Amazon threat intelligence experts have documented two cases in which Iran leveraged hacking to prepare for kinetic attacks.

The post Amazon Details Iran’s Cyber-Enabled Kinetic Attacks Linking Digital Spying to Physical Strikes appeared first on SecurityWeek.

DEEP DIVE — While Washington is focused on Iran’s accelerating uranium-enrichment program and increasingly aggressive regional posture, an equally consequential shift is unfolding with seemingly less fanfare: North Korea’s rapid nuclear and missile advancements are quietly reshaping the global threat landscape.

For U.S. policymakers, the danger is no longer a pair of isolated challenges but a converging two-front nuclear problem—one that threatens to push America’s deterrence posture, crisis-management capacity, and alliance coordination closer to a breaking point. To understand how these two fronts could interact, experts emphasize that Iran and North Korea share a long-standing strategic alignment.

“The Iran–North alliance represents a four-decade-long partnership driven by shared hostility toward the United States, economic needs, and strategic isolation,” Danny Citrinowicz, a nonresident fellow with the Atlantic Council’s Middle East Programs and former head of the Iran Branch in the Research and Analysis Division (RAD) in Israeli defense intelligence, tells The Cipher Brief. “The Iranians need to rearm and prepare for another campaign, which requires additional and fresh thinking regarding the depth of the relationship between Tehran and Pyongyang.”

He also warns that this moment may become an inflection point.

“If Iran seeks to change its nuclear strategy, it could ask North Korea for nuclear bombs or highly enriched material or spare parts for the destroyed nuclear facilities, such as the conversion facility in Isfahan,” Citrinowicz continued. “The potential damage in the event of such an event is so severe that it is essential that the intelligence organizations of the United States, South Korea, and Israel identify signs of this.”

Pyongyang’s Nuclear Threat

Despite UN sanctions and diplomatic efforts, a recent Congressional Research Service (CRS) brief underscored that North Korea continues to surge forward with both nuclear-weapons and ballistic-missile development. For Kim Jong Un, analysts note, nuclear weapons are a guarantor of regime security, and he has no intention of abandoning them.

North Korea’s nuclear doctrine and capability sets are evolving in troubling ways. The 2025 CRS brief states that a September 2023 law expanded the conditions under which Pyongyang would employ nuclear weapons, lowering what had been a high threshold for use. The same report noted the regime “promised to boost nuclear weapons production exponentially and diversify nuclear strike options.”

On the delivery side, the brief outlines how North Korea is fielding solid-fueled road-mobile ICBMs, sea-based launch systems, and pursuing multiple warheads on a single missile — all elements that raise the question not just of deterrence but of crisis stability and escalation control. In short, Pyongyang appears to be reaching toward a survivable deterrent — or perhaps a warfighting capability — that can impose calculations on the U.S. and its allies in a far more challenging way than before.

“Kim’s investment in new nuclear-capable delivery systems reflects the strategic importance of the country’s nuclear arsenal,” Kelsey Davenport, Director for Nonproliferation Policy at the Arms Control Association, tells The Cipher Brief. “North Korea is better positioning itself to evade and overwhelm regional missile defenses and target the U.S. homeland.”

Treston Wheat, chief geopolitical officer at Insight Forward, reinforces that intelligence picture, stressing that open-source assessments now “frame North Korea as a maturing nuclear-warfighting state,” with doctrine “trending toward first-use options in extreme regime-threat scenarios.” He notes that U.S. intelligence already evaluates Pyongyang as having achieved miniaturization: “A 2017 DIA assessment judged DPRK miniaturization sufficient for SRBM-to-ICBM delivery.”

Taken together, those capabilities point to a shifting threat environment for Washington.

“North Korea has tested missiles with the range necessary to target the continental United States,” Davenport underscored. “U.S. military planners have to assume that North Korea can target the United States.”

Need a daily dose of reality on national and global security issues? Subscriber to The Cipher Brief’s Nightcap newsletter, delivering expert insights on today’s events – right to your inbox. Sign up for free today.

Iran’s Nuclear Surge

Meanwhile, Iran is not standing still. Tehran has begun openly emulating aspects of Pyongyang’s nuclear playbook, indicating that if Western strikes against Iranian nuclear infrastructure forced Tehran to go underground, it could adapt quickly. That duality matters: Iran can arguably deploy its program overtly, under inspection and diplomatic cover, but at some threshold, it may decide the only path to survival is accelerated weaponization. If that happens while North Korea is already pushing new strategic capabilities, the U.S. is confronted with two simultaneous flashpoints — one in the Middle East, the other in Northeast Asia.

Deterrence, by definition, demands clarity of purpose, credible capabilities, and correctly calibrated signals. When the U.S. must manage a nuclear-armed North Korea and a near-breakout Iran at the same time, the risk is that strategic bandwidth becomes overstretched.

“Despite the failure of that approach, Iran maintains that its nuclear doctrine is unchanged and it does not intend to pursue nuclear weapons,” Davenport noted. “(But) without a pragmatic diplomatic approach that addresses Iranian economic and security concerns, Tehran’s thinking about nuclear weapons could shift.”

That potential shift in Tehran’s calculus becomes even more concerning when paired with broader warnings about Western inattention.

“If Western focus on the Iran threat dwindles, there is a risk the regime could take a new, covert path to nuclear weapons using remaining or reconstituted assets or foreign help,” Andrea Stricker, Deputy Director of the Nonproliferation and Biodefense Program at the Foundation for Defense of Democracies, tells The Cipher Brief. “Such a lack of focus is similar to how North Korea became nuclear-armed.”

Tehran, experts caution, still retains deep technical capacity.

“Iran retained enough fissile stock and technical expertise to rebuild quickly, meaning the setback was tactical rather than strategic,” Wheat noted.

From Washington’s vantage point, the real danger is a dual crisis hitting at once — an Iranian enrichment surge or strike on its facilities in West Asia, paired with a North Korean missile volley or nuclear test in East Asia. That scenario forces the U.S. into parallel decision-cycles, stretching military, diplomatic, and intelligence resources, straining alliances, and creating openings that adversaries could exploit.

North Korea’s expanding warfighting delivery systems add another layer of risk: limited, precision escalation meant to test U.S. resolve. As the CRS notes, its ballistic-missile testing is designed to evade U.S. and regional defenses, putting American and allied forces at heightened risk. In effect, Pyongyang is developing not only a survivable deterrent but potential coercive leverage — just as Iran’s enrichment trajectory edges closer to a threshold that could trigger a U.S.-led military response.

“The possibility of Pyongyang providing nuclear assistance to Tehran is increasing,” Citrinowicz said. “The United States will need to focus its intelligence on this possibility, with the help of its allies who are monitoring developments.”

But that intelligence challenge intersects with another problem: mounting questions about U.S. credibility.

“President Trump has dealt a serious blow to U.S. credibility in both theaters,” Davenport asserted. “This risks adversaries attempting to exploit the credibility deficit to shift the security environment in their favor.”

U.S. Intelligence and Strategic Implications

Open-source intelligence paints a worrying picture: North Korea may have enough fissile material for perhaps up to 50 warheads, though the accuracy and reliability of delivery remain questions. It also signals Pyongyang’s development of submarine-launched ballistic missiles and multiple-warhead ICBMs. The regime has restored its nuclear test site and is now postured to conduct a seventh nuclear test at a time of its choosing.

The IAEA’s November 2025 report says it can no longer verify the status of Iran’s near–near-weapons-grade uranium stockpile after Tehran halted cooperation following the June 2025 Israeli and U.S. strikes on Natanz, Fordow, and Esfahan.

The last confirmed data, from September, showed Iran holding 440.9 kg of uranium enriched to 60 percent — a short step from weapons-grade and potentially enough for up to 10 bombs if fully processed. IAEA chief Rafael Grossi says most of this material is now entombed in damaged facilities. Moreover, satellite imagery activity around storage tunnels in Isfahan has raised serious red flags. The IAEA further cautions that oversight of this highly-enriched uranium site is “long overdue,” warning that the agency has lost “continuity of knowledge.”

Moreover, before the strikes, the IAEA assessed Iran could produce enough weapons-grade material for one bomb in about a week using part of its 60 percent stockpile at Fordow. Damage to centrifuges has likely slowed that timeline. Still, the larger question is political: whether Iran, under renewed UN sanctions and scrutiny, decides that staying within NPT safeguards costs more than openly moving toward a weapon, particularly if work resumes at undeclared or rebuilt sites.

“The U.S. and Israeli strikes have created a window of respite. What happens next depends greatly on Iran’s will to provoke new Israeli strikes,” Stricker said. “North Korea is a wild card and could provide nuclear fuel, facilities, and equipment to Iran.”

Are you Subscribed to The Cipher Brief’s Digital Channel on YouTube? There is no better place to get clear perspectives from deeply experienced national security experts.

Looking Ahead

For Washington, the takeaway is stark: systems designed to manage one nuclear threat at a time may crumble should two crises flare simultaneously. The U.S. would need tighter allied coordination, faster intelligence sharing, and stronger, more flexible military deployments to cope.

Yet above all, policymakers must anticipate the possibility of simultaneous escalation in different theatres.

In the coming months and years, key indicators will include North Korea’s choice to conduct a seventh nuclear test or field a credible submarine-launched nuclear force, and Iran’s enrichment trajectory or decision to strike a covert breakout path. The U.S. must also watch for signs of cross-coordination between Moscow and Pyongyang, or between Tehran and Pyongyang — though open links remain murky.

From a policy perspective, a dual-front scenario demands updated wargames, an inter-theatre force posture review, and close allied coordination across NATO, the Indo-Pacific, and Middle East partners. Washington must also guard against the “umbrella illusion” — the belief that the same deterrence logic will apply unchanged across two theatres facing two distinct adversaries with differing doctrine, capabilities, and thresholds.

Finally, media and public attention naturally tend to focus on Iran’s progress or North Korea’s missile launches — one at a time. However, deterring two simultaneous nuclear-adversary theatres demands strategic awareness that the world may not be sequentially configured. For the U.S., what happens in one theatre may shape adversary calculations in the other. The risk is that by the time Washington pivots from Iran, Pyongyang — or Tehran — may have forced a new reality.

In this two-front nuclear dilemma, the question is no longer whether to monitor Iran or North Korea, but how the U.S. will deter both at the same time — and whether its strategic framework is ready for that challenge.

Emerging forms of collaboration amplify that challenge.

“More concerning is that North Korea is positioning itself to benefit from Russian expertise and to further refine its missile systems using data collected from Russia’s use of North Korean systems against Ukraine,” Davenport added.

The state-sponsored APT has been targeting the victims’ family members to increase pressure on their targets.

The post Iranian Hackers Target Defense and Government Officials in Ongoing Campaign appeared first on SecurityWeek.

DEEP DIVE — Tucked deep into the cragged hills of southern Lebanon, Hezbollah, the once powerful Iranian-backed militia brought to its knees by a war with Israel, has spent the past year meticulously gouging its way back to relevancy.

For Western and Israeli security forces, the designated terrorist group’s covert but influential resurgence establishes a precarious problem: a persistent, low-level threat that could instantly trigger a wider conflict, critically testing the resilience of any ceasefires and the existing, fragile statehood.

Financial Lifelines and Sanctions

The November 5 announcement from the U.S. Treasury’s Office of Foreign Assets Control (OFAC) targeted key elements of Hezbollah’s financial network. Two operatives — Ossama Jaber, a Hezbollah financier who personally collected tens of millions via Lebanese exchange houses from September 2024 to February 2025, and Ja’far Muhammad Qasir, a sanctioned terrorist collaborating with Syrian oil magnate Yasar Husayn Ibrahim — were blacklisted for laundering Iranian cash into Hezbollah’s war chest.

These funds, exploiting Lebanon’s cash-heavy, regulation-light economy, bankrolled everything from paramilitary salaries to the reconstruction of terror infrastructure battered by Israeli strikes. Under Secretary of the Treasury for Terrorism and Financial Intelligence, John Hurley, didn’t mince words: For Lebanon to emerge “free, prosperous, and secure,” Hezbollah must be “fully disarmed and cut off from Iran’s funding and control.”

Matthew Levitt, a senior fellow and director of the counterterrorism and intelligence program at The Washington Institute for Near East Policy, and a former counterterrorism intelligence analyst for the FBI, points out that despite sanctions, Iran’s financial backing is pivotal to Hezbollah’s survival and operational reach.

“We assume Iran still provides about the same amount of money, but Hezbollah is having a harder time getting it through on a timely basis. They can’t just ship it from Iran or Iraq anymore without inspections, so they rely more on diaspora networks in South America and Africa,” he tells The Cipher Brief. “All of this is against the backdrop of severe setbacks. Hezbollah intends to continue positioning itself to not only fight militarily but also assert an oversized, dominant position within Lebanon by virtue of force.”

