Mossad, Shin Bet and the IDF unmask Unit 4000: the IRGC clandestine directorate for global terrorism 

By Andre Pienaar

In a rare joint statement issued on 20 April 2026, the Mossad, the Shin Bet and the Israel Defense Forces disclosed the existence, structure and leadership of Unit 4000, a covert directorate of the Islamic Revolutionary Guard Corps (IRGC) Intelligence Organisation (IO) responsible for assassination, sabotage and targeted kinetic attacks on Israeli, Jewish and Western targets around the world.

The disclosure set out, in unusual public detail, how the unit’s senior leadership was identified, mapped and systematically eliminated during Operation Rising Lion, the Israeli component of the joint US–Israeli campaign against Iran known in Washington as Operation Epic Fury.

The statement also confirmed, for the first time, that the terror cell disrupted in Azerbaijan in early March 2026, whose targets included the Baku–Tbilisi–Ceyhan oil pipeline, the Israeli embassy in Baku, an Ashkenazi synagogue and a leader of the Mountain Jewish community, was a priority operation of Unit 4000.

The joint disclosure is significant on three levels.

First, it is the most complete public attribution to date of the IRGC’s overseas terror-operations directorate.

Second, it ends Iran’s long-standing doctrine of plausible deniability for global terrorism.

Third, it confirms that the Epic Fury campaign was not only a strike on Iran’s missile, nuclear and conventional military infrastructure, but a deliberate decapitation of the IRGC apparatus that runs Iran’s global war of terrorism outside its own borders against the US and its allies.

The Azerbaijan plot: what was intercepted

Azerbaijan’s State Security Service (DTX) announced on 6 March 2026 that it had disrupted a multi-target IRGC operation prepared over several months. The targets were the Baku–Tbilisi–Ceyhan (BTC) pipeline, the 1,768-kilometre strategic energy corridor that carries roughly one-third of Israel’s imported crude oil, together with Israel’s embassy in Baku, the city’s Ashkenazi synagogue and a named leader of the local Jewish religious community.

Azerbaijani investigators recovered 7.73 kilograms of C-4 military-grade explosive from a container abandoned in Baku’s Sabail district, which was subsequently moved and concealed inside a military district of the capital. They also recovered explosive drones and fragmentation charges smuggled across the long and porous Iranian–Azerbaijani border. At least ten individuals were identified in connection with the plot.

Two Iranian nationals, Behnam Sahebali Rostamzadeh and Yaser Rahim Zandekian, were named as on-the-ground operatives working with Azerbaijani accomplice Tarkhan Tarlanoglu Guliyev. A senior IRGC intelligence officer, Ali-Asghar Bardbar Sharamini, was identified as the planner and coordinator. Hafez Tavassoli coordinated the operation on the ground. Several Iranian nationals have been placed on international wanted lists and a number of Azerbaijani citizens have been sentenced to prison terms.

The Israeli joint statement released on 20 April confirmed that the Azerbaijan network did not operate on its own authority. It was a cell within a clandestine global directorate directed by named IRGC officers inside Iran, operating under a chain of command that stretched to the most senior levels of IRGC Intelligence.

What Unit 4000 is, and what it is not

Unit 4000, also called Division 4000 or the Special Operations Department, sits inside the IRGC’s Intelligence Organisation (Sazman-e Etela’at-e Sepah, IRGC-IO).

It is not part of the Quds Force. The Quds Force is the IRGC’s foreign expeditionary military arm. It operates largely in the open, sustaining Hezbollah, the Iraqi Popular Mobilisation Forces, the Houthis and the Fatemiyoun and Zainabiyoun militias as a parallel state-to-state projection of Iranian military power. Quds Force operations are characterised by standing proxy forces, territorial presence and logistical depth.

Unit 4000 is the covert-action counterpart of the Quds Force. Its mission is narrower and more clandestine: kinetic operations on third-country soil executed through deniable local cells. Its signature targets are Israeli diplomatic premises, Jewish communal institutions, specific strategic infrastructure and senior Israeli and Western officials. It works not through proxy armies but through networks of local criminal contacts, migrant-community recruits and in-country handlers, a tradecraft visible in plots attributed over the past two years to IRGC assets in the United States, Canada, Australia, the United Kingdom, Cyprus, Turkey, Greece, South Africa and now Azerbaijan.

