{"id":5007,"date":"2026-04-22T09:24:00","date_gmt":"2026-04-22T09:24:00","guid":{"rendered":"https:\/\/sawahsolutions.com\/national\/mossad-shin-bet-and-the-idf-unmask-unit-4000-the-irgc-clandestine-directorate-for-global-terrorism\/"},"modified":"2026-04-22T09:35:14","modified_gmt":"2026-04-22T09:35:14","slug":"mossad-shin-bet-and-the-idf-unmask-unit-4000-the-irgc-clandestine-directorate-for-global-terrorism","status":"publish","type":"post","link":"https:\/\/sawahsolutions.com\/national\/mossad-shin-bet-and-the-idf-unmask-unit-4000-the-irgc-clandestine-directorate-for-global-terrorism\/","title":{"rendered":"Mossad, Shin Bet and the IDF unmask Unit 4000: the IRGC clandestine directorate for global terrorism\u00a0"},"content":{"rendered":"<div>\n<div id=\"ai-voice-player-wrapper\">\n<div class=\"ai-voice-player-container\" data-theme=\"light\">\n<p>        <!-- Summary Section (Initially Hidden) --><\/p>\n<p>        <!-- Translate Section --><\/p>\n<div id=\"ai-voice-translate-section\" class=\"feature-section\" style=\"display: none;\">\n<div class=\"feature-content\">\n<p>&#13;<br \/>\n                    <select id=\"ai-voice-translate-select\">&#13;<option value=\"en\">English (Original)<\/option>&#13;<option value=\"es\">Spanish &#8211; Espa\u00f1ol<\/option>&#13;<option value=\"fr\">French &#8211; Fran\u00e7ais<\/option>&#13;<option value=\"de\">German &#8211; Deutsch<\/option>&#13;<option value=\"ar\">Arabic &#8211; \u0627\u0644\u0639\u0631\u0628\u064a\u0629<\/option>&#13;<option value=\"zh-CN\">Chinese &#8211; \u4e2d\u6587<\/option>&#13;<option value=\"ja\">Japanese &#8211; \u65e5\u672c\u8a9e<\/option>&#13;<option value=\"ru\">Russian &#8211; \u0420\u0443\u0441\u0441\u043a\u0438\u0439<\/option>&#13;<option value=\"pt\">Portuguese &#8211; Portugu\u00eas<\/option>&#13;<option value=\"it\">Italian &#8211; Italiano<\/option>&#13;<option value=\"ko\">Korean &#8211; \ud55c\uad6d\uc5b4<\/option>&#13;<option value=\"nl\">Dutch &#8211; Nederlands<\/option>&#13;<option value=\"tr\">Turkish &#8211; T\u00fcrk\u00e7e<\/option>&#13;<option value=\"pl\">Polish &#8211; Polski<\/option>&#13;<option value=\"hi\">Hindi &#8211; \u0939\u093f\u0928\u094d\u0926\u0940<\/option>&#13;<br \/>\n                    <\/select>&#13;\n                <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>        <!-- Read Along Section --><\/p>\n<p>        <!-- Ask AI Section --><\/p>\n<div id=\"ai-voice-askai-section\" class=\"feature-section\" style=\"display: none;\">\n<div class=\"feature-content\">\n<div id=\"ai-voice-chat-messages\" class=\"chat-messages\">\n<div class=\"chat-message ai-message\">\n<p>\ud83e\udd16<\/p>\n<p>&#13;<br \/>\n                            Hi! I&#8217;m here to help you understand this article. Ask me anything about the content!&#13;\n                        <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>&#13;<br \/>\n                    <input type=\"text\" id=\"ai-voice-chat-input\" class=\"chat-input\" placeholder=\"Ask about the article...\"\/>&#13;<br \/>\n                    <button id=\"ai-voice-chat-send\" class=\"send-btn\">Send<\/button>&#13;\n                <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<p><em>By Andre Pienaar<\/em><\/p>\n<p>In a rare joint statement issued on 20 April 2026, the Mossad, the Shin Bet and the Israel Defense Forces disclosed the existence, structure and leadership of Unit 4000, a covert directorate of the Islamic Revolutionary Guard Corps (IRGC) Intelligence Organisation (IO) responsible for assassination, sabotage and targeted kinetic attacks on Israeli, Jewish and Western targets around the world.<\/p>\n<p>The disclosure set out, in unusual public detail, how the unit\u2019s senior leadership was identified, mapped and systematically eliminated during Operation Rising Lion, the Israeli component of the joint US\u2013Israeli campaign against Iran known in Washington as Operation Epic Fury.<\/p>\n<p>The statement also confirmed, for the first time, that the terror cell disrupted in Azerbaijan in early March 2026, whose targets included the Baku\u2013Tbilisi\u2013Ceyhan oil pipeline, the Israeli embassy in Baku, an Ashkenazi synagogue and a leader of the Mountain Jewish community, was a priority operation of Unit 4000.