A Battered Front, But Not Broken

The Israel-Hezbollah war, which ignited in 2023 alongside the war in Gaza, decimated the organization’s leadership, weapons arsenal, and fighting ranks, with more than 3,000 of its fighters killed. The decapitation strikes were surgical: On September 27 last year, an Israeli airstrike flattened Hezbollah’s Beirut headquarters, killing Secretary-General Hassan Nasrallah, the group’s iron-fisted architect of asymmetric warfare. In the ensuing ground incursion, Israeli forces dismantled border launch sites and command bunkers, leaving Hezbollah’s Radwan Force, the elite unit tasked with infiltrating Galilee, reeling.

Yet, as analysts caution, Hezbollah is battered but not broken. A number of its battle-hardened fighters, who cut their teeth supporting the Assad regime in Syria, are now integrating into civilian life, ready to rearm at any time. Furthermore, the group’s Shia base, which comprises roughly 31 percent of the Lebanese population, remains loyal to Hezbollah, upheld by its wide-reaching welfare networks amid a country grappling with a crumbling economy.

These moves indicate that Hezbollah’s military recovery is already well underway.

“Hezbollah is giving much more attention than before the war to its Badr Unit, positioned north of the Litani River, and strengthening it with Radwan forces,” Sarít Zehavi, senior researcher at the Alma Research and Educational Center, tells The Cipher Brief. “They are also shifting from smuggling to local manufacturing of drones and missiles. Even though some brigades are not yet redeployed to the border, they continue training and rebuilding capabilities.”

The Badr Unit, a key element of Hezbollah’s northern forces, has become the group’s tactical spearhead along the Litani River and near the Israeli border. Tasked with reconnaissance, border infiltration, and rapid response, the unit has been reinforced with Radwan-trained fighters and advanced drone capabilities. Badr is central to Hezbollah’s evolving doctrine of “strategic latency,” maintaining a persistent threat without provoking full-scale war, and acts as a bridge between conventional militia operations and the group’s clandestine drone and cyber activities.

Moreover, Lebanon’s political deadlock increases the risk that Hezbollah will maintain its military dominance.

The Beirut government, assembled hastily earlier this year under President Joseph Aoun, is characterized as the least Hezbollah-affiliated in years, with a focus on reclaiming national independence from the dominant insurgents. There is, however, significant skepticism about how such a push is enforced. Hezbollah continues to rebuff key appointments, and its diminished but growing stockpile, estimated at 20,000 remaining rockets, hangs over Beirut’s ambitions.

This hybrid threat presents a national security nightmare for Washington: a non-state actor wielding state power, rendering diplomacy incredibly difficult.

Need a daily dose of reality on national and global security issues? Subscriber to The Cipher Brief’s Nightcap newsletter, delivering expert insights on today’s events – right to your inbox. Sign up for free today.

Iran’s Evolving Logistical Pipelines

Tehran’s shadow looms largest. The IRGC-Quds Force, Hezbollah’s ideological leader since 1982, has poured over $1 billion into the group this year alone, per Treasury disclosures — despite layered U.S. sanctions biting into Iran’s oil exports. However, a source familiar with the U.S. Office of Foreign Assets Control told The Cipher Brief on background that tracking Iran’s funds has become increasingly challenging in recent months.

“The Treasury and State Departments need more resources to track violations, and the government shutdown left many investigators sidelined,” the source observed. “Congress can help by requiring reports on Iranian weapons shipments and funding enforcement teams.”

The Iranian cash flows through hawala networks and Beirut’s labyrinthine exchange houses, where operatives like Jaber convert petrodollars into untraceable Lebanese pounds. It’s a masterclass in sanctions evasion: Iran’s regime, squeezed by domestic protests and a rial in freefall, prioritizes its “Axis of Resistance” over breadlines at home.

“Assad’s downfall severely crimped Hezbollah’s pipeline from Tehran, but even so, Hezbollah and Iran remain adept at exploiting fragile states. Beirut and Damascus show some interest in interdiction. Still, both are weak governments, and they have other priorities,” Jonathan Ruhe, Director of Foreign Policy at the JINSA Gemunder Center for Defense & Strategy, tells The Cipher Brief. “Iran also exploits power vacuums in Sudan and Libya to resupply Hezbollah from the sea, using surreptitious maritime tactics like Iran’s sanctions-busting ‘shadow fleets.’”

Post-war Syria has forced Tehran to improvise. The once-feared land bridge — stretching from Iran through Iraq and Syria to Lebanon — has been battered by Israeli airstrikes and rebel attacks, yet parts of it still survive. To bolster its Middle East proxy, the Iranian regime has upped its use of maritime routes. Iranian cargo ships dock at Syria’s Tartus port under civilian manifests, offloading drone kits and rocket fuel disguised as fertilizer. Trucks then traverse the unguarded border into Lebanon’s Qalamoun Mountains, often chaperoned by IRGC advisors.

Domestically, however, Hezbollah is reducing reliance on imports. Clandestine factories in Beirut’s Dahiyeh suburbs and Bekaa orchards churn out refurbished Kornet anti-tank missiles and Ababil drones from scavenged parts. There is a reported network of 50-plus workshops, some powered by smuggled Chinese microchips, slashing reliance on vulnerable sea lanes. Despite its own economic ailments, Tehran continues to give precedence to Hezbollah’s position as a frontline deterrent over short-term financial stability.

Rebuilding the Arsenal: From Ashes to Drones

Israeli assessments estimate Hezbollah has reclaimed just 20 percent of its pre-war precision arsenal, but what emerges is nimbler and deadlier in specific domains. Drones top the list: low-cost Shahed-136 clones, assembled from Iranian blueprints and Syrian-sourced engines, can loiter over Galilee for hours, scouting IDF positions or delivering 50 kg (110pounds) warheads. Short-range Fajr-5 rockets, concealable in olive groves, are proliferating under civilian camouflage — mosques, schools, even UNIFIL outposts.

Smuggling remains vital. Iran’s military equipment, including advanced components for precision-guided missiles (PGMs), is first transported into Syria using an array of methods designed to evade international scrutiny. Non-descript convoys then travel from Syria’s Homs City to the border city of Al-Qusayr near Lebanon. The Syrian-Lebanese border in the Homs/Al-Qusayr area is porous, mountainous, and complex to police. Over the course of this year, Israel has conducted more than 40 strikes intercepting shipments near the southern coast of the city of Tyre. Yet the cat-and-mouse game favors smugglers. Private companies, fronts for IRGC logistics, reportedly run nighttime operations mixing weapons with sacks of flour labeled as aid.

“Even before October 7, Hezbollah tried to make precision munitions with Iranian help,” Ruhe noted. “Tehran is now redoubling these efforts. For all Israel’s successes over the last two years, it struggled to wage a multifront war of attrition, and it struggled to defeat Hezbollah’s drones. Hezbollah and Iran want to exploit this exact weakness by being able to oversaturate Israeli defenses with mass drone swarms, similar to what Iran helps Russia do against Ukraine.”

Indeed, Hezbollah’s rebuilding of its ranks is quieter but no less strategic. After losing an estimated 5,000 to 7,000 fighters, the group now runs “resistance summer camps” in the Litani Valley, teaching teenagers bomb-making and cyber tactics under the guise of community service. Morale has waned, but ideology endures: recruits draw strength from chants of Nasrallah’s martyrdom.

Are you Subscribed to The Cipher Brief’s Digital Channel on YouTube? There is no better place to get clear perspectives from deeply experienced national security experts.

The Long Game: Shadows on the Northern Border

For Israel, the situation is a high-stakes strategic battle. Prime Minister Netanyahu’s cabinet has stepped up its drone strikes into Lebanon in recent weeks, and preemptive raids to enforce ceasefire arms restrictions are not off the table. Nonetheless, Hezbollah leaders in November rejected talks, and in an official letter to the Lebanese government, insisted that “any attempt at political negotiations with Israel does not serve Lebanon’s national interest.” The statement both rallies supporters and signals Tehran’s firm stance. Iran’s approach is one of “strategic latency” — maintaining a constant, restrained threat to deter Israel without triggering all-out war.

The United States also has global interests at risk. Hezbollah’s networks extend into Latin America and Africa, where they help launder money through drug and diamond trades. Those funds could support operations that reach U.S. soil. Washington’s current strategy — including a $230 million-plus aid package to Lebanon tied to reforms — aims to cut off Hezbollah’s financial base.

This fragile financial and operational landscape underscores that, despite international efforts, Hezbollah’s on-the-ground capabilities remain resilient and difficult to fully contain. A spokesperson for the U.S. Department of State tells The Cipher Brief that while “the Government of Lebanon made a courageous and historic decision to restore state authority by ordering the disarming of Hezbollah and establishing the Lebanese Armed Forces and Internal Security Forces as the legitimate forces for Lebanon, the credibility of Lebanon’s government rests on its ability to transform words into action.”

“The region and world are watching carefully,” the spokesperson continued. “Disarming Hezbollah and other non-state actors, as well as ending Iran’s proxy activities, is crucial to ensuring peace in Lebanon and across the region. The United States of America commends the Government of Lebanon’s efforts to ensure Lebanon is sovereign, peaceful, prosperous, and safe for all Lebanese people.”

Zehavi also pointed to the gap between hopes for disarmament and reality.

“The Lebanese Army is not entering villages and into the private properties where Hezbollah is actually hiding its weapons down,” she explained. “If this continues this way, and it looks like this is where it is going, what we will see is a very unstable situation.”

Lebanon, however, may face the most direct consequences. Hezbollah functions as both a militia and a provider of social services. Several of its clinics are also used as bunkers, and Tehran-financed roads routinely lead to new depots and launch locations. As Zehavi highlights, Hezbollah is rebuilding on two fronts: strengthening its military infrastructure while expanding civilian programs to maintain local support.

The organization, experts say, is not right now preparing for a major offensive but focuses on smaller, ongoing operations — perhaps cyberattacks on Haifa’s ports, sniper fire along the border, and drone swarms testing Israel’s defenses. Iran’s proxy strategy remains intact despite sanctions and setbacks.

Yet, according to Ruhe, if the United States, Europe, and Arab partners enforce UN sanctions on Iran’s rearming of Hezbollah and back Beirut, a better-than-status-quo scenario is possible.

“(But) if Hezbollah and Iran believe Beirut is alone, and that Israel will be isolated for acting militarily, then it’s a matter of when — not if — Hezbollah recovers,” he continued. “And the more successfully it helps Hezbollah rebuild, the more likely Iran will test Israeli and U.S. resolve with its own rearmament.”

For Western policymakers, the objectives are clear: disrupt Hezbollah’s finances, bolster Lebanon’s government, and limit the group’s military power. Otherwise, the risk grows of a wider northern conflict that could draw in larger powers.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.

DEEP DIVE — Entire cities in the Darfur region of Sudan have been burned and razed, millions have fled their homes, and unspeakable terror and violence plague those left behind. When fighting erupted on April 15, 2023, between the Sudanese Armed Forces (SAF) under Abdel Fattah al‑Burhan and the Rapid Support Forces (RSF) led by Mohamed Hamdan Dagalo, better known as Hemedti, few predicted the conflict would become one of Africa’s worst humanitarian disasters.

There is, however, more to this war than just an internal battleground. The war in Darfur is no longer simply a domestic power struggle. It has become a multilayered proxy battlefield involving Egypt, Turkey, the United Arab Emirates (UAE), Saudi Arabia, Russia, Iran and more — each supporting rival Sudanese actors to secure strategic footholds.

“The current phase has Darfur as a killing field. The Sudanese protagonists have sorted out somewhat the areas each controls. Still, on the political front, both are committed to eliminating the other in a fight to the finish,” United States Ambassador to Sudan during the George W. Bush administration, Cameron Hume, tells The Cipher Brief. “There may be agreement on a time-limited humanitarian ceasefire, but no one is aiming at a durable political settlement between the two main parties.”

Infographic with a map showing areas controlled by the army, the Rapid Support Forces and neutral groups in Sudan as of September 23, 2025, according to the Critical Threats Project at the American Enterprise Institute and the AFP. (Infographic with a map showing areas controlled by the army, the Rapid Support Forces and neutral groups in Sudan as of September 23, 2025, according to the Critical Threats Project at the American Enterprise Institute and the AFP (Graphic by AFP) (Graphic by Olivia Bugault, Valentina Breschi, Nalini Lepetit-Chella/AFP via Getty Images)

United Arab Emirates

Despite official denials, the UAE remains the RSF’s cornerstone patron in Darfur, suspected of funneling advanced weaponry — including Chinese CH-95 and “Long Wang 2” strategic drones for 24-hour surveillance and strikes, Norinco-guided bombs, howitzers, and thermobaric munitions —via a covert air bridge of more than 240 UAE-chartered flights from November 2024, often landing at Chad’s Amdjarass airfield or South Darfur’s Nyala base.

