nytimes.com By Farnaz FassihiRonen Bergman and Mark Mazzetti 2025/08/30
Israel was able to track the movements of key Iranian figures and assassinate them during the 12-day war this spring by following the cellphones carried by members of their security forces.
The meeting was so secret that only the attendees, a handful of top Iranian government officials and military commanders, knew the time and location.
It was June 16, the fourth day of Iran’s war with Israel, and Iran’s Supreme National Security Council gathered for an emergency meeting in a bunker 100 feet below a mountain slope in the western part of Tehran. For days, a relentless Israeli bombing campaign had destroyed military, government and nuclear sites around Iran, and had decimated the top echelon of Iran’s military commanders and nuclear scientists.
The officials, who included President Masoud Pezeshkian, the heads of the judiciary and the intelligence ministry and senior military commanders, arrived in separate cars. None of them carried mobile phones, knowing that Israeli intelligence could track them.
Despite all the precautions, Israeli jets dropped six bombs on top of the bunker soon after the meeting began, targeting the two entrance and exit doors. Remarkably, nobody in the bunker was killed. When the leaders later made their way out of the bunker, they found the bodies of a few guards, killed by the blasts.
The attack threw Iran’s intelligence apparatus into a tailspin, and soon enough Iranian officials discovered a devastating security lapse: The Israelis had been led to the meeting by hacking the phones of bodyguards who had accompanied the Iranian leaders to the site and waited outside.
Israel’s tracking of the guards has not been previously reported. It was one part of a larger effort to penetrate the most tightly guarded circles of Iran’s security and intelligence apparatus that has had officials in Tehran chasing shadows for two months.
According to Iranian and Israeli officials, Iranian security guards’ careless use of mobile phones over several years — including posting on social media — played a central role in allowing Israeli military intelligence to hunt Iranian nuclear scientists and military commanders and the Israeli Air Force to swoop in and kill them with missiles and bombs during the first week of the June war.
“We know senior officials and commanders did not carry phones, but their interlocutors, security guards and drivers had phones; they did not take precautions seriously, and this is how most of them were traced,” said Sasan Karimi, who previously served as the deputy vice president for strategy in Iran’s current government and is now a political analyst and lecturer at Tehran University.
The account of Israel’s strike on the meeting, and the details of how it tracked and targeted Iranian officials and commanders, is based on interviews with five senior Iranian officials, two members of the Islamic Revolutionary Guards Corps and nine Israeli military and intelligence officials.
The security breakdowns with the bodyguards are just one component of what Iranian officials acknowledge has been a long-running and often successful effort by Israel to use spies and operatives placed around the country as well as technology against Iran, sometimes with devastating effect.
Want to stay updated on what’s happening in Iran and Israel? , and we’ll send our latest coverage to your inbox.
Following the most recent conflict, Iran remains focused on hunting down operatives that it fears remain present in the country and the government.
“Infiltration has reached the highest echelons of our decision making,” Mostafa Hashemi Taba, a former vice president and minister, said in an interview with Iranian media in late June.
This month Iran executed a nuclear scientist, Roozbeh Vadi, on allegations of spying for Israel and facilitating the assassination of another scientist. Three senior Iranian officials and a member of the Revolutionary Guards said Iran had quietly arrested or placed under house arrest dozens of people from the military, intelligence and government branches who were suspected of spying for Israel, some of them high-ranking. Israel has neither confirmed nor denied a connection to those so accused.
Spy games between Iran and Israel have been a constant feature of a decades-long shadow war between the two countries, and Israel’s success in June in killing so many important Iranian security figures shows just how much Israel has gained the upper hand.
President Masoud Pezeshkian of Iran attending a protest in Tehran on June 22, following the U.S. attacks on nuclear sites in Iran. Mr. Pezeshkian himself escaped an attack on a bunker on June 16.
Credit...
Arash Khamooshi for The New York Times
Israel had been tracking senior Iranian nuclear scientists since the end of 2022 and had weighed killing them as early as last October but held off to avoid a clash with the Biden administration, Israeli officials said.
