Secret spy unit leads Iran’s intel gathering for surveillance, deadly plots

“The fear of miscalculation and renewed conflict stems, among other things, from the fact that, like Israel, Iran feels that it is under an existential threat,” one of the Western sources said.

Western officials, according to the i24 report, assess that Tehran has prioritized missile reconstruction over accelerating its nuclear program, viewing the project as more urgent for national security. They told the channel that Iran’s new missiles are expected to be less precise because Israel damaged key planetary-mixer infrastructure during the 12-day war.

Iran has concluded it would need a large volume of missiles to overwhelm Israeli defenses, the officials added. The Houthis in Yemen, they also said, may escalate drone launches at Israel.

Satellite analyses published earlier by the Associated Press showed reconstruction work at Iranian missile-production sites struck during the war, though experts told the agency they had not seen signs of large solid-fuel mixers, a crucial component of the program.

The officials also warned that mutual damage in any new confrontation would be severe. “The Iranians know that if they attack, Israel will carry out a wide range of comprehensive attacks,” one said. “The Iranians will bring down skyscrapers in Tel Aviv, and in Tehran there will be great destruction.”

Israeli officials and Western governments have repeatedly referenced the prospect of another round of fighting in recent weeks. An Israeli security official said less than two weeks ago that the military is preparing for a conflict that could last longer than 12 days.

Israel may pursue an attempt at regime change in Iran, the sources told i24, but it is not certain that it will receive American support.

The previously undisclosed visit, held between November 7 and 11, 2024, involved physicists and engineers travelling on consecutively numbered diplomatic passports and meeting Russian institutes connected to military research, the report said, citing documents it obtained and corroborated through corporate filings, sanctions records, leaked travel data and other correspondence.

According to the report, the exchanges form part of a broader pattern of contact between Russian military-linked research centers and Iran’s Organization of Defensive Innovation and Research (SPND), a Defense Ministry body long sanctioned by Washington for alleged work on nuclear weapons design.

Jim Lamson, a senior research associate at the James Martin Center for Nonproliferation Studies and a former CIA analyst, told the FT the evidence indicated that Iran’s defense-linked scientists were “seeking laser technology and expertise that could help them validate a nuclear weapon design without conducting a nuclear explosive test.”

Tehran maintains its nuclear program is entirely peaceful, and Moscow has publicly opposed the Islamic Republic obtaining a nuclear weapon.

• 

  Iran runs covert nuclear procurement network with Vienna-based front firms

• 

  Iranian nuclear experts visited Russian labs with dual-use tech - FT

• 

  700 Russians working on Iran's Bushehr nuclear facility, Rosatom says

The delegation met Laser Systems, a Russian company under US sanctions that develops equipment for both civilian and classified military use. 

The November 2024 mission followed an earlier set of meetings revealed in August, which showed that a Vienna-linked procurement network involving DamavandTec – and using diplomatic passports issued by Iran’s foreign ministry – had arranged introductions between Iranian nuclear scientists and Russian companies with defense and intelligence ties.

Academic and institutional records reviewed by the FT showed the men who travelled were not DamavandTec employees but researchers from Shahid Beheshti University, Islamic Azad University of Kashan and Malek Ashtar University of Technology, an institution under US and EU sanctions for its role in nuclear-related activity.

The FT said the visit had been framed in invitations as an opportunity for technological collaboration, though the scope of any technology transfer between the two sides remains unclear.

The findings come against the backdrop of years of Western allegations that SPND operates covert procurement networks in Europe and Asia to source dual-use equipment. 

An investigation by Iran International in 2025 documented a Vienna-based hub tied to SPND-linked front firms purchasing neutronics-related and other sensitive components with potential applications in nuclear weapons design.

Washington has sanctioned more than 30 SPND scientists and multiple affiliated entities, saying the organization oversees “dual-use research and development activities applicable to nuclear weapons and nuclear weapons delivery systems.”

In 2024, Iran’s parliament formally recognized SPND under Iranian law, placed it under the authority of the Supreme Leader and exempted its budget from parliamentary oversight.

“The operation represents a notable technical advancement for the group, which introduced two previously undocumented custom backdoors: TWOSTROKE, a lightweight Windows implant written in C++ that supports command execution, file operations, screenshot capture and various persistence methods,” Google-owned firm said.

“The other is DEEPROOT, a cross-platform backdoor developed in ‘Go’ language crossed platform that works on both Linux and Windows systems, enabling shell commands and file transfers,” the report added.

Attackers gained initial access primarily through spear-phishing emails containing tailored job recruitment lures aimed at defense and aviation professionals, as well as through supply-chain compromises involving trusted third-party software vendors and virtual desktop infrastructure providers, Mandiant reported.

“Once inside victim networks, UNC1549 (aka Nimbus Manticore/Tropical Scorpius) deployed additional tools including SIGHTGRAB for screenshots and CRASHPAD for credential harvesting and data staging,” Mandiant said. “Command-and-control traffic was routed through compromised Microsoft Azure tenant accounts to blend with legitimate cloud activity and avoid detection.”

