public spaces, providing intelligence support for counterterrorism and anti-riot operations.
• Cyber Police (FATA): Polices the domestic internet, investigating cybercrime, financial fraud, and online political dissent.
• Border Guard Command: Manages physical frontier security and immigration intelligence.
• Special Units: Highly trained riot-control forces deployed during domestic uprisings.

FARAJA coordinates closely with MOIS and the IRGC during political crises. In early 2026, FARAJA's infrastructure was heavily targeted by US-Israeli strikes, temporarily crippling urban law-enforcement capabilities36.

Visual 3: Domestic Security Responsibilities

Code snippet graph LR Threat\[Domestic Unrest / Dissent\] Threat \--\> FARAJA\[FARAJA: Riot Control, Cyber Policing\] Threat \--\> Basij\[Basij: Neighborhood Surveillance, Informants\] Threat \--\> IRGC\_IO\[IRGC-IO: Strategic Subversion, High-Value Arrests\] Threat \--\> MOIS\[MOIS: Intercepts, Economic Security\]

FARAJA \--\> Courts\[Revolutionary Courts\] IRGC\_IO \--\> Courts MOIS \--\> Courts

PART IX — Judiciary, Prosecutors, Prisons, and Security Cases

The Iranian intelligence system relies inextricably on the Judiciary to provide a veneer of legality for covert detentions and political repression. Intelligence and security investigations are channeled through the Revolutionary Courts, which possess exclusive jurisdiction over national-security offenses, espionage, and attempts to overthrow the state. General and Revolutionary Prosecutor’s Offices work in tandem with intelligence agencies to authorize warrants for arrests and searches. However, MOIS and IRGC-IO officers frequently bypass formal procedures, conducting preventive arrests without immediate judicial oversight. A defining characteristic of the system is the profound institutional power imbalance between judges and intelligence investigators. In national-security prosecutions, the intelligence file dictates the outcome. Access to independent legal representation is routinely denied during the critical investigative phase. Evidence is highly classified, rendering appeals largely performative. Multilateral human rights organizations conclusively document that the role of confessions is central to Iranian security prosecutions. Intelligence agencies operate autonomous detention facilities (such as Ward 209 in Evin Prison run by MOIS, and Ward 2A run by the IRGC) where coercive interrogation—including solitary confinement and "white torture"—is routinely utilized to extract televised confessions29. Chief Justice Gholam-Hossein Mohseni-Eje'i further expanded judicial warfare in 2026 by authorizing the confiscation of diaspora property for those deemed cooperative with foreign powers37.

PART X — Supreme Leader’s Office and Parallel Oversight

The intelligence-related role of the Office of the Supreme Leader (Bayt-e Rahbari) is paramount. It functions as the ultimate intelligence fusion center and arbiter of interagency disputes. The Supreme Leader does not possess a formal, independent statutory intelligence collection agency. Instead, he relies on a vast network of personal representatives embedded within every military, security, and civilian body. These clerics provide ideological-political supervision and maintain informal intelligence channels that bypass the formal commanders. This parallel reporting ensures the Leader receives unfiltered assessments regarding the loyalty of senior commanders and the security of classified programs. The Bayt manages crisis decision-making and leadership-succession security. By cultivating competing intelligence centers (MOIS vs. IRGC), the Supreme Leader prevents any single service from monopolizing information or posing a coup threat. However, this system relies heavily on the physical presence of the Leader to function. The assassination of Ali Khamenei in February 2026 and the subsequent isolation of Mojtaba Khamenei demonstrated that when the central arbiter is removed, the overlapping agencies collapse into paralyzing factional infighting7.

PART XI — Intelligence Coordination

Iranian law officially confirms the existence of the Council for Intelligence Coordination (CIC) (Shoray-e Hamahangi-ye Ettela'at). Designed to de-conflict the sprawling intelligence apparatus, the CIC integrates the 16 recognized intelligence and security bodies operating within the state26. By statute, the Minister of Intelligence chairs the CIC. The council's legal authority involves assigning collection priorities, establishing information-sharing mechanisms, and producing joint assessments regarding counterterrorism and cyber threats. In practice, the CIC suffers from profound coordination problems. The IRGC-IO frequently ignores CIC directives, viewing MOIS leadership as a civilian intrusion into military-ideological affairs26. While the Supreme National Security Council (SNSC) receives and integrates intelligence at the highest policy level without functioning as a collection agency itself, operational military-civilian information sharing remains highly disjointed.

Table 8: Interagency Overlap and Rivalry

PART XII — Intelligence Disciplines and Capabilities

Iran has developed highly asymmetrical capabilities to offset its conventional military and economic weaknesses.

Table 5: Intelligence Disciplines by Agency

Human Intelligence (HUMINT): Iran possesses deep regional HUMINT capabilities. Relying on shared religious, linguistic, and cultural ties, the IRGC-QF and MOIS embed operatives seamlessly across Iraq, Lebanon, and Syria. However, global HUMINT is weak, heavily reliant on the coercion of the Iranian diaspora and diplomatic cover. Cyber Intelligence (CYBINT): Highly capable at a relatively low cost. Iran utilizes sophisticated spear-phishing, destructive wipers, and ransomware, heavily dependent on private commercial contractors. Signals & Electronic Intelligence (SIGINT/ELINT): Moderate regional capability, focused on electronic warfare and localized intercepts in the Persian Gulf. Known technological limitations force a heavy dependence on commercial Chinese and Russian hardware. Imagery & Geospatial Intelligence (IMINT/GEOINT): Expanding, but highly limited. Iran's indigenous space-launch capabilities provide rudimentary low-resolution IMINT, heavily supplemented by the purchase of commercial satellite imagery. Protective Intelligence: Historically perceived as strong, but publicly documented failures—including the 2025-2026 assassinations of nearly 40 top-tier Iranian commanders—strongly assess a catastrophic, systemic limitation in counter-surveillance and VIP protection4.