From the end of last year until June, what the Israelis called a “decapitation team” reviewed the files of all the scientists in the Iranian nuclear project known to Israel, to decide which they would recommend to kill. The first list contained 400 names. That was reduced to 100, mainly based on material from an Iranian nuclear archive that the Mossad, the Israeli intelligence agency, had stolen from Iran in 2018. In the end, Iran said the Israelis focused on and killed 13 scientists.
At the same time, Israel was building its capacity to target and kill senior Iranian military officials under a program called “Operation Red Wedding,” a play on a bloody “Game of Thrones” episode. Brig. Gen. Amir Ali Hajizadeh, the commander of the Revolutionary Guards’ Aerospace Force, was the first target, one Israeli official said.
Ultimately, Israeli officials said, the basic idea in both operations was to locate 20 to 25 human targets in Iran and hit all of them in the opening strike of the campaign, on the assumption that they would be more careful afterward, making them much harder to hit.
In a video interview with an Iranian journalist, the newly appointed head of the Revolutionary Guards Corps, Brig. Gen. Ahmad Vahidi, said that although Israel had human operatives and spies in the country, it had tracked senior officials and scientists and discovered the location of sensitive meetings mostly through advanced technology.
“The enemy gets the majority of its intelligence through technology, satellites and electronic data,” General Vahidi said. “They can find people, get information, their voices, images and zoom in with precise satellites and find the locations.”
From the Israeli side, Iran’s growing awareness of the threat to senior figures came to be seen as an opportunity. Fearing more assassinations on the ground of the sort that Israel had pulled off successfully in the past, the supreme Iranian leader, Ayatollah Ali Khamenei, ordered extensive security measures including large contingents of bodyguards and warned against the use of mobile phones and messaging apps like WhatsApp, which is commonly used in Iran.
Those bodyguards, Israel discovered, were not only carrying cellphones but even posting from them on social media.
“Using so many bodyguards is a weakness that we imposed on them, and we were able to take advantage of that,” one Israeli defense official said.
Iranian officials had long suspected that Israel was tracking the movements of senior military commanders and nuclear scientists through their mobile phones. Last year, after Israel detonated bombs hidden inside thousands of pagers carried by Hezbollah operatives in Lebanon, Iran banned many of its officials in particularly sensitive jobs from using smartphones, social media and messaging apps.
Smartphones are now completely off limits for senior military commanders, nuclear scientists and government officials.
The protection of senior officials, military commanders and nuclear scientists is the responsibility of an elite brigade within the Revolutionary Guards called Ansar al-Mehdi. The commander in chief of Ansar, appointed last August after the new government came into office, is Gen. Mohamad Javad Assadi, one of the youngest senior commanders in the Guards.
General Assadi had personally warned several senior commanders and a top nuclear scientist, Mohammad Mehdi Tehranchi, that Israel was planning to assassinate them at least a month before they were killed on the first day of the war, according to two senior Iranian officials with knowledge of the conversation. He had also called a meeting with the team leaders of security details asking them to take extra precautions, the officials said.
The cellphone ban initially did not extend to the security guards protecting the officials, scientists and commanders. That changed after Israel’s wave of assassinations on the first day of the war. Guards are now supposed to carry only walkie-talkies. Only team leaders who do not travel with the officials can carry cellphones.
But despite the new rules, according to officials who have held meetings with General Assadi about security, someone violated them and carried a phone to the National Security Council meeting, allowing the Israelis to carry out the pinpoint strike.
Hamzeh Safavi, a political and military analyst whose father is the top military adviser to Ayatollah Khamenei, said that Israel’s technological superiority over Iran was an existential threat. He said Iran had no choice but to conduct a security shakedown, overhaul its protocols and make difficult decisions — including arrests and prosecution of high-level spies.
“We must do whatever it takes to identify and address this threat; we have a major security and intelligence bug and nothing is more urgent than repairing this hole,” Mr. Safavi said in a telephone interview.
