In late 2023, Israeli intelligence received information that Hezbollah,
the Lebanese terrorist organization, had been given the green light to
kill Moshe (Bogie) Ya'alon.
At the top of the Military
Intelligence Directorate, officials struggled to understand the nature
of the intelligence, which seemed to have landed on them without
context. No one in the intelligence community had the faintest idea that
Hezbollah was planning to assassinate the former defense minister and
IDF chief of staff, or anything close to that.
But the report, whose existence is
being revealed here for the first time, came from reliable sources, and
Military Intelligence decided not to take any risks. Officials called
the Shin Bet security agency, the body responsible in Israel for
protecting public figures. "We don't know exactly what is going on,"
they told them. "But Bogie should not leave the house any time soon."
"That night I slept in my apartment
in central Israel," Ya'alon, a member of Kibbutz Grofit in the Arava
region, recalled this week. "The next morning I was planning to head out
early for a handbike ride in Yarkon Park, as part of an activity I have
been doing for years with wounded IDF soldiers. But before dawn, Shin
Bet people came to my house, knocked on the door and told me, 'You are
not going out.'"
Did that surprise you?
"No, because for many years now I
have seen myself as a target. That means looking around, being cautious
and sensitive to any change."
Ya'alon may be sensitive to every
change, but on that day he came within a hair's breadth of death. At
around 6:30 a.m. on September 15, 2023, while Ya'alon remained inside
his apartment in central Israel on Shin Bet instructions, a powerful
Claymore-type explosive device detonated in Tel Aviv's Yarkon Park. The
device had been planted beneath a tree, directly on Ya'alon's planned
riding route. Only by sheer luck was no one hurt.
Following the explosion, the Shin
Bet launched an investigation. With the help of security cameras, it
quickly traced those who had planted the bomb and arrested them later
that same day with police assistance. In the interrogation rooms, the
suspects spun for their interrogators a long and convoluted story that
exposed an extensive terrorist network and the blindness of the entire
intelligence community. It turned out that, right under its nose, a
skilled and well-equipped terrorist cell had been operating inside
Israel, and only a great deal of luck prevented it from carrying out its
plan: revenge.
Karma
Ibrahim Makhoul, an Israeli
citizen, had made a living from smuggling even while living in Israel,
and maintained ties with criminal elements in Lebanon. Handguns, drugs,
weapons, Makhoul moved all of them across the border fence and into
Israel. In early 2023, he apparently decided to expand his business and
crossed into Lebanon on his own initiative. When Hezbollah operatives
captured him, they immediately suspected he was an Israeli spy. After
several days of interrogation, they realized they had in their hands a
smuggling expert with deep ties inside Israel, and recruited him.
Under Hezbollah's protection,
Makhoul began smuggling weapons and drugs into Israel through the
Lebanese border, relying on his friends in Israel. As emerges from the
severe indictment filed against eight of them, all of whose names are
barred from publication, Makhoul at some point enlisted his
acquaintances to carry out what can be called the "Claymore plan": an
operation to assassinate two senior Israeli security figures using
explosive devices to be smuggled from Lebanon. The operation was run by
Hezbollah, but according to Israeli intelligence assessments, it was
directed by figures in Iran's Islamic Revolutionary Guard Corps. The
explosive devices themselves, Israel believes, were manufactured in Iran
or with Iranian assistance.
In summer 2023, Makhoul called two
of his friends in Israel on WhatsApp and Signal video calls, while
filmed against the backdrop of a car with a Lebanese license plate and
holding a weapon. In this way he proved to them that he was cooperating
with Hezbollah and working for it, and that there was a good deal of
money in this business. Makhoul instructed them to reach the border with
Lebanon near Kibbutz Sasa, and while they were driving along the fence
he guided them to a point where they picked up packages of weapons and
military equipment that had been thrown in advance over the border fence
from Lebanon. In this way, the terrorist cell succeeded in smuggling
into Israel a carbine rifle, two handguns, and above all three Claymore
devices.
