Israel’s covert operations in Iran: How advanced AI and cyber warfare transformed targeted strikes

The Israeli intelligence agencies have long collaborated with their American counterparts, notably the CIA and NSA, in covert operations targeting Iran.

Among these operations is the Stuxnet program, unveiled in 2010, which used malicious code to target Iran’s uranium enrichment program.

However, many of the intelligence capabilities used today to target Iranian leadership were developed only after a wave of cyber confrontations between Tehran and Tel Aviv about five years ago. Following suspected Iranian attacks that disrupted Israeli water facilities, Israel retaliated with a series of counter-operations, including disabling traffic signals in Tehran, shutting down gas stations by sabotaging their systems, and preventing Basij forces from withdrawing money from ATMs.

However, these operations, limited as they may seem, were masking a broader campaign led by Unit 8200 to penetrate what officials describe as Iran’s “digital nervous system.” “Everything that can be hacked, we tried to hack,” said an Israeli military official, referring to phone calls, traffic cameras, and even internal security systems.

Intrusions reached sensitive databases managed by security agencies, including sites used as command centers during emergencies or as alternative shelters for leaders. The official added, “Sometimes we accessed data from Revolutionary Guard intelligence, sometimes from the army or police… our access to information became deeper and more precise.”

In contrast, Iran’s domestic surveillance policies inadvertently created unexpected vulnerabilities — by forcing the routing of communications through centralized internet control centers, those very points became potential targets for hacking.

A former Western intelligence official explained that “stealth penetration provides an extremely strong observation point,” enabling the interception of messages and calls belonging to regime officials.

Although Tehran moved to tighten these loopholes by imposing restrictions on mobile phone usage within security agencies, these measures did not completely halt the breaches. “Even if the phone is banned during work, the person will return to use it once off duty… no one lives in isolation,” one official said.

What is the decisive factor?

According to a Washington Post report, the decisive factor lies in an advanced AI platform used to analyze vast amounts of data extracted from within Iran to track leaders’ movements and map their behavioral patterns; officials describe this tool as one of the major intelligence developments in the last decade.

The results of these capabilities became evident during the 12-day campaign last year, in which concurrent strikes targeted Iran’s nuclear infrastructure and military leaders. The information was so precise that it allowed missiles to be redirected mid-flight according to the targets’ movements.

However, this precision was not always absolute. In early March, Israel targeted the “Assembly of Experts” headquarters in Qom, where members were scheduled to meet to discuss succession. The building was destroyed, but the meeting had been held virtually, sparing the members from harm. A defense official clarified that the goal was to disrupt the meeting, not eliminate its participants.

As American and Israeli military leaders sketched war plans against Iran, a clear formula emerged in the division of roles: the U.S. focused on targeting Iran’s military and nuclear infrastructure, while a more sensitive mission was assigned to Israel, tracking and targeting Iranian leaders.

According to the Washington Post, Israel carried out this mission at an unprecedented pace, announcing the killing of over 250 senior Iranian officials since the war began, from the Supreme Leader in the first strike to the commander of the Revolutionary Guard’s naval forces, who was recently reported killed.

President Donald Trump characterized these strikes as part of a joint operation, telling reporters last week, “We killed all their leadership, then they convened to select new leaders, and we killed them all,” noting that the objective of regime change was virtually achieved, since “the current leadership is entirely different from the one we started with.”

A pivotal strike

The report indicates that Israel managed to bring about this change in Iran’s leadership hierarchy remarkably quickly, beginning with the February 28 attack that killed Supreme Leader Ayatollah Ali Khamenei — ending his decades‑long rule — along with the head of the defense council, the Revolutionary Guard commander, the army chief of staff, the defense minister, and a large number of senior officials.

Although presented as an exceptional intelligence achievement, Israeli officials reveal that intelligence agencies had been monitoring the meetings of the so-called “Group of Five,” the Supreme Leader’s close circle, for months.

One security official said, “They were meeting almost every week… sometimes at different locations, sometimes in more fortified places.”

According to the report, the information was so precise that targeting this group was proposed even before the 12-day war in June, but the plan was postponed to prioritize strikes against Iran’s nuclear program.

According to officials, Khamenei was killed inside his residence while with his family, while his son Mojtaba — later appointed as his successor — was injured during the strike but survived.

An assassination system

This “decapitation campaign” relies on an assassination system Israel has developed over decades, but it has seen a qualitative leap in recent years. Officials point to an unprecedented expansion of surveillance capabilities within Iran, ranging from recruiting human sources inside the regime to extensive cyber intrusions targeting thousands of objectives, including street cameras, payment platforms, and digital infrastructure.

This data is analyzed through a secret AI platform designed to track leaders’ movements and map their lifestyle patterns.

Execution methods include pre-planted explosive devices, drones capable of infiltrating buildings, and advanced missiles launched from stealth aircraft — tactics Israel has refined over years of regional confrontations.

The report is based on interviews with security officials who spoke on condition of anonymity because of the sensitivity of the information.

However, this effectiveness raises concerns among some experts, who warn that assassinations could shift from being a limited tool to a permanent strategy.