Iran’s MOIS and IRGC Intelligence: How Tehran Operates Covertly

Iran operates one of the most complex and layered intelligence architectures in the world: a dual apparatus in which a civilian ministry and a revolutionary military corps conduct parallel, overlapping, and sometimes competing intelligence activities across the Middle East and beyond. The Ministry of Intelligence and Security — known by its Persian acronym VAJA, or by the widely used abbreviation MOIS — serves as Iran’s primary civilian intelligence organ, while the Islamic Revolutionary Guard Corps (IRGC) and its elite Quds Force operate as a second, independently powerful intelligence and covert action apparatus reporting directly to the Supreme Leader.^[1] Understanding how Tehran operates covertly requires understanding both arms of this system and the ideological framework that governs them.

From SAVAK to SAVAMA: The Pre-Revolutionary Intelligence Inheritance

Iran’s modern intelligence tradition begins not with the Islamic Republic but with the Shah’s secret police. SAVAK — the Bureau for Intelligence and Security of the State — was established in 1957 with direct CIA and French intelligence assistance, trained by American officers and equipped to monitor, suppress, and eliminate political dissidents at home and abroad.^[2] At its peak, SAVAK employed approximately 5,000 full-time agents and an extensive network of informers, operating with powers of censorship, surveillance, arrest, and torture that made it one of the most feared internal security services of the Cold War era.

The Shah used SAVAK to arrest, imprison, and torture opponents across the political spectrum: communists, nationalists, Islamists, and liberals. The organization’s brutality was a significant catalyst for the popular revolution that swept Mohammad Reza Shah from power in 1979. When Ayatollah Khomeini returned from exile, the new revolutionary government faced an immediate institutional dilemma: how to build an intelligence capability for the Islamic Republic without relying on agents of the despised SAVAK apparatus.^[2]

In practice, pragmatism prevailed. The interim organization known as SAVAMA — which briefly assumed SAVAK’s functions after the revolution — retained significant numbers of experienced SAVAK personnel, particularly those with expertise in penetrating leftist and dissident networks. Former SAVAK staff were believed to have been instrumental in the new intelligence apparatus’s infiltration of opposition movements, even as the revolutionary government publicly condemned everything SAVAK represented. This institutional continuity between the Shah’s secret police and the Islamic Republic’s intelligence machinery has been documented by analysts including Magnus Ranstorp, who estimated the new ministry’s eventual staff at approximately 30,000 personnel.

The Founding of MOIS: Structure and Mandate

The Ministry of Intelligence of the Islamic Republic of Iran was formally established on August 18, 1983, consolidating the various smaller intelligence organizations that had proliferated across different government bodies in the immediate post-revolutionary period.^[1] Its creation was proposed by Saeed Hajjarian to the government of Prime Minister Mir-Hossein Mousavi and required the approval of Ayatollah Khomeini himself. A distinctive requirement embedded in its founding charter distinguished MOIS from intelligence ministries in other states: the minister must be a doctor of Islamic jurisprudence (a mujtahid), ensuring that clerical authority penetrates the leadership of the intelligence apparatus at the highest level.

The ministry was placed under the executive branch, reporting to the President of Iran, rather than to the Supreme Leader directly. This structural choice was contested: alternatives proposed during the ministry’s founding debates included placing it under the judiciary, the Supreme Leader’s office, or the IRGC. The choice of presidential oversight created a permanent institutional tension, as subsequent Supreme Leaders — particularly Ayatollah Khamenei — sought to maintain informal but decisive influence over an agency nominally accountable to elected presidents whose political orientations varied considerably.^[1]

MOIS headquarters are located on Hirmand Street in the Pasdaran district of Tehran. The ministry’s operational mandate encompasses domestic counterintelligence and surveillance, monitoring of political dissidents and opposition groups, counterterrorism within Iran, foreign intelligence collection, and covert operations abroad. The ministry maintains liaison relationships with intelligence services of allied states, including Syria’s General Intelligence Directorate, Hezbollah’s security apparatus in Lebanon, and, periodically, with Russian and Chinese intelligence services on matters of shared strategic interest. For context on how Russia’s post-Soviet successor agency operates today, see our analysis of Russia’s FSB: the KGB’s successor and how it operates today.

