In late 2023, Israeli intelligence received information that Hezbollah, the Lebanese terrorist organization, had been given the green light to kill Moshe (Bogie) Ya'alon.
At the top of the Military Intelligence Directorate, officials struggled to understand the nature of the intelligence, which seemed to have landed on them without context. No one in the intelligence community had the faintest idea that Hezbollah was planning to assassinate the former defense minister and IDF chief of staff, or anything close to that.
But the report, whose existence is being revealed here for the first time, came from reliable sources, and Military Intelligence decided not to take any risks. Officials called the Shin Bet security agency, the body responsible in Israel for protecting public figures. "We don't know exactly what is going on," they told them. "But Bogie should not leave the house any time soon."
"That night I slept in my apartment in central Israel," Ya'alon, a member of Kibbutz Grofit in the Arava region, recalled this week. "The next morning I was planning to head out early for a handbike ride in Yarkon Park, as part of an activity I have been doing for years with wounded IDF soldiers. But before dawn, Shin Bet people came to my house, knocked on the door and told me, 'You are not going out.'"
Did that surprise you?
"No, because for many years now I have seen myself as a target. That means looking around, being cautious and sensitive to any change."
Ya'alon may be sensitive to every change, but on that day he came within a hair's breadth of death. At around 6:30 a.m. on September 15, 2023, while Ya'alon remained inside his apartment in central Israel on Shin Bet instructions, a powerful Claymore-type explosive device detonated in Tel Aviv's Yarkon Park. The device had been planted beneath a tree, directly on Ya'alon's planned riding route. Only by sheer luck was no one hurt.
Following the explosion, the Shin Bet launched an investigation. With the help of security cameras, it quickly traced those who had planted the bomb and arrested them later that same day with police assistance. In the interrogation rooms, the suspects spun for their interrogators a long and convoluted story that exposed an extensive terrorist network and the blindness of the entire intelligence community. It turned out that, right under its nose, a skilled and well-equipped terrorist cell had been operating inside Israel, and only a great deal of luck prevented it from carrying out its plan: revenge.
Karma
Ibrahim Makhoul, an Israeli citizen, had made a living from smuggling even while living in Israel, and maintained ties with criminal elements in Lebanon. Handguns, drugs, weapons, Makhoul moved all of them across the border fence and into Israel. In early 2023, he apparently decided to expand his business and crossed into Lebanon on his own initiative. When Hezbollah operatives captured him, they immediately suspected he was an Israeli spy. After several days of interrogation, they realized they had in their hands a smuggling expert with deep ties inside Israel, and recruited him.
Under Hezbollah's protection, Makhoul began smuggling weapons and drugs into Israel through the Lebanese border, relying on his friends in Israel. As emerges from the severe indictment filed against eight of them, all of whose names are barred from publication, Makhoul at some point enlisted his acquaintances to carry out what can be called the "Claymore plan": an operation to assassinate two senior Israeli security figures using explosive devices to be smuggled from Lebanon. The operation was run by Hezbollah, but according to Israeli intelligence assessments, it was directed by figures in Iran's Islamic Revolutionary Guard Corps. The explosive devices themselves, Israel believes, were manufactured in Iran or with Iranian assistance.
In summer 2023, Makhoul called two of his friends in Israel on WhatsApp and Signal video calls, while filmed against the backdrop of a car with a Lebanese license plate and holding a weapon. In this way he proved to them that he was cooperating with Hezbollah and working for it, and that there was a good deal of money in this business. Makhoul instructed them to reach the border with Lebanon near Kibbutz Sasa, and while they were driving along the fence he guided them to a point where they picked up packages of weapons and military equipment that had been thrown in advance over the border fence from Lebanon. In this way, the terrorist cell succeeded in smuggling into Israel a carbine rifle, two handguns, and above all three Claymore devices.