Unit 4000’s chain of command now broken

The joint Israeli statement, read together with earlier Azerbaijani and Turkish disclosures, maps a four-level command structure. Every level has now been disrupted.

1. At the top sat Majid Khademi, head of the IRGC Intelligence Protection Organisation. Khademi’s position in the IRGC-IO hierarchy placed Unit 4000 among the directorates he oversaw. His exposure had begun before the Israeli air campaign: on 30 January 2026, the US Treasury’s Office of Foreign Assets Control designated Khademi under its IRGC, Iranian Financial Sanctions Regulations and Iran Human Rights authorities for his role in the violent repression of Iranian protestors. Approximately four weeks later, on 28 February, Khademi was killed in the opening phase of Operation Rising Lion. The sequence, OFAC designation followed by targeted kinetic strike, illustrates how sanctions designations are functioning in the current campaign as public warning markers on targets that are separately being prepared for kinetic action.
2. Beneath Khademi served Rahman Moghadam (also rendered Makadam) as the operational chief of Unit 4000 and head of the Special Operations Department. Moghadam managed the overseas network day to day, training and recruiting operatives inside Iran and assigning them to gather intelligence on Israeli political and diplomatic officials and other targets. He was killed in an Israeli Air Force strike in the early days of Operation Rising Lion.
3. Mohsen Suri was the key operator beneath Moghadam. Suri’s function was that of a travelling case officer: he moved between jurisdictions to meet local terror cells in person, direct their missions and bring new groups into the network. That role gave Israeli intelligence the critical seam in Unit 4000’s structure. When Mossad and Shin Bet identified the emergency IRGC facility where Suri was sheltering with other intelligence personnel during the war, he was killed in a targeted strike on that facility.
4. The fourth named figure, Mehdi Yekeh-Dehghan, operating under the alias “the Doctor”, was Unit 4000’s country-level handler for Azerbaijan and Turkey. Beyond the Azerbaijan operation, Yekeh-Dehghan was also running a parallel Turkey–Cyprus axis: smuggling explosive drones from Iran into Turkey and onward to Cyprus, and conducting reconnaissance on US and allied military assets, including Incirlik Air Base in Adana. Yekeh-Dehghan’s exposure did not begin in Azerbaijan. In January 2026, Turkish authorities arrested several individuals, including an Iranian national, on espionage charges connected to his network. That arrest was, in retrospect, the first visible thread.

Why the BTC pipeline was the centrepiece target in Azerbaijan

The selection of the Baku–Tbilisi–Ceyhan pipeline as the critical infrastructure target reveals much about Iran’s strategic calculus. BTC is a 1,768-kilometre pipeline from the Sangachal terminal on the Caspian, through Tbilisi in Georgia, to the Mediterranean port of Ceyhan in Turkey. Its throughput capacity is approximately 1.2 million barrels per day. Crucially, it carries roughly one-third of Israel’s imported crude oil.

Targeting BTC served three simultaneous strategic purposes.

First, it was a direct economic blow to Israel’s war economy. A successful strike, even a partial interruption, would have forced Israel into emergency substitution from Gulf or Atlantic cargoes at a punitive premium during active hostilities, with associated shipping insurance and rerouting costs.

Second, it was a punitive signal to Azerbaijan and Turkey, the two countries that have most openly aligned with Israel against Iran. Baku’s security cooperation with Israeli intelligence, including reported use of Azerbaijani territory for operations against Iran, has long been a grievance in Tehran. Ankara’s maintenance of the Turkish leg of the corridor, and its continuing integration with Israeli energy supply chains, completes the picture. BTC is a shared Azerbaijani–Turkish strategic asset. Hitting it was a message to both capitals that their partnership with Israel carried operational cost inside their own territory.

Third, it preserved Iran’s clandestine terrorism on a non-attributable basis. A ballistic or cruise missile strike on BTC would have been directly attributable and would have invited conventional retaliation on Iranian soil. An improvised explosive device attack on a pipeline passing through a third country, executed by Azerbaijani nationals recruited through local criminal networks, maintained a plausible-deniability posture consistent with Unit 4000 doctrine.

The concurrent Jewish-community targets, the Israeli embassy, the Ashkenazi synagogue and a leader of the Mountain Jewish community, are the ideological signature of Unit 4000. That signature is not new. It traces in an unbroken line back to the bombings of the Israeli Embassy in Buenos Aires in 1992 and the AMIA Jewish community centre in 1994, whose attribution to IRGC networks has been established for three decades.

