After the ceasefire that ended Israel’s 12-day war against Iran, Iranian officials were stunned by the sophistication of the Mossad’s operation and alarmed by the revelation of where the security breach had occurred.
Despite mounting evidence of a high-level intelligence breach, some Iranian officials deflected blame by targeting a French journalist named Catherine Shakdam. In an interview with state media, Mostafa Kavakebian, a former member of the Iranian parliament, said “the breach came from Catherine Shakdam, an Israeli spy, who shared her bed with 120 officials in the country.” Javad Zarif, a former foreign minister, added: “We need to understand how Catherine Shakdam infiltrated the country.”
For the record, Shakdam, a Jew who converted to Islam, traveled to Iran in 2017 for less than a month. She interviewed candidate Ebrahim Raisi, wrote several articles for the supreme leader’s website, took photos with the daughters of two military men assassinated by Israel -- Emad Mughniyeh, Hezbollah’s chief of staff and Qasem Soleimani, commander of the Quds Force -- and participated in a conference about Palestine. She now identifies as a Zionist and a Jew.
Aside from Kavakebian’s allegations of Shakdam’s espionage activities, a range of speculation went farther and stranger on who was responsible for helping the Israelis. Abullah Ganji, an Iranian conservative activist, posted on X, “After the recent war, a few sheets of paper were found on the streets of Tehran containing talismans with Jewish symbols." Meanwhile, a senior Iranian official accused Jerusalem of using "the occult and supernatural spirits" during its military operation.
Indeed, Iran security intelligence -- including Vezarat–e–Ettelaat (the Ministry of Intelligence) and Ettelaat–e –Sepah, (the Intelligence Department of the IRGC) -- was caught off guard and suffered extensive, system-wide damage. At least 30 IRGC senior commanders were killed during the Israeli strikes, three core nuclear sites were destroyed, along with major IRGC infrastructure, and what remained of Iran's air defense systems after Israeli strikes in October of last year. To date -- Operation Rising Lion is the largest failure experienced by Tehran's intelligence apparatus since the 1979 Islamic Revolution.
As the Iranian security apparatus grappled with the embarrassment and internal breach, one question continued to resonate, among the public. Who is aiding Israeli intelligence from within Iran?
While some blame the occult and Shakdam, the security forces have largely scapegoated four groups: Kurds, Baluch, Azerbaijanis, and Afghan refugees.
The Kurdish Connection
Historically, the Iranian regime has perceived its Kurdish citizens as separatists aligned with Israel’s strategic interests, particularly the push for Kurdish independence -- a movement Tehran fears could destabilize its western borders. Iranian authorities suspect that the Mossad maintains covert cells within Kurdistan, capable of facilitating intelligence operations inside Iran.
Immediately following Operation Rising Lion, Kurdish forces intercepted a drone launched at the Erbil airport by an Iranian proxy. On July 15 and 16, drone attacks targeted Kurdistan Regional Government (KRG) oilfields, with suspicions falling on pro-Iranian militias.
Hengaw, a Norwegian-based Kurdish human rights organization, says Iranian security forces have already arrested more than 140 Kurds for aiding Israel during the 12-day war. These arrests have likely increased since.
Targeting Iraqi Kurdistan is just as much about Iran's Kurdish minority population as Erbil's relations with Washington. The regime remains deeply uneasy about the U.S. presence in northern Iraq, viewing it as a potential threat to its national security and regional influence. The U.S.’s largest consulate in the world is in Erbil, the capital of the Kurdistan Region of Iraq.
Attacks on the KRG are not without precedent. In 2023, Iran launched ten ballistic missile toward Erbil, in response to the 2023 killing of Sayed Razi Mosavi, the commander of the Quds Force in Syria, in an Israeli airstrike. The missile strikes killed prominent businessman Peshraw Dizayee, his daughter, Karam Mikhail, and three other people. The IRGC justified the attack, saying Iran had targeted a “Mossad espionage center.”