Iran’s minister of intelligence said in a statement this month that it had foiled an Israeli assassination attempt on 23 senior officials but did not provide their names or details of their positions and ranks. It said in the months leading up to the war, Iran had discovered and foiled 13 plots by Israel that aimed to kill 35 senior military and government officials. (An Israeli intelligence official disputed the Iranian account, saying that Israel had not been carrying out operations ahead of the surprise attack in June that could have led to heightened alertness on the part of Iran.)
The statement also said that security forces had identified and arrested 21 people on charges of spying for the Mossad and working as field and support operators in at least 11 provinces around Iran.
Iran has also accelerated efforts to recruit its own spies in Israel since the attacks of Oct. 7, 2023, which ignited the war in the Gaza Strip and triggered aggressive Israeli military operations in Iran and Lebanon.
Over the past year, Shin Bet, Israel’s domestic intelligence service, has arrested dozens of Israelis and charged them with being paid agents of Iran, accused of helping collect intelligence about potential targets for Iranian strikes on Israel.
Israel has made killing Iran’s top nuclear scientists an urgent priority as a way to set back the nation’s nuclear program, even poisoning two young upcoming scientists.
As Iran made steady progress over the years toward enriching its uranium stockpile into near-weapons grade material, Israeli military and intelligence officials concluded that the campaign of sabotage and explosions in the enrichment apparatus, which the Mossad had been engaged in for many years, had only a marginal impact.
In 2021, according to three Israeli security officials, the focus turned to what Israeli officials called “the weapon group” — a cadre of Iranian scientists who the Israelis believed met regularly to work on building a device to trigger the enriched uranium and cause a nuclear explosion. This is one of the most technologically difficult parts of a nuclear project. (Iran has said its nuclear program is for peaceful purposes, and the U.N.’s atomic watchdog and American intelligence agencies have long assessed that Iran has not weaponized its nuclear project.)
It was this group of scientists that became the focus of what Israel called Operation Narnia, the military plan to kill off scientists during the war’s early days this spring.
By the time of the June 16 national security meeting of top Iranian officials, Israel had already killed a number of high-profile figures associated with the nuclear program, including Mr. Tehranchi and Fereydoun Abbasi, another nuclear scientist, both killed just days earlier. The cellphones of their bodyguards helped Israel target all of them.
But Israel was also targeting a wide variety of Iranian leaders, including the heads of government branches at the national security meeting, and killed at least 30 senior military commanders through strikes during the war.
General Hajizadeh, the head of the Revolutionary Guards’ air force, assembled his leadership team, accompanied by their security units, at the very start of the war to monitor intelligence about possible Israeli strikes. Israeli warplanes swooped in and carried out a pinpoint strike on the bunker where General Hajizadeh had taken refuge, killing him and other top commanders.
Mr. Hajizadeh’s son Alireza has said that his father took extra caution with phones. On a video published on Iranian media, he said that “when my father wanted to discuss something important he would tell us to take the phones and smart devices out of the room and place it far away.”
The ability to track the bodyguards also helped lead the Israelis to the June 16 meeting. The attendees, in addition to Mr. Pezeshkian, the Iranian president, included the speaker of Parliament, Gen. Mohammad Baqer Ghalibaf, and the head of the judiciary, Gholam-Hossein Mohseni-Ejei. Also on hand were the ministers of the interior, defense and intelligence and military commanders, some brand-new to their jobs after their bosses had been killed in previous strikes.
The attack destroyed the room, which soon filled with debris, smoke and dust, and the power was cut, according to accounts that emerged afterward. Mr. Pezeshkian found a narrow opening through the debris, where a sliver of light and oxygen was coming through, he has said publicly.
Three senior officials said the president dug through the debris with his bare hands, eventually making enough of a space for everyone to crawl out one by one. Mr. Pezeshkian had a minor leg injury from a shrapnel wound and the minister of interior was taken to the hospital for respiratory distress, officials said.
“There was only one hole, and we saw there was air coming and we said, we won’t suffocate. Life hinges on one second,” Mr. Pezeshkian said recently, recounting the attack in a meeting with senior clerics, according to a video published in Iranian media. He said if Israel had succeeded in killing the country’s top officials it would have created chaos in the country.