Tradecraft exposed

Several operational details from the Azerbaijani and Israeli disclosures warrant further analysis.

The cell moved 7.73 kilograms of C-4 and explosive drones overland from Iran into Azerbaijan and then cached material inside a military district of Baku. The choice of a military district for concealment, rather than a civilian warehouse or residential property, implies one of two things: either corrupted insiders inside Azerbaijani military infrastructure, or deliberate exploitation of perimeter security gaps in hardened areas. Either interpretation suggests substantial intelligence preparation of the Azerbaijani operating environment before the kinetic preparation began.

The local-proxy layer matches a template now visible across multiple jurisdictions. Iranian handlers run third-country-national operatives through ordinary criminal contacts, while the command and planning layer remains inside IRGC-IO safe houses on Iranian soil. That architecture has been observed in plots attributed to IRGC assets in Australia, where members of a Sydney motorcycle gang were recruited as executors, and in the United States, the United Kingdom and Scandinavia, where migrant-community recruits have been used similarly.

Compartmentalisation appears to have broken down. Mossad’s ability to roll up Turkey, Cyprus and Azerbaijan cells from a single investigative thread suggests either excessive concentration of control in a small number of travelling handlers such as Yekeh-Dehghan and Suri, or communications-security failures across cells that should have been siloed from each other. That is a structural vulnerability in the Unit 4000 model. The deniability that makes the architecture politically useful also makes it operationally thin when one handler falls.

The most revealing detail is Suri’s presence at what Israeli agencies described as a pre-identified IRGC “emergency facility”. That characterisation indicates Mossad and Shin Bet had mapped Unit 4000’s continuity-of-operations infrastructure inside Iran well before the kinetic phase of the campaign began on 28 February. The 20 April public disclosure is the surface expression of an intelligence picture that had been complete for months.

Strategic implications

For Iran, the short-term implication is the loss of the top three command levels of its principal overseas terror-operations directorate in a span of roughly six weeks. Reconstitution is possible, but the institutional memory needed to run a network of this reach does not transfer neatly to a successor. Any replacement commander will also have to operate inside the post-Khamenei succession vacuum created by the deaths of the Supreme Leader and senior regime figures during Epic Fury, without the clear political top cover that Unit 4000 has historically enjoyed from the Supreme Leader’s office. The joint Israeli disclosure is designed to extend the cost of reconstitution: every new tasking will now be attributed in advance, precisely the condition Iran’s deniability architecture was built to prevent.

For Azerbaijan, the posture shift is visible and consequential. Azerbaijan is the other major Shia power in the world, but Baku offers a secular alternative model of governance to Iran’s radical theocracy. Baku’s March disclosure, followed by the Iranian drone strike on Nakhchivan that wounded four people and struck Nakhchivan Airport terminal, has eroded whatever residual restraint President Aliyev maintained in pushing back publicly against Tehran. The BTC pipeline now sits on Iran’s confirmed kinetic target list in a way that cannot be publicly retracted, and pipeline-specific insurance and reconstruction cover will reflect it.

For the wider theatre, the overseas target set extends materially beyond Azerbaijan. The Israeli statement named Turkey, Cyprus, Greece and other European jurisdictions as nodes. A rolling wave of second-order arrests should follow as the intelligence underpinning the 20 April disclosure is shared with allied European services.

Bottom line

What Azerbaijan intercepted in March was not a rogue cell. It was a multi-faceted priority operation of a clandestine IRGC Intelligence directorate that operates globally.

The entire command chain, Majid Khademi, Rahman Moghadam, Mohsen Suri and the Yekeh-Dehghan country-handler network, has been physically or legally neutralised inside a single six-week window by Israel, making the wider international environment safer.

The joint Mossad, Shin Bet and IDF disclosure on 20 April confirms that Operation Epic Fury was not only a strike on Iran’s missile, nuclear and conventional military apparatus. It was a targeted decapitation of the directorate that executes Iran’s clandestine war of terrorism outside its own borders.

For the first time in a generation, Iran’s doctrine of plausible deniability for global terrorism is being publicly dismantled in real time. The question the Azerbaijan plot poses is not whether Unit 4000 will reconstitute. It is whether the Islamic Republic’s political leadership, in its current decapitated state, still has the coherence to authorise and mobilise Unit 4000’s reconstitution, and what the new set of targets will be.