These supplies, additionally routed through Libyan intermediaries like Khalifa Haftar’s networks and Ugandan/Somali airfields, have empowered RSF assaults, such as the latest siege and takeover of El Fasher. Economically, UAE-based firms like Hemedti’s Al-Junaid control Darfur’s Jebel Amer and Songo gold mines, exporting $1.6B in 2024, reportedly laundered via seven sanctioned Dubai entities to fund RSF salaries, Colombian mercenaries and further arms.

“The United Arab Emirates is the key sponsor of the RSF in strategic terms. Its interest is to convert influence in western Sudan into leverage over corridors, gold monetization and logistics, and to prevent an outcome in which Islamists consolidate in Khartoum,” Dr. Andreas Krieg, Associate Professor at King’s College London, tells The Cipher Brief.

Sudan’s gold — its primary export — has also become a lifeline for the UAE, feeding Dubai’s markets with more than ten tons a year from RSF-controlled areas. The trade aligns with Abu Dhabi’s long-term ambitions and its stance against the Muslim Brotherhood, as well as its past reliance on RSF fighters in Yemen. Despite Emirati denials and Sudan’s failed genocide case against the UAE at the ICJ, evidence ties the UAE directly to embargo breaches, from passports recovered in Omdurman to Emirati-made vehicles found at RSF sites.

As the UAE expands its influence through RSF control of Darfur’s 700-kilometer Red Sea corridor, reviving stalled DP World and AD Ports projects to rival Saudi NEOM, it effectively uses the militia as a proxy to secure resources and block SAF dominance. Approximately 70 percent of Sudan’s gold production from RSF-controlled areas is smuggled through Dubai, while overall illicit exports account for around 40 percent of the country’s total gold output.

Need a daily dose of reality on national and global security issues? Subscriber to The Cipher Brief’s Nightcap newsletter, delivering expert insights on today’s events – right to your inbox. Sign up for free today.

Turkey

Ankara, seeing the Darfurian conflict as both a threat to its regional ambitions and a challenge to Islamist allies, has backed al-Burhan’s forces with drones worth $120 million, delivered through Egypt. Their weapons supply assisted SAF in retaking Khartoum earlier this year but comes with deeper incentives: ideological ties with Burhan’s Islamist faction and strategic objectives for Red Sea access.

“Turkey’s quiet intelligence-sharing and counterterrorism pacts give it outsized sway over local regimes,” John Thomas, managing director of strategic policy firm Nestpoint Associates, tells The Cipher Brief.

The result, experts say, is a dangerous and growing proxy war between the UAE and Turkey — one now fought with advanced drones and air defenses across Sudan’s skies. The stalemate has fractured the country, spilled instability into Chad and Libya, and left tens of thousands dead, a toll experts warn could further destabilize the Horn of Africa.

Beyond the pace and scale of Turkish arms transfers, the presence of Turkish private military contractors (PMCs) in Africa merits closer scrutiny.

“In addition to the pace and spread of Turkey’s arms flow, I would say the presence of Turkish PMCs in Africa is something policymakers really ought to focus on more closely,” Will Doran, Turkey researcher at the Foundation for Defense of Democracies, tells The Cipher Brief. “A lot of these PMCs, like Erdogan himself, are warm towards the Muslim Brotherhood and have some questionable ties to Islamist militias on the ground in the Sahel. This isn’t to say Turkey is backing the region’s big names in terrorism. For one, Ankara’s deployed against al-Shabaab in Somalia, but the PMC trend is worrisome nonetheless.”

Egypt

Egypt views Sudan as a vital flank for its national interests. The Nile River flows from Sudan into Egypt, and Cairo has long been vigilant about any instability upstream. Egypt supports General Abdel Fattah al-Burhan and his Sudanese Armed Forces (SAF) because Cairo views them as the most dependable group to safeguard Egypt’s key national interests — namely, the Nile River corridor, which is Egypt’s sustenance for water and trade, and the southern border, which it shares with Sudan.

According to Dr. Krieg, “Egypt is the principal state backer of the army.”

“Its strategic priorities are the security of the Nile heartland, avoidance of an Islamist resurgence, and denial of hostile basing or rival influence along the Red Sea,” he continued.

Egypt, already hosting more than a million refugees, also fears that if Khartoum collapses into chaos, the resulting instability — such as refugee flows, arms trafficking, or militant activity — could spill over the border into its territory. Diplomatically, Cairo has kept direct intervention limited and insists on a Sudan-led solution, yet it retains close military and political ties to Burhan.

Saudi Arabia

Riyadh shares a parallel concern: as the Gulf kingdom pursues its Vision 2030 and Red Sea coastal investments, it has an interest in a stable Sudan firmly aligned with its regional agenda. Riyadh has backed the SAF via financial and diplomatic support, while also positioning itself as a mediator.

“Saudi Arabia is perhaps the outside player with potential influence that gets the least attention,” said Amb. Hume.

Dr. Krieg also observed that “Saudi Arabia has positioned itself as a convenor and would prefer a unified state that secures the Red Sea.”

“Chad and the Haftar camp in eastern Libya function as corridors and logistics enablers, and their choices directly affect the intensity of fighting in Darfur,” he explained. “Those intermediaries in Libya and Chad are all part of the UAE’s Axis of Secessionists; a network of non-state actors that are all tied to Abu Dhabi directly or indirectly.”

Are you Subscribed to The Cipher Brief’s Digital Channel on YouTube? There is no better place to get clear perspectives from deeply experienced national security experts.

Iran

Since late 2023, Iran has resumed ties with SAF leader Abdel Fattah al-Burhan after a seven-year break, sending Mohajer-6 and Ababil drones, artillery, and intel via seven Qeshm Fars Air flights to Port Sudan from December 2023 through July 2024. This aid helped SAF retake Khartoum in March 2025 and strike RSF in Darfur. In addition, Iran uses Sudan’s Yarmouk arms factory to counter the UAE-backed RSF. Tehran’s overarching goal? Access to Port Sudan to support the Houthis in Yemen and spread Shiite influence — risking wider regional proxy conflict.

“Iran’s military support has helped shift momentum toward the SAF. As one of many foreign actors exacerbating Sudan’s internal tensions, Iran contributes to the country’s unfolding humanitarian disaster,” Jonathan Ruhe, Director of Foreign Policy at the JINSA Gemunder Center for Defense & Strategy, tells The Cipher Brief. “And as one of many foreign actors trying to claim concessions from the government and vying to exploit Sudan’s natural resources, Iran helps worsen the country’s already high levels of impoverishment.

Research Fellow at the Foundation for the Defense of Democracies, Husain Abdul-Hussain, also underscored that while Iranian involvement in Sudan is still in its infancy, “it will certainly grow as the war grinds on.”

“The more reliant Islamist militias become on Iran, the stronger they become and the more indebted to Tehran,” he explained. “Eventually, relations between Iran and Sudanese Islamist militias will be similar to its relations with Islamist militias in Lebanon (Hezbollah), Iraq (Hashd Shaabi), Gaza (Hamas) and Yemen (Houthis). Note that Sudan Islamist militias are Sunni (like Hamas in Gaza), and unlike Shia Iran and its Lebanese and Iraqi Shia militias. The Houthis are their own breed of Islam (Yazidis) but are allied with Shia Iran.”

Russia

Moscow, meanwhile, has played both sides in Sudan’s civil war for profit and power. Before 2024, the Wagner Group, now under Russia’s Defense Ministry, backed the RSF with arms like surface-to-air missiles, in return for gold from RSF-held mines like Jebel Amer — smuggling up to 32.7 tons worth $1.9 billion via Dubai from 2022 to 2023 to skirt Ukraine war sanctions and fund operations. This fueled RSF violence, including the 2023 to 2025 massacres in el-Geneina and el-Fasher.

Around midway through last year, in the aftermath of Prigozhin’s demise, Moscow flipped to bolstering the SAF in its quest for a Port Sudan naval base. Russia subsequently vetoed a UN ceasefire resolution last November to keep up its influence in Khartoum, while reports emerged of Russian mercenaries operating in West Darfur, worsening the fear and displacement.

“Russia linked commercial and security networks remain present around gold flows and in facilitation roles close to the RSF camp,” said Dr. Krieg.

Why So Many Foreign Players?

At the heart of Sudan’s crisis lie three intertwined forces: geography, resources, and regional rivalry. Poised along the Nile, the Red Sea, and the Horn of Africa, Sudan is pivotal to everything from Cairo’s water security to the maritime goals of Gulf States to the influence ambitions of Moscow and Ankara. Moreover, its ports and resource-rich land have morphed domestic infighting into a lucrative war economy.

“Material backing has lengthened the war and structured its geography,” Mr. Krieg said. “The result is not a decisive victory for either side but a hardening of zones, with the RSF advantaged in a peripheral theatre where it can police corridors and extract revenue, and the army entrenched where the state’s core institutions, population and donor attention reside.”

Why It’s So Hard to End the War

With so many players in the field and a deep distrust among warring parties, ending the war in Sudan has become extraordinarily difficult. The United States, for its part, leads the “Quad” alongside the UAE, Egypt, and Saudi Arabia, pushing for a three-month humanitarian truce. The RSF agreed to a deal on November 6, and Washington is now pressing the Sudanese army to do the same in hopes of easing the fighting and starting talks on the war’s deeper causes.

If the war in Sudan continues, the U.S. faces a growing humanitarian catastrophe: estimates suggest more than 150,000 deaths and over 14 million people displaced, with nearly 25 million facing acute hunger. Regionally, unchecked control of the RSF in Darfur could destabilize the Red Sea corridor, a vital route for global trade and U.S. allies. Domestically, failure to resolve the conflict would erode U.S. credibility on human rights and genocide prevention, heighten refugee pressures in North Africa and Europe, and contradict the moral precedent set during the 2003 Darfur genocide.

“Washington will be paying more attention,” one White House-connected source tells The Cipher Brief. “It isn’t ignored. It is a conflict Trump wants to see ended.”

Dr. Krieg asserted that Sudan is entering a consolidation phase in which the Rapid Support Forces have turned Darfur into a defensible rear area and administrative base. The fall of El Fasher removed the last significant government foothold in the region. It gave the RSF control of the interior lines across West, South, Central, and much of North Darfur, as well as access to Libya and Chad for resupply and commerce.

He thus asserts that Sudan’s future is likely to go one of two ways.

“The Sudanese Armed Forces still hold the Nile corridor, the capital area and much of the east, which creates a west versus centre geography. That configuration points to two near-term paths. Either the front stabilises into a frozen conflict that resembles an informal partition, or the RSF seeks to push east through North Kordofan and test the approaches to the center,” Dr. Krieg added. “Humanitarian conditions are acute, with siege tactics, displacement and food insecurity now baked into the conflict economy. The political tempo has slowed rather than accelerated, since battlefield gains in Darfur give the RSF reasons to bank advantages before contemplating concessions.”

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.

The wars in Ukraine and Gaza must stop. Russia’s February 2022 invasion of Ukraine, a sovereign nation with 1994 security assurances from Russia, has killed or maimed tens of thousands of combatants and civilians. Efforts by President Donald Trump to end this war have failed, with an emboldened Vladimir Putin escalating hostilities in Ukraine, while probing the credibility of NATO, flying drones into Poland and Romania and recently violating Estonia’s airspace. This is the Putin who lamented the dissolution of the Soviet Union in 1991 and vowed to recreate the Russian Empire. And that’s what he’s doing. Georgia and Crimea in 2008 and 2014 was a prelude to his invasion of Ukraine in 2022. The Baltic states - Estonia, Latvia and Lithuania – are next, on Putin’s quest to recreate the Russian Empire.

It's obvious what Putin is doing. He got away with Georgia and Crimea and Putin is confident he’ll prevail in Ukraine with minimal consequences. So, what could the UN do to sanction Russia for its violation of Ukraine’s sovereignty? Indeed, there should be an outcry from the UN demanding that Mr. Putin halt his invasion of Ukraine and enter negotiations with Kyiv.

Iran’s continued refusal to permit UN nuclear inspections and refusal to resume nuclear talks with the U.S. resulted in the reimposition — on September 28 — of sanctions lifted in 2015. So, given that Iran has not changed its attitude and in fact has become more defiant, “snap back” sanctions ban nuclear enrichment, establish an arms embargo and ban tests and transfers of ballistic missiles. It’s clear that Iran wants the option to acquire nuclear weapons capability. A nuclear-armed Iran will be an existential threat to Israel -- an adversary Iran wants to annihilate – and the region.

But for Iran it’s more than acquiring nuclear weapons. Iran is a state sponsor of terrorism, working with its proxies – Hezbollah, Hamas, Houthis -- to destabilize and terrorize the region. On September 17, the Department of State also designated three Iraqi militia groups aligned with Iran as terrorist organizations. These terrorist groups have attacked the U.S. Embassy in Baghdad and bases hosting U.S. and Canadian forces.

Indeed, the human rights situation in Iran is equally dismal. The 2009 presidential election protests and the 2022 killing of Mahsa Amini by the so-called morality police for incorrectly wearing her head scarf sparked national protests that were brutally suppressed by the ruling theocracy. Nationwide arrests and executions were conducted by a weak and corrupt theocracy that was threatened by the public and its outcry for justice and liberty.