The advanced explosive devices were later transferred, under Makhoul's direction, to other figures in the terrorist network he had built, through a maze of intermediaries, cellphones purchased for the purpose and dead drops. One of the places where the explosive devices were hidden was a girls' school in the Palestinian town of al-Eizariya, near Jerusalem. All of this was discovered by the intelligence services only in hindsight.
At the end of August 2023, Makhoul, who was operating in Hezbollah's service and under Iranian direction, began engineering the next stage of his Claymore plan. Under his instructions, one of the members of the network in Israel bought a remotely controlled camera and installed it in his car. That same terrorist also fitted one of the Claymore devices with a remote activation mechanism. "We are going to kill an important person," Makhoul told his partner in a phone conversation.
On the evening of September 14, 2023, the terrorist arrived at Yarkon Park equipped with the explosive device and planted it at the point Makhoul had instructed him to. He parked his car so that the camera inside it was aimed at the tree beneath which the device had been planted. From that moment on, all that was needed was to press a button, somewhere in Lebanon. Only in hindsight did Israel understand that this was what Hassan Nasrallah had meant when he gave the authorization to kill Bogie Ya'alon.
Ya'alon did not pass through the park that day. The explosive device went off anyway at 6:30 a.m., apparently because of a mistaken identification, according to the Shin Bet, and no one was hurt. This was the closest Iran had ever come to assassinating a senior Israeli official. In hindsight, it became clear that the same terrorist network had planned to assassinate another former senior security figure using an additional Claymore device. The identity of that figure is barred from publication, but it can be said that he held one of Ya'alon's former positions.
Military Intelligence received much praise because of the affair. The attack on Bogie had been foiled only thanks to the strange piece of information it picked up at the last minute. But the Military Intelligence officers who handled the case did not allow themselves to rejoice. They felt that this was an intelligence failure that had turned into a success almost purely by chance. A fluke. Three weeks later came the surprise attack of October 7.
Immediately after the bomb exploded in Yarkon Park, a gag order was imposed on the details of the investigation, and it was lifted only a year later. By the time the Shin Bet finally exposed the terrorist cell that had intended to assassinate Ya'alon, the war was already at its height and the story had faded and been forgotten. But the attempted assassination of the former defense minister and chief of staff is only one expression of a broad and long-running Iranian project, led by the Revolutionary Guards and intended to strike senior Israelis wherever they may be. It is an ongoing, sophisticated effort, driven mainly by feelings of revenge, feelings that took root among the Iranians long before the killing of Ayatollah Khamenei. The scale and depth of this Iranian operation are described here for the first time.
"I know very well who sent the cell that was meant to kill me," Ya'alon told us. "It was a senior Hezbollah figure, working in cooperation with the Iranians. Luckily for me, a pager exploded in his hand, and he lost his hand and his eyesight. In that respect, I have some satisfaction, because as defense minister I approved the idea behind the pager operation."
The targets
It is not recommended to rely on karma, which so far has prevented Iran from assassinating a senior Israeli figure. "The fact that until now none of our senior commanders, in Israel or abroad, has been murdered owes a lot to luck," says a former senior IDF officer familiar with the issue.
Iranian activity aimed at harming senior Israeli figures has been going on for decades, first under the umbrella of Iranian intelligence and later under the Quds Force of the Islamic Revolutionary Guard Corps. Over that period, the Iranians have operated in several waves. For example, between 2011 and 2016, following a wave of killings of Iranian nuclear scientists attributed to Israel, more and more Iranian attempts were uncovered to retaliate by harming figures in Israel, from security personalities to businessmen.
The current wave began in January 2020, immediately after the killing of Quds Force commander Gen. Qassem Soleimani. "Their efforts intensified greatly after Soleimani was killed, and later after the assassination of Mohsen Fakhrizadeh, head of the nuclear program, in November of that same year," confirms a former Mossad official who until recently dealt precisely with these matters.