“People,” he said, “would have lost hope.”
bloomberg.com 2025-08-26 - Twenty activists urging company to sever ties with Israeli military were arrested last week. Executive Brad Smith said he welcomed discussion but not disruption.
For the better part of a year, Microsoft Corp. has failed to quell a small but persistent revolt by employees bent on forcing the company to sever business ties with Israel over its war in Gaza.
The world’s largest software maker has requested help from the Federal Bureau of Investigation in tracking protests, worked with local authorities to try and prevent them, flagged internal emails containing words like “Gaza” and deleted some internal posts about the protests, according to employees and documents reviewed by Bloomberg. Microsoft has also suspended and fired protesters for disrupting company events.
Despite those efforts, a steady trickle of employees, sometimes joined by outside supporters, continue to speak out in an escalating guerilla campaign of mass emails and noisy public demonstrations. While still relatively small, the employee activism is notable given the weakening job market and the Trump administration’s crackdown on pro-Palestinian protests.
Last week, 20 people were arrested on a plaza at Microsoft’s Redmond, Washington, headquarters after disregarding orders by police to disperse. Instead, they chanted and called out Microsoft executives by name, linking arms as police dismantled their makeshift barricades and, one by one, zip-tied them and led them away.
On Tuesday, protesters occupied the office of Microsoft President Brad Smith, sharing video on the Twitch livestreaming platform that showed them chanting, hanging banners and briefly attempting to barricade a door with furniture. Smith didn’t appear to be there. Police detained at least two people who entered a building that houses the offices of senior executives, said Jill Green, a spokesperson for the Redmond Police Department. Others were protesting outside, she said.
An employee group called No Azure for Apartheid says that by selling software and artificial intelligence tools to Israel’s military, the company’s Azure cloud service is profiting from the deaths of civilians. Microsoft denies that, but the protests threaten to dent its reputation as a thoughtful employer and reasonable actor on the world stage. In recent years, Microsoft has generally stayed above the fray while its industry peers battled antitrust investigations, privacy scandals or controversial treatment of employees.
Now Microsoft is being forced to grapple with perhaps the most politically charged issue of the day: Israel’s treatment of Palestinians. Earlier this month, the company announced an investigation into reports by the Guardian newspaper and other news outlets that Israel’s military surveillance agency intercepted millions of Palestinian mobile phone calls, stored them on Microsoft servers then used the data to select bombing targets in Gaza. An earlier investigation commissioned by Microsoft found no evidence its software was used to harm people.
Microsoft says it expects customers to adhere to international law governing human rights and armed conflict, and that the company’s terms of service prohibit the use of Microsoft products to violate people’s rights. “If we determine that a customer — any customer — is using our technology in ways that violate our terms of service, we will take steps to address that,” Smith said in an interview last week, adding that the investigation should be completed within several weeks. Smith said employees were welcome to discuss the issue internally but that the company will not tolerate activities that disrupt its operation or staffers.
After Hamas’s deadly Oct. 7, 2023 attack on Israel, Microsoft executives were quick to offer condolences and support to employees. “Let us stand together in our shared humanity,” then-human resources chief Kathleen Hogan said in a note a few days after the attacks, which killed some 1,200 people, including civilians and soldiers.
Unity was short-lived: Jewish employees lamented what they said was a troubling rise in antisemitism. Palestinian staffers and their allies accused executives of ignoring concerns about their welfare and the war in Gaza, which has killed tens of thousands. The debate continued in internal chatrooms, meetings with human resources leaders and in question-and-answer sessions with executives. But the chatter was mostly limited to Microsoft’s halls.