In 2020, Iranian security forces arrested three Kurdish Iranians after the assassination of Mohsen Fakhrizadeh, an Iranian nuclear physicist and chief of Iran’s nuclear program. He was reportedly killed in a road ambush by an autonomous satellite-operated gun. In June, the three men were executed for killing Fakhrizadeh as part of a crackdown on Israeli spies.
Baluchistan under Fire
The Baluch make up the majority of Iran's poorest province -- Sistan and Baluchistan. For decades, Baluch separatists have been waging a low-intensity insurgency against Tehran that claims the lives of security forces on a monthly basis. During the 2022 Women, Life, Freedom protests, Zahedan—the capital of the region—witnessed the deadliest crackdown, with security forces killing over 100 people.
On July 1, the IRGC launched a “counterterrorism” operation in the Baluch-majority province of Sistan-Baluchistan, claiming to target “mercenaries of the Zionist regime”—despite no Israeli operations taking place in the region.
Azerbaijanis as Alleged Operatives
Iranian officials have historically portrayed Azerbaijan as a close ally of Israel, suggesting that that its neighbor serves as a strategic sanctuary for Israeli operations. Authorities have accused Iranian-Azerbaijanis -- Iran’s largest minority of some 30 million inhabitants-- of working for the Mossad during the 12-day war. More than 90 have been arrested for cooperating with Israel, according to Hengaw.
Iranian officials also claim that Israeli drones were launched from Azerbaijan. Notably, the Khorasan newspaper, an outlet linked to the office of Iran’s Supreme Leader, noted that “a collection of reports, field evidence, and credible speculations” indicates that Baku assisted Israel in conducting its attack against Iran.
Refugees Turned Suspects
For the first time, Iranian authorities have alleged that Afghan refugees – most of whom fled to Iran following the collapse of the U.S.-backed government in 2021-- are connected to the Mossad and assisted in the attacks on such sensitive sites as the nuclear facilities. Amid Israel’s recent operations inside Iran, the Iranian government issued an order for Afghan refugees to leave the country by July 6. Since January, around 1.4 million Afghans have been deported, with around 500,000 of those deportations following the 12 Day War.
Following Israel’s strike, Iran arrested Afghan refugees and blamed them for surveillance and building drones to target Iranian facilities. Tasnim, the Iranian news agency, released a video, claiming Iranian police found a small drone factory in Shahr-e-Rey, in southern Tehran, a neighborhood with a significant population of Afghan refugees. Moreover, Iranian security officials claimed that they arrested an Afghan university student who had files on making bombs and drones on his cellphone, accusing him of assisting Israeli drone strikes.
In 2021, a surge of anti-Afghan rhetoric flooded social media, fueled by misinformation and disinformation. The campaign centered around the Farsi hashtag of “Deportation of Afghans, National Demand.” Notably, these X accounts fell silent during the Israeli strikes on Iran’s Ministry of Intelligence and the IRGC’s intelligence branch – avoiding any anti-Afghan posts throughout the 12-day conflict. This coordinated silence suggested that the smear campaign was orchestrated by elements within the intelligence apparatus, aiming to incite public hostility and ultimately facilitate the removal of Afghan refugees from Iran. After the Israeli attacks, these same accounts reemerged, accusing refugees of being the primary culprits and calling for their expulsion.
Israel’s strike provided Iranian officials with a pretext to label Afghan refugees as Mossad operatives or collaborators, resulting in the expulsion or departure of more than 700,000 Afghan refugees, according to the Bureau for Aliens and Foreign Immigrant Affairs. However, the credibility of the accusations quickly unraveled. In an interview with Iranian state media, Member of Parliament Mannan Raeesi, said that precise intelligence and assessments had found no Afghan refugees among alleged Israeli spies. “This is mostly a defamation campaign,” Raisi asserted.
These accusations also carry a strong sense of hypocrisy.
Both long-term Afghan residents – who have lived in Iran for nearly four decades - and those who fled the Taliban regime, have consistently faced systemic discrimination, including being denied access to such fundamental rights as opening bank accounts or even obtaining SIM cards. This level of scrutiny and control have placed them in a precarious situation under constant surveillance by Iranian authorities. Yet, despite these restrictions, Iranian officials have accused Afghans of collaborating with Israeli intelligence – alleging they’ve shared sensitive information, including the locations of IRGC commanders, strategic sites, and military bases.