The Cipher Brief brings expert-level context to national and global security stories. It’s never been more important to understand what’s happening in the world. Upgrade your access to exclusive content by becoming a subscriber.

Ensuring that food and water are available to the people of Gaza is a priority objective, as is ending this bloody war. The onslaught in Gaza was caused by Hamas’s October 7 attacks that killed approximately 1,200 people, mostly civilians, and the abduction of 251 hostages. This was the bloodiest day for Israel since its independence on May 14, 1948. Indeed, Hamas is a terrorist organization closely affiliated with Iran, which provides Hamas with the weaponry and support needed for its acts of terrorism.

The situation in the South China Sea could escalate quickly between China and the Philippines. The irony is that a 2016 ruling by a UN-backed arbitration tribunal invalidated China’s expansive claims in the South China Sea, ruling overwhelmingly with the Philippines. The ruling was deemed final and binding, although China has rejected the ruling and continues to defy it.

These are just some of the national security issues the UN should openly discuss and attempt to resolve. The wars and turmoil in Myanmar, Sudan, Yemen, Haiti and Libya also require immediate UN attention. This is the mission of the UN.

This column by Cipher Brief Expert Joseph Detrani was first published in The Washington Times.

Are you Subscribed to The Cipher Brief’s Digital Channel on YouTube? There is no better place to get clear perspectives from deeply experienced national security experts.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.

EXPERT PERSPECTIVE — In 1943, a body washed up on a beach in Huelva, Spain. It was the body of a Royal Marine officer, Major William Martin. Martin was carrying papers, cuffed to his wrist in a briefcase, suggesting that the Allies would invade Greece and Sardinia, not Sicily. Spain was officially neutral, but a few Spanish officials sympathetic to the Nazis allowed German agents to discreetly photograph the documents before Spain quietly passed the documents to the British. Those British officials appeared to be in a state of panic over the lost briefcase.

Would this opportunistic espionage expose a critical Allied operation? In reality, Major William Martin never existed. The body was that of Glyndwr (“Glendure”) Michael, a Welsh drifter who died from consuming rat poison. You probably recognize this as Operation Mincemeat. British intelligence developed this incredible ruse, with American approval, and painstakingly developed a plan for the body to wash up near Huelva Spain and provided background and a personal story for Michael that allowed the body to pass convincingly as a Royal Martine officer who perished at sea while delivering sensitive documents.

The Germans took the bait. Convinced by this fabricated narrative, Hitler diverted significant forces away from Sicily. When the Allies landed in Sicily, they encountered far less resistance than expected, saving countless lives and accelerating the collapse of Axis defenses in southern Europe.

Beyond innovation and sheer audacity, this was a master class in story-telling, in knowing the pressures facing the target audience (Hitler), in creating a believable altered reality, in understanding how information moved through Nazi circles and among those who enabled them and, most importantly, in persuading our adversaries to make consequential decisions that advanced our interests over theirs. It was cognitive warfare on the offense, it represented a cognitive advantage during a perilous period, and it remains a reminder of the timeless power of cognitive persuasion.

History has many other examples of where commanders and leaders have stepped beyond traditional thinking and conventional operations into the information and cognitive space to confuse our adversaries, to win the day, and, at times, to change history.

Is this important today? Let us put cognitive warfare in strategic perspective.

First, great power competition is intensifying and the stakes are high.

The U.S is now facing the most significant global challenges than at any time in our history. We face more capable peer adversaries, more aspiring regional nations, and more proxy threats than ever before. The global environment is more uncertain than ever, and our place in it is not guaranteed. If we are to remain the global leader, we’ll have to be ready for today’s and tomorrow’s rapidly evolving competition and warfare. We must look to prioritize and commonly orient our Nation’s capabilities toward actively maneuvering and gaining advantage across the cognitive landscape to help ensure our security interests, and to actively deny any adversary their own advantage.

Second, great powers will go to great lengths to avoid direct military engagement that could have catastrophic consequences. Russia has lost the equivalent of what would be one of the world’s largest militaries and it has experienced a massive reduction in national power in the war with Ukraine. We also know the examples from WWII when nations and great militaries were defeated and even decimated as a result of great power conflict.

China has advocated winning without fighting for decades, and it still does. Khrushchev famously said “We will take American without firing a shot. We do not have to invade the U.S. We will destroy you from within.” Putin is a believer and practitioner in that approach.

Their approaches are not a mystery. Our adversaries have telegraphed how they plan to attack us, and to defeat us, without direct military engagement.

Third, given those considerations, our adversaries are increasingly relying on operations in the gray zone, or gray warfare, to advance their national interests and to take steps to undermine and weaken the United States, without risking a superpower conflict. They have prioritized their resources, decisions, and actions toward this end.

China and Russia, and even Iran and North Korea, believe there are more gains than risks in the gray zone, and any risks they do face are manageable, so we should expect them to expand their activities. If we solely maintain an unblinking stare at the conventional military capabilities of our adversaries, we might miss the real war already well underway in the gray zone.

Finally—cognitive warfare stands as the most prevalent and consequential activity our adversaries conduct in the gray zone.

This is not your grandfather’s Cold War disinformation. This is an assault on cognition, powered by advanced technology and enabled by an information environment that provides camouflage, infrastructure, and operational resources for our adversaries. Ultimately, cognitive warfare is a contest for truth and knowledge—a struggle to shape perception, control understanding, and influence both the decision-making process and its outcomes.

The Cipher Brief brings expert-level context to national and global security stories. It’s never been more important to understand what’s happening in the world. Upgrade your access to exclusive content by becoming a subscriber.

Never before in history have individuals, organizations, societies, and nations faced such a sustained assault on our ability to make our own decisions—our autonomy to think, decide, and act in our own best interests. From our adversaries’ perspective, controlling perceptions, manufacturing realities, steering decision-making, intimidation as persuasion, decision fatigue, and manufactured false choices make for persuasive and effective strategy.

In this global information landscape, where technology levels the playing field, any individual or group, and state or non-state actors can reach global audiences almost immediately. Thousands of internet sites, fake users, fabricated organizations, bots, and willing surrogates, managed by Russia, China, Iran, and North Korea, wage cognitive warfare against the U.S., our allies, and our partners at unprecedented scale and velocity. Artificial intelligence now serves as a force multiplier—amplifying reach, supercharging deception, automating the manipulation of public opinion, and constricting time in the information maneuver space.

As individuals and groups within America, this is everything from how we see the world, how we vote, how we invest, whom and what we trust, which policies we support or oppose, and who we believe are our friends and partners—locally, regionally, and globally.

For national security leaders, policymakers, and corporate and military decision-makers, our adversaries seek to influence consequential decisions on issues like Ukraine, Taiwan, trade, military posture, supply chains, alliances, participation in international organizations, technology development, and a host of other issues that could tip the balance in our adversaries’ favor.

For China, Russia, Iran, and North Korea, this is integrated national strategy where the instruments of national power—government, private sector, and surrogates—are combined to achieve strategic impact. Further, the willingness of our adversaries to defy international law; challenge economic interests, and violate the sovereignty and laws of every country including the U.S.; engage in bribery, political coercion, sabotage, and assassinations—essentially a “no limits” approach” to cognitive warfare—gives them considerable leverage—made more effective by our lack of focused emphasis on recognizing, prioritizing and taking action to mass and commonly orient our great national strengths.

If we are to make consequential decisions with confidence, we must have high certainty in the information we receive, value, and share. In the cognitive domain, truth is a strategic asset—precious, powerful, and fragile. To endure, it must be shielded from the relentless assault of manipulation, coercion, and altered realities initiated by our adversaries to shape the strategic landscape and create influence attack vectors intended to undermine and disable our ability to do the same.

Churchill recognized both the strategic value and fragile nature of truth in a time of conflict. He famously said, “In wartime, the truth [is] so precious that it should always be attended by a bodyguard of lies.” The lesson is clear. Today, just as in 1943, we must seize and defend the cognitive advantage if we are to navigate these equally perilous times.

What do we need to do to achieve a cognitive advantage?

- First, we need to reassert a strong U.S. national narrative.

In the cognitive domain, our national narrative is both sword and shield. It projects power, influence, and advances our interests. It tells the story of our values, our history, our aspirations, our view of the world, and our resolve and is reinforced by actions and deeds. Our military and economic strength and our global leaderships are strong parts of this narrative. It supports confidence in our actions, our institutions, and our commitments. It also counters adversary narratives and actions that seek to undermine America within our own borders and across the world. We all know today that our national narrative is being questioned by some at home and abroad. Regardless of how we see the political environment, we must articulate and advance a strong seamless U.S. national narrative as foundational to a cognitive advantage. We must take this on.

- Second, we need to empower our master storytellers.

Our master storytellers are not just communicators; they are architects of persuasion. We all know this; we read, we watch movies, and we listen. Facts are fleeting, but stories remain with us—they shape how we feel which in turn drives how we behave. In the cognitive domain, well-crafted stories—including those tailored to navigate today’s hyper-technical environment and chaotic information environment—shape threat perceptions, influence our perception of reality, sustain resolve, and can tip the balance in competition or conflict.

Adversaries recognize the power of narrative and weaponize it; even the truth is more persuasive when it is delivered as part of a compelling story. History proves the advantage: in cognitive warfare, facts alone rarely shift outcomes—compelling narratives and persuasive storytelling do. As in 1943, our edge will be defined by those who can craft and deliver the stories that influence minds and shape events. Yes, we need our master storytellers as much today as we did in 1943.

- Third, we need to see and understand our adversaries’ capabilities and intentions in the cognitive domain—where perception, knowledge, and decision-making are contested. Our adversaries, of course, go to great lengths to mask and conceal their activities. It is time for cognitive intelligence—intelligence in and about the cognitive domain and our ability to reliably understand how, where, and why adversaries seek to shape our thinking and decisions—to emerge as a priority.

- Fourth, we need a sustain a technological edge in AI, Cognitive Science, Cyber, and other technologies that force our adversaries to go on the defensive. China in particular is working to take that advantage from us by its own means but also by stealing U.S. data, technologies, and intellectual property to use against us. We must safeguard the extraordinary capabilities of U.S. technologies—including those small, bold startups—that not only provide a critical national security advantage but are also relentlessly targeted by our adversaries.

- Fifth—and critically important—we need to plan, organize and drive designed strategies and actions across our governmental institutions, international partners, and private sector at the intersections of shared security interests to defend against adversary tactics that target our economic, military, infrastructure, informational and Cyber pillars of security each fueled by human perception, reasoning, and effective decision-making. If you remember anything from this article, please remember this. As a priority, we need a strategy and a commitment to play offense in a quiet but relentless manner that confuses our adversaries, shatters their confidence, and forces them—not us—to deal with the uncertainties of cognitive warfare.

- Finally, if all of this is to work, we need to harness the incredible intellectual power, critical thinking, and collaboration among government, private sector, academia, and in many cases, our allies. We need to work at the nexus of shared interests. In this collaboration; we need leaders; not to overly prescribe or to build bureaucracy, but to inspire, convene, add clarity of purpose, and to enable the incredible capability this community offers. We must use the power to convene to commonly inform and set conditions for mutually beneficial action and outcomes, and to help close the relationship seams used by our adversaries as attack vectors.

Need a daily dose of reality on national and global security issues? Subscriber to The Cipher Brief’s Nightcap newsletter, delivering expert insights on today’s events – right to your inbox. Sign up for free today.

For our leaders, a reminder that when relegated to small tasks and small thinking, influence operations in the cognitive domain will achieve small results. This is a time for vision, for big thoughts, innovation, and audacity. With those attributes, and thinking back to the remarkable achievements of 1943, today’s operations in the cognitive domain can and will do remarkable things.

Those elements, we believe, are the foundation of a cognitive advantage. If we are successful, it means we have a sustained ability to protect our decision-making autonomy at all levels; we preserve domestic and allied social cohesion; we retain global influence, credibility and narrative power; we expose and undermine adversary efforts at cognitive warfare; and we achieve U.S. objectives without resulting in direct conflict. Challenging?—Yes. Attainable?—Certainly.

A final word. Last June, Dave Pitts visited Normandy for the 80^th Anniversary of D-Day—which was our last conventional war of great powers. It was a war that resulted in a devastating loss of human life and unprecedented destruction. Omaha Beach, the Drop Zones around St. Mere Eglise, and the American Cemetery were vivid reminders. That war established the U.S as a global superpower and established a world order that has lasted 80 years. It also enshrined in history the “Greatest Generation.”

Today, authoritarian rule is on the rise, national sovereignty around the world is being undermined, and the global order as we know it is under attack. Once again, our preeminence, leadership, and resolve are being challenged. Let’s be clear, the next war—a quieter war, a gray war—is already underway. The outcome of that war will be as consequential as conventional war.