<\/p>\n<p>The joint disclosure is significant on three levels.<\/p>\n<p>First, it is the most complete public attribution to date of the IRGC\u2019s overseas terror-operations directorate.<\/p>\n<p>Second, it ends Iran\u2019s long-standing doctrine of plausible deniability for global terrorism.<\/p>\n<p>Third, it confirms that the Epic Fury campaign was not only a strike on Iran\u2019s missile, nuclear and conventional military infrastructure, but a deliberate decapitation of the IRGC apparatus that runs Iran\u2019s global war of terrorism outside its own borders against the US and its allies.<\/p>\n<h6 class=\"wp-block-heading\">The Azerbaijan plot: what was intercepted<\/h6>\n<p>Azerbaijan\u2019s State Security Service (DTX) announced on 6 March 2026 that it had disrupted a multi-target IRGC operation prepared over several months. The targets were the Baku\u2013Tbilisi\u2013Ceyhan (BTC) pipeline, the 1,768-kilometre strategic energy corridor that carries roughly one-third of Israel\u2019s imported crude oil, together with Israel\u2019s embassy in Baku, the city\u2019s Ashkenazi synagogue and a named leader of the local Jewish religious community.<\/p>\n<p>Azerbaijani investigators recovered 7.73 kilograms of C-4 military-grade explosive from a container abandoned in Baku\u2019s Sabail district, which was subsequently moved and concealed inside a military district of the capital. They also recovered explosive drones and fragmentation charges smuggled across the long and porous Iranian\u2013Azerbaijani border. At least ten individuals were identified in connection with the plot.<\/p>\n<p>Two Iranian nationals, Behnam Sahebali Rostamzadeh and Yaser Rahim Zandekian, were named as on-the-ground operatives working with Azerbaijani accomplice Tarkhan Tarlanoglu Guliyev. A senior IRGC intelligence officer, Ali-Asghar Bardbar Sharamini, was identified as the planner and coordinator. Hafez Tavassoli coordinated the operation on the ground. Several Iranian nationals have been placed on international wanted lists and a number of Azerbaijani citizens have been sentenced to prison terms.<\/p>\n<p>The Israeli joint statement released on 20 April confirmed that the Azerbaijan network did not operate on its own authority. It was a cell within a clandestine global directorate directed by named IRGC officers inside Iran, operating under a chain of command that stretched to the most senior levels of IRGC Intelligence.<\/p>\n<h6 class=\"wp-block-heading\">What Unit 4000 is, and what it is not<\/h6>\n<p>Unit 4000, also called Division 4000 or the Special Operations Department, sits inside the IRGC\u2019s Intelligence Organisation (Sazman-e Etela\u2019at-e Sepah, IRGC-IO).<\/p>\n<p>It is not part of the Quds Force. The Quds Force is the IRGC\u2019s foreign expeditionary military arm. It operates largely in the open, sustaining Hezbollah, the Iraqi Popular Mobilisation Forces, the Houthis and the Fatemiyoun and Zainabiyoun militias as a parallel state-to-state projection of Iranian military power. Quds Force operations are characterised by standing proxy forces, territorial presence and logistical depth.<\/p>\n<p>Unit 4000 is the covert-action counterpart of the Quds Force. Its mission is narrower and more clandestine: kinetic operations on third-country soil executed through deniable local cells. Its signature targets are Israeli diplomatic premises, Jewish communal institutions, specific strategic infrastructure and senior Israeli and Western officials. It works not through proxy armies but through networks of local criminal contacts, migrant-community recruits and in-country handlers, a tradecraft visible in plots attributed over the past two years to IRGC assets in the United States, Canada, Australia, the United Kingdom, Cyprus, Turkey, Greece, South Africa and now Azerbaijan.<\/p>\n<h6 class=\"wp-block-heading\">Unit 4000\u2019s chain of command now broken<\/h6>\n<p>The joint Israeli statement, read together with earlier Azerbaijani and Turkish disclosures, maps a four-level command structure. Every level has now been disrupted.