PART XIII — Cyber Apparatus

The Iranian cyber apparatus is heavily decentralized, blending government cybersecurity policy with intelligence collection, criminal cyber activity, and influence operations. Operations are divided between the civilian MOIS and the military IRGC, heavily utilizing private contractors, surveillance technology firms, and university-linked groups. Threat-actor labels assigned by cybersecurity vendors (e.g., APT, Sandstorm, Kitten) refer to overlapping technical clusters based on probabilistic attribution, not formal Iranian military units. An "APT" may consist of government officers, university students, and criminal contractors operating interchangeably11.

Table 12: Cyber-Group Aliases and Attribution Confidence

Public Evidence and 2026 Developments: Following the destruction of Iranian telecommunications infrastructure during Operation Epic Fury, IRGC-linked groups like Void Manticore adapted by utilizing Starlink IP ranges to bypass domestic blackouts. They deployed destructive MBR-wiping malware via Group Policy against GCC critical infrastructure and US medical firms (e.g., Stryker Corporation)13. Concurrently, MOIS-linked actors like MuddyWater shifted from commodity PowerShell tools to sophisticated Rust-based payloads (e.g., RustyWater, BugSleep) to maintain persistent espionage access11. Iran routinely denies involvement in offensive cyber operations.

PART XIV — Information Operations and Political Influence

Iran’s information and influence ecosystem integrates covert intelligence with overt public diplomacy to shape regional narratives and undermine adversaries. Distinctions must be made among different activities:

• State Broadcasting & Propaganda: Islamic Republic of Iran Broadcasting (IRIB) acts as the domestic and international mouthpiece, frequently airing forced confessions orchestrated by MOIS and IRGC-IO.
• Religious & Cultural Outreach: Organizations like Al-Mustafa International University provide educational scholarships that function as soft-power tools and, occasionally, as agent-spotting venues for the Quds Force.
• Cyber-Enabled Influence Operations: Hack-and-leak operations (such as those conducted by "Handala Hack") are designed to embarrass adversary governments and stoke social unrest, seamlessly blending technical intrusion with psychological warfare13.
• Support to Aligned Media: The IRGC and MOIS provide financial and logistical support to aligned foreign media outlets across the "Axis of Resistance."

While diplomatic missions and religious foundations promote the regime's ideology, it is analytically inaccurate to describe all Iranian cultural activity as covert influence. Normal diplomacy operates in parallel with intelligence-supported influence.

PART XV — Domestic Surveillance and Regime Security

Domestic survival is the absolute priority of the Iranian intelligence apparatus. The state aggressively monitors perceived internal threats, including political opposition, labor activism, student organizations, journalists, women’s-rights activists (e.g., the "Woman, Life, Freedom" movement), and ethnic/religious minorities. Exiled opposition movements, former government officials, and security-service insiders are tracked with equal intensity45. The architecture of domestic surveillance involves multiple overlapping entities:

• MOIS: Monitors communications, internet traffic, and systemic economic dissent.
• IRGC-IO and Basij: Manage human informant systems and execute high-profile arrests of political dissidents29.
• FARAJA and Cyber Police (FATA): Enforce public morality and monitor online dissent. FARAJA claims to utilize facial recognition and identity databases to enforce the "Noor Plan" (mandatory hijab), though independent technical analysis assesses these claims are frequently exaggerated to instill psychological deterrence34.

Human-Rights Analysis: Capabilities that are independently documented include digital surveillance, deep packet inspection, severe internet throttling during protests, and preventive arrests. Human rights organizations conclusively document severe violations of privacy, freedom of expression, and freedom of association. Due process is systematically denied. The treatment of prisoners involves widespread allegations of torture, forced confessions, and extrajudicial killings. Extraterritorial threats to dissidents demonstrate that the regime views diaspora activism as a primary security threat29.

PART XVI — Foreign Intelligence and Diaspora Activity

Iran’s foreign-intelligence priorities focus heavily on regime preservation and economic survival. Key objectives include monitoring opposition organizations and the Iranian diaspora, acquiring dual-use technology, conducting economic espionage to bypass sanctions, and tracking foreign military/nuclear capabilities. MOIS intelligence officers operating under diplomatic cover utilize Iranian embassies to manage liaison relationships, conduct counterintelligence abroad, and orchestrate covert influence. Overseas Operations and Judicial Findings: European courts have conclusively documented Iranian state terrorism. In a landmark case, MOIS intelligence officer Assadollah Assadi, operating out of the Iranian embassy in Vienna, was arrested in Germany in 2018 for smuggling an explosive device to a proxy couple with the intent to bomb an Iranian opposition rally in Paris46.

• Investigating Authority: Belgian and German judiciaries.
• Outcome: Assadi was convicted in Belgium in 2021 and sentenced to 20 years in prison.
• Iranian Response: Iran vehemently denied the plot, claiming Assadi was a framed diplomat protected by the Vienna Convention46.
• Confidence Assessment: High confidence. Judicial findings conclusively proved the plot. In 2023, Iran secured Assadi's release by exchanging him for a Belgian aid worker illegally held hostage in Tehran, validating the regime's strategy of utilizing hostage diplomacy to extract captured intelligence officers47.

Visual 4: Foreign Intelligence and Regional Responsibilities

Code snippet graph LR HQ\[Supreme Leader / SNSC\] \--\> MOIS\[MOIS Foreign Directorate\] HQ \--\> QF\[IRGC Quds Force\] HQ \--\> Artesh\[Artesh J2\]

MOIS \--\>|Diplomatic Cover| Embassies\[Embassies in Europe/Asia\] MOIS \--\> Diaspora\[Diaspora Monitoring & Assassinations\] MOIS \--\> Tech\[Tech Procurement & Sanctions Evasion\]

QF \--\>|Covert Ops| Levant\[Iraq, Syria, Lebanon\] QF \--\> Partners\[Proxy/Partner Arming & Training\]

Artesh \--\> Attaches\[Overt Military Attaches\]

PART XVII — Regional Intelligence Priorities

Iran's intelligence objectives are heavily shaped by its "Forward Defense" doctrine, which seeks to engage adversaries far from its borders.