Mandiant said with high confidence that the activity supports Iranian state interests focused on strategic intelligence collection.

Sensitive data was exfiltrated from compromised networks, though the specific content and affected countries have not been disclosed.

Hassan Salarieh, head of the Iranian Space Agency, told a media event in Semnan that the Zafar-2, Paya and the second batch of Kosar imaging satellites are ready for launch. 

He said Iran’s space sector had advanced to the point where “satellites with one-meter and sub-five-meter imaging resolution are now under construction.”

Salarieh said the first experimental launch from the Chabahar Space Center – a coastal site under development in Iran’s southeast – will take place next year. 

“Chabahar is becoming one of the most important launch centers in West Asia,” he said, adding that its construction began in 2023 and that the site is designed to support heavier, liquid-fuel launch vehicles.

• 

  US restores India waiver for operations at Iran’s Chabahar Port

• 

  Iran developing Chabahar space center for heavier liquid-fuel rockets

His comments come as Iran accelerates work on Chabahar’s second development phase. In April, the agency said the facility would eventually handle semi-heavy liquid-fuel rockets and serve as Iran’s main space gateway, with a geographic position suited for placing satellites into sun-synchronous and geostationary orbits.

Salarieh said Iran had also signed its first private-sector contracts for satellite constellations, including the narrow-band Kosar system intended for emergency data transfer, and highlighted recent milestones such as the launch of private-built satellites on a Russian rocket, the successful 2023 flight of the solid-fuel Sorayya launcher, and the deployment of the Nahid-2 communications satellite in 2025.

Iran has long said its space program is civilian and scientific, though Western governments argue that technologies used for orbital launches can advance long-range ballistic missile capabilities. 

President Masoud Pezeshkian has said Iran’s missile and space work supports national deterrence, while Defense Minister Aziz Nasirzadeh has said Tehran could eventually offer launch services to allied states.

• 

  Iran plans maiden launch of its first satellite constellation by March

• 

  Iran says upgraded communication satellite ready for December launch

Salarieh said domestic expertise had raised Iran’s launch capacity to “several hundred kilograms” and that efforts in propulsion, solid-fuel and liquid-fuel systems had advanced in parallel over the past three years. 

Iran’s space program has picked up pace since the 2009 launch of the Omid satellite, with universities and state-linked research centers producing a series of experimental spacecraft. 

In 2023 and 2024, Iran also carried out multiple sub-orbital tests, launched reconnaissance satellites via foreign rockets and unveiled new satellite buses and transfer stages, including the Saman-1 upper stage designed for higher-altitude orbits.

Salarieh said the government sees space as a strategic industry with economic, security and industrial implications. “We have strong human capital and significant infrastructure,” he said. “The development of space capability will continue rapidly.”

“Things that might succeed in the short term may have very different consequences long term,” the paper quoted Malley, who served under US President Donald Trump's predecessor Joe Biden, as saying.

The region’s history, he added, is “a whole list of military 'successes'” that later backfired.

Malley pointed to Israel’s military actions in the region, including attacks in Beirut and against the Palestine Liberation Organization in Tunis, as well as the US invasions of Iraq and Afghanistan and the American intervention in Lebanon.

He said these supposed short-term “victories” often “end up boomeranging,” with consequences that included the rise of Osama bin Laden, stronger Iranian influence in Iraq, the Taliban’s return to power and the emergence of Hezbollah.

Malley told the newspaper that Israeli and US attacks on Iran in June revealed the extent of Israeli access to Iranian airspace and intelligence related to Tehran’s nuclear and missile programs.

The attacks, he said, showed that “Israel had supremacy over Iranian airspace and extraordinary intelligence” regarding Iranian personnel and facilities.

That assessment could affect Tehran’s calculations if it considers rebuilding parts of its nuclear program, Malley said.

“If Iran chooses to restore or resume its nuclear program, it’s going to have to think many times, because it knows that Israel is watching and the US is watching,” he said.

Malley said the June strikes “did set back Iran’s nuclear program,” though “it didn’t obliterate it in the way that President Trump said,” the report added.

Iran denies seeking nuclear weapons, but Israel and Western countries doubt its intentions. Washington has demanded Tehran end all domestic enrichment.

Diplomatic breakthrough or further escalation?

On the outlook for US–Iran relations, Malley said he could imagine either further military escalation or a diplomatic breakthrough under President Trump.

“I wouldn’t be surprised” by renewed US–Israeli strikes, Malley was quoted as saying, but he added that he “wouldn’t be shocked” if Washington and Tehran reached an understanding that halted Iranian enrichment in exchange for sanctions relief and restored UN inspections.

Malley warned that deep mistrust in Tehran has made negotiations more difficult, telling the newspaper that Iranian leaders believe Trump “betrayed them not once, not twice, but three times.”

US talks with Tehran over its disputed nuclear program began earlier this year with a 60-day ultimatum. On the 61st day, June 13, Israel launched a surprise military campaign which was capped with US strikes on June 22 targeting key nuclear sites in Esfahan, Natanz and Fordow.