The advanced explosive devices were
later transferred, under Makhoul's direction, to other figures in the
terrorist network he had built, through a maze of intermediaries,
cellphones purchased for the purpose and dead drops. One of the places
where the explosive devices were hidden was a girls' school in the
Palestinian town of al-Eizariya, near Jerusalem. All of this was
discovered by the intelligence services only in hindsight.
At the end of August 2023, Makhoul,
who was operating in Hezbollah's service and under Iranian direction,
began engineering the next stage of his Claymore plan. Under his
instructions, one of the members of the network in Israel bought a
remotely controlled camera and installed it in his car. That same
terrorist also fitted one of the Claymore devices with a remote
activation mechanism. "We are going to kill an important person,"
Makhoul told his partner in a phone conversation.
On the evening of September 14,
2023, the terrorist arrived at Yarkon Park equipped with the explosive
device and planted it at the point Makhoul had instructed him to. He
parked his car so that the camera inside it was aimed at the tree
beneath which the device had been planted. From that moment on, all that
was needed was to press a button, somewhere in Lebanon. Only in
hindsight did Israel understand that this was what Hassan Nasrallah had
meant when he gave the authorization to kill Bogie Ya'alon.
Ya'alon did not pass through the
park that day. The explosive device went off anyway at 6:30 a.m.,
apparently because of a mistaken identification, according to the Shin
Bet, and no one was hurt. This was the closest Iran had ever come to
assassinating a senior Israeli official. In hindsight, it became clear
that the same terrorist network had planned to assassinate another
former senior security figure using an additional Claymore device. The
identity of that figure is barred from publication, but it can be said
that he held one of Ya'alon's former positions.
Military Intelligence received much
praise because of the affair. The attack on Bogie had been foiled only
thanks to the strange piece of information it picked up at the last
minute. But the Military Intelligence officers who handled the case did
not allow themselves to rejoice. They felt that this was an intelligence
failure that had turned into a success almost purely by chance. A
fluke. Three weeks later came the surprise attack of October 7.
Immediately after the bomb exploded
in Yarkon Park, a gag order was imposed on the details of the
investigation, and it was lifted only a year later. By the time the Shin
Bet finally exposed the terrorist cell that had intended to assassinate
Ya'alon, the war was already at its height and the story had faded and
been forgotten. But the attempted assassination of the former defense
minister and chief of staff is only one expression of a broad and
long-running Iranian project, led by the Revolutionary Guards and
intended to strike senior Israelis wherever they may be. It is an
ongoing, sophisticated effort, driven mainly by feelings of revenge,
feelings that took root among the Iranians long before the killing of
Ayatollah Khamenei. The scale and depth of this Iranian operation are
described here for the first time.
"I know very well who sent the cell
that was meant to kill me," Ya'alon told us. "It was a senior Hezbollah
figure, working in cooperation with the Iranians. Luckily for me, a
pager exploded in his hand, and he lost his hand and his eyesight. In
that respect, I have some satisfaction, because as defense minister I
approved the idea behind the pager operation."
The targets
It is not recommended to rely on
karma, which so far has prevented Iran from assassinating a senior
Israeli figure. "The fact that until now none of our senior commanders,
in Israel or abroad, has been murdered owes a lot to luck," says a
former senior IDF officer familiar with the issue.
Iranian activity aimed at harming
senior Israeli figures has been going on for decades, first under the
umbrella of Iranian intelligence and later under the Quds Force of the
Islamic Revolutionary Guard Corps. Over that period, the Iranians have
operated in several waves. For example, between 2011 and 2016, following
a wave of killings of Iranian nuclear scientists attributed to Israel,
more and more Iranian attempts were uncovered to retaliate by harming
figures in Israel, from security personalities to businessmen.
The current wave began in January
2020, immediately after the killing of Quds Force commander Gen. Qassem
Soleimani. "Their efforts intensified greatly after Soleimani was
killed, and later after the assassination of Mohsen Fakhrizadeh, head of
the nuclear program, in November of that same year," confirms a former
Mossad official who until recently dealt precisely with these matters.