• Israel: The primary adversary. Intelligence priorities focus on tracking military capabilities, funding Hamas and Hezbollah, and conducting cyber espionage49.
• United States: Focuses on force posture in CENTCOM, intent, and political dynamics.
• Iraq, Syria, and Lebanon: Vital logistical and political corridors. Iran maintains profound linguistic, cultural, and political access here, successfully integrating intelligence and regional strategy10. However, it faces backlash from local populations weary of militia dominance.
• Yemen: Providing technical intelligence and targeting data to the Houthis.
• Saudi Arabia, UAE, Bahrain: Viewed with intense suspicion. Iran targets their critical infrastructure (energy, transport) with cyber wipers to establish deterrence while seeking diplomatic normalization13.
• Afghanistan and Pakistan: Managing border security, narcotics flows, and militant Sunni groups.
• Russia and China: Managing complex strategic alignments, purchasing military technology, and navigating cyber-cooperation.

PART XVIII — ISRAEL AND COUNTERINTELLIGENCE

The intelligence competition between Iran and Israel defines Middle Eastern security. Israel's Mossad, frequently acting in concert with allied intelligence, has repeatedly demonstrated catastrophic penetrations of Iranian security. Counterintelligence within Iran is the jurisdiction of the IRGC-IPO, MOIS, and Artesh IPO. Their mandate includes the protection of nuclear scientists, military commanders, and sensitive facilities31. The public record reveals severe failures:

• The theft of the nuclear archive (2018).
• High-profile assassinations (e.g., Mohsen Fakhrizadeh in 2020).
• The 2025/2026 Decapitation: The ability of Israel and the US to locate and simultaneously eliminate Ali Khamenei, IRGC Chief Salami (2025), Armed Forces Chief Bagheri (2025), MOIS Chief Khatib (2026), and IRGC-IO/IPO Chief Khademi (2026) inside supposedly secure underground bunkers demonstrates an unprecedented failure of Iranian counterintelligence2.

Repeated high-profile penetrations strongly assess that Iran suffers from a combination of severe structural counterintelligence weakness, pervasive insider threats (human espionage), compartmentation failures, and systemic corruption. The regime's emphasis on politicized security appointments—prioritizing ideological loyalty over professional competence—creates fatal blind spots31.

PART XIX — NUCLEAR, MISSILE, SPACE, AND DEFENSE-INDUSTRIAL SECURITY

Protecting intelligence relating to the nuclear program, ballistic missiles, and unmanned aircraft is the joint responsibility of the IRGC-IPO, MOIS, the Defense Ministry, and the Atomic Energy Organization of Iran. The nuclear program is guarded by specialized IRGC units. Despite profound physical hardening of facilities (e.g., Fordow and Natanz being buried under mountains), the program suffers from acute personnel vulnerability52. Dual-use technology, defense research, and aerospace procurement networks are managed by MOIS and IRGC front companies operating illicitly across Europe and Asia, operating at a strategic level to bypass multilateral sanctions and export controls.

PART XX — ECONOMIC AND FINANCIAL INTELLIGENCE

Because Iran's economy operates under severe multilateral sanctions, intelligence services engage heavily in economic survival tactics. A clear distinction exists between official financial intelligence (focused on anti-money laundering) and state-sponsored economic evasion. The Iranian Financial Intelligence Unit (FIU) is nominally tasked with investigating organized crime and illicit finance. In practice, MOIS and IRGC intelligence components oversee vast smuggling networks, bypassing civilian customs to export oil and import defense procurement materials54. Economic intelligence analysis focuses heavily on monitoring critical infrastructure, labor unrest, and economic protests resulting from inflation. MOIS actively suppresses strikes in the energy and transit sectors, viewing economic dissatisfaction as an immediate national security threat.

PART XXI — INTELLIGENCE TRAINING, RECRUITMENT, AND PROFESSIONAL CULTURE

Iranian intelligence officers are drawn from a heavily vetted, ideologically loyal segment of society.

• MOIS Training: Recruits primarily from seminaries (e.g., the Haqqani School) and trains at the Imam Mohammad Bagher University, a specialized intelligence academy demanding deep theological loyalty, rigorous security clearances, and extensive family background checks21.
• FARAJA Training: Police officers train at Amin Police University, which includes specialized faculties for counter-narcotics, cybercrime, and criminal investigation57.
• IRGC Training: Conducted at Imam Hossein University and internal IRGC academies, emphasizing revolutionary credentials and asymmetric warfare.

Professional Culture: A profound tension exists between professional competence and religious ideology. Loyalty to Velayat-e Faqih frequently overrides objective analytical capability. Institutional rivalry and patronage networks dictate career progression, punishing officers who deliver unwelcome truths while rewarding those who align assessments with hardline political expectations.

PART XXII — LEGAL FRAMEWORK

The intelligence apparatus operates within a veneer of legality that masks profound arbitrary power.

Table 6: Legal Authority by Agency

The laws governing intelligence theoretically require judicial authorization for communications surveillance and arrests. However, the lack of an independent judiciary means that intelligence agencies face no meaningful legal barriers. Budget secrecy ensures that parliamentary powers of ministerial accountability remain strictly superficial.

PART XXIII — OVERSIGHT AND ACCOUNTABILITY

Independent, democratic oversight of Iranian intelligence is non-existent. Accountability is strictly internal and top-down.

Table 7: Oversight Mechanisms

The fact that MOIS is monitored by the IRGC, and the IRGC by the Supreme Leader's representatives, does not constitute oversight; it constitutes "coup-proofing." There is zero budget transparency, no protection for whistleblowers, and no remedy for citizens subjected to unlawful surveillance or detention.