That changed in early April at a bash Microsoft hosted to mark the 50th anniversary of the company’s founding. Early that morning, Vaniya Agrawal picked up Ibtihal Aboussad and drove to Microsoft’s campus. The two early-career company engineers — who respectively hail from the Chicago area and Morocco — had both decided to leave Microsoft over its ties to Israel, which had been documented in a series of articles, including by the Associated Press, and reached out to No Azure for Apartheid. “This isn’t just Microsoft Word with a little Clippy in the corner,” said Agrawal, who was arrested on Wednesday. “These are technological weapons. Cloud and AI are just as deadly as bombs and bullets.”
bleepingcomputer.com - Cybersecurity firm Profero cracked the encryption of the DarkBit ransomware gang's encryptors, allowing them to recover a victim's files for free without paying a ransom.
This occurred in 2023 during an incident response handled by Profero experts, who were brought in to investigate a ransomware attack on one of their clients, which had encrypted multiple VMware ESXi servers.
The timing of the cyberattack suggests that it was in retaliation for the 2023 drone strikes in Iran that targeted an ammunition factory belonging to the Iranian Defence Ministry.
In the ransomware attack, the threat actors claimed to be from DarkBit, who previously posed as pro-Iranian hacktivists, targeting educational institutes in Israel. The attackers included anti-Israel statements in their ransom notes, demanding ransom payments of 80 Bitcoin.
Israel's National Cyber Command linked DarkBit attacks to the Iranian state-sponsored APT hacking group known as MuddyWater, who have a history of conducting cyberespionage attacks.
In the case investigated by Profero, the attackers did not engage in ransom payment negotiations, but instead appeared to be more interested in causing operational disruption.
Instead, the attackers launched an influence campaign to maximize reputational damage to the victim, which is a tactic associated with nation-state actors posing as hacktivists.
Decrypting DarkBit
At the time of the attack, no decryptor existed for DarkBit ransomware, so Profero researchers decided to analyze the malware for potential weaknesses.
DarkBit uses a unique AES-128-CBC key and Initialization Vector (IV) generated at runtime for each file, encrypted with RSA-2048, and appended to the locked file.
Profero found that the key generation method used by DarkBit is low entropy. When combined with the encryption timestamp, which can be inferred from file modification times, the total keyspace is reduced to a few billion possibilities.
Moreover, they found that Virtual Machine Disk (VMDK) files on ESXi servers have known header bytes, so they only had to brute force the first 16 bytes to see if the header matched, instead of the entire file.
Profero built a tool to try all possible seeds, generate candidate key/IV pairs, and check against VMDK headers, which they ran in a high-performance computing environment, recovering valid decryption keys.
In parallel, the researchers discovered that much of the VMDK file content hadn't been impacted by DarkBit's intermittent encryption, as those files are sparse and many encrypted chunks fall onto empty space.
This allowed them to retrieve significant amounts of valuable data without having to decrypt it by brute-forcing keys.
"As we began to work on speeding up our brute force, one of our engineers/team members? had an interesting idea," explained Profero.
"VMDK files are sparse, which means they are mostly empty, and therefore, the chunks encrypted by the ransomware in each file are also mostly empty. Statistically, most files contained within the VMDK filesystems won't be encrypted, and most files inside these file systems were anyways not relevant to us/our task/our investigation."
"So, we realized we could walk the file system to extract what was left of the internal VMDK filesystems... and it worked! Most of the files we needed could simply be recovered without decryption."
Security experts are dismissing a pro-Iranian hacktivist group's claim to have breached Indian nuclear secrets in reprisal for the country's support of Israel.
The LulzSec Black group last week claimed to have hacked "the company responsible for Indian nuclear reactors" and to have stolen 80 databases, of which it was now selling 17 databases containing 5.2 gigabytes of data. The group claimed the information detailed the precise location of India's nuclear reactors, numerous chemical laboratories, employee personally identifiable information, industrial and engineering information, precise details of guard shifts and "other sensitive data related to infrastructure."
LulzSec Black, named after the notorious hacktivist collective that committed a string of high-profile hits in 2011, claims to be a group of "Palestinian hackers." Previous attacks tied to the group include disruptions targeting Israel, as well as countries that support Israel, including France and Cyprus.
Threat intelligence firm Resecurity said the group's nuclear claims vary from being dramatically overstated to outright lies.