"The motivation is revenge," adds
Shalom Ben Hanan, former head of the Shin Bet's counterespionage
division. "We have been killing their senior figures for many years. In
recent years it has also come out in the media, and the Iranians want to
create a response equation, a price tag. This is a very significant
issue for them and part of the overall campaign they are waging against
us."
One of the tools the Iranians use
to gather intelligence on senior figures in Israel is the spy network
they have deployed inside the country, which surfaced after October 7.
"Under the heading of Iranian espionage in Israel, the target of harming
individuals is one of the central ones," Ben Hanan says. "Many of those
involved in espionage affairs in the past two years, at some point in
the investigation it emerges that they were offered the chance to
assassinate a senior figure or collect intelligence on a senior figure
in preparation for an assassination. Sometimes it is a blunt proposal,
sometimes it is a request to collect pre-operational intelligence, and
sometimes it is testing and probing the willingness of that person to
carry out an assassination."
According to data Israel Hayom
publishes here for the first time, since the outbreak of the war the
Shin Bet and the police have uncovered 38 cases of Israelis recruited by
Iran, of which in 13 cases Israeli citizens were asked to collect
information on senior Israeli figures in order to pass it on to Iranian
operatives.
Among the targets identified by
Shin Bet investigations during this period are Prime Minister Benjamin
Netanyahu, ministers Israel Katz and Itamar Ben-Gvir, MK Benny Gantz,
who held several senior security positions, former prime minister
Naftali Bennett, former defense minister Yoav Gallant, former IDF chief
of staff Herzi Halevi, former Shin Bet head Ronen Bar, and even a senior
female academic working at the Institute for National Security Studies.
"The Iranians have a well-oiled system, it works all the time, and they
have high motivation," says a legal source familiar with some of these
cases.
The Iranian effort to assassinate
senior figures intensified even further after Operation Rising Lion.
"There we basically carried out a decapitation operation against them,
with wholesale assassinations," in Ben Hanan's words. Following that,
the Shin Bet began identifying persistent Iranian attempts to recruit
and run more and more Israeli citizens for the purpose of harming
individuals, with an emphasis on senior officers. During the operation,
the IDF set up a "shadow general staff," intended to deal with a
situation in which the army's top brass was hit, and one of the
directives barred the chief of staff and his deputy from being in the
same room. Former chief of staff Herzi Halevi also received increased
security during the operation and was instructed not to move around in
crowded places. Other generals were asked to evacuate their homes for
several days. During Operation Lion's Roar as well, security was
reinforced for officers, along with some cabinet ministers and other
senior figures. In several cases, the families of senior figures were
asked to leave their homes and move to alternative apartments.
"The counterespionage division
that I headed made a leap forward in the past decade in everything
related to Iranian espionage," says Ben Hanan. "It is investing a great
many resources in this, including setting up new units operating in
cyberspace, greatly expanding the use of human intelligence tools,
working with technologies suited to the world of state espionage, and
international cooperation."
The IDF also stepped up its
security arrangements for senior officers at the start of the October 7
war, through the General Staff unit for protecting senior officials in
the Operations Directorate. The unit, which among other things runs a
command center linked 24/7 to cameras documenting protected officers,
has been expanded significantly over the past two years. For example,
the unit began providing exceptional protection to the commander of the
Nevatim Air Force Base as early as November 2024. The opposition channel
Iran International claimed that the Nevatim commander was the
assassination target of seven Israelis from northern Israel accused of
spying for Iran.
"There are people, mainly in
politics, who like the security around them because it is a status
symbol," says Brig. Gen. (res.) Ran Kochav, who during his tenure as IDF
spokesman was protected at the highest level after receiving threats on
his life דווקא from far-right activists. "In my experience, it is
something very unpleasant. The bodyguard is attached to you 24 hours a
day and sits outside your house while you sleep, shower or host guests,
and they put cameras inside your private space. Sometimes in the middle
of the night you feel like opening the door and telling the bodyguard,
'Brother, forget the security. Come in and warm up.'"
The expansion of the unit
protecting senior officials joins another step the IDF is preparing to
take: the establishment of a new brigade in the Operations Directorate
that will bring under it the unit for protecting senior officials, the
Information Security Department operating in Military Intelligence, and
the Military Police's camp protection array. "This is a direct result of
the IDF's understanding that there is a problem not only with
protecting senior figures, but also with everything connected to
information security in general and the leaking of secrets," says a
source familiar with the details. As of the time of writing, the new
brigade is expected to be headed by Tal Ashur, who was commander of the
Multi-Domain Unit and commander of the Southern Brigade in Gaza. He is
to be promoted to brigadier general.
"The spray method"
In Israel, of course, efforts are
being made to thwart plots to assassinate senior figures and also to
protect them as much as possible. But not infrequently the Iranians have
managed to come close again to carrying out their plans. One such case
occurred in October 2024. This time the target was a well-known Israeli
scientist living in Rehovot.
For several months, Binyamin
Weiss, a resident of Bnei Brak, had been in contact with an Iranian
handler through messaging apps on his phone. Weiss carried out tasks for
his handler such as setting cars on fire, spraying graffiti and hanging
posters calling for civil revolt. Seemingly, Weiss was just another one
of those low-level Israeli spies caught in the web Iran had cast
online. But at a certain point Weiss's activation was escalated, and he
was asked to gather intelligence on a well-known Israeli scientist
living in Rehovot. Weiss agreed. He drove to Rehovot and photographed
the scientist's home and car using a camera that transmitted the
information back.
The intelligence supplied by
Weiss was used by the Iranians to direct a terrorist cell from Beit
Safafa that had already managed to obtain weapons and was on its way to
the scientist's home. Thanks to Shin Bet intelligence guidance, which
apparently had already been tracking the cell, its members were
arrested. "But this is proof of Iranian activity not only on the
intelligence level, but also on the operational level," a security
source said this week. "In this case, there really was an assassination
cell that was ready to carry out the killing."
Another case foiled by the Shin
Bet and the police was that of Vadim Kupriyanov, a handyman who had
simply been looking for work in a Telegram group for job seekers.
Someone in the group apparently identified Kupriyanov's strong desire to
make easy money, and began running him on seemingly simple jobs. In the
Shin Bet, this Iranian recruitment practice is called "the spray
method."
The first tasks given to
Kupriyanov were described by his handler as "real estate jobs." He
photographed busy streets in cities in central Israel, later also prices
of products in supermarkets and pharmacies, and sent them in. In his
defense, Kupriyanov would later claim that he did not think he was
carrying out espionage tasks. In any event, he was paid thousands of
shekels for the service via cryptocurrency.
Kupriyanov became so enthusiastic
about the easy money he was making that he opened an additional
Telegram user account on his partner's phone and established a second,
parallel connection with the Iranian handler, thinking he could make
money twice over. The Iranians, whether or not they knew that Kupriyanov
was "working" them, began raising the bar of the missions. His partner,
who sensed that something was not right with what was going on on her
phone, urged him to stop, but Kupriyanov ignored her.
At a certain point, Kupriyanov
was asked to install a camera in the front and rear of his car and drive
to a certain address in Ra'anana. According to him, he did not know
that it was the home of former prime minister Naftali Bennett. In line
with the instructions he received, he circled Bennett's house in
Ra'anana and then positioned himself with the car up the street, with
the camera aimed at the house and transmitting constantly backward. At
that stage he was arrested on the spot by the Shin Bet, and an
indictment was later filed against him.
The cases of Weiss and Kupriyanov
are characteristic of the Iranian method of operation: the use of
Israeli agents activated through readily available messaging apps, paid
in digital currency, and taken through a slippery process of escalation.
Another case with similar
characteristics that was recently exposed involved the collection of
intelligence around Gallant's home. Fares Abu al-Hija, a 32-year-old
resident of Kaukab Abu al-Hija, had also been looking for casual work
online. He connected with a figure calling himself "Martin" and began
receiving relatively simple assignments from him, including buying and
transferring cellphones. At the end of each such mission, Abu al-Hija
sent a photo and video to his Iranian handler to prove that it had
indeed been carried out. In return, he was paid through the Binance app.
After several such tasks, he was asked to photograph a café in Tel
Aviv.
Abu al-Hija's "classic" process
of escalation took a twist when it became sharp and steep almost all at
once. At a relatively early stage in the operation, he was asked to go
to the community of Amikam, where Gallant lives, and document several
streets. A report on Channel 12 claimed that in any case Gallant was not
staying at his home at that time, after he had been asked to leave
because of another affair in which someone else had been discovered
photographing the area around his residence.
Abu al-Hija was arrested on the
spot, immediately after he sent "Martin" photos and videos from Amikam.
That fact, combined with the timing of other arrests for similar
offenses, may point to the working method of the Shin Bet and the
police. A source familiar with the issue who spoke with us says that the
Shin Bet tracks many Iranian operations in parallel, and tries to
balance the need to "maintain control" with the desire to gather more
evidence against Israeli spies. "The Shin Bet is flooded with many
incidents, and it is impossible to monitor everything," he explains.
"Therefore, from the moment an activation process 'deteriorates' to a
certain stage, arrests are made as quickly as possible."
A ticking bomb
Somewhat oddly, neither the Shin
Bet nor the police has succeeded in formulating a profile of the average
Israeli "assassin." The spies run by Iran who have been caught paint a
colorful mosaic that includes different ages and backgrounds, diverse
population groups and varying motivations. "We have not managed to
identify common DNA," says Chief Insp. Yossi Elkrif. "It starts with
people who are desperate for money, use drugs of various kinds or who
understand that easy money will help them survive, and goes all the way
to normative people, but apparently the thrill gives them great
satisfaction."
For nine years now, Elkrif has
served as an investigations officer in the security division of Lahav
433's international crime investigations unit. As such, he has a
long-term perspective on Iran's efforts to activate agents in Israel.
"Since October 7 we have seen a significant increase, by hundreds of
percent, in cases involving contact with an Iranian agent," he says.
"They are trying to get as deep as possible into the soft underbelly of
the State of Israel."
One of the spies Elkrif himself
investigated is Yaakov Perel, a Satmar Hasid arrested in September 2025
and charged with assisting the enemy in wartime and passing information
to the enemy with intent to harm state security. "In his case, for
example, the motivation was not money but ideology," Elkrif says. "We
defined him as a 'ticking bomb.' In the interrogation room, when he
already understood he was facing many years in prison, he told me, 'So
much the better, now I will spread my doctrine in prison.'"
Perel, an anti-Zionist activist
with Israeli and US citizenship, was living in Morocco, where he first
made contact with the Iranians back in 2017. In November 2024, after
Nasrallah was killed, the enraged Perel contacted an Iranian handler on
Telegram and offered his services. Under Iranian direction he flew from
Casablanca to Boston to renew his Israeli passport at the Israeli
consulate, where he bought two "operational" phones with SIM cards and
installed apps for encrypted messaging with his handlers. Two days later
he landed in Israel and rented an apartment in Beit Shemesh. According
to the understandings between Perel and his handlers, he was told that
immediately after completing his tasks in Israel, they would arrange
political asylum for him in Iran, together with all the members of his
family.
Perel began by photographing
train stations, but was quickly sent on two more complex missions:
gathering intelligence around the homes of Minister Ben-Gvir and former
chief of staff Halevi. Because he did not have a driver's license, he
installed cameras on his bicycle and began riding around the homes of
both targets. He transmitted the video live to his handlers in Iran. In
this case as well, he was arrested immediately after the act. "In the
interrogation, when Perel was already trying to reduce the legal damage
for himself, he explained that he saw this as legitimate transmission of
information," investigator Elkrif says. "He knew that what he was doing
could lead to harm to Ben-Gvir and Halevi, but he said, 'I will not
pull the trigger.'"
Perel's trial is still ongoing,
like the trials of most of the Iranian spies caught in Israel. In fact,
apart from Moti Maman, a resident of Ashkelon who was sentenced to 10
years in prison after being convicted of contact with a foreign agent,
all the other cases opened in these affairs over the past two and a half
years are still underway. Even Maman's case ended in conviction only as
part of a plea bargain.
