Adversary Intelligence — 2026-04-21

Mossad, IDF and Shin Bet expose IRGC Unit 4000 global attack network; name dead commanders Moghadam, Khademi, Suri

In a joint 20 April announcement, the Mossad, IDF, and Shin Bet disclosed what they described as a previously covert IRGC Intelligence Organization element, Unit 4000, tasked with collecting intelligence on senior Israeli political and security officials, military installations, ports, and vessels globally and preparing lethal operations. Israeli officials named the network head Rahman Moghadam, his superior Majid Khademi, and a senior coordinator Mohsen Suri, all killed in the opening phase of the 2026 war, according to Jerusalem Post, JNS, and Algemeiner coverage. The network footprint cited in the announcement included Azerbaijan, Turkey, Cyprus, Greece, and other European states. Azerbaijani authorities said they had foiled plots against the Israeli Embassy in Baku, a local synagogue, Jewish community leaders, and the Baku-Tbilisi-Ceyhan pipeline, which carries roughly one-third of Israeli oil imports.

Analysis
The joint disclosure corroborated across Jerusalem Post, JNS, and Algemeiner serves two functions beyond reporting Unit 4000's existence: justifying the decapitation strikes against Moghadam, Khademi, and Suri, and placing Azerbaijan, Turkey, Cyprus, and Greece on notice that Israeli collection penetrated the network to name-and-location granularity. The BTC pipeline's inclusion in the Azerbaijani target set confirms the network prioritized economic-infrastructure payoff over symbolic assassination alone, meaning replacement targeting packages very likely retain that emphasis. A second Israeli disclosure cycle naming successor cell leaders is likely within 60-90 days, consistent with the reconstitution-pressure tempo Israeli services have applied against Hezbollah's External Security Organization and IRGC Quds Force over the past decade. The named-and-killed framing may overstate operational impact, since IRGC Intelligence Organization builds redundancy into cell structures, and Unit 4000 continuity is very likely already restored under a new internal designation, with the public exposure functioning primarily as deterrence signaling to host states rather than genuine degradation of Iran's external-operations capacity.
3 sources
  1. Israel uncovers global IRGC terror network targeting officials - The Jewish Chronicle
  2. Israel Exposes Iranian Terror Network as IRGC-Linked Cells Expand Attacks Across Europe - Algemeiner
  3. Israel exposes Iran-backed terror network in Azerbaijan - JNS

View in full brief →

UNCLASSIFIED // OPEN SOURCE