Adversary Intelligence — 2026-05-04
Iran Ran Six-Year Cyber, Influence, and Assassination Campaign Against Israeli Security Think Tank INSS
A Haaretz investigation published today, based on more than 100,000 emails and messages, documents a six-year Iranian campaign against
Analysis
The six-year operation cast INSS as both an intelligence collection target and a perceived physical threat requiring neutralization. Over 100,000 exfiltrated communications, documented in Haaretz's record and corroborated by Times of Israel and HackNotice, reached policy deliberations conducted by former heads of Mossad and Military Intelligence. Tehran's choice to surface the breach through Handala and amplify it via Press TV weaponizes attribution for deterrence and coercive signaling, reducing incentives for operational restraint. The disclosure may instead serve to intimidate INSS researchers rather than reflect actual intrusion depth. A follow-on publicly attributed operation against a comparable institution before July 2026 is unlikely, as disclosures at this institutional class surface through investigation-driven events, not at steady state.
The six-year operation cast INSS as both an intelligence collection target and a perceived physical threat requiring neutralization. Over 100,000 exfiltrated communications, documented in Haaretz's record and corroborated by Times of Israel and HackNotice, reached policy deliberations conducted by former heads of Mossad and Military Intelligence. Tehran's choice to surface the breach through Handala and amplify it via Press TV weaponizes attribution for deterrence and coercive signaling, reducing incentives for operational restraint. The disclosure may instead serve to intimidate INSS researchers rather than reflect actual intrusion depth. A follow-on publicly attributed operation against a comparable institution before July 2026 is unlikely, as disclosures at this institutional class surface through investigation-driven events, not at steady state.