Cognitive warfare may very well be the defining contest of this era—a generational challenge—given the threats it poses to U.S. national security, our place and influence in the world, and our commitment to our own self-determination. If you are a professional in this space—government, private sector, academia, and ally—this is clearly your time.

Today, we are surrounded by threats, but we are also surrounded by opportunities, by extraordinary expertise, and by willing partners. The challenges ahead are formidable, but so are our experiences and capabilities as a nation. The incredible resolve, sacrifice, and refusal to fail—hallmarks of the Greatest Generation—are woven into the fabric of America and will continue to serve us well. Securing our future now demands leadership, collaboration, a bias for action, and adaptability—the hallmarks of this generation. We have what it takes.

Yes, confidence is clearly justified—but we must just as clearly match that confidence with decisive action. Time is not on our side as others have already decided to prioritize cognitive related strategies. It is time to take a bold step forward in the cognitive domain and to seize the cognitive advantage.

All statements of fact, opinion, or analysis expressed are those of the author and do not reflect the official positions or views of the U.S. Government. Nothing in the contents should be construed as asserting or implying U.S. Government authentication of information or endorsement of the author's views.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals.

Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

EXPERT PERSPECTIVE – The White House rolled out a 20-point plan on Monday calling for a permanent truce in Israel's war against Hamas that calls for the release of hostages. President Trump is calling the plan the most significant effort yet to secure peace in the region.

Cipher Brief Expert General Jack Keane (Ret.), a trusted advisor to the president who declined multiple overtures to serve as U.S. Secretary of Defense during the first Trump administration, met recently in the region with Prime Minister Benjamin Netanyahu, President Isaac Herzog and Minister of Strategic Affairs Ron Dermer as well as senior IDF leaders to talk about what is needed for lasting peace and how to curb Iran's influence via proxies like Hamas.

After those meetings, we asked Gen. Keane for his assessment of the situation on the ground, whether he believes Israel is capable of sustaining wars on three separate fronts (Hamas in Gaza, Hezbollah in Lebanon and the Houthis in Yemen), and whether he believes Hamas will ever accept a deal that requires them to surrender power. Our conversation has been lightly edited for length.

THE INTERVIEW

Gen. Jack Keane (Ret.)

General Jack Keane (Ret.), a four-star general, retired after 37 years of military service culminating in his appointment as acting Chief of Staff and Vice Chief of Staff of the US Army. General Keane is president of GSI Consulting and serves as chairman of the Institute for the Study of War. In 2020, Gen. Keane was presented with the Presidential Medal of Freedom by President Donald Trump.

Kelly: As you’ve just returned from the Middle East where you engaged in a number of high-level meetings with senior Israeli leaders, what is your raw assessment of events on the ground?

Gen. Keane: There's a major paradigm shift strategically taking place in the Middle East as a result of Israel’s - supported by the United States - domination of Iran and its proxies. And it's hard to overstate the significance of it. The reality is that it's a sea change that's going to be felt for decades, and there is such huge opportunity here - once and for all - to stabilize the Middle East. But it’s an opportunity that requires follow-up with the Iranians to keep the pressure on economically and diplomatically. Iran is so much more vulnerable now after the defeat that Israel has handed to them.

Israel also needs to stay focused on the proxies - obviously Hamas, and hopefully, we will see a deal here pretty soon. Either they surrender or Israel will force them to give up power and get the hostages back as well.

Israel also must continue to push back on the Houthis. While we were there, there were three attacks in the vicinity where we were staying, during a nine-day trip. The Houthis are launching individual missiles or drones, but not in volleys. These are more - in military terms - harassment attacks, but Israel is pushing back hard on Houthis by destroying their valuable infrastructure.

Hezbollah has been completely decapitated, and every time Hezbollah tries to move into Southern Lebanon, Israel conducts airstrikes as they just absolutely refuse to let them rebuild in that area. Israel has conducted over a thousand airstrikes to make sure they don’t reconstitute in the South without much media coverage. When I met with Prime Minister Benjamin Netanyahu, I told him that I think there are two major lessons learned here for Israel. One is that you can never, ever again, permit Iran's proxies to build up capability on your border. And that is obviously significantly for Hamas, as well as Hezbollah.

And the second is that you've got to work yourself into a position where you're much more independent of the United States. I said, "You can't afford, going forward, to go through these political swings that we have now in national security and foreign policy in America where one Administration fully supports with everything you need and another Administration holds back what you need.

During the Cold War, the U.S. had a fairly consistent policy whether the Democrats or Republicans were in charge. For sure, some of the methods were changed from one administration to the next, but the objectives were pretty much the same: contain the Soviet Union.

Recently, we’ve gone through major swings. The previous administration - much more so than the American people realize - pulled the plug on a lot of the vital ammunition and weapons that Israel needed, and then they micromanaged how they conduct a war and this was being led by civilians out of the White House who had absolutely no competence in doing something like that, and Israel can't afford to go through another swing like that.

So, my advice is to get as close to being completely independent of the United States for weapons and ammunition but not independent of the United States in terms of geopolitical support or moral support, to be sure.

But the opportunities today are pretty significant and they're already taking place.

There is now work toward normalization of relations with Lebanon and Lebanon is talking about disarming Hezbollah. Who would've thought that something like that could have taken place just a couple of years ago?

Bashar al-Assad is gone in Syria and in Israel, Ron Dermer, the Minister of Strategic Affairs in Israel, who I spoke to at length, is working very hard to develop a security agreement with Syria and the new regime. They have their eyes wide open. They know that Ahmed Al-Sharaa is former al-Qaeda and that organization is still supporting him, but he's trying to consolidate all the different factions in Syria. And Israel doesn’t want any of those factions coming south and interfering with their security.

The Israel Defense Forces (IDF) took me into Syria to show me their defensive positions that they've established there. That makes some sense. I doubt if they will give any of that up in this security agreement, but the fact that there are serious negotiations going on is pretty significant.

In Gaza, hopefully we will get a deal here pretty soon, and that will certainly enable a lot of other things to happen once the fighting stops. But the Abraham Accords, despite the attack on the Qataris, despite the prolonged and protracted war in Gaza, the feedback that I got from Israeli leadership is that the Arabs are still interested in normalizing the relationship. They know that it's going to add to peace and stability in the region. It’s not necessarily easy, but it's something that has huge strategic potential for the future.

I think Turkey is a real challenge. President Recip Tayyip Erdogan had great influence on Al-Sharaa seizing power. I think he wants to control Syrian leadership and he's anti-Israel, he's pro-Hamas, he's Muslim Brotherhood, and he has been a thorn in the side of Democratic and Republican administrations for years, despite the fact that he's a member of NATO. I think when we're dealing with Erdogan, even though he's been there longer than we would like to see, we have to look beyond him and look at the strategic place that Turkey holds in the Middle East and in Europe. They're the second-largest military in Europe, after Russia. The largest military member of NATO in Europe, obviously the United States is more powerful than them. So, they have huge capability, and while Erdogan frustrates us quite a bit, I think we need to figure out a way to work with him in our interest and Israel's interest despite his anti-Israel attitude.

And as much as that may be an opportunity, it's probably more of a challenge. President Trump is cutting the deal with him in the memorandum of understanding to build small modular nuclear reactors and the large nuclear reactors in the future. Turkey has one that was built by Russia and the fact that we're trying to pull him away from Russia, that's a good thing and could create some balance. If we just shut him down and don't want to deal with him because we don't like his attitude on a number of things, he'll just turn to Russia and China and that doesn't make any sense, strategically.

My overall take on this, is that if we continue to stay engaged and really finish Iran’s ability to be a destabilizer in the region, then the potential for stability and growth in the region - in the way that everybody's been hoping for, is really on the horizon.

The Cipher Brief Threat Conference is happening October 19-22 in Sea Island, GA. The world's leading minds on national security from both the public and private sectors will be there. Will you? Apply for a seat at the table today.

Kelly: Prime Minister Netanyahu was just in New York at the United Nations saying that Israel must finish the job in Gaza. You mentioned an agreement on the table. Do you have anything that makes you think Hamas would agree to it?

Gen. Keane: I don't know. I have great skepticism. We have been here so many times, where the United States, Israel and the Qataris have said, "We're really close to a deal." And then at the last minute, Hamas finds some reason to reject it. Hamas' real issue is that they want to stay in control of Gaza. Israel does not want that to happen, the United States does not want that to happen, and usually they foreclose on not making the deal because they don't want to give up control. Hopefully this time they're willing to, and that control would turn over to some representation of the Palestinians and Arab authorities and would allow for some kind of a stabilization force. Prime Minister Netanyahu has said time and time again, "I don't want to occupy Gaza. That's not in Israel's interest.”

Kelly: Yeah. Let's switch for just a moment to Russia. There’s been a change in the relationship between President Trump and Russian President Vladimir Putin over the last several months. President Trump has shown his growing frustration with Putin's lack of interest in actually ending the war in Ukraine. Where do you see the path forward there?

Gen. Keane: Just as you say, it's been eight months, and the president has admitted that he thought this was going to be easier than how it has turned out because he had such a positive relationship with Putin. But Putin's strategic objectives are very clear. He wants to take control of Ukraine, put in place a stooge government and expand into Eastern Europe, and he's dead set on that. Nothing to date has convinced him to change those objectives. In other words, he believes continuing the war is in his national interest so that Moscow can achieve those objectives, and nothing we have done has dissuaded him from that. So, what the president has done, I think, is to be patient with him, despite the fact that Putin delays, obfuscates, tries to confuse, et cetera. The Alaska Summit was a pivotal moment. There is no doubt that Putin made an overture to President Trump that he was willing to meet with President Zelensky following the summit, not immediately, but in a short period of time and that he was also willing to have a three-party meeting to include President Trump. The very next day, Putin’s spokesperson said that there are no plans for a meeting between President Zelenskyy and President Putin, and if there were going to be plans, there would have to be some conditions established and negotiated before there would ever be a meeting such as that.

I think based on that, the president realized that Putin continues to lie consistently and especially during the last couple of months of the negotiations. And even post Alaska Summit, Putin has done what? He has militarily escalated the war, not a little bit, but quite significantly and his attacks are largely focused against the Ukrainian people with hundreds and hundreds of drones and ballistic missiles a night, raining down on them and hitting their energy infrastructure. He knows winter is coming and he wants the lights to be out and the heat to be off and for them to suffer.

And as of right now, there is somewhere in the neighborhood of 11,000 to 15,000 kidnapped Ukrainian children who are still in Russia's hands. We know this from multiple international sources and that, in of itself, is a war crime and really horrific. So, when you put all of that together; the delay tactics, the lies that he's been telling the President, and the military escalation, even as the president is trying to bring him to the negotiating table, he can’t be trusted.

Russia is weak economically, weak militarily, and they can be stopped. Not only can they be stopped, but they can be overtaken by the Ukrainian military. That is not a new thought process for the president. What's new now is that he is talking about it publicly. I can tell you for a fact that he's known for some time how weak Russia is economically and how weak they are militarily. Moscow is conducting a massive narrative that they're succeeding on offensive operations. “They're overwhelming the Ukrainians. It's just a matter of time. This is a war of attrition. The West, the United States and the Europeans, I can outlast them. They will eventually give in and we will win.” That has been his narrative. And now the president, I think, has made the decision to give up on Putin, and he's obviously talking to the public more about his perception of Putin, his perception of Russia, and the status that they have. That's step one. He hasn't changed any policy, but he's changed the narrative.

What remains to be seen is step two, and is the president going to continue what he said he would do, which is increase military and economic pressure on Russia? Military pressure could stop Russia cold from taking any more territory. And by the way, in the last two years, they've only increased the territory under their control by only 1% out of the 20% they control. And the president could also permit Ukraine to attack deep into Russia with increased long-range weapons and remove any restrictions on the use of those weapons. That would be significant military pressure.

We've been talking about economic pressure for weeks. Europeans must stop buying oil and gas from Russia. It’s shameful that they're still doing it, and very hypocritical. As the president says, "You are fueling Putin's war at the same time that you're supporting Ukraine. It makes no sense."

And then the United States needs to do the same in terms of sanctions and tariffs. That would be a part of a step two that makes the most sense. The sooner we get about that, the better. The president has said that in the past, and I believe that is what should be done. It's his decision, certainly, and we'll see what's going to happen next.

Kelly: As you mentioned, winter is coming, and Vladimir Putin knows how to take advantage of that time. How have you seen Russia expand military actions over the past few weeks?