"This activity is related to the 'pseudo-hacktivist' activities by Iran" designed to provoke fear, uncertainty and doubt, Resecurity told Information Security Media Group. "Many of their statements are overstatements, having no connection to reality. For example, they clearly do not have '80 databases' or even 5.2 GB of data."
LulzSec Black's claims arrive amidst U.S. government alerts of the "heightened threat environment" facing critical infrastructure networks and operational technology environments, following Israel launching missile strikes against Iran on June 13 (see: Infrastructure Operators Leaving Control Systems Exposed).
While the resulting regional war appears to now be moderated by a fragile ceasefire, many governments are still bracing for reprisals (see: Israel-Iran Ceasefire Holding Despite Fears of Cyberattacks).
What LulzSec Black may actually possess is identity and contact information for nuclear specialists, likely stolen from third-party HR firms and recruitment websites such as the CATS Software applicant tracking system and recruitment software, Resecurity said. This can be seen in the long list of various job titles - "security auditor, heavy water unit," "nuclear engineer, analysis lab, tritium gas," and "radiation officer, fuel fabrication, uranium dioxide" - in a sample of dumped data.
In that data, tags such as "Top Secret," appear, which Resecurity said likely either reflect clearances held by job candidates, or were added by the hackers themselves "so it will look like it is from some nuclear energy facility."
Barcelone se mue en “capitale européenne de la cyberguerre”. Depuis un an et demi, “au moins trois équipes renommées d’experts en piratage informatique”, venus d’Israël, se sont installées dans la capitale de la Catalogne, détaille El Periódico de Catalunya. Le journal espagnol s’appuie sur les informations du quotidien de Tel-Aviv Ha’Aretz, qui a publié le 26 décembre un article sur les hackers “délocalisés” d’Israël vers des pays de l’Union européenne, dont l’Espagne.
Retired Israeli case agents behind Mossad's boobytrapped pagers and walkie-talkies in Lebanon explain how they got Hezbollah to buy the devices and the plots' impact on the Middle East.
The Department of Homeland Security knows which countries SS7 attacks are primarily originating from. Others include countries in Europe, Africa, and the Middle East.
Serbian authorities are using spyware and Cellebrite forensic extraction tools to hack journalists and activists in a surveillance campaign.
An invisible detonator and wafer-thin plastic explosives turned batteries into bombs
It all started with an ESET statement on their official account on "X", wherein they mentioned that their partner company in Israel has gone under a targeted malicious email campaign that they managed to block within 10 minutes.
Back in May, I started tracking Handala, a hacktivist branded group expressing pro-Palestine views:
A senior official previously condemned the platform for ‘censoring’ Hamas-related content.
Documents reveal how Israel seized files, suppressed information related to WhatsApp’s lawsuit against Pegasus spyware vendor NSO
Shalev Hulio is remaking his image but is still involved in a web of cybersecurity ventures with his old colleagues from NSO Group.
At least seven more Russian, Belarusian, Latvian, and Israeli journalists and activists have been targeted with Pegasus within the EU.
Exclusive: Yossi Sariel unmasked as head of Unit 8200 and architect of AI strategy after book written under pen name reveals his Google account
Experts are finding thousands of examples of AI-created content every week that could allow terrorist groups and other violent extremists to bypass automated detection systems.
#algorithms #censorship #content #disinformation #israel-hamas #moderation #terrorism #war
The hacker collective called GhostSec has unveiled an innovative Ransomware-as-a-Service (RaaS) framework called GhostLocker. They provide comprehensive assistance to customers interested in acquiring this service through a dedicated Telegram channel. Presently, GhostSec is focusing its attacks on Israel. This move represents a surprising departure from their past activities and stated agenda.
Weeks after breach of college chain Atid servers, hacker group Sharp Boys puts stolen information up for sale and releases additional data of students; Atid: ‘These are Iranian hackers, and most of the materials are outdated’
Haaretz reveals NFV Systems’ surveillance tools; firm under investigation by secretive Israeli body for skirting arms export controls, in case that may ‘damage national security’