"The motivation is revenge," adds Shalom Ben Hanan, former head of the Shin Bet's counterespionage division. "We have been killing their senior figures for many years. In recent years it has also come out in the media, and the Iranians want to create a response equation, a price tag. This is a very significant issue for them and part of the overall campaign they are waging against us."
One of the tools the Iranians use to gather intelligence on senior figures in Israel is the spy network they have deployed inside the country, which surfaced after October 7. "Under the heading of Iranian espionage in Israel, the target of harming individuals is one of the central ones," Ben Hanan says. "Many of those involved in espionage affairs in the past two years, at some point in the investigation it emerges that they were offered the chance to assassinate a senior figure or collect intelligence on a senior figure in preparation for an assassination. Sometimes it is a blunt proposal, sometimes it is a request to collect pre-operational intelligence, and sometimes it is testing and probing the willingness of that person to carry out an assassination."
According to data Israel Hayom publishes here for the first time, since the outbreak of the war the Shin Bet and the police have uncovered 38 cases of Israelis recruited by Iran, of which in 13 cases Israeli citizens were asked to collect information on senior Israeli figures in order to pass it on to Iranian operatives.
Among the targets identified by Shin Bet investigations during this period are Prime Minister Benjamin Netanyahu, ministers Israel Katz and Itamar Ben-Gvir, MK Benny Gantz, who held several senior security positions, former prime minister Naftali Bennett, former defense minister Yoav Gallant, former IDF chief of staff Herzi Halevi, former Shin Bet head Ronen Bar, and even a senior female academic working at the Institute for National Security Studies. "The Iranians have a well-oiled system, it works all the time, and they have high motivation," says a legal source familiar with some of these cases.
The Iranian effort to assassinate senior figures intensified even further after Operation Rising Lion. "There we basically carried out a decapitation operation against them, with wholesale assassinations," in Ben Hanan's words. Following that, the Shin Bet began identifying persistent Iranian attempts to recruit and run more and more Israeli citizens for the purpose of harming individuals, with an emphasis on senior officers. During the operation, the IDF set up a "shadow general staff," intended to deal with a situation in which the army's top brass was hit, and one of the directives barred the chief of staff and his deputy from being in the same room. Former chief of staff Herzi Halevi also received increased security during the operation and was instructed not to move around in crowded places. Other generals were asked to evacuate their homes for several days. During Operation Lion's Roar as well, security was reinforced for officers, along with some cabinet ministers and other senior figures. In several cases, the families of senior figures were asked to leave their homes and move to alternative apartments.
"The counterespionage division that I headed made a leap forward in the past decade in everything related to Iranian espionage," says Ben Hanan. "It is investing a great many resources in this, including setting up new units operating in cyberspace, greatly expanding the use of human intelligence tools, working with technologies suited to the world of state espionage, and international cooperation."
The IDF also stepped up its security arrangements for senior officers at the start of the October 7 war, through the General Staff unit for protecting senior officials in the Operations Directorate. The unit, which among other things runs a command center linked 24/7 to cameras documenting protected officers, has been expanded significantly over the past two years. For example, the unit began providing exceptional protection to the commander of the Nevatim Air Force Base as early as November 2024. The opposition channel Iran International claimed that the Nevatim commander was the assassination target of seven Israelis from northern Israel accused of spying for Iran.
"There are people, mainly in politics, who like the security around them because it is a status symbol," says Brig. Gen. (res.) Ran Kochav, who during his tenure as IDF spokesman was protected at the highest level after receiving threats on his life דווקא from far-right activists. "In my experience, it is something very unpleasant. The bodyguard is attached to you 24 hours a day and sits outside your house while you sleep, shower or host guests, and they put cameras inside your private space. Sometimes in the middle of the night you feel like opening the door and telling the bodyguard, 'Brother, forget the security. Come in and warm up.'"