Internal Crackdowns as a Deterrent
The Iranian regime’s treatment of its ethnic minorities -- Kurds, Baluch, Azerbaijanis, and Afghan refugees – bears striking resemblance to the oppressive tactics of Saddam Hussein, who ruthlessly cracked down on Shia populations in southern Iraq and on Kurds in the north following his defeat in the 1991 Gulf War. Saddam responded with internal repression to reassert his control.
Iranian allies across the region have echoed this playbook. For example, when mass protests swept across Syria in 2011 during the Arab Spring, President Bashar al-Assad responded with indiscriminate violence against Sunni civilians, particularly in the northern regions of Homs and Idlib. Similarly, in the aftermath of the Saudi-led coalition’s intervention in Yemen in 2015, the Houthis movement launched a brutal campaign of arrests and executions, accusing civilians of colluding with Saudi forces and revealing strategic Houthis positions.
Iran’s post-conflict actions suggest a regime grappling more with psychological defeat than with strategic recovery. Following Israel’s unexpected strike, which contradicted years of Iranian bravado about swift retaliation and impenetrable defenses, the Islamic Republic appears to have turned its frustration inward. The sudden crackdown on ethnic minorities seems less about uncovering espionage networks and more about asserting control in the face of humiliation. For Tehran, it is essential to maintain deterrence over its own citizens.
For decades, Tehran has positioned itself as a regional powerhouse, relentlessly threatening Israel with annihilation and projecting an image of unshakeable strength. But the surprise attack dismantled that illusion. In its aftermath, the regime scrambled to restore authority – not by identifying real culprits – but by targeting marginalized communities who already face institutional discrimination and surveillance.
The effectiveness of Israeli intelligence operations in Iran reveals not only its capabilities but also sheds light on the disposition of the Iranian people—especially among Iran’s oppressed groups, each for their own reasons. No successful intelligence effort is possible without a network of human assets. The fact that Israel has managed to build such networks suggests that many Iranians are willing to cooperate with Israeli intelligence. In some cases, these individuals may not have even known they were working for Israel; their main motivation was simply to strike at the regime.
This willingness to undermine the Islamic Republic underscores the moral and economic bankruptcy of the revolution. A regime that fears spies around every corner is not just facing a capable enemy—it is facing a crisis of legitimacy. When citizens are open to aiding foreign intelligence against their own rulers, it says more about the regime than its adversaries.
There’s also a deeper layer to the regime’s behavior. Its repression of ethnic and religious minorities reveals the moral degradation of a state that claims to defend the “oppressed” (mostazafin) against the “oppressors” (mostakberin). In reality, those lofty revolutionary slogans are used to justify the systematic oppression of Iran’s most vulnerable communities.
Paradoxically, the regime is compelled to act against its own fundamental interests. Although it has no desire to further alienate minority populations, it feels obligated to demonstrate a show of force. In doing so, it traps itself in a self-defeating cycle with narrowing room for maneuver.
However, there is some short-term pragmatism in Iran's actions. Israeli intelligence has clearly penetrated the highest echelons of Iranian power; otherwise, the precision targeting of senior military officials would not be possible. These are not just formal high-ranking officers but also insiders known in Iranian political slang as khodiha—members of the inner circle.
Instead of investigating the security breaches, the regime prioritizes protecting these insiders from suspicion. As a result, its harsh crackdowns on dissidents and vulnerable populations are not just acts of repression—they are diversions, meant to shield the system’s own insiders from accountability for its growing internal failures.
Hussain Ehsani is a Research Fellow at the Turan Research Center. He previously was as a senior researcher at the Afghan Institute for Strategic Studies. He holds a master’s degree from the University of Tehran.
Alex Grinberg is a Senior Fellow at the Turan Research Center, a resident Iran expert at the Jerusalem Institute for Strategy and Security, a research fellow at the Begin Sadat Center for Strategic Studies, and a Captain in the reserves of the Israeli Defense Forces Intelligence.
