Counterintelligence — 2026-07-09

Tajik National Charged With 14 Counts of Espionage for Iran Including Filming Haifa Port and Elbit Systems Facility

BLUFIran's use of cryptocurrency-paid migrant workers recruited via Telegram signals a shift toward disposable, scalable human-intelligence networks that bypass Israel's traditional counterintelligence tripwires.

Israeli state prosecutors filed an indictment at the Tel Aviv District Court on Monday against Bekhruz Shakhriv Dodobaev, a 33-year-old Tajik national whose temporary residency permit had lapsed by May, charging him with 14 counts including contact with a foreign agent and communicating information to an enemy with intent to harm state security 1Haifa Port and Elbit Facility" data-source="Ynetnews" data-url="https://www.ynetnews.com/article/44li2nn2o" data-rt="secondary" data-mbfc="high" data-otype="newspaper">2. According to the indictment, Dodobaev was recruited via Telegram in late 2025 or early 2026 by handlers using the names Anna, Uri, and Polina, whom prosecutors identify as Iranian agents, and was paid in cryptocurrency from February through June for surveillance tasks 1. He allegedly filmed the Haifa Port shoreline and vessels, transmitted coordinates and video from the Elbit Systems Cyclone facility in Ahihud after being told he was documenting a missile-impact site, and relayed footage and coordinates from sites struck by Iranian missiles during the war 12. Prosecutors also allege he distributed job advertisements with handler-supplied Telegram contacts in migrant neighborhoods of Ashdod and Tel Aviv to recruit additional sources, and the state has asked the court to detain him through the end of proceedings 1.

Analysis
Iranian handlers running a Tajik migrant worker as a low-cost tasking asset against hardened targets reflects a model built to sidestep monitoring designed for traditional agent handling, using cryptocurrency and Telegram cutouts. Job-ad recruitment in Ashdod and Tel Aviv migrant neighborhoods indicates handlers sought to scale beyond a single source, and the disguised Elbit Systems tasking widens the target set: Israeli counterintelligence must now assume such networks can reach beyond port surveillance. Both public accounts trace to the same indictment, so their convergence reflects shared access to one court filing rather than independent verification. The disclosure's prominence may serve Shin Bet deterrence messaging on Iranian recruitment tactics as much as it signals a genuinely expanded operational threat.

2 sources

Iran spying case: Tajik national charged with 14 counts of espionage crimes - The Jerusalem Post
Indictment: Tajik National Allegedly Spied for Iran, Photographed Haifa Port and Elbit Facility - Ynetnews