The expansion of the unit protecting senior officials joins another step the IDF is preparing to take: the establishment of a new brigade in the Operations Directorate that will bring under it the unit for protecting senior officials, the Information Security Department operating in Military Intelligence, and the Military Police's camp protection array. "This is a direct result of the IDF's understanding that there is a problem not only with protecting senior figures, but also with everything connected to information security in general and the leaking of secrets," says a source familiar with the details. As of the time of writing, the new brigade is expected to be headed by Tal Ashur, who was commander of the Multi-Domain Unit and commander of the Southern Brigade in Gaza. He is to be promoted to brigadier general.
"The spray method"
In Israel, of course, efforts are being made to thwart plots to assassinate senior figures and also to protect them as much as possible. But not infrequently the Iranians have managed to come close again to carrying out their plans. One such case occurred in October 2024. This time the target was a well-known Israeli scientist living in Rehovot.
For several months, Binyamin Weiss, a resident of Bnei Brak, had been in contact with an Iranian handler through messaging apps on his phone. Weiss carried out tasks for his handler such as setting cars on fire, spraying graffiti and hanging posters calling for civil revolt. Seemingly, Weiss was just another one of those low-level Israeli spies caught in the web Iran had cast online. But at a certain point Weiss's activation was escalated, and he was asked to gather intelligence on a well-known Israeli scientist living in Rehovot. Weiss agreed. He drove to Rehovot and photographed the scientist's home and car using a camera that transmitted the information back.
The intelligence supplied by Weiss was used by the Iranians to direct a terrorist cell from Beit Safafa that had already managed to obtain weapons and was on its way to the scientist's home. Thanks to Shin Bet intelligence guidance, which apparently had already been tracking the cell, its members were arrested. "But this is proof of Iranian activity not only on the intelligence level, but also on the operational level," a security source said this week. "In this case, there really was an assassination cell that was ready to carry out the killing."
Another case foiled by the Shin Bet and the police was that of Vadim Kupriyanov, a handyman who had simply been looking for work in a Telegram group for job seekers. Someone in the group apparently identified Kupriyanov's strong desire to make easy money, and began running him on seemingly simple jobs. In the Shin Bet, this Iranian recruitment practice is called "the spray method."
The first tasks given to Kupriyanov were described by his handler as "real estate jobs." He photographed busy streets in cities in central Israel, later also prices of products in supermarkets and pharmacies, and sent them in. In his defense, Kupriyanov would later claim that he did not think he was carrying out espionage tasks. In any event, he was paid thousands of shekels for the service via cryptocurrency.
Kupriyanov became so enthusiastic about the easy money he was making that he opened an additional Telegram user account on his partner's phone and established a second, parallel connection with the Iranian handler, thinking he could make money twice over. The Iranians, whether or not they knew that Kupriyanov was "working" them, began raising the bar of the missions. His partner, who sensed that something was not right with what was going on on her phone, urged him to stop, but Kupriyanov ignored her.
At a certain point, Kupriyanov was asked to install a camera in the front and rear of his car and drive to a certain address in Ra'anana. According to him, he did not know that it was the home of former prime minister Naftali Bennett. In line with the instructions he received, he circled Bennett's house in Ra'anana and then positioned himself with the car up the street, with the camera aimed at the house and transmitting constantly backward. At that stage he was arrested on the spot by the Shin Bet, and an indictment was later filed against him.
The cases of Weiss and Kupriyanov are characteristic of the Iranian method of operation: the use of Israeli agents activated through readily available messaging apps, paid in digital currency, and taken through a slippery process of escalation.
Another case with similar characteristics that was recently exposed involved the collection of intelligence around Gallant's home. Fares Abu al-Hija, a 32-year-old resident of Kaukab Abu al-Hija, had also been looking for casual work online. He connected with a figure calling himself "Martin" and began receiving relatively simple assignments from him, including buying and transferring cellphones. At the end of each such mission, Abu al-Hija sent a photo and video to his Iranian handler to prove that it had indeed been carried out. In return, he was paid through the Binance app. After several such tasks, he was asked to photograph a café in Tel Aviv.