<\/p>\n<ol class=\"wp-block-list\">\n<li>At the top sat Majid Khademi, head of the IRGC Intelligence Protection Organisation. Khademi\u2019s position in the IRGC-IO hierarchy placed Unit 4000 among the directorates he oversaw. His exposure had begun before the Israeli air campaign: on 30 January 2026, the US Treasury\u2019s Office of Foreign Assets Control designated Khademi under its IRGC, Iranian Financial Sanctions Regulations and Iran Human Rights authorities for his role in the violent repression of Iranian protestors. Approximately four weeks later, on 28 February, Khademi was killed in the opening phase of Operation Rising Lion. The sequence, OFAC designation followed by targeted kinetic strike, illustrates how sanctions designations are functioning in the current campaign as public warning markers on targets that are separately being prepared for kinetic action.<\/li>\n<li>Beneath Khademi served Rahman Moghadam (also rendered Makadam) as the operational chief of Unit 4000 and head of the Special Operations Department. Moghadam managed the overseas network day to day, training and recruiting operatives inside Iran and assigning them to gather intelligence on Israeli political and diplomatic officials and other targets. He was killed in an Israeli Air Force strike in the early days of Operation Rising Lion.<\/li>\n<li>Mohsen Suri was the key operator beneath Moghadam. Suri\u2019s function was that of a travelling case officer: he moved between jurisdictions to meet local terror cells in person, direct their missions and bring new groups into the network. That role gave Israeli intelligence the critical seam in Unit 4000\u2019s structure. When Mossad and Shin Bet identified the emergency IRGC facility where Suri was sheltering with other intelligence personnel during the war, he was killed in a targeted strike on that facility.<\/li>\n<li>The fourth named figure, Mehdi Yekeh-Dehghan, operating under the alias \u201cthe Doctor\u201d, was Unit 4000\u2019s country-level handler for Azerbaijan and Turkey. Beyond the Azerbaijan operation, Yekeh-Dehghan was also running a parallel Turkey\u2013Cyprus axis: smuggling explosive drones from Iran into Turkey and onward to Cyprus, and conducting reconnaissance on US and allied military assets, including Incirlik Air Base in Adana. Yekeh-Dehghan\u2019s exposure did not begin in Azerbaijan. In January 2026, Turkish authorities arrested several individuals, including an Iranian national, on espionage charges connected to his network. That arrest was, in retrospect, the first visible thread.<\/li>\n<\/ol>\n<h6 class=\"wp-block-heading\">Why the BTC pipeline was the centrepiece target in Azerbaijan<\/h6>\n<p>The selection of the Baku\u2013Tbilisi\u2013Ceyhan pipeline as the critical infrastructure target reveals much about Iran\u2019s strategic calculus. BTC is a 1,768-kilometre pipeline from the Sangachal terminal on the Caspian, through Tbilisi in Georgia, to the Mediterranean port of Ceyhan in Turkey. Its throughput capacity is approximately 1.2 million barrels per day. Crucially, it carries roughly one-third of Israel\u2019s imported crude oil.<\/p>\n<p>Targeting BTC served three simultaneous strategic purposes.<\/p>\n<p>First, it was a direct economic blow to Israel\u2019s war economy. A successful strike, even a partial interruption, would have forced Israel into emergency substitution from Gulf or Atlantic cargoes at a punitive premium during active hostilities, with associated shipping insurance and rerouting costs.<\/p>\n<p>Second, it was a punitive signal to Azerbaijan and Turkey, the two countries that have most openly aligned with Israel against Iran. Baku\u2019s security cooperation with Israeli intelligence, including reported use of Azerbaijani territory for operations against Iran, has long been a grievance in Tehran. Ankara\u2019s maintenance of the Turkish leg of the corridor, and its continuing integration with Israeli energy supply chains, completes the picture. BTC is a shared Azerbaijani\u2013Turkish strategic asset. Hitting it was a message to both capitals that their partnership with Israel carried operational cost inside their own territory.