Gen. Keane: We saw within the last week, Russia’s military activities escalating into violating Poland's airspace with war-like instruments. In this case, 19 drones penetrated Polish airspace and there was a smaller incursion in Romania and fighter jets violating Estonia's airspace as well. NATO must come to the conclusion that this activity is an Article 5 violation, and they have every right to shoot at those aircraft if they do it again. If they don't do that, if they wring their hands and continue to talk about it and push back rhetorically on Russia, what they'll see next is not a handful of drones but hundreds of drones and eventually a thousand drones that would absolutely overwhelm all of their air defense systems. These are acts of war, and they should be responded in kind. That doesn't mean that Poland's going to declare war on Russia, but I am suggesting they have every right to shoot at somebody who violates their airspace with warplanes. And that will get Putin's attention. Otherwise, if we don't do it and we just continue to use rhetoric, Putin will expand to other countries and increase the scale of the attack to weaken NATO and force the Europeans to focus more on their defense and less on Ukraine’s.

Putin is not reckless. He's a killer. He's a thug. He's ruthless, but he's not reckless. He's actually quite deliberate and methodical. We've been watching him for 25 years. Those of us who know him can almost call his plays because he's so predictable. Push back on him with strength and he will shut it down.

Updated to reflect White House release of the 20-point plan on Monday.

Are you Subscribed to The Cipher Brief’s Digital Channel on YouTube? There is no better place to get clear perspectives from deeply experienced national security experts.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.

EXPERT INTERVIEW – The United Nations has reimposed sweeping economic and military sanctions on Iran, ten years after lifting them under the 2015 nuclear deal.

Britain, France, and Germany triggered the “snapback” mechanism, accusing Tehran of nuclear escalation and blocking inspections. Iran had already halted oversight after U.S. and Israeli strikes in June damaged several nuclear sites and military facilities.

President Masoud Pezeshkian insists Iran has no intention of building nuclear weapons, calling the sanctions “unfair and illegal.” But the move marks another blow to the Joint Comprehensive Plan of Action (JCPOA), the deal meant to cap Iran’s enrichment and research while allowing civilian nuclear energy.

Iran accelerated banned nuclear activity after Trump pulled the U.S. out of the deal in 2018, repeatedly dismissing the accord as flawed.

The latest sanctions cut Iran off from global banks, reimpose arms and missile restrictions, and revive asset freezes and travel bans on key officials. Analysts say the measures hit Iran at a fragile moment with its economy shrinking, inflation surging, and the rial collapsing to record lows. Oil sales, foreign investment, shipping, and manufacturing are all expected to take a hit.

The Cipher Brief spoke with longtime Middle East and Energy Analyst Norm Roule, who formerly served as National Intelligence Manager for Iran at ODNI. Roule continues to travel regularly to the region for meetings with high-level officials throughout the Middle East.

Norman T. Roule

Norman Roule is a geopolitical and energy consultant who served for 34 years in the Central Intelligence Agency, managing numerous programs relating to Iran and the Middle East. He also served as the National Intelligence Manager for Iran (NIM-I)\n at ODNI, where he was responsible for all aspects of national intelligence policy related to Iran.

The Cipher Brief: Why are snapback sanctions different from other sanctions already imposed on Iran?

Roule: First, we should touch on what this means for the regime. The sanctions hit Iran at one of its most fragile moments since the late 1980s. The government remains unpopular to an unprecedented degree. Virtually every economic indicator in Iran is poor. Its national security architecture of militias, foreign proxies, Russia, China, and the Revolutionary Guard failed during the recent conflict with Israel and the U.S. The main driver of the regime is to maintain stability as it completes transitions to the post-revolutionary generation of leadership. Despite the absence of large-scale protests, destabilizing national unrest could occur at any time.

Over the past few months, Iran’s diplomats have used the prospect of a nuclear deal and the possibility of sanctions relief as a source of hope for the Iranian people. The return of UN sanctions strips Tehran of one of its few remaining political assets.

The primary difference between the latest sanctions and U.S. sanctions is that these measures are binding on all 193 member states of the United Nations. Iran will, of course, do everything it can to evade sanctions. Russia, China, North Korea, Venezuela, and other Iranian partners who already have a history of violating Iran sanctions are unlikely to enforce these sanctions with enthusiasm.

However, unlike U.S. sanctions, which they have argued could be ignored because they were imposed only by Washington, these sanctions are imposed by the United Nations. This will make it harder for these countries to involve other countries in their own violations. Likewise, it makes it much easier for the U.S. government to seek compliance worldwide due to the legal and reputational risks associated with countries and businesses that we might approach on this issue.

The Cipher Brief: Can you discuss the specific sanctions and your assessment of their likelihood of success?

Roule: First, and most damaging for Iran, these sanctions isolate Iranian banks from a large part of the global financial system and require that UN members prevent the use of their banking systems on sanctioned trade. Hence, Iran has lost the ability to manage its oil revenues through international banks. Instead, it will need to engage in oil bartering or use intermediaries, which is a slower and more expensive process. It will likely reduce its oil sales at a time when Saudi Arabia is trying to reclaim some of the market share lost to Iran in recent years.

Banks understand that Iran will seek to defy sanctions. They also know that there are expensive legal consequences if they fail to undertake due diligence operations to examine transactions and shipments, thereby demonstrating that they have fulfilled their sanctions obligations.

Next, there is the restoration of the conventional arms embargo: This bans traditional arms transfers to or from Iran. This should make it harder for Iran to acquire advanced weapons from Russia and China, but also to sell its weapons systems to Russia, Sudan, and other countries. I will admit that I am not sanguine on the last point.

Third, we have nuclear and missile restrictions: This includes a prohibition on uranium enrichment, reprocessing, heavy-water activities, and ballistic missile technology transfers or tests capable of delivering nuclear weapons (beyond 300 km range). Iran is likely to ignore most of these restrictions and will test the international community as it does so. But I think it will also try to do so in a way that avoids sparking a regime-destabilizing war with Israel or the U.S.

Snapback also restores restrictions on dual-use goods, materials, and technologies that could aid nuclear or missile programs. These sections require increased inspections of Iranian ships and aircraft to prevent the transfer of prohibited materials or goods. For governments and businesses, this requirement will be among the more intrusive and time-consuming, and thus expensive. At the same time, Tehran will game the system by introducing complicated, multi-country layers of shell companies to obtain critical materials. This is where international legal and intelligence partnerships will play an essential role in identifying and neutralizing these networks.

Next, snapback returns asset freezes and travel bans on designated Iranian individuals. This is a rather long list and includes Islamic Revolutionary Guard Corps officials, nuclear scientists, and officials related to their programs, as well as their assets worldwide. Travel bans should be successful. Asset bans are less so, primarily due to the small number of such assets located abroad. These restrictions, however, serve as a powerful reminder to businesses of the reputational impact of doing business with Iran.

What does all of this mean? Join The Cipher Brief Threat Conference - happening October 19-22 in Sea Island, GA. to engage with the world’s leading national security experts to help answer those questions. Apply for your seat at the table today.

The Cipher Brief: Let’s go deeper. Can you break this down by sector? Is there any part of Iran’s economy that will be hurt more than another? Oil seems most likely.

Roule: We should keep in mind that, following the negative impact of the initial sanctions announcement, the effect of sanctions should be understood as corrosive. Further impact is shaped by how seriously and loudly we enforce sanctions, as well as how vigorously and successfully Tehran develops countermeasures.

To begin, Iran started the year in challenging economic conditions. The IMF’s projection for Iran’s GDP was dismal, 0.5%, so negative growth in the coming months would be far from surprising. Indeed, one wonders how it will be avoided.

The snapback announcement caused the Iranian rial to plummet to a new record low of 1.12 million to the dollar. Tehran will have little choice but to inject precious hard currency into the market to sustain its failing currency. I also expect more enthusiasm for the effort to cut some of the zeros from the Iranian currency. Iran’s leaders likely worry that the coming months will see a further weakening of the rial and a spike in inflation, which currently hovers around 43%.

Foreign investment, such as it is, will also take a hit. In 2024, Iran claimed – and probably overstated – that it attracted around $5.5 billion in foreign investment. That minuscule figure will shrink even further.

Let’s talk about sectoral impacts.

Shipping costs for Iran are likely to increase substantially. A significant portion of Iran’s seaborne trade will face new cargo inspections, bans on dual-use goods shipments, insurance difficulties, and possibly even port servicing complications.

Manufacturing and mining will be impacted in terms of both imports and exports as they face new pressures on supply chains and financing. This impact will affect trade with Europe, but it will also dampen Iran’s efforts to establish trade with Africa and complicate its trade relations with Iraq.

Although Iran’s defense industry may not be participating in trade shows, one suspects that its existing trade in drones and light arms will continue. Its current clients – Russia, Sudan, and other African countries, and reportedly Venezuela and Bolivia – may choose to ignore sanctions given their lack of alternative suppliers and animosity with the West.

The impact of sanctions on Iranian oil sales to China will be the most significant, if difficult to assess, in the coming months. Beijing and Tehran have deliberately obscured the payment relationship, and the former has imposed tough terms on Iran. China will view this new phase as an opportunity to offload more goods, machinery, and technology onto the Iranian market, and possibly to negotiate a larger price discount for the oil it acquires.

The use of intermediaries, smaller banks that are outside the scope of international monitoring, and shell firms will also increase costs for Tehran. Last, it isn’t unreasonable to think that Chinese oil sales could contract. Beijing – likely seeing the writing on the wall on this issue – has been building its reserves, and the Saudis and Emirates can fill the missing production, although they won’t discount their oil to match Iran’s prices.

The Cipher Brief: What are Iran’s likely next moves? Is diplomacy dead? What do you say to those who believe military action is expected?

Roule: Iran’s playbook is unlikely to be a surprise. Tehran’s leaders used Western media to issue their side of the story, projecting a blend of confidence, defiance, and dismissal of the impact of sanctions. Once home, Iran’s leaders will show that they won’t stop their nuclear work.

It is likely that even within Iran, the program's future remains under debate, with several options being considered. Tehran’s efforts to maintain close relations with Moscow and Beijing make it likely that it will seek to involve these capitals in its programs. One could imagine Iran dangling IAEA access at some point to gain international acceptance. Three possible programs could emerge in the coming months.

The most likely option is that Iran will seek to rebuild a modernized version of the enrichment and even the conversion facilities destroyed in the Twelve-Day War. This process would be expensive, and, depending on the number and location of facilities, could take years to complete. This option would be consistent with Iranian policy rhetoric but would risk a military attack and an extension of sanctions. The problem with lengthy construction is that this also delays benefits to Iran’s economy.

Tehran could reduce the likelihood of an attack by allowing the IAEA access to the sites or involving Russia or China in the operation and construction of the sites. Such an option, if involving advanced centrifuges, would allow Iran to retain the capability to produce highly enriched uranium, including weaponization levels, in the future should it wish to do so.

A far less likely option is to select a foreign fuel source for domestic reactors to provide power. Since this would mean abandoning a domestic enrichment program, this option is thus improbable in the foreseeable future.

Least likely for now would be weaponization. Such a decision would require Iran’s leadership to believe it could undertake and execute such an activity without discovery by Israeli or Western intelligence and, if discovered, would not face devastating military action similar to the June 2025 war.

In any case, activity at the recently reported Mount Kolang Gaz La facility in Esfahan Province is sufficient to be observable to the West, and as we have recently seen, to draw the attention of Western media, thereby sending a message. I expect construction at the site won’t be very fast until Tehran sees how Israel and the U.S. respond to this announcement and until Iran comes to a conclusion as to what direction it wishes to go in its nuclear program.

Diplomacy on Iran’s nuclear program is far from over, with low-level conversations perhaps taking place in Vienna and European capitals. The international community will remain – and should remain- insistent that the International Atomic Energy Agency (IAEA) gain access to Iran’s nuclear enterprise as soon as possible. Such a return cannot be achieved without engagement and diplomacy. However, it will take time for the politics to cool and a new paradigm of proposals to emerge.

Washington, Europe, and the Gulf will entertain serious proposals from Iran that it will accept a nuclear program that allows the IAEA access it requires. More broadly, Washington is looking for a deal that means Iran won’t have the capacity to build nuclear weapons, or accept constraints on its missile program, and end the regional operations of the Quds Force.

Iran’s current leadership is unlikely to make such a decision until sanctions begin to erode the economy. The death of the Supreme Leader could pave the way for a new generation of leadership, which – while no less assertive and potentially even hostile – might be more willing to be more accommodating on these issues to ensure the survival of the Islamic Republic.

Extreme caution should be exercised when discussing the possibility of military hostilities. The U.S. certainly doesn’t seek to start a war in the region. Israel may conduct military operations in Iran over Quds Force actions. Still, it is hard to see why Israel would argue it needs to undertake a costly military operation simply because Tehran is denying the IAEA access to rubble at Natanz. However, the Twelve Day War has changed the rules. An Israeli or US military attack on Iran is no longer unthinkable. If Iran were to undertake weaponization activity or attempt to conceal weaponization-related equipment or material, some in Tehran probably won’t be surprised if another surgical attack takes place.

Moving to Tehran, it is hard to see what benefits military action brings to Tehran. Iran is operating under some harsh realities. The Twelve Day War made it clear that Israel’s intelligence capabilities within Iran are extraordinary, and there is no reason to believe the capabilities aren’t still in place. If so, any plan would likely be discovered and perhaps neutralized before it could take off. Further, Iran’s air defenses continue to be no match for Israel or U.S. air and missile systems.