The Chain Murders: MOIS and the Assassination of Dissidents

The most damaging domestic scandal in MOIS history erupted in late 1998, when a series of murders of Iranian intellectuals and dissidents — which came to be known as the “chain murders” — was traced to operatives within the intelligence ministry. Over a period of approximately two months, three dissident writers, a political leader, and his wife were killed in Iran. The murders followed a pattern: the victims were strangled or stabbed, and their deaths were initially presented as accidents or suicides.^[3]

Following intense journalistic investigation inside Iran and significant international pressure, prosecutors announced in 1999 that an intelligence ministry official named Saeed Emami had led “rogue elements” responsible for the killings — but that Emami had died in prison, allegedly by suicide. The claim of rogue action was widely dismissed by the victims’ families and international human rights organizations, who argued that operations of this scale and coordination could not have been unauthorized. In 2001, three intelligence ministry agents were sentenced to death for two of the murders; the Iranian Supreme Court subsequently reduced two of those sentences to life imprisonment.^[3]

The chain murders episode forced a partial reform of MOIS under President Khatami, who appointed reformist figures to lead the ministry and sought to constrain its domestic political operations. The reform period was short-lived. Under subsequent conservative administrations, MOIS reasserted its traditional domestic surveillance functions and expanded its budget substantially: as of 2024, MOIS received a tenfold increase in funding, signaling the Islamic Republic’s renewed investment in internal control mechanisms.

The IRGC: A Military Force with an Intelligence Empire

If MOIS represents Iran’s formal intelligence ministry, the Islamic Revolutionary Guard Corps represents something more expansive and, in many respects, more powerful: a multi-service military organization with its own intelligence apparatus, its own foreign policy, and an economic empire that by 2026 analysts described as a “state-within-a-state.”^[4] The IRGC was established by Ayatollah Khomeini on May 5, 1979 — just weeks after the revolution — as a parallel military force to the regular Iranian Army, tasked not with conventional national defense but with protecting the ideological integrity of the Islamic Republic itself.

The IRGC’s constitutional mandate authorizes it to prevent foreign interference in Iran, thwart coups by the traditional military, and crush “deviant movements” that threaten the legacy of the Islamic Revolution. This mandate has been interpreted expansively to justify IRGC involvement in domestic political surveillance, election security, economic regulation, and covert operations across the Middle East and beyond. With approximately 125,000 active personnel as of 2024 and a budget of approximately $6.96 billion, the IRGC dwarfs MOIS as an institutional force within the Iranian state.^[4]

The IRGC reports directly to the Supreme Leader, not to the elected President — a structural arrangement that makes it simultaneously the most powerful single institution in Iran and the most direct instrument of the Supreme Leader’s covert foreign policy. The IRGC’s five service branches include Ground Forces, Aerospace Force, Navy, the Basij paramilitary militia, and the Quds Force, the specialized extraterritorial operations unit that serves as Iran’s primary instrument of covert action abroad.

The Quds Force: Iran’s Primary Instrument of Covert Power Projection

The Quds Force — its name translating to “Jerusalem Force,” reflecting the Iranian revolutionary commitment to the liberation of al-Quds — is the element of Iran’s intelligence and covert operations apparatus most consequential for regional stability and Western security assessments. U.S. Army General Stanley McChrystal described the Quds Force as analogous to a combination of the CIA and the Joint Special Operations Command: an organization capable of both intelligence collection and direct covert action at strategic scale.^[5]

The Quds Force traces its origins to “Department 900,” a special intelligence unit created during the Iran-Iraq War of 1980-1988. After the war ended, the IRGC was reorganized and the Quds Force was established as an independent service branch in 1988, inheriting and expanding the external operations functions of its predecessor unit.^[5] A defining early operation had already occurred in 1982, when IRGC personnel were deployed to Lebanon’s Bekaa Valley following Israel’s invasion and played a direct role in the creation of Hezbollah — a relationship that transformed the Quds Force from a special operations unit into the architect of Iran’s most consequential strategic asset abroad.