<\/p>\n<p>Third, it preserved Iran\u2019s clandestine terrorism on a non-attributable basis. A ballistic or cruise missile strike on BTC would have been directly attributable and would have invited conventional retaliation on Iranian soil. An improvised explosive device attack on a pipeline passing through a third country, executed by Azerbaijani nationals recruited through local criminal networks, maintained a plausible-deniability posture consistent with Unit 4000 doctrine.<\/p>\n<p>The concurrent Jewish-community targets, the Israeli embassy, the Ashkenazi synagogue and a leader of the Mountain Jewish community, are the ideological signature of Unit 4000. That signature is not new. It traces in an unbroken line back to the bombings of the Israeli Embassy in Buenos Aires in 1992 and the AMIA Jewish community centre in 1994, whose attribution to IRGC networks has been established for three decades.<\/p>\n<h6 class=\"wp-block-heading\">Tradecraft exposed<\/h6>\n<p>Several operational details from the Azerbaijani and Israeli disclosures warrant further analysis.<\/p>\n<p>The cell moved 7.73 kilograms of C-4 and explosive drones overland from Iran into Azerbaijan and then cached material inside a military district of Baku. The choice of a military district for concealment, rather than a civilian warehouse or residential property, implies one of two things: either corrupted insiders inside Azerbaijani military infrastructure, or deliberate exploitation of perimeter security gaps in hardened areas. Either interpretation suggests substantial intelligence preparation of the Azerbaijani operating environment before the kinetic preparation began.<\/p>\n<p>The local-proxy layer matches a template now visible across multiple jurisdictions. Iranian handlers run third-country-national operatives through ordinary criminal contacts, while the command and planning layer remains inside IRGC-IO safe houses on Iranian soil. That architecture has been observed in plots attributed to IRGC assets in Australia, where members of a Sydney motorcycle gang were recruited as executors, and in the United States, the United Kingdom and Scandinavia, where migrant-community recruits have been used similarly.<\/p>\n<p>Compartmentalisation appears to have broken down. Mossad\u2019s ability to roll up Turkey, Cyprus and Azerbaijan cells from a single investigative thread suggests either excessive concentration of control in a small number of travelling handlers such as Yekeh-Dehghan and Suri, or communications-security failures across cells that should have been siloed from each other. That is a structural vulnerability in the Unit 4000 model. The deniability that makes the architecture politically useful also makes it operationally thin when one handler falls.<\/p>\n<p>The most revealing detail is Suri\u2019s presence at what Israeli agencies described as a pre-identified IRGC \u201cemergency facility\u201d. That characterisation indicates Mossad and Shin Bet had mapped Unit 4000\u2019s continuity-of-operations infrastructure inside Iran well before the kinetic phase of the campaign began on 28 February. The 20 April public disclosure is the surface expression of an intelligence picture that had been complete for months.<\/p>\n<h6 class=\"wp-block-heading\">Strategic implications<\/h6>\n<p>For Iran, the short-term implication is the loss of the top three command levels of its principal overseas terror-operations directorate in a span of roughly six weeks. Reconstitution is possible, but the institutional memory needed to run a network of this reach does not transfer neatly to a successor. Any replacement commander will also have to operate inside the post-Khamenei succession vacuum created by the deaths of the Supreme Leader and senior regime figures during Epic Fury, without the clear political top cover that Unit 4000 has historically enjoyed from the Supreme Leader\u2019s office. The joint Israeli disclosure is designed to extend the cost of reconstitution: every new tasking will now be attributed in advance, precisely the condition Iran\u2019s deniability architecture was built to prevent.