Iran’s missiles and drones not only had no strategic impact on the course of the Israeli attack but were significantly reduced in number by Israeli attacks. Iran fought alone in June: neither Russia nor China showed the slightest interest or capability in helping Iran during the June war. A conflict that spread to the region risks costing Iran its détente with the GCC and potentially jeopardizing its support from China. Iran’s population remains disillusioned, and testing their willingness to endure a conflict would be quite the risk. Much depends on specific events and drivers, but current conditions don’t seem to lean towards a regional conflict.

Are you Subscribed to The Cipher Brief’s Digital Channel on YouTube? There is no better place to get clear perspectives from deeply experienced national security experts.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.

OPINION — Israel’s Operation Rising Lion will go down as among the most impressive military campaigns in history. Military academies, military planners, and the Intelligence Community will study it for decades. More urgent, however, is that policymakers understand the importance of U.S. support in enabling Israel to advance our shared interests.

In less than a fortnight, Israel brought to its knees a major regional adversary, geographically nearly 75 times its size and 1,000 miles away. As we learned on a recent trip to Israel with the Jewish Institute for National Security of America, Israel—with crucial U.S. support—crippled Iran’s nuclear and missile capabilities, dismantled its air defenses, and decapitated its command and control. At the Pentagon’s request, Israeli pilots cleared the way for U.S. B-2 bombers.

Since first exposing Iran’s nuclear weapons program in 1994, Israel knew that it might need to take military action. Yet, June’s attack was only seven months in the making. At the end of 2024, a narrower plan based on precision strikes against a few nuclear facilities was shelved and a far broader campaign was developed from scratch—targeting not only the entirety of Iran’s nuclear supply chain, but its ballistic missiles, top generals, and leading nuclear scientists as well.

What made that sweeping operation feasible was an extraordinary string of Israeli successes since the brutal Hamas attack on October 7, 2023. Israel defeated Hamas, decimated Hezbollah, defended itself against hundreds of Iranian-launched ballistic missiles and thousands of drones, eliminated Syrian anti-air batteries, and knocked out Iran’s advanced Russian S-300 air defenses, opening an unimpeded corridor to Iran.

Suddenly, Iran was more exposed than at any point in the last forty years. The regime responded by accelerating both its nuclear weapons research and missile production. Israel now had both the opportunity and urgent need to act quickly and comprehensively against myriad Iranian targets.

Rapidly expanding its war plan required Israel to gather intelligence on hundreds of additional targets, develop new capabilities and operational concepts, and ready large numbers of personnel for new and unfamiliar missions. It wasn’t until earlier this year, for example, that Israel decided to use its full fleet of combat aircraft - including older F-16s - against Iran. And it was just days before the June 13 “go” date that the operation’s final pieces were put in place.

The extraordinary agility and ingenuity of Israel’s planning was exceeded only by the excellence of its military execution. The campaign started with a surprise attack that combined exquisite intelligence with perfectly synchronized operations—including stand-off weapons, forward-deployed drones, and clandestine ground teams—to eliminate Iran’s top military command and leading scientists in the war’s first minutes.

Drawing on the full-range of its advanced capabilities - including indigenously developed air launched munitions and complex cyber operations - Israel systematically neutralized Iran’s air defenses, establishing total air superiority from the Iraqi border to Tehran in just forty-eight hours. For the rest of the war, Israeli jets owned the skies over their greatest enemy’s capital. Operating without challenge, Israeli UAVs blanketed Iranian missile sites, providing persistent intelligence and hunting missile launchers before they could fire.

Need a daily dose of reality on national and global security issues? Subscriber to The Cipher Brief’s Nightcap newsletter, delivering expert insights on today’s events – right to your inbox. Sign up for free today.

Essential to Israel’s success were its two squadrons of F-35 fifth-generation fighters. Every strike package had several of them in the lead. F-15 pilots told us they felt less safe without an F-35 nearby. The aircraft’s next generation avionics allowed pilots to detect and defeat Iranian defenses that intelligence had not previously identified—even when they obscured their position by keeping sensors turned off until Israeli jets were near.

Israel’s achievements are extraordinary. For the first time, a U.S. ally has taken the lead, utilizing American weapons, in achieving a decades-long, bipartisan U.S. national security objective - preventing a nuclear Iran - and has dealt a serious blow to our most dangerous enemy in a part of the world that has long been deemed vital to U.S. interests, and, in doing so, has almost single-handedly transformed the Middle East’s balance of power in favor of the West.

This success was enabled not by the United States joining the fight, vital though that was, but by the decades-long U.S. investment in Israel’s ability to defend itself - through weapons sales, joint training and intelligence sharing. Not to mention Israel’s fierce determination to fight back.

The lessons for policymakers from Operation Rising Lion are clear: Israel is a U.S. national security asset and we need more allies equally determined and capable.

The Iran war is not yet over; if left unchecked, Iran may well reconstitute its nuclear program, ballistic missiles, or terrorist network. Russia remains an aggressor and China the pacing threat. The United States should find and support regional partners, like Israel. Provide them with the weapons, intelligence, advanced technology, and political support needed to address these threats.

That’s real burden sharing—a local partner prepared to carry the lion’s share of the responsibility, not to mention the fighting and dying, to counter shared threats.

General Charles Wald, USAF (ret.), served as the deputy commander of U.S. European Command. Lieutenant General Robert P. Ashley, USA (ret.), was the 21st Director of the Defense Intelligence Agency. Vice Admiral Mark Fox, USN (ret.), served as Deputy Commander of U.S. Central Command. All three are members of the Jewish Institute for National Security of America’s (JINSA) Iran War Assessment.

EXPERT Q&A — Russia’s massive drone attack overnight on six Ukrainian regions, which hit energy and gas transport infrastructure and cut off power to over 100,000 people, is the latest sign that Moscow is nowhere near peace. Coupled with the Kremlin’s rejection of meaningful security guarantees for Ukraine, it’s clear that President Vladimir Putin is still pursuing his maximalist war goals. That doesn’t surprise General (Ret.) Philip Breedlove, former NATO Supreme Allied Commander, who said the U.S. has been “completely deterred” by Putin for the last 11 years, across four presidents, which has built a "sanctuary" for Russia and allowed it to escalate in Ukraine unchecked.

Cipher Brief COO and Executive Editor of the Open Source Report, Brad Christian spoke with Gen. Breedlove about how that dynamic and is shaping the war and peace negotiations, as well as other global security challenges — from the threat posed by Iranian drones to the true relationship between members of the Axis of Authoritarians. Our conversation has been lightly edited for length and clarity.

The Cipher Brief: Let's start in the Middle East. Broadly speaking, how are you thinking about all of the changes and all of the action that is happening in the region and what it might be pointing to?

General Breedlove: I'm in the Middle East now and have been here for almost seven days. I'm in my second capital and we're working through some of the issues that are left over after the 12-day war such as how the Middle East is continuing to react to that and what we expect out of Iran following the pretty good beating they took. And then, what does that mean for our good friends and partners in the Middle East?

This is a time where I think many of the leaders of these nations are still reeling from what happened. I was talking with some very senior leaders today and I pointed out that in the first three and a half days of this 12-day war, Iran shot nearly 1,500 drones and missiles in the fight. And I asked them, "Is your country ready to defend against 1,500 rockets and missiles?" And of course, there's really only one nation in the Middle East that's set up for that and that's Israel, who was of course attacked. And so, others here in this region are trying to think this through.

And while these other countries are good, maybe even great partners of the U.S., we haven't fought together before. For example, how would they connect to the Navy ships and the US Air Force airplanes that have done so much in the Middle East in these recent challenges? And frankly, there's a lot of scratching of heads going on because those type’s of challenges can’t be solved overnight and nobody, including Israel, is ready to face that kind of onslaught without help from the United States.

So, there's a lot of concern and a lot of angst about how countries get ready for this? You've heard that the Axis of Evil countries, Iran and others, Russia, are starting to build these Shahed drones by the hundreds and thousands and starting new factories in South America. These adversarial nations are unable to use what we would call normal, Western style air power so they are substituting it with these drone attacks and it's a tough problem for many countries to defend against.

And then, frankly, while the nations I'm dealing with are not necessarily concerned about Israel attacking them, they are taken aback that Israel can launch aircraft, fly 1,000 miles and establish air superiority over a nation in two days. And so, there's a lot of people rethinking where they are and how it all works here based on the actions of the recent Israel-Iran conflict.

I think the good news is that the threat of Iran is somewhat diminished. Iran is going to spend some time rebuilding its defenses because especially its air defense network was pretty much decimated.

It's a busy time in the Middle East. It's a time where we need to find peace. It's a time where we don't need another distraction, as we're facing multiple theaters of conflict right now.

The Cipher Brief: On the topic of peace and some normalcy, what is the mood there? What’s happening in Gaza is both incredibly complicated and terribly upsetting to much of the world. Is there going to be a return to some regional normalcy in the relatively near future?

General Breedlove: I don't think I see or hear that right now. There's a lot of concern that the political situation, that the leadership of Israel is in with their own people and the desire for getting the hostages back either dead or alive is very much alive. And even inside of Israel, there are now protests against what's going on in Gaza. So, I can't imagine a more concerning and more confused situation and there is angst of how this is all going to work out. I must say that there is concern about how the people of Gaza have been treated. But I will tell you this, Brad, as I move around these capitals in this region, the recognized threat is Iran.

Prefer to watch The Cipher Brief interview with former NATO Supreme Allied Commander General (Ret.) Philip M. Breedlove? Check it out by subscribing to The Cipher Brief's YouTube channel.

The Cipher Brief: I want to shift gears a little bit here to the other topic that is dominating the national security space and that's Russia’s war with Ukraine. You've said consistently from the beginning of Russia’s full scale invasion that, "Mr. Putin has us deterred and we have not established deterrence over either Russia or Vladimir Putin." I'd just like to get your take on where we are with the negotiations. So many people seem to be scratching their heads at some of the things that we’re seeing play out in the public facing side of the negotiations. How are you thinking about it?

General Breedlove: Well, bottom line upfront, nothing has changed. We remain deterred. In the press you hear people talking about this war being three and a half years long. This war is over 11 years long. It started in the spring of '14 when I was still serving as the Supreme Allied Commander of Europe, and it hasn't stopped. It was hot for a few years and then it went warm. Russians were killing Ukrainians and Ukrainians were killing Russians on the line of contact. And then, after some six years or so of that warm war on the line of contact, Russia re-invaded, and I call this the third phase of the 11-year-long war.

This war has covered four presidents, Obama, Trump twice and Biden once, and all four of them have been nearly and completely deterred from the very beginning. We, as we always do in the military, offered options for how to address this conflict in Ukraine back in 2014. And the answer was, "We're not going to take any action because the war will escalate if we take action." Well, we gave them options from very small movements to larger more bellicose movements, they chose none of them and here we are. What we do know is we did not take action for fear of escalation. We were deterred and we didn't take action and Russia escalated anyway. And so our lack of action ended up in the escalation of the problem by the Russians. And that has repeated itself through four administrations for the past 11 years. We are still deterred. We have taken precious little action to stop the fight in Ukraine and we still find ourselves saying, "We're not going to do that because we've got to give peace a chance and we don't want to escalate the problem." And that formula is not working now and has not worked for 11 years.

We have virtually enabled the Russian war on Ukraine by our lack of action in a more severe way. Many of us from military backgrounds say that we have built sanctuary for Russia. From that sanctuary, we allow them to attack Ukraine. If you can think of a map, up in the northwest corner of the map is Belarus all the way to the east around through Russia all the way to the south, into the Black Sea and west across the Black Sea. We have allowed Russia to attack Ukraine from nearly 300 degrees on the map, and we still cannot determine that we should allow Ukraine to fire back deeply into Russia with our kit.

Mr. Elbridge Colby, Undersecretary of Defense for Policy, at times seems to be out of sync with President Trump because the President recently said, "You can't win a war that way." And Mr. Colby, once again, announced in the last day or so that, "We're not going to let them do long-range fires with American kit." This is an absurd policy, and it's guaranteed to be a loser and we've got to get past being so completely deterred by Russia's threats. Their program of reflexive control is working excellent on our leadership and we've got to break free of it.

The Cipher Brief: The US and Europe could inflict significant pressure on Russia through the expanded use of sanctions, yet President Trump has not yet approved the use of the sanctions that could really bite. Would increasing sanctions really cause that much of a risk of escalation on the part of Russia?

General Breedlove: Folks who follow Putin and Russia will say something to the following effect, I actually say it all the time- Sanctions have never changed Putin's actions on the battlefield. Sanctions have hurt Russia. Sanctions have hurt the Russian people. Sanctions have hurt the Russian economy. All those things are true, but they have never changed Russian actions on the battlefield. And so, we either need to double and triple the really crushing sanctions and take all of the frozen Russian money and use it to help Ukraine. We've got to physically stop the Russian shadow fleet from moving oil around the world. There's a whole host of things we could do that would truly bring Russia to their knees and we haven't done it.

