Analysis: Unpacking Iran’s counterintelligence apparatus

Iran intelligence agent wanted poster
The FBI’s Persian-language wanted poster for Ahmad Khazai, Iran’s former counterintelligence deputy in its Ministry of Intelligence.

The Federal Bureau of Investigation (FBI) recently issued “seeking information” posters for two operatives of the Islamic Republic’s intelligence services implicated in the 2007 abduction of retired FBI agent Robert Levinson on Iran’s Kish Island.

The FBI identified Ahmad Khazai and Mohammad Baseri—officials of Iran’s Ministry of Intelligence (MOI), also known as MOIS—as those responsible for Levinson’s kidnapping. At the time, Baseri headed the US team within the MOI’s counterintelligence department, while Khazai served as the deputy head of counterintelligence. Khazai, who holds the clerical title Hojjat al Eslam, was dismissed from his position in 2009 and now leads the Institute for Political Studies and Research at MOI. The US Treasury Department sanctioned both men in 2020 for orchestrating Levinson’s abduction.

Levinson’s case reflects Tehran’s broader strategy of transnational repression, carried out by a network of competing yet cooperating factions. Over the last decade, Iran has built an infrastructure for assassinations and kidnappings worldwide that is executed by the Islamic Revolutionary Guard Corps (IRGC) and the MOI. Different offices within the two organizations operate in the same domains with similar objectives, leading to a dynamic of both collaboration and competition.

The IRGC and the MOI are active in the United Arab Emirates, which has become a significant target for Iran’s covert operations. The MOI has been linked to the 2020 abduction of Iranian dissident Jamshid Sharmahd in Dubai, with the ministry claiming responsibility for the “complex operation.” Meanwhile, the IRGC is implicated in the 2013 disappearance of Abbas Yazdi, who was previously detained and interrogated by the Guards. The UAE has also been the site of attempted operations against Israeli targets, such as the foiled plot to kidnap an Israeli businessman in January and the killing of an Israeli rabbi by an Uzbek gang with Iranian ties.

Turkey has also become a key theater for Iranian intelligence operations, with both the IRGC and the MOI actively targeting adversaries. In 2024, the IRGC unsuccessfully attempted to lure an Iranian-Israeli journalist into Turkey but succeeded in abducting another journalist, Mohammad Bagher Moradi, and smuggling him back to Iran. Similarly, in 2020, MOI operatives kidnapped the former leader of an Iranian Arab separatist movement, later announcing he was in their custody.

Tehran’s intelligence strategy in Israel, spearheaded by the IRGC and the MOI, is a complex and coordinated effort that blends cyberwarfare with traditional human intelligence operations. In late 2024, Israel reported an “unprecedented” number of espionage attacks orchestrated by Tehran. The Cyber Electronic Command of the IRGC and the MOI focus on cyber-attacks, phishing campaigns, and intelligence gathering, while the IRGC Intelligence Organization specializes in analyzing and collecting information. Successfully executing these operations requires the collaboration of at least three IRGC divisions and two MOI units, highlighting the depth and intricacy of Iran’s intelligence coordination against Israel.

Iran’s involvement in the US is not new, but recent developments have brought it into sharper focus. The US Justice Department revealed that the IRGC orchestrated an assassination attempt against former President Donald Trump while he was on the 2024 campaign trail, and the MOI was implicated in a foiled 2021 abduction attempt targeting Iranian-American journalist Masih Alinejad.

Overlapping intelligence structures

The MOI and IRGC’s intelligence branches ultimately report to Iranian Supreme Leader Ali Khamenei, operating under his direct authority. Specifically, the IRGC commander, the IRGC Quds Force (IRGC-QF) commander, and the intelligence minister all answer directly to the supreme leader. Alongside the MOI, Iran’s intelligence network includes the IRGC Intelligence Organization and IRGC-QF—the latter responsible for Iran’s extraterritorial military and intelligence operations. However, the lack of a clear delineation of responsibilities between these entities has led to significant bureaucratic friction.

While the IRGC and MOI collaborate on foreign intelligence operations, they frequently clash over domestic security matters. The assassination of former Hamas Political Chief Ismail Haniyeh in Tehran exposed these tensions, as the IRGC’s Intelligence Organization took control of the investigation, barring the MOI from involvement. Conflicting narratives about how the attack occurred—whether through an internal security breach or an external strike—further underscored the rivalries and blame-shifting between the regime’s intelligence agencies.

The MOI’s expansive role

While the MOI primarily oversees domestic intelligence and counterintelligence, it remains deeply involved in foreign operations, particularly in gathering intelligence on Iranian opposition groups and neutralizing perceived threats to the regime.

The MOI remains a central player in Iran’s global intelligence efforts, boasting 15 directorates covering security, counterintelligence, foreign operations, strategic affairs, and economic activities. It has specific offices dedicated to intelligence collection in Europe, Africa, the Americas, the Middle East, Israel/Palestine, and Asia. Most Iranian foreign officers and diplomats have ties to the MOI or IRGC, with embassies frequently serving as hubs for espionage, logistical coordination, and intelligence gathering. MOI and Quds Force operatives routinely exploit diplomatic cover using embassies, cultural centers, and charities to facilitate operations.

The Quds Force

The Quds Force functions as Iran’s external intelligence and covert operations arm, with responsibilities ranging from managing proxy militias to conducting assassinations, kidnappings, and sabotage operations abroad. It works closely with the MOI in several key areas, including infiltrating opposition groups, creating terrorist and paramilitary networks, countering foreign intelligence threats, running disinformation campaigns, and acquiring advanced technology for Iran’s military-industrial complex.

Structurally, the Quds Force is divided into specialized branches, each handling intelligence, finance, foreign languages, sabotage, and special operations. Its regional focus is categorized into eight regions: Europe and North America, former Soviet states, Iraq, Turkey, the Levant, the Arabian Peninsula, South Asia, and North Africa.

Janatan Sayeh is a research analyst at the Foundation for Defense of Democracies focused on Iranian domestic affairs and the Islamic Republic’s regional malign influence.

Tags: , , , , ,

Iraq

Islamic state

Syria

Aqap

Al shabaab

Boko Haram

Isis