<\/p>\n<p>For Azerbaijan, the posture shift is visible and consequential. Azerbaijan is the other major Shia power in the world, but Baku offers a secular alternative model of governance to Iran\u2019s radical theocracy. Baku\u2019s March disclosure, followed by the Iranian drone strike on Nakhchivan that wounded four people and struck Nakhchivan Airport terminal, has eroded whatever residual restraint President Aliyev maintained in pushing back publicly against Tehran. The BTC pipeline now sits on Iran\u2019s confirmed kinetic target list in a way that cannot be publicly retracted, and pipeline-specific insurance and reconstruction cover will reflect it.<\/p>\n<p>For the wider theatre, the overseas target set extends materially beyond Azerbaijan. The Israeli statement named Turkey, Cyprus, Greece and other European jurisdictions as nodes. A rolling wave of second-order arrests should follow as the intelligence underpinning the 20 April disclosure is shared with allied European services.<\/p>\n<h6 class=\"wp-block-heading\">Bottom line<\/h6>\n<p>What Azerbaijan intercepted in March was not a rogue cell. It was a multi-faceted priority operation of a clandestine IRGC Intelligence directorate that operates globally.<\/p>\n<p>The entire command chain, Majid Khademi, Rahman Moghadam, Mohsen Suri and the Yekeh-Dehghan country-handler network, has been physically or legally neutralised inside a single six-week window by Israel, making the wider international environment safer.<\/p>\n<p>The joint Mossad, Shin Bet and IDF disclosure on 20 April confirms that Operation Epic Fury was not only a strike on Iran\u2019s missile, nuclear and conventional military apparatus. It was a targeted decapitation of the directorate that executes Iran\u2019s clandestine war of terrorism outside its own borders.<\/p>\n<p>For the first time in a generation, Iran\u2019s doctrine of plausible deniability for global terrorism is being publicly dismantled in real time. The question the Azerbaijan plot poses is not whether Unit 4000 will reconstitute. It is whether the Islamic Republic\u2019s political leadership, in its current decapitated state, still has the coherence to authorise and mobilise Unit 4000\u2019s reconstitution, and what the new set of targets will be.<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>&#13; &#13;English (Original)&#13;Spanish &#8211; Espa\u00f1ol&#13;French &#8211; Fran\u00e7ais&#13;German &#8211; Deutsch&#13;Arabic &#8211; \u0627\u0644\u0639\u0631\u0628\u064a\u0629&#13;Chinese &#8211; \u4e2d\u6587&#13;Japanese &#8211; \u65e5\u672c\u8a9e&#13;Russian &#8211; \u0420\u0443\u0441\u0441\u043a\u0438\u0439&#13;Portuguese &#8211; Portugu\u00eas&#13;Italian &#8211; Italiano&#13;Korean &#8211; \ud55c\uad6d\uc5b4&#13;Dutch &#8211; Nederlands&#13;Turkish &#8211; T\u00fcrk\u00e7e&#13;Polish &#8211; Polski&#13;Hindi &#8211; \u0939\u093f\u0928\u094d\u0926\u0940&#13; &#13; \ud83e\udd16 &#13; Hi! I&#8217;m here to help you understand this article. Ask me anything about the content!&#13; &#13; &#13; Send&#13; By Andre Pienaar<\/p>\n","protected":false},"author":1,"featured_media":5008,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[],"class_list":{"0":"post-5007","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-iran"},"_links":{"self":[{"href":"https:\/\/sawahsolutions.com\/national\/wp-json\/wp\/v2\/posts\/5007","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawahsolutions.com\/national\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawahsolutions.com\/national\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawahsolutions.com\/national\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sawahsolutions.com\/national\/wp-json\/wp\/v2\/comments?post=5007"}],"version-history":[{"count":1,"href":"https:\/\/sawahsolutions.com\/national\/wp-json\/wp\/v2\/posts\/5007\/revisions"}],"predecessor-version":[{"id":5009,"href":"https:\/\/sawahsolutions.com\/national\/wp-json\/wp\/v2\/posts\/5007\/revisions\/5009"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawahsolutions.com\/national\/wp-json\/wp\/v2\/media\/5008"}],"wp:attachment":[{"href":"https:\/\/sawahsolutions.com\/national\/wp-json\/wp\/v2\/media?parent=5007"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawahsolutions.com\/national\/wp-json\/wp\/v2\/categories?post=5007"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawahsolutions.com\/national\/wp-json\/wp\/v2\/tags?post=5007"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}