It's hard to understand. We're all hoping that the President will regain his gumption, like he did going into the conversation in Alaska with Mr. Putin. You remember it was very, very clear, he said it multiple times, "If we don't get a ceasefire, there is no second meeting." Well, we didn't get a ceasefire and now we're negotiating a second meeting. And there was also the 50-day that turned into 10 days that turned into 12 days. Well, those 12 days are gone. We don't have a ceasefire, and we haven't announced new sanctions. So, there are many tools that we haven't taken that we need to take. Mr. Putin is not going to stop. Mr. Putin will have to be stopped.

Are you Subscribed to The Cipher Brief’s Digital Channel on YouTube? There is no better place to get clear perspectives from deeply experienced national security experts.

The Cipher Brief: What are NATO and Ukraine's next best moves, given everything that's in play right now?

General Breedlove: It's a confusing issue about what America is going to do or not do in any possible peace-enforcement capacity. The best move right now, not under a NATO hat, because clearly, Mr. Putin believes he's in charge and he said there will be no NATO involvement, but if NATO or European Union nations were to volunteer for a coalition of the willing presence in Ukraine, then that's what, I think, needs to happen. We need the big nations- the UK, the French, the Germans, to step up but they're waiting and watching for American leadership. Is America going to be that backbone and offer what the president talked about in his post-talk news conference and so forth? We need for all of that to happen. We need for America to make a decision to supply air power, command and control, intelligence, surveillance, reconnaissance, et cetera, those non-boots on the ground capabilities. And then, we need the European nations who've already intimated they may be willing to provide boots on the ground to get in there and get a stoppage of the fighting.

Mr. Putin’s entire objective however is to keep kicking the can to the right, run right up to the red line, wave a bright shiny object, get another red line, run right up to the red line, wave another shiny object, get another deadline. He is very good and has had great success at moving our red lines to the right.

The Cipher Brief: I want to ask if you could give us your best and worst-case scenario about how the axis relationship between China- Russia- Iran- North Korea could evolve over the next six months and what that might mean for America and our allies?

General Breedlove: I recently heard someone use a new construct that I had never heard, but it's beginning to make even more sense. This particular author labeled Russia as a proxy of China fighting against America. We've heard several times people describe Russia as the little brother, and China's going to use Russia, as opposed to Russia using China in this conflict. There does appear to be a definite relationship there where China is positioning Russia to do as much damage as they can to the United States' interests in the region. And so I think that we're going to see continued cooperation amongst these nations. They're doing this, every one of them, to benefit their nation. Russia's getting what they need from China by way of parts for the Shahed drones and other things.

Russia, of course, now is using three tranches of North Koreans to fight and to man their factories. And now, we hear they're even looking for women in South America who might want to come over and man factories. Russia is in trouble. I'd like to finish the conversation with the fact that I see Russia as losing the war against Ukraine now, not winning it.

But back to the cooperation. There's a lot of mutual benefit there for these countries. Iran has got to rebuild its air defenses; they were decimated by Israel. Russia desperately needs manpower. They can't staff their factories, and they still haven't totally retaken all the land that was taken by Ukraine and they're having to use North Koreans to help them do that. China needs them all because they want American power diminished, tied up, canceled, in any way they can, and they see Russia as a useful tool to do that. So, they all have their needs and desires and I think the mutual affray will only increase over time.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.

OPINION — Israel’s intelligence penetration of Iran played out in dramatic form over the course of the 12-day war this summer, but Iran is running an aggressive recruitment and spying operation of its own targeting Israel. And while the two espionage campaigns are not comparable in scale, scope, or success, Israel’s domestic security agency was sufficiently concerned that in the wake of the war it partnered with the country’s national public diplomacy directorate to launch a media campaign warning Israelis against spying for Iran.

Over the course of the war, Israeli intelligence treated Iran like its backyard playground, recruiting sources, both Iranian citizens and citizens of neighboring countries, and inserting its operatives to gather intelligence on the country’s most secret nuclear facilities, scientists, and officials. These efforts enabled covert operations, including the construction of remotely controlled missile and drone systems inside central Iran, that struck Iranian targets from within at the very outset of the 12-day war. Iranians recruited by Israel even helped smuggle “technologically modified vehicles” into the country, which were used to target Iranian air defense positions and clear a path for Israeli aircraft entering Iranian airspace.

In the weeks since the war ended, Iranian officials have carried out a domestic witch hunt, arresting thousands of individuals in their search for people who spied for Israel. Iran even executed one of its own nuclear scientists, alleging he spied for Israel. Now, Iran aims to turn the tables on Israel by increasing its own network of people in Israel recruited to spy for Iran.

It is now clear, however, that at the same time Israeli intelligence was recruiting sources and operatives in Iran, Iran was doing the same in Israel, just to a much smaller effect. While Iranian efforts to infiltrate and surveil targets in Israel date back to at least 2013, Israeli intelligence organizations have documented a significant surge in Iranian efforts to recruit both Israeli and non-Israeli citizens to spy for Iran, beginning in early 2020. Unlike Israel’s penetration of key Iranian intelligence and nuclear agencies, Iranian espionage in Israel remains at the edges, probing at the margins in its attempts to penetrate Israeli intelligence and society. These typically involve digital recruitment targeting Israelis in financial straits.

At first, Iran only tasked its recruits to collect basic information on the location of Israeli military bases and Israeli leaders, and to post anti-government signs and graffiti in public places to brew domestic dissent. Indeed, in the days before the 12-day war, Iranian officials boasted that the regime’s spy networks in Israel acquired sensitive documents about Israel's nuclear program. Iran’s minister of intelligence, Esmail Khatib, said that “complete nuclear files were obtained, along with documents related to [Israel’s] connections with the U.S., Europe, and other countries, as well as intelligence that strengthens Iran’s offensive capabilities.”

But starting in mid-2024–between the Iranian missile and drone attack on Israel in April and the ballistic missile attack in October– the Iranians started tasking recruits not only to carry out acts of espionage but also arson and even murder plots targeting Israeli scientists, journalists, security and military leaders, and senior politicians. Israeli officials described the spike in the number of plots as “unprecedented.” Israel Police Superintendent Maor Goren said, “If we go check the last years – the last decades – we can count on two hands how many people got arrested for this.”

While none of the murder plots came to fruition, Israeli authorities report that several came very close to being carried out and were thwarted at the last minute. And unlike pure espionage cases, which often take time to develop, some of the murder plots were being planned as soon as 9 days after initial recruitment. In other cases, Israeli authorities only discovered a cell of persons of Azeri descent who had been carrying out espionage operations as a team, some two years after they started spying on Israel. They were spotted when they moved from spying on military sites to conducting surveillance of a senior Israeli military figure they were told to kill.

The Cipher Brief brings expert-level context to national and global security stories. It’s never been more important to understand what’s happening in the world. Upgrade your access to exclusive content by becoming a subscriber.

The Washington Institute’s Iranian External Operations Map, which tracks Iranian plots abroad, has documented at least 31 plots carried out by Iranian-recruited Israelis in Israel. These recruits have sprayed graffiti and lit fires across Israel, in addition to collecting basic information on military bases, government officials, and nuclear scientists to send back to their handlers in Iran. However, Iranian efforts to recruit Israeli spies have not led to a single successful assassination or targeted attack in Israel. Iran conducts its recruitment primarily online via Telegram, WhatsApp, and social media platforms, although there are a few instances of Iranian handlers approaching potential recruits in person while abroad. Recruitment efforts appear to rely heavily on financial incentives while also exploiting existing social cleavages. Out of the 31 cases carried out by Israeli perpetrators documented by the Washington Institute, 20 involved some type of monetary compensation, usually via cryptocurrency.

While the Israeli perpetrators in 25 out of the 31 cases knew, or at least suspected, that they were working on behalf of the Iranians, many rationalized their actions as falling short of full-blown espionage. The tasks assigned to these individuals varied widely. Some were given relatively harmless assignments, such as tagging graffiti or putting up posters, while others appeared to be amateurish or unskilled in their roles. However, not all the recruits were unsophisticated. Several engaged in more serious activities, including intelligence collection and attempts to recruit others– sometimes even targeting their own family members to expand the network.

Consider the case of father and son, Bassem and Tahrir Safadi, residents of the Druze village of Mas'ade, who were arrested for spying on behalf of the Islamic Revolutionary Guard Corps Quds Force. At the request of his father, Tahrir would allegedly collect information on IDF movements in the Golan Heights and report to Hussam as-Salam Tawfiq Zidan, a journalist at Al-Alam News Network, an Iranian state-owned news outlet. Zidan, who lived in Damascus and worked for the Palestine division of the Quds Force, is accused of requesting Bassem and Tahrir to take photos of troops, tank movements, equipment, and more.

One of the most serious plots Israel thwarted is the 2024 assassination plot against Prime Minister Benjamin Netanyahu, former Defense Minister Yoav Gallant, and former Shin Bet Director Ronen Bar. Moti Maman, a businessman with connections to Turkey and Iran, allegedly travelled to Turkey and Iran twice to meet with Iranian intelligence officials to further the plots against Netanyahu, Gallant, and Bar. Maman was also allegedly directed to intimidate Israeli civilians working for Iran who had failed to complete their missions, to find Russians or Americans who could be tasked with assassinating Iranian dissidents in the United States and Europe, and to attempt to recruit a Mossad officer to act as a double agent. Before leaving Iran for the second time, Maman received 5,000 euros from the Iranian intelligence agents for attending the meetings. According to the Shin Bet, Iranian officials viewed the assassination plots as acts of revenge for the killing of Hamas leader Ismail Haniyeh.

In total, The Washington Institute has documented 39 known Iranian plots in Israel from 2013-2025, 31 of which involved Israeli nationals, the rest involved Palestinians or other non-Israeli citizens. Several of these plots had multiple perpetrators, bringing the total number of Israeli participants in those 31 cases to more than 45 individuals. According to the National Public Diplomacy Directorate, indictments have been filed against 35 Israeli citizens involved in these cases. The age of the perpetrators ranges from 13 to 73, with over half in their teens or twenties. The individuals recruited came from a range of backgrounds, such as Azerbaijani or the Caucasus region, and the targets of their espionage efforts included both security infrastructure and broader social vulnerabilities, including the Iron Dome, government officials, Muhane Yehuda market, IDF bases, nuclear scientists and facilities, and malls and hospitals. The wide breadth of targets illustrates how Iranian intelligence sought to exploit financial, ideological, and personal incentives to build influence inside Israel.

Subscriber+Members have exclusive access to the Open Source Collection Daily Brief, keeping you up to date on global events impacting national security. It pays to be a Subscriber+Member.

Iranian Minister of Intelligence Esmail Khatib described Iranian espionage and sabotage plots in Israel as a key part of Iran’s broader war against Israel. "The Zionist regime must confront a strategy of internal aggression within itself,” he said a month after the 12-day war concluded, “and just as our armed forces' effective missiles compelled them to halt [the war], all intelligence and security agencies are also exerting effort, and in recent days, you have seen they were forced to conduct briefing sessions to counter the infiltration of intelligence services within the Zionist regime."

In response to Iranian recruitment efforts in Israel, the Shin Bet, in partnership with the National Public Diplomacy Directorate, launched a nationwide public-awareness campaign titled “Easy Money, Heavy Price,” to warn Israelis against spying for Iran. Running across radio, online platforms, and social media, the campaign warns that even modest payments from Iran, roughly $1,500, can result in severe consequences. The ads note that some who accepted money from Iran are now in prison, and that assisting Tehran can carry penalties of up to 15 years in jail.

Still, it's important to contextualize these plots. None came close to matching the level of operational complexity, strategic impact, or tradecraft displayed by Israel in its operations against Hezbollah or Iran. While Israel slowly vets and trains its potential recruits, the Iranians engage in shotgun recruitment online, with few recruits going to meet their handlers in places like Turkey or for training in Iran. The two sides are operating on completely different levels of intelligence capability and sophistication. Nevertheless, the Israeli authorities have treated these cases with appropriate seriousness, underscoring the potential long-term threat posed by Iran. “The war has not ended. We are in a state of temporary pause,” the head of the IRGC’s intelligence organization, Brigadier General Majid Khademi, warned last week. Iranian Intelligence Minister Khatib made his plans clear, calling for an “aggressive internal strategy” against Israel so that Israeli security agencies are forced to “confront a strategy of internal aggression” by Iranian agents within Israeli territory.

Alongside Israel’s demonstrated ability to penetrate Iran, the country’s security agencies now believe they will have to step up their game to counter Iranian spying in Israel. The public media campaign is surely just the beginning of a broader counter-espionage effort. What they have seen in the past year, Israeli officials maintain, represents a far greater espionage threat than anything they have seen before.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals.

Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief