Iran’s intelligence structure ill-suited to Israeli threat, ex-Guard commander says

The activity involves movements and coordination beyond normal patterns, including Iranian drone, missile and air-defence units, the sources said.

The developments could be linked to military exercises, Western officials with knowledge of the matter told Iran International but added that the scale and synchronization had drawn closer scrutiny.

Intelligence services are tracking command-and-control signals, deployments and logistical movements associated with the IRGC Air Force, the sources said.

The assessments come amid continued tensions between Iran and Western countries over Tehran’s nuclear and missile programs, and speculation about the possibility of renewed Israeli or even US attacks on Iran.

NBC News reported earlier today that Israeli officials are preparing to brief US President Donald Trump on options for possible new military strikes on Iran, citing concerns that Tehran is expanding its ballistic missile program.

Israeli officials believe Iran is rebuilding facilities linked to ballistic missile production and repairing air defenses damaged in a 12-day war in June, which they view as more urgent concerns than nuclear enrichment and fears of Tehran acquiring a nuclear weapon, NBC reported.

• 

  Trump says Iran could avoid past and future attacks with a deal

Iran denies seeking a nuclear weapon but the United States and Western countries want Iran to end uranium enrichment, curb its missile power and rein its aid for armed groups in the region like Hamas and Hezbollah. Tehran has rejected the conditions.

Earlier this month, Iran’s Supreme Leader Ali Khamenei dismissed speculations about a possible fresh round of war on Iran, calling it part of “enemy propaganda”.

“Today, beyond these military confrontations — which have existed, as you have seen, and whose likelihood is constantly being talked up, with some even deliberately fanning the flames to create anxiety, though they will not succeed, God willing — we are facing a propaganda and media confrontation,” Khamenei said.

The Hamas attack, the 12-day Iran-Israel war in June and Israel’s relentless strikes on Iranian-aligned actors did not end the region’s conflicts, but they changed how states now manage them.

In place of grand diplomacy or formal pacts, a loose alignment has begun to form from overlapping security, political and economic imperatives.

Stretching informally from Baghdad to Damascus, this nascent arc of stability is emerging less as a peace project than as a constraint on Iran’s regional reach—interlocking with the logic of the Abraham Accords and pressing against the network of proxies through which Tehran has long projected power.

This shift has unfolded alongside a parallel Iranian track: diplomatic outreach, particularly towards Saudi Arabia and other Arab neighbors, aimed at preserving room for manoeuvre even as Tehran’s proxy network comes under strain.

That dual approach matters, shaping regional calculations as Iran seeks both to absorb pressure and to prevent the emergence of a more openly consolidated front against it.

Iraq: on the mend but shaky

In Iraq, the aftermath of the recent elections and the government’s brief attempt to designate Lebanese Hezbollah and the Houthis as terrorist organisations—followed by a rapid reversal—highlight a deeper struggle over sovereignty.

An emergent bloc of political, clerical and institutional actors is pushing for greater state consolidation, while Iran-backed networks seek to preserve the hybrid armed–political order entrenched since the fight against Islamic State in 2014.

Senior clerics linked to the orbit of Grand Ayatollah Ali al-Sistani have repeatedly warned that the continued power of militias is eroding national unity and hollowing out state authority.

At the same time, developments inside Iraq are complicating Tehran’s position. Efforts to expand domestic gas production, reduce reliance on Iranian imports and attract Western investment after the withdrawal of sanctioned Russian firms are slowly reshaping the economic outlook.

Improved, if fragile, coordination between Baghdad and the Kurdistan Regional Government on revenue sharing and border controls has also narrowed institutional fissures Iran has long exploited.

These shifts are incremental and uneven, and their durability remains uncertain. Yet together they form the first pillar of a broader regional realignment rooted less in ideology than in state capacity and economic necessity.

Iraq may also prove the weakest link: its politics remain volatile, and Iran-aligned actors retain deep organizational and financial networks. Still, even limited consolidation across security, energy and governance would tilt the strategic balance of the Levant in ways long thought unattainable.

Syria: stabilizing but weak

The fall of Bashar al-Assad a year ago, and the rise of a Salafi-leaning transitional authority have opened a period of uncertainty, marked by serious risks but also new constraints on external actors.

Syria is unlikely to join the Abraham Accords or pursue formal normalisation with Israel soon. Nevertheless, quiet contacts involving Damascus, Israel and Qatar—aimed at limiting spillover, restraining militias and establishing narrow de facto understandings—point to the emergence of a pragmatic, if tentative, security framework.

Events beyond Syria’s borders have sharpened regional sensitivities.

Israel’s attempted attack against Hamas leaders in Qatar which failed to kill their intended targets unsettled several US Arab partners and may have influenced strategic thinking even where public positions remained measured.

More significant is the regional effect of a Syria no longer fully aligned with Iran’s strategic priorities. A stabilizing Syrian state, broadly aligned with Iraq and Jordan, would sharply restrict the land and air corridors Iran has long used to supply Hezbollah in Lebanon.

Recent interceptions of Iranian weapons shipments across Syrian and Jordanian territory by Israel and Jordan underscore that Iran may still see Syria as a transit point for its weapons.

A pattern emerging

This informal Baghdad–Damascus alignment intersects with the logic of the Abraham Accords, which the Trump administration’s November 2025 National Security Strategy identifies as the US priority to build up security in the region.

The document frames Arab and Muslin normalization with Israel not as a legacy achievement but as a functional framework for missile defence, maritime security as well as intelligence and regional burden-sharing.

While Saudi Arabia, Qatar, Oman and Kuwait remain outside the Accords formally, growing patterns of de facto cooperation—through air-defence coordination, early-warning integration, maritime security arrangements and intelligence exchanges—suggest the Accords already function as an organising principle for states reluctant to make public commitments.

The spine is formal, but the supporting structures are increasingly informal, sustaining the framework without requiring every participant to commit publicly.

The restrained language of the 2025 strategy reflects a broader shift in Washington’s approach. Rather than relying primarily on American primacy, the United States now appears focused on containing Iran by reinforcing regional structures anchored in the Accords and complemented by emerging alignments in Iraq and Syria.

Across the region, a discernible pattern is taking shape.

Iraq’s uneven institutional recovery, Syria’s cautious stabilisation, Jordan’s intensified border security, the Persian Gulf states’ expanding coordination and Israel’s sustained security posture together form the outlines of the most coherent countervailing structure the region has seen in more than a decade.

The contest, however, remains unresolved. Iran retains significant capacity, adaptive networks and a proven ability to rebuild and readjust.

The Baghdad–Damascus arc nonetheless represents a challenge to Tehran’s regional strategy rooted not in declarations or grand bargains, but in overlapping state interests and practical constraints—an alignment shaped by necessity rather than design.

Speaking on Thursday during a visit to South Khorasan province, Pezeshkian said that although Iran had launched missiles during the fighting, Israel’s arsenal proved superior in both quantity and capability.

“It is true that we had missiles, but their missiles were more numerous, more powerful, more precise and easier to deploy,” Pezeshkian said.

He added that it was the people who ultimately frustrated Israel, without elaborating.

Pezeshkian rejected calls for Iran to curb its missile program, framing it as essential to national defense.

“They tell us not to have missiles, while they arm Israel to the teeth so it can come here whenever it wants, raze everything and leave,” he said. “I will not accept that.”

• 

  Iran's buoyant missile arsenal vexes Israel, analysts say

US officials have said any talks with Tehran would hinge on sweeping conditions that include Iran ending uranium enrichment and dismantling key parts of its nuclear program, curbing or accepting limits on its missile program, and rolling back support for regional proxy forces.

The missile issue is politically charged in Tehran after the June conflict, in which Israel relied heavily on layered air and missile defenses – alongside US support – to blunt waves of Iranian ballistic missiles and drones, while still suffering some strikes that penetrated defenses.

The bipartisan bill includes provisions to counter Iranian threats, such as increased congressional transparency on Iran's uranium enrichment activities and potential weaponization decisions.

“I am also pleased that this bill... includes directing necessary resources towards defending our nation from the threats posed by Iran,” Republican senator Tom Cotton said in a joint statement with ranking member Senator Warner.

The intelligence bill requires US intelligence to warn American citizens of lethal threats from Iran and directs resources to defend against “Iranian threats.”

It also codifies travel restrictions on Iranian diplomats in the US, alongside those for Chinese, Russian, and North Korean diplomats.

Additional resources are directed toward defending the United States against various Iranian threats, including cyberattacks, proxy militias, and assassination plots.

Democratic Senator Mark Warner praised the overall bill for providing essential resources, authorities, and robust congressional oversight to the intelligence community.

“I thank my colleagues and am glad to see this bill pass once again on a strong bipartisan basis,” Senator Warner said in the joint statement.

The National Defense Authorization Act funds US defense for 2026, while Intelligence Authorization Act embedded within ensures intel focus on global threats like Iran and China.

Bennett said in a statement that the device linked to the compromised account is no longer in use, according to the report.

Earlier in the day, the group, calling itself “Handala” and linked to Iran’s intelligence ministry, alleged it had hacked what it described as Bennett’s iPhone 13 as part of what it called “Operation Octopus.”

It went on to publish a link it said reveals a trove of private communications it extracted from his device.

The name appears to reference Bennett’s own long-standing description of Iran as “the head of the octopus,” with regional allied militant groups as its arms.

In an open letter, the group taunted Bennett, writing: “You once prided yourself on being a beacon of cybersecurity ... Yet, how ironic that your own iPhone 13 has fallen so easily to the hands of Handala.”

“Consider this a warning and a lesson. If your personal device can be compromised so effortlessly, imagine the vulnerabilities that lurk within the systems you once claimed to protect,” the group added.

Handala published a series of files on its website and Telegram channel that it said were taken from the compromised device.

The group claimed it had gained access to private correspondence and contact information, publishing what it said were phone numbers linked to Bennett and to Avia Sassi, whom it described as a close associate.

Handala further claimed that the materials included private chats spanning several years, covering political coordination, candidate selection and, later, security-related concerns following the October 7 attack by Hamas militants on Israel.

Before the statement by Bennett’s office was released, Israel Hayom reported that Bennett’s office initially told the paper that it was "unaware of such an event." According to the report, Bennett’s security team said the matter is being handled by Israeli security and cyber authorities, that the device in question is not currently in use.

The report quoted Shai Nahum, a cyber warfare expert who reviewed the materials released by the group, said the data was unlikely to have originated from Bennett’s personal phone.

"According to forensic analysis of the leaked files, there is a high probability that this is not Bennett's phone, but apparently that of one of his associates," Nahum said.

Handala's claim comes a day after the group said it was offering a $30,000 reward for information related to Israel’s military sector after releasing material it said identified people involved in designing Israeli missile defense systems.

Who is Handala?

Handala is widely described by cybersecurity researchers and Western officials as tied to Iran’s Ministry of Intelligence.

It derives its name from a character created by Palestinian cartoonist Naji al-Ali. A barefoot boy in patched trousers, Handala represented Palestinian dispossession.

Researchers say the group operates as part of a broader cyber unit known as Banished Kitten, also referred to as Storm-0842 or Dune, which they link to the ministry’s Domestic Security Directorate.

The group has been linked to cyber operations against Israeli infrastructure and public institutions for around two years.

In January, it claimed responsibility for a cyberattack on Israeli kindergartens that disrupted public address systems at about 20 locations. In August, the group was linked to hacks targeting multiple Israeli entities, including academic institutions, technology firms, media outlets and industrial companies.

Handala has also been linked to cyber operations targeting Iran International, a London-based Persian-language broadcaster.