The Quds Force’s operational model involves the training, equipping, financing, and in some cases direct commanding of non-state armed actors aligned with Iranian interests. Its principal proxies include Hezbollah in Lebanon, Hamas and Palestinian Islamic Jihad in Gaza, the Houthis in Yemen, and a range of Shia militia organizations in Iraq and Syria. This “Axis of Resistance” — as Iranian officials describe the network — represents Iran’s primary covert power projection capability and the central strategic challenge facing Israel, Saudi Arabia, and American forces throughout the Middle East.^[5]

The Quds Force’s most operationally significant commander was General Qasem Soleimani, who led the organization from 1998 until his assassination by a U.S. drone strike at Baghdad International Airport on January 3, 2020. Soleimani was the primary architect of Iran’s regional proxy strategy, personally managing relationships with Hezbollah’s Hassan Nasrallah, Iraqi militia commanders, and Syrian President Bashar al-Assad during the Syrian civil war. His killing prompted Iranian ballistic missile strikes against U.S. bases in Iraq and represented the most direct military confrontation between the United States and Iran since the 1988 tanker war. He was succeeded by his deputy, Esmail Qaani. The CIA’s own history of covert operations against Iranian proxies and nuclear infrastructure is covered in our analysis of the complete history of the CIA from OSS to modern day.

Transnational Repression: Tehran’s Global Reach Against Dissidents

Both MOIS and the IRGC conduct operations against Iranian dissidents, journalists, and opposition figures living outside Iran — a pattern of transnational repression that has brought Iranian intelligence into direct conflict with Western law enforcement and intelligence services. These operations range from surveillance and harassment to assassination plots and attempted kidnappings on the soil of NATO member states.

In November 2019, Masoud Molavi, an online opposition activist, was shot and killed on a street in Istanbul’s Sisli neighborhood. Turkish security officials subsequently claimed that the suspected killer had confessed to acting under the orders of Iranian intelligence officers at the Iranian consulate in Turkey.^[1] The U.S. Department of Justice has charged Iranian national Shahram Poursafi with plotting to assassinate former National Security Adviser John Bolton, reportedly in retaliation for the American killing of Qasem Soleimani. Iranian agents have been accused of multiple plots to kidnap or assassinate Iranian-American journalist Masih Alinejad in New York, with the Justice Department filing charges against Iranian nationals in connection with these operations.

European counterintelligence agencies have documented an escalating pattern of Iranian operations on European soil. In November 2023, former European Parliament Vice-President Alejo Vidal-Quadras was shot in the face in Madrid — an attack he survived — in an operation suspected to involve Iranian operatives. In April 2025, the Dutch government summoned Iran’s ambassador following the exposure of two assassination attempts linked to Tehran involving criminal network intermediaries. In May 2025, British authorities arrested five Iranian nationals suspected of plotting an attack on the Israeli embassy in London; the operation was described as one of the most significant counterterrorism actions in recent years and is believed to have been orchestrated by IRGC Unit 840.^[1]

The IRGC-MOIS Rivalry: Competing Intelligence Architectures

The relationship between MOIS and the IRGC’s intelligence apparatus is not one of seamless coordination but of institutional competition shaped by the Islamic Republic’s divided authority structure. MOIS, reporting to the President, has at times been led by reformist figures aligned with presidents like Khatami and Rouhani who sought to moderate Iran’s covert operations profile and engage diplomatically with the West. The IRGC, reporting to the Supreme Leader, has consistently prioritized the confrontational approach embedded in Khomeini’s revolutionary doctrine.

This institutional tension has produced concrete operational friction. During the Khatami presidency (1997-2005), reformist MOIS leadership clashed with IRGC hardliners over the scope of domestic surveillance and the methods used against dissidents. The chain murders scandal itself can be understood partly as a product of this friction: IRGC-aligned hardliners within MOIS resisting the reformist direction signaled by the Khatami government. The Supreme Leader’s ultimate authority over both institutions serves as the mechanism for resolving these disputes — typically in favor of the IRGC’s more aggressive posture on strategic questions. For comparison with how a similarly dual-track intelligence system operates, see our profile of China’s MSS: the Ministry of State Security explained.

Cyber Operations and the Digital Dimension

Iran’s intelligence apparatus has developed substantial cyber capabilities since the 2010 Stuxnet attack — itself a U.S.-Israeli operation against Iran’s nuclear centrifuge infrastructure — demonstrated both the vulnerability of critical systems and the strategic potential of offensive cyber operations. The IRGC’s Aerospace Force and dedicated cyber units have been responsible for a series of significant attacks: the 2012 Shamoon malware attack on Saudi Aramco that destroyed data on approximately 30,000 computers; coordinated distributed denial-of-service attacks on American financial institutions; and ongoing intrusion campaigns against government, military, and private sector targets across the Middle East, Europe, and North America.

MOIS and the IRGC maintain separate cyber capabilities that are not always coordinated. Western cybersecurity firms and government agencies have tracked multiple distinct Iranian threat actor groups — including APT33, APT34, and APT39 — whose operations have been attributed to different elements of the Iranian intelligence apparatus. The fragmentation reflects the broader institutional structure: MOIS focuses cyber operations on intelligence collection and dissident monitoring, while IRGC cyber units combine collection with destructive attack capabilities and influence operations.^[4]

The Nuclear File: Intelligence at the Center of Geopolitics

No domain has made Iran’s intelligence services more central to global security than the nuclear program. MOIS and the IRGC’s intelligence directorate have maintained intensive counterintelligence operations around Iran’s nuclear facilities since the program’s existence became publicly known in 2002. These operations have been directed against the IAEA, Western intelligence collection efforts, and — most consequentially — against alleged Israeli and American sabotage operations targeting nuclear personnel and infrastructure.

Between 2010 and 2012, five Iranian nuclear scientists were assassinated in a series of targeted killings attributed to the Mossad: Masoud Ali-Mohammadi, Majid Shahriari, Darioush Rezaeinejad, Mostafa Ahmadi Roshan, and Fereidoon Abbasi (who survived a car bombing). Iranian counterintelligence attributed these operations to Israeli intelligence acting with Western support, and the killings prompted significant MOIS and IRGC intelligence reforms focused on protecting nuclear program personnel.^[1] Iran’s retaliatory operations included the 2012 attempted bombing of the Israeli embassy in New Delhi and attacks on Israeli diplomatic personnel in Georgia and Thailand — operations attributed to Quds Force elements.

Contemporary Structure and the Axis of Resistance

Iran’s intelligence apparatus in 2026 operates in an environment of unprecedented pressure following the Israeli military campaign of June 2025, during which senior IRGC commanders were killed in a wave of strikes. The death of IRGC commander Hossein Salami in June 2025 and significant losses among the senior officer corps have disrupted operational continuity, though the institutional structures of both MOIS and the Quds Force remain intact.^[4] The Quds Force continues to be led by Esmail Qaani, Soleimani’s successor since January 2020, while MOIS operates under the direction of the Pezeshkian government.

Iran’s covert power projection model — built around the Quds Force’s proxy network, MOIS’s transnational surveillance and assassination capabilities, and an expanding cyber arsenal — represents a distinct approach to intelligence tradecraft: one that prioritizes ideological alignment and religious solidarity as recruitment mechanisms, leverages asymmetric proxy relationships to project power at a fraction of conventional military cost, and accepts the visibility of its operations as a deliberate signal of deterrence to adversaries. Whether this model proves sustainable in the face of continued Israeli military action, Western sanctions, and internal economic pressure is the central question in any forward assessment of Tehran’s covert capabilities.