Abu al-Hija's "classic" process of escalation took a twist when it became sharp and steep almost all at once. At a relatively early stage in the operation, he was asked to go to the community of Amikam, where Gallant lives, and document several streets. A report on Channel 12 claimed that in any case Gallant was not staying at his home at that time, after he had been asked to leave because of another affair in which someone else had been discovered photographing the area around his residence.
Abu al-Hija was arrested on the spot, immediately after he sent "Martin" photos and videos from Amikam. That fact, combined with the timing of other arrests for similar offenses, may point to the working method of the Shin Bet and the police. A source familiar with the issue who spoke with us says that the Shin Bet tracks many Iranian operations in parallel, and tries to balance the need to "maintain control" with the desire to gather more evidence against Israeli spies. "The Shin Bet is flooded with many incidents, and it is impossible to monitor everything," he explains. "Therefore, from the moment an activation process 'deteriorates' to a certain stage, arrests are made as quickly as possible."
A ticking bomb
Somewhat oddly, neither the Shin Bet nor the police has succeeded in formulating a profile of the average Israeli "assassin." The spies run by Iran who have been caught paint a colorful mosaic that includes different ages and backgrounds, diverse population groups and varying motivations. "We have not managed to identify common DNA," says Chief Insp. Yossi Elkrif. "It starts with people who are desperate for money, use drugs of various kinds or who understand that easy money will help them survive, and goes all the way to normative people, but apparently the thrill gives them great satisfaction."
For nine years now, Elkrif has served as an investigations officer in the security division of Lahav 433's international crime investigations unit. As such, he has a long-term perspective on Iran's efforts to activate agents in Israel. "Since October 7 we have seen a significant increase, by hundreds of percent, in cases involving contact with an Iranian agent," he says. "They are trying to get as deep as possible into the soft underbelly of the State of Israel."
One of the spies Elkrif himself investigated is Yaakov Perel, a Satmar Hasid arrested in September 2025 and charged with assisting the enemy in wartime and passing information to the enemy with intent to harm state security. "In his case, for example, the motivation was not money but ideology," Elkrif says. "We defined him as a 'ticking bomb.' In the interrogation room, when he already understood he was facing many years in prison, he told me, 'So much the better, now I will spread my doctrine in prison.'"
Perel, an anti-Zionist activist with Israeli and US citizenship, was living in Morocco, where he first made contact with the Iranians back in 2017. In November 2024, after Nasrallah was killed, the enraged Perel contacted an Iranian handler on Telegram and offered his services. Under Iranian direction he flew from Casablanca to Boston to renew his Israeli passport at the Israeli consulate, where he bought two "operational" phones with SIM cards and installed apps for encrypted messaging with his handlers. Two days later he landed in Israel and rented an apartment in Beit Shemesh. According to the understandings between Perel and his handlers, he was told that immediately after completing his tasks in Israel, they would arrange political asylum for him in Iran, together with all the members of his family.
Perel began by photographing train stations, but was quickly sent on two more complex missions: gathering intelligence around the homes of Minister Ben-Gvir and former chief of staff Halevi. Because he did not have a driver's license, he installed cameras on his bicycle and began riding around the homes of both targets. He transmitted the video live to his handlers in Iran. In this case as well, he was arrested immediately after the act. "In the interrogation, when Perel was already trying to reduce the legal damage for himself, he explained that he saw this as legitimate transmission of information," investigator Elkrif says. "He knew that what he was doing could lead to harm to Ben-Gvir and Halevi, but he said, 'I will not pull the trigger.'"
Perel's trial is still ongoing, like the trials of most of the Iranian spies caught in Israel. In fact, apart from Moti Maman, a resident of Ashkelon who was sentenced to 10 years in prison after being convicted of contact with a foreign agent, all the other cases opened in these affairs over the past two and a half years are still underway. Even Maman's case ended in conviction only as part of a plea bargain.