PART XXIV — INSTITUTIONAL RIVALRY AND POLITICIZATION

The friction between MOIS (aligned nominally with the presidency and civilian government) and the IRGC-IO (aligned with the hardline military) is the defining feature of Iranian intelligence. This rivalry involves fierce competition for access to the Supreme Leader, control over lucrative economic sectors, and bureaucratic prestige over foreign operations.

• Negative Impacts: Rival agencies refuse to share information, conduct overlapping arrests, actively sabotage each other's investigations, and attempt to pass the blame following intelligence failures. During the 2026 conflict, President Pezeshkian accused IRGC commanders (notably Ahmad Vahidi) of deliberately wrecking ceasefire efforts and dictating cabinet appointments (blocking his choice for MOIS minister), highlighting extreme politicization9.
• Positive Impacts (for the Regime): The rivalry prevents a unified intelligence community from monopolizing power, thus protecting the Supreme Leader from a potential military coup.

PART XXV — INTELLIGENCE CYCLE

The Iranian intelligence cycle mirrors standard models but is heavily distorted by ideology.

1. Direction and Priority Setting: The SNSC and the Supreme Leader set broad requirements.

2. Collection Planning: The CIC nominally attempts to de-conflict operations.

3. Collection: Executed by MOIS (diplomatic/technical), IRGC-QF (regional partners), and IRGC-IO/Basij (domestic surveillance).

4. Processing: Agencies decrypt, translate, and collate raw data.

5. Analysis: Highly siloed. Ideological filtering occurs heavily here; analysts frequently downplay domestic unrest as "foreign plots" to avoid angering hardline superiors.

6. Production: Drafting of finalized intelligence products.

7. Dissemination: MOIS and the IRGC deliver separate, often contradictory, assessments directly to the Bayt-e Rahbari and the SNSC.

8. Decision Support: The Supreme Leader arbitrates conflicting reports.

9. Feedback & Re-tasking: Driven heavily by regime paranoia and immediate crisis management.

Note: The exact mechanisms by which the Supreme Leader's office reconciles conflicting military and civilian intelligence assessments remain unknown and are based on inference.

Visual 6: Flowchart of the Intelligence Cycle

Code snippet graph TD A\[Direction: Supreme Leader & SNSC set priorities\] \--\> B\[Planning: CIC theoretically de-conflicts\] B \--\> C\[Collection: MOIS / IRGC / Artesh execute\] C \--\> D\[Processing: Raw data collation\] D \--\> E\[Analysis: Filtered through ideological lens\] E \--\> F\[Dissemination: Separate reports sent to Bayt-e Rahbari\] F \--\> G\[Decision Support & Feedback\] G \--\> A

PART XXVI — HISTORICAL DEVELOPMENT

Table 9: Major Historical Reforms

Visual 5: Timeline of Institutional Development

Code snippet timeline title Evolution of Iranian Intelligence 1957 : SAVAK established under Mohammad Reza Shah 1979 : Islamic Revolution; Komitehs take control 1984 : Ministry of Intelligence (MOIS) formally established 1988-1998 : "Chain Murders" of dissidents by MOIS operatives 1999 : MOIS purged; IRGC begins consolidating domestic power 2009 : Green Movement; IRGC-IO formally elevated 2018 : Mossad steals nuclear archive; Assadi arrested 2020 : Quds Force Commander Qasem Soleimani assassinated 2022 : "Woman, Life, Freedom" protests violently suppressed 2025 : "Twelve-Day War"; IRGC/Artesh leadership targeted 2026 : Operation Epic Fury; Decapitation of Supreme Leader and Intel Chiefs

PART XXVII — REQUIRED CASE STUDIES

Case Study 1: Establishment of the Ministry of Intelligence

Background: Post-1979 intelligence was chaotic, run by competing militias and clerics. Institutions involved: Revolutionary Committees, Prime Minister's Office, Parliament. Chronology: In 1983-1984, the government consolidated these bodies into MOIS. Institutional Lessons: The requirement that the minister be a mujtahid ensured clerical control over espionage, permanently embedding theological doctrine into Iranian intelligence tradecraft22. Confidence Assessment: Officially confirmed.

Case Study 2: The Chain Murders

Background: Between 1988 and 1998, over 80 intellectuals and dissidents were murdered27. Institutions involved: MOIS. Chronology: In late 1998, Dariush Forouhar and his wife were brutally stabbed. Following public outcry, reformist President Khatami ordered an investigation. Official Account: MOIS issued an unprecedented statement admitting "rogue agents" led by Deputy Minister Saeed Emami committed the murders. Emami supposedly committed suicide in prison by drinking hair remover28. Independent Evidence: Human rights groups strongly assess the killings were ordered by top regime clerics, making Emami a scapegoat. Institutional Lessons: The scandal crippled MOIS's domestic prestige, allowing the IRGC to seize political security portfolios56. Confidence Assessment: High confidence in MOIS involvement; disputed confidence regarding Emami's suicide.

Case Study 3: Intelligence and the 2009 Green Movement

Background: Disputed election of Mahmoud Ahmadinejad. Institutions involved: MOIS, IRGC, Basij, FARAJA. Chronology: Massive street protests erupted. MOIS struggled to contain the unrest. Institutional Lessons: Supreme Leader Khamenei formally expanded the IRGC Intelligence Organization, shifting the center of gravity for domestic repression permanently from civilian to military hands29. Confidence Assessment: Strongly assessed.

Case Study 4: Protection of the Nuclear Program

Background: Ongoing covert war with Israel over uranium enrichment. Institutions involved: IRGC-IPO, MOIS, Defense Ministry. Chronology: Multiple scientists assassinated (e.g., Fakhrizadeh in 2020); sabotage at Natanz; devastating 2026 bunker-buster strikes on deeply buried sites like Fordow52. Institutional Lessons: The IRGC-IPO's inability to secure classified facilities highlights massive technical and human-intelligence vulnerabilities inside Iran's most guarded zones. Confidence Assessment: High confidence in the failures; unknown mechanisms of exact penetration.

Case Study 5: A Major Iranian Cyber Operation (2026)

Background: Retaliatory cyber operations following the 2026 war. Institutions involved: Void Manticore (Handala Hack), affiliated with MOIS/IRGC CT divisions42. Chronology: March/April 2026\. Handala deployed destructive wipers against GCC infrastructure and US firm Stryker. Evidence: Cybersecurity firms documented MBR-wiping malware pushed via Group Policy42. Institutional Lessons: Iran effectively uses low-cost cyber contractors to impose asymmetric costs on technologically superior adversaries, even while its own physical infrastructure is under bombardment13. Confidence Assessment: Strongly assessed by rigorous cybersecurity telemetry.

Case Study 6: A Foreign Operation Involving Iranian Dissidents

Background: 2018 plot to bomb an MEK opposition rally in Paris. Institutions involved: MOIS Foreign Directorate. Chronology: MOIS officer Assadollah Assadi smuggled a bomb in a diplomatic pouch. He was arrested in Germany, convicted in Belgium (2021) to 20 years, and swapped in 2023 for a Belgian hostage47. Official Iranian Account: Claimed Assadi was a framed diplomat protected by the Vienna Convention. Independent Evidence: Belgian court records conclusively proved MOIS used embassies for terror logistics. Institutional Lessons: Iran views Western legal systems as asymmetrical battlefields, utilizing hostage diplomacy to extract captured intelligence officers. Confidence Assessment: Officially confirmed via European judicial findings.

Case Study 7: Intelligence and a Domestic Protest Movement (2022)

Background: Death of Mahsa Amini in FARAJA custody sparked the "Woman, Life, Freedom" movement. Institutions involved: FARAJA, IRGC-IO, Basij. Chronology: Widespread riots. State security utilized live ammunition, mass detentions, and digital surveillance to crush the movement34. Institutional Lessons: The state's reliance on coercive violence shattered its remaining domestic legitimacy, shifting the security apparatus into an indefinite "war footing" against its own citizens37. Confidence Assessment: Confirmed by multiple independent sources.

Case Study 8: A Major Counterintelligence Failure (Epic Fury 2026\)

Background: Feb-March 2026 US/Israeli airstrikes. Institutions involved: IRGC-IPO, AFGS, MOIS. Chronology: Strikes accurately eliminated Supreme Leader Ali Khamenei, IRGC Chief, MOIS Chief, and Artesh commanders simultaneously1. Institutional Lessons: The pinpoint accuracy of the strikes strongly assesses massive internal compromise. IRGC-IPO failed to protect the state's highest apex, demonstrating that ideological vetting cannot substitute for professional counterintelligence. Confidence Assessment: High confidence regarding the deaths; mechanisms of intelligence compromise remain unknown.

PART XXVIII — STRENGTHS

Deep Regional Networks: Quds Force cultural and linguistic integration in Iraq, Lebanon, and Syria allows Iran to project power far beyond its borders without committing conventional forces10. Cyber Asymmetry: Iran is highly capable of disruptive wiper and ransomware attacks at a fraction of the cost of conventional arms. The agility of its cyber contractors is formidable11. Redundant Organizational Resilience: The parallel structure ensured that even after the total decapitation of leadership in 2026, the institutions continued to function, suppress dissent, and execute cyber operations38. Integration of Intelligence and Strategy: The seamless blend of intelligence collection, proxy arming, and diplomatic leverage allows Iran a high tolerance for long-term competition.

PART XXIX — WEAKNESSES

Catastrophic Counterintelligence Failures: The targeted killings of the Supreme Leader, nuclear scientists, and intelligence chiefs strongly assess massive foreign penetration and insider threats4. Rampant Politicization: Ideological filtering ensures that analysts fear delivering unwelcome assessments. Promotion relies on patronage and revolutionary credentials rather than technical expertise. Institutional Rivalry: Poor interagency coordination between MOIS and IRGC leads to duplication, wasted resources, and fatal security blind spots26. Domestic Legitimacy Crisis: The state's total reliance on coercive reporting and violent suppression drains intelligence resources away from foreign threats to focus on ordinary citizens, breeding massive domestic resentment37.

Table 15: Intelligence Strengths and Weaknesses

PART XXX — COMPARATIVE ANALYSIS

At the institutional level, Iran's intelligence system is uniquely fractured compared to other major powers.

• Versus the United States: US intelligence is highly professionalized, legally constrained by civilian oversight, and globally deployed. Iranian intelligence is heavily domestic, politically weaponized by the military (IRGC), and relies on regional militias rather than global technical infrastructure.
• Versus Israel: Israel's Mossad and Shin Bet exhibit highly unified, technologically advanced collection capabilities. Iran’s system is less technologically sophisticated but leverages massive human mass (Basij) and deniable regional proxies.
• Versus Russia: Both utilize brutal domestic suppression and conduct assassinations abroad. However, Russia's FSB/SVR exhibit a relatively unified command under the executive, whereas Iran maintains the intentionally fractured MOIS/IRGC system.
• Versus China: China relies on ubiquitous, highly centralized, high-tech digital panopticons. Iran aspires to this (e.g., facial recognition claims by FARAJA), but lacks the domestic technological base, relying more on low-tech informants and brute force34.
• Versus Saudi Arabia & Turkey: Both maintain centralized intelligence directorates heavily loyal to the head of state. Iran’s dual civilian-military (MOIS-IRGC) split is singular in the region.

PART XXXI — FUTURE INDICATORS

Ten critical developments to monitor over the next five years:

1. Status of Mojtaba Khamenei: Whether he emerges publicly to assert control, or remains a figurehead sidelined by an IRGC military junta8.

2. IRGC-IO vs. MOIS Balance: Whether the IRGC entirely absorbs MOIS functions following the wartime chaos, eliminating the last vestige of civilian intelligence.

3. Cyber Escalation: The increasing integration of artificial intelligence in Iranian phishing, malware generation, and automated influence operations11.

4. Nuclear Reconstitution Security: How the IRGC-IPO secures deeply buried sites (e.g., "Pickaxe Mountain") and scientist communications after the devastating 2026 strikes53.

5. Hostage Diplomacy: Increased seizures of dual nationals by MOIS to deter Western sanctions and orchestrate prisoner swaps47.

6. FARAJA's Biometric Enforcement: The extent to which facial recognition actually functions in enforcing the "Noor Plan," versus serving merely as psychological intimidation34.

7. Artesh Subjugation: Whether the IRGC completely subsumes the regular military command structure following the death of AFGS Chief Mousavi.

8. Regional Partner Autonomy: Whether groups like Hezbollah and the Houthis act with increasing independence due to Iranian leadership paralysis32.

9. Counterintelligence Purges: Mass arrests and executions within the IRGC to root out the moles responsible for the 2026 decapitation37.

10. Russian/Chinese Tech Reliance: Iran's increasing dependence on Eastern bloc surveillance and SIGINT hardware due to Western sanctions.

Table 14: Current Leaders (Verified as of July 20, 2026\)

MYTHS VERSUS REALITY

• Myth: MOIS controls all Iranian intelligence activity. Reality: The IRGC-IO is frequently more powerful domestically and operates with total impunity29.
• Myth: The Quds Force is simply Iran’s equivalent of the CIA. Reality: It functions more as a hybrid of the CIA, US Special Operations Command, and a militant diplomatic corps10.
• Myth: Every Iranian cyber group is a formal government unit. Reality: Many are private contractors or university syndicates directed by state organs40.
• Myth: MOIS and IRGC Intelligence never cooperate. Reality: While rivals, they coordinate heavily during acute existential crises (e.g., suppressing nationwide riots).
• Myth: Iran’s security services are either completely incompetent or nearly omnipotent. Reality: They are highly capable asymmetrically (cyber/proxies) but suffer from crippling corruption and catastrophic counterintelligence blind spots4.
• Myth: Every regional armed group supported by Iran is directly controlled by Tehran. Reality: Groups like Hezbollah are partners with immense local autonomy, not mere puppets10.
• Myth: All Basij members are trained intelligence officers. Reality: Most are ideological volunteers providing low-level, noisy informant data.
• Myth: Parliament has no formal intelligence-related role whatsoever. Reality: It nominally approves the MOIS budget and minister, though it lacks operational oversight.
• Myth: The Supreme Leader personally manages every operation. Reality: He relies on competing factions and sets broad policy; his recent absence shows the system runs on brutal bureaucratic inertia8.
• Myth: Every arrest for espionage proves that espionage occurred. Reality: Due process is absent; confessions are almost always extracted via coercion to fit regime narratives29.
• Myth: Every foreign attribution of a cyberattack is conclusively proven. Reality: Attribution relies on probabilistic modeling of tactics and infrastructure.
• Myth: Every Iranian denial is automatically false. Reality: While frequently deceptive, Iran occasionally denies operations legitimately conducted by rogue actors or highly autonomous proxies.

UNRESOLVED QUESTIONS

• Exact Internal Directorates of MOIS: The precise, current organizational chart of MOIS remains completely opaque to public-source analysis21.
• Division of Labor Overseas: The exact jurisdictional boundaries between MOIS diplomatic stations and IRGC Intelligence operations abroad remain murky.
• Reconciling Competing Assessments: How the Supreme Leader's office practically reconciles contradictory intelligence reports from MOIS and the IRGC remains unverified.
• Quds Force Independence: The degree of independent tactical authority exercised by the Quds Force versus direct orders from the SNSC.
• Cyber Contractor Involvement: The exact financial and organizational division of labor between IRGC cyber commanders and private Iranian hacker networks.
• Counterintelligence Announcements: The reliability of Iranian announcements regarding the capture of "Zionist spy rings" is unknown; many are assessed to be internal political purges framed as counterespionage.
• Extent of Foreign Penetration: How high up the Israeli/US human intelligence networks reached within the IRGC-IPO to facilitate the 2026 decapitation strikes4.
• Leadership Succession Security: The exact intelligence and security arrangements currently shielding Mojtaba Khamenei from both foreign strikes and internal coups12.

Table 13: Confirmed Facts versus Disputed Claims

PERSIAN TERMINOLOGY GLOSSARY

• Artesh: Regular Armed Forces.
• Basij: Paramilitary volunteer mobilization force.
• Bayt-e Rahbari: Office of the Supreme Leader.
• FARAJA: Law Enforcement Command (Police).
• Ijtihad: Independent Islamic legal reasoning.
• IRGC (Sepah): Islamic Revolutionary Guard Corps.
• Mujtahid: A cleric qualified in Ijtihad. Legally required for the MOIS Minister.
• Sazman-e Ettela'at: Intelligence Organization.
• Sazman-e Hefazat-e Ettela'at: Intelligence Protection Organization (Counterintelligence).
• Velayat-e Faqih: Guardianship of the Islamic Jurist (Iran's foundational theocratic doctrine).

SOURCE-QUALITY APPENDIX

This report relies on a diverse array of public sources, prioritized to mitigate the inherent bias of state-controlled media and opposition claims.