Within the law enforcement system
there are those who are dissatisfied with the conduct of the judicial
system on this issue and claim it is dragging its feet. On the other
hand, there are those who argue that the legislature set a very high
threshold of punishment for security offenses, while in practice many of
the detainees are "stupid kids who did not fully understand what they
were doing." That gap causes the prosecution and the courts, according
to this view, to hesitate before convicting defendants of offenses such
as contact with a foreign agent and assisting the enemy in wartime.
Besides being the only one
convicted so far, Maman's story, who in an exceptional case visited Iran
and met with local intelligence figures, provides fascinating testimony
to the strong interest of the Revolutionary Guards in assassinating the
most senior people in Israel. "The Iranians tried to understand whether
Maman could get to Netanyahu or to Bennett," says attorney Eyal
Besserlik, who represented Maman in the case and represents him on
appeal. "Moti was obviously not in that direction, but they really
insisted that he 'get to the man in Ra'anana.' Therefore, one of the
first things Moti did when he landed in Israel and was immediately
arrested was to ask that Bennett's security be increased. He told the
Shin Bet that even while he was barred from meeting a lawyer." According
to Besserlik, Maman offered to become a double agent who would work מול
the Iranians and deceive them, but the prosecution rejected the
proposal after consulting with the police unit and the Shin Bet.
Iranian attempts to harm Israelis
do not end within the borders of the State of Israel. "There are
constant attempts to assassinate and especially to kidnap senior figures
abroad," says Ben Hanan, whose counterespionage division also dealt
with this issue. "These are mainly security figures who were exposed to
classified and sensitive information."
For that purpose, the Iranians
use what is known as a "honey trap," intended to lure the target to a
particular place. Ben Hanan reveals here for the first time one such
attempt, in an effort to kidnap a very senior former figure in the
security establishment. "The Iranians recruited an Israeli man, and we
in the Shin Bet got onto it but did not understand why he interested
them specifically," Ben Hanan recounts. "Only then did we realize that
the goal was to use that Israeli, who happens to know several security
figures, in order to lure the final targets of the Iranian operation. He
was supposed to receive large sums of money for that."
At a certain point, that Israeli
did in fact approach a senior security personality, a man who had held a
very high security clearance, and tried to persuade him to meet at a
certain point abroad. "At that point we stopped him and interrogated
him," Ben Hanan says. "What I have just told you is based on that
suspect's confession in interrogation."
"Since its establishment, the
Khomeinist regime has operated to harm Israelis abroad," adds Yoram
Schweitzer, a former intelligence official who researches terrorism. In a
study he recently published together with Anat Shapira, Schweitzer
analyzes Iranian methods of operation for harming Israelis abroad,
including senior figures. Among those methods are the recruitment of
local operatives, in many cases criminals, in order to give Iran
plausible deniability; the use of extortion and threats, including
against family members, when recruiting operatives; and the use of
cryptocurrency to finance operations. Using these methods, the Iranians
have in recent years tried to harm Israeli businessmen in Turkey and
Georgia, and more recently also Israel's ambassador to Mexico.
"The body that took the lead in
these operations is the Quds Force of the Revolutionary Guards, which
specializes in running cells or individuals outside Iran," says
Schweitzer. "The Iranians have an almost absolute monopoly on managing
assassination operations, whether abroad or in Israel. Naim Qassem,
while still serving as Hezbollah's deputy leader, admitted that
operations abroad can be carried out only with the approval of the
supreme leader, because of the complexity and implications of the
event." Hezbollah, according to Schweitzer, at times serves as a
"contractor" for the Iranians, especially in places where the Lebanese
terrorist organization has access to operatives on the ground in Israel,
exactly as in the attempted assassination of Bogie Ya'alon.
Incidentally, the man in Iran who
was responsible for managing the broad operation of assassinating and
kidnapping senior Israelis was Saeed Izadi, a senior general in the
Revolutionary Guards. He himself was killed in Operation Rising Lion.