Adversary Intelligence — 2026-09-05

IRGC Unit 4000 Plans Maritime Attacks on Ships and Ports in East Asia Through Recruited Networks in Thailand and Indonesia

BLUFPublic exposure of named operatives, intermediaries, and targets makes an actual IRGC-linked attack on East Asian shipping or ports unlikely within six months, but compels immediate port-security reassessments at Malacca-strait chokepoints.

Iran International reported on August 31, citing sources familiar with the plans, that IRGC Unit 4000 has recruited non-Iranian operatives in Thailand and Indonesia and sent them to Iran for training ahead of planned attacks on shipping and ports in East Asia 1. The sources named three Indonesian recruits: Pandu Yudhawinata, Ardiyanta Mutoha and Mohammad Hossein, and said targets include the Malacca and Bangka straits, Indonesia's Tanjung Priok Port, and China's Ningbo-Zhoushan and Shanghai ports 12. The sources identified Brigadier General Rahman Moghaddam as commander overseeing the operation and said he survived a March 3 Israeli strike previously reported to have killed him 13. Iran International's sources also named Unit 4000 officers Mohsen Aghazadeh and Vahid Yekeh-Dehqan as running the recruitment and training effort, and linked intermediaries Seyyed Momen Saketicha and fellow cleric Seyed Sulaiman Husaini in Thailand and clerics Zahir Yahya and Abdullah Saqqaf in Indonesia to the network 134. Separately, the sources linked recruit Yudhawinata to a 1994 Bangkok embassy bomb plot and to past attacks in Sri Lanka 34.

Analysis
Public exposure of Unit 4000's Southeast Asia network hands Jakarta and Beijing named operatives, intermediaries, and clerics to investigate, compelling port-security reassessments at Malacca-strait chokepoints and the named Chinese and Indonesian facilities regardless of whether an attack materializes. Moghaddam's survival of the March 3 strike previously reported as fatal indicates Tehran retains command continuity for overseas sabotage planning despite presumed leadership losses. Actual attack execution is unlikely within six months given the difficulty of striking hardened port infrastructure and the network's exposure now that its members are publicly named. This calculus is consistent with the leak itself reflecting an Israeli or Western effort to preemptively disrupt the network by naming it before an operation matures. Confidence is low, resting on a single primary sourcing chain relayed consistently across secondary outlets without independent corroboration. A YES resolution forces Indonesian and Chinese authorities to immediately harden Tanjung Priok, Ningbo-Zhoushan, and Shanghai; a NO lets regional navies deprioritize these straits against existing Hormuz and Red Sea contingencies.
4 sources
  1. IRGC Unit 4000 plans attacks on shipping in East Asia, sources say - Iran International
  2. IRGC commander formerly believed dead alive is plotting attacks in new waterway - The Jerusalem Post
  3. Iran IRGC Unit 4000 Plans Attacks On Ships Waterways And Ports In East Asia Sources Say - Marine Insight
  4. Iran's IRGC Unit 4000 Plans Asian Maritime Attacks, Sri Lanka Link Reported - Sri Lanka Guardian

View in full brief →

UNCLASSIFIED // OPEN SOURCE