Table 16: Evaluation of Key Source Categories

Works cited

1. 2026 Iran war \- Wikipedia, https://en.wikipedia.org/wiki/2026\Iran\_war

2. 2026 Iran war | Deal, Explained, United States, Israel, Strait of Hormuz, Map, & Conflict, https://www.britannica.com/event/2026-Iran-war

3. Esmaeil Khatib \- Wikipedia, https://en.wikipedia.org/wiki/Esmaeil\_Khatib

4. List of Iranian officials killed during the 2026 Iran war \- Wikipedia, https://en.wikipedia.org/wiki/List\of\Iranian\officials\killed\during\the\2026\Iran\_war

5. Who are the new Iranian military chiefs appointed after Israeli assassinations?, https://today.lorientlejour.com/article/1464464/who-are-the-new-iranian-military-chiefs-appointed-after-assassination-of-irgc-commander-and-armed-forces-chief-in-israeli-strike.html

6. Majid Khademi \- Wikipedia, https://en.wikipedia.org/wiki/Majid\_Khademi

7. Mojtaba Khamenei \- Wikipedia, https://en.wikipedia.org/wiki/Mojtaba\_Khamenei

8. Saudi outlet, citing Israeli source, claims new supreme leader Mojtaba Khamenei 'not in Iran', https://www.timesofisrael.com/liveblog\_entry/saudi-outlet-citing-israeli-source-claims-new-supreme-leader-not-in-iran/

9. Ahmad Vahidi \- Wikipedia, https://en.wikipedia.org/wiki/Ahmad\_Vahidi

10. Quds Force \- Wikipedia, https://en.wikipedia.org/wiki/Quds\_Force

11. The Iranian Cyber Capability 2026 \- Trellix, https://www.trellix.com/blogs/research/the-iranian-cyber-capability-2026/

12. 'Not in Iran': Israeli source says supreme leader absent as internal power struggle deepens, https://timesofindia.indiatimes.com/world/middle-east/not-in-iran-israeli-source-says-supreme-leader-absent-as-internal-power-struggle-deepens/articleshow/132497130.cms

13. Handala Claims Destructive Wiper Attack on GCC Nation's Critical Infrastructure \- Hive Pro, https://www.hivepro.com/threat-advisory/handala-claims-destructive-wiper-attack-on-gcc-nations-critical-infrastructure

14. Who was Majid Khademi, and why does his killing matter? | Iran International, https://www.iranintl.com/en/202604065378

15. Iran’s Supreme Leader Is Missing... The Guards Are Not., https://alhurra.com/en/27955

16. Supreme National Security Council \- Wikipedia, https://en.wikipedia.org/wiki/Supreme\National\Security\_Council

17. Supreme National Security Council (SNSC) \- United Against Nuclear Iran | UANI, https://www.unitedagainstnucleariran.com/government-institution/supreme-national-security-council-snsc

18. General Staff of the Armed Forces of the Islamic Republic of Iran \- Military Wiki \- Fandom, https://military-history.fandom.com/wiki/General\Staff\of\the\Armed\Forces\of\the\Islamic\Republic\of\_Iran

19. General Staff of the Armed Forces of the Islamic Republic of Iran \- Wikipedia, https://en.wikipedia.org/wiki/General\Staff\of\the\Armed\Forces\of\the\Islamic\Republic\of\_Iran

20. Ministry of Intelligence (Iran) \- Wikipedia, https://en.wikipedia.org/wiki/Ministry\of\Intelligence\_(Iran))

21. Iran's Ministry of Intelligence and Security (MOIS) \- Grey Dynamics, https://greydynamics.com/irans-ministry-of-intelligence-and-security-mois/

22. Offices in Iran Required Being a Mujtahid \- İRAM Center, https://iramcenter.org/en/offices-in-iran-required-being-a-mujtahid\_en-689

23. Ijtihad \- Wikipedia, https://en.wikipedia.org/wiki/Ijtihad

24. Iran's President Appoints Caretaker Minister of Intelligence \- Politics news, https://www.tasnimnews.ir/en/news/2026/03/22/3546908/iran-s-president-appoints-caretaker-minister-of-intelligence

25. Full article: The Islamic Republic of Iran's Use of Diplomats in Its Intelligence and Terrorist Operations against Dissidents: The Case of Assadollah Assadi \- Taylor & Francis, https://www.tandfonline.com/doi/full/10.1080/08850607.2023.2295205

26. Iranian Ministry of Intelligence \- Grey Dynamics, https://greydynamics.com/iranian-ministry-of-intelligence/

27. Chain murders of Iran \- Wikipedia, https://en.wikipedia.org/wiki/Chain\murders\of\_Iran

28. Iran's Malign Intelligence Activities | UANI, https://www.unitedagainstnucleariran.com/irans-malign-intelligence-activities

29. Intelligence Organization of the Islamic Revolutionary Guard Corps \- Wikipedia, https://en.wikipedia.org/wiki/Intelligence\Organization\of\the\Islamic\Revolutionary\Guard\_Corps

30. Mohammad Kazemi \- Wikipedia, https://en.wikipedia.org/wiki/Mohammad\_Kazemi

31. US rescue inside Iran opens debate over war's next phase, https://www.iranintl.com/en/202604063967

32. Iran Quds Force commander Qaani reappears, says 'axis of resistance' emerged stronger during war \- Anadolu Ajansı, https://www.aa.com.tr/en/us-israel-iran-war/iran-quds-force-commander-qaani-reappears-says-axis-of-resistance-emerged-stronger-during-war/3968112

33. Artesh \- United Against Nuclear Iran | UANI, https://www.unitedagainstnucleariran.com/government-institution/artesh

34. Ahmad-Reza Radan \- Spreading Justice, https://spreadingjustice.org/individual-violator/sj09492/

35. Police Command of the Islamic Republic of Iran \- Wikipedia, https://en.wikipedia.org/wiki/Police\Command\of\the\Islamic\Republic\of\_Iran

36. Why have the US and Israel bombed more than 75 Iranian police facilities? \- Al Jazeera, https://www.aljazeera.com/news/2026/3/30/why-have-the-us-and-israel-bombed-more-than-75-iranian-police-facilities

37. War Footing in Courts and Streets of Iran: Strategy of "Maximum Elimination" \- Iran HRM, https://iran-hrm.com/2026/03/24/war-footing-in-courts-and-streets-of-iran-the-islamic-republics-strategy-of-maximum-elimination-on-the-eve-of-the-iranian-new-year/

38. Iran in the Aftermath of the Twelve-Day War \- Giga- Hamburg, https://www.giga-hamburg.de/publications/giga-focus/iran-in-the-aftermath-of-the-twelve-day-war

39. Council for Intelligence Coordination \- Wikipedia, https://en.wikipedia.org/wiki/Council\for\Intelligence\_Coordination

40. THREAT RESEARCH: IRAN 2026 THREAT POSTURE ASSESSMENT \- Augur Security, https://www.augursecurity.com/post/threat-research-iran-2026-threat-posture-assessment

41. Iranian Advanced Persistent Threats \- Horizon3.ai, https://horizon3.ai/wp-content/uploads/2026/03/Iranian\APT\TTP\Report\_2026.pdf

42. “Handala Hack” \- Unveiling Group's Modus Operandi \- Check Point Research, https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/

43. LevelBlue SpiderLabs Breaks Down the Role of Cyber Operations Taken in the Iran Crisis, https://www.levelblue.com/blogs/spiderlabs-blog/levelblue-spiderlabs-breaks-down-the-role-of-cyber-operations-taken-in-the-iran-crisis

44. Pre-Positioned Access: The Cyber Threat Behind the Iran Conflict \- Centripetal, https://www.centripetal.ai/threat-research/pre-positioned-access-cyber-threat-iran-conflict

45. Iran Is Ready for Change in Protest of Mass Atrocity Crimes \- Medium, https://carolruthweber.medium.com/iran-is-ready-for-change-in-protest-of-mass-atrocity-crimes-1b1e0ae4eced

46. Asadollah Asadi \- Wikipedia, https://en.wikipedia.org/wiki/Asadollah\_Asadi

47. Iranian Convicted Of Terrorism Exchanged With Belgian Hostage In Oman, https://www.iranintl.com/en/202305268884

48. Iran, Belgium conduct prisoner swap freeing aid worker, diplomat | News \- Al Jazeera, https://www.aljazeera.com/news/2023/5/26/iran-frees-jailed-belgian-aid-worker

49. Iran in crisis: the landscape after the Twelve-Day War | OSW Centre for Eastern Studies, https://www.osw.waw.pl/en/publikacje/osw-commentary/2025-12-18/iran-crisis-landscape-after-twelve-day-war

50. Israeli airstrikes eliminate senior Iranian military officials \- FDD's Long War Journal, https://www.longwarjournal.org/archives/2025/06/israeli-airstrikes-eliminate-senior-iranian-military-officials.php

51. Humiliation and Transformation: The Islamic Republic After the 12-Day War, https://www.fpri.org/article/2025/10/humiliation-and-transformation-the-islamic-republic-after-the-12-day-war/

52. Iran in the Box: The Coercive Architecture of the 2026 Iran War and Its Strategic Implications, https://smallwarsjournal.com/2026/03/30/iran-in-the-box/

53. US is bombing Iran at the heaviest rate since start of the war and leaning toward expanding operations further, https://www.washingtonexaminer.com/daily-on-defense/4650978/us-bombing-iran-heaviest-rate-since-war-leaning-toward-expanding-operations/

54. 2026 Iran war ceasefire \- Wikipedia, https://en.wikipedia.org/wiki/2026\Iran\war\_ceasefire

55. (PDF) Iran's Intelligence Organizations and Transnational Suppression The Washington Institute \- ResearchGate, https://www.researchgate.net/publication/356904636\Iran's\Intelligence\Organizations\and\Transnational\Suppression\The\Washington\_Institute

56. Iran's Intelligence Organizations and Transnational Suppression | The Washington Institute, https://www.washingtoninstitute.org/policy-analysis/irans-intelligence-organizations-and-transnational-suppression

57. Forgotten Behind Closed Doors: Iran Must be Held to Account for the Mass Execution of Alleged Drug Offenders \- Abdorrahman Boroumand Center, https://www.iranrights.org/newsletter/issue/164

58. Police Technologies in Combating the Fentanyl Crisis: Challenges and Strategies, https://jpmed.ir/article-1-1272-en.pdf

59. Iran's president says Guards commanders are wrecking ceasefire chances, https://www.iranintl.com/en/202604074692

60. Saeed Emami \- Wikipedia, https://en.wikipedia.org/wiki/Saeed\_Emami

61. Belgium's Shameful and Dangerous Deal with Iran \- International Institute for Counter-Terrorism, https://ict.org.il/wp-content/uploads/2023/05/Karmon\Belgium-Deal-with-Iran\2023\05\_30.pdf

62. IRGC Quds Force chief Qaani warns US, Israel against escalation in Gaza, Lebanon, https://www.jpost.com/middle-east/article-898148

63. Operation Epic Fury | U.S. Department of War, https://www.war.gov/Spotlights/Operation-Epic-Fury/

64. Treasury Sanctions Iranian Regime Officials for Violent Repression and Corruption, https://home.treasury.gov/news/press-releases/sb0375

65. Qaani warns Israel of 'another 2000' if it remains in southern Lebanon | Iran International, https://www.iranintl.com/en/202606213412

Memory References

• International Coverage
• Regional Intelligence Atlas
• International Fairness
• Memory operating model
• Long-term memory pointer ledger

Related Durable Documents

• Long-term memory index
• Split-memory architecture

Supersession Status

Current canonical research report. It supports design and research routing but does not override explicit repository instructions, verified implementation, tests, or active .uai current-state records. Review status and truth boundaries are recorded in the pointer ledger.