Within the law enforcement system there are those who are dissatisfied with the conduct of the judicial system on this issue and claim it is dragging its feet. On the other hand, there are those who argue that the legislature set a very high threshold of punishment for security offenses, while in practice many of the detainees are "stupid kids who did not fully understand what they were doing." That gap causes the prosecution and the courts, according to this view, to hesitate before convicting defendants of offenses such as contact with a foreign agent and assisting the enemy in wartime.
Besides being the only one convicted so far, Maman's story, who in an exceptional case visited Iran and met with local intelligence figures, provides fascinating testimony to the strong interest of the Revolutionary Guards in assassinating the most senior people in Israel. "The Iranians tried to understand whether Maman could get to Netanyahu or to Bennett," says attorney Eyal Besserlik, who represented Maman in the case and represents him on appeal. "Moti was obviously not in that direction, but they really insisted that he 'get to the man in Ra'anana.' Therefore, one of the first things Moti did when he landed in Israel and was immediately arrested was to ask that Bennett's security be increased. He told the Shin Bet that even while he was barred from meeting a lawyer." According to Besserlik, Maman offered to become a double agent who would work מול the Iranians and deceive them, but the prosecution rejected the proposal after consulting with the police unit and the Shin Bet.
Iranian attempts to harm Israelis do not end within the borders of the State of Israel. "There are constant attempts to assassinate and especially to kidnap senior figures abroad," says Ben Hanan, whose counterespionage division also dealt with this issue. "These are mainly security figures who were exposed to classified and sensitive information."
For that purpose, the Iranians use what is known as a "honey trap," intended to lure the target to a particular place. Ben Hanan reveals here for the first time one such attempt, in an effort to kidnap a very senior former figure in the security establishment. "The Iranians recruited an Israeli man, and we in the Shin Bet got onto it but did not understand why he interested them specifically," Ben Hanan recounts. "Only then did we realize that the goal was to use that Israeli, who happens to know several security figures, in order to lure the final targets of the Iranian operation. He was supposed to receive large sums of money for that."
At a certain point, that Israeli did in fact approach a senior security personality, a man who had held a very high security clearance, and tried to persuade him to meet at a certain point abroad. "At that point we stopped him and interrogated him," Ben Hanan says. "What I have just told you is based on that suspect's confession in interrogation."
"Since its establishment, the Khomeinist regime has operated to harm Israelis abroad," adds Yoram Schweitzer, a former intelligence official who researches terrorism. In a study he recently published together with Anat Shapira, Schweitzer analyzes Iranian methods of operation for harming Israelis abroad, including senior figures. Among those methods are the recruitment of local operatives, in many cases criminals, in order to give Iran plausible deniability; the use of extortion and threats, including against family members, when recruiting operatives; and the use of cryptocurrency to finance operations. Using these methods, the Iranians have in recent years tried to harm Israeli businessmen in Turkey and Georgia, and more recently also Israel's ambassador to Mexico.
"The body that took the lead in these operations is the Quds Force of the Revolutionary Guards, which specializes in running cells or individuals outside Iran," says Schweitzer. "The Iranians have an almost absolute monopoly on managing assassination operations, whether abroad or in Israel. Naim Qassem, while still serving as Hezbollah's deputy leader, admitted that operations abroad can be carried out only with the approval of the supreme leader, because of the complexity and implications of the event." Hezbollah, according to Schweitzer, at times serves as a "contractor" for the Iranians, especially in places where the Lebanese terrorist organization has access to operatives on the ground in Israel, exactly as in the attempted assassination of Bogie Ya'alon.
Incidentally, the man in Iran who was responsible for managing the broad operation of assassinating and kidnapping senior Israelis was Saeed Izadi, a senior general in the Revolutionary Guards. He himself was killed in Operation Rising Lion.
