CommandEleven Intelligence // Iran Desk. This dossier follows Iran’s Homeland Threat to the US and The Gig Economy of Terror.
Iran runs its plotting abroad through more than one organization, and in 2026 both of the main ones were hit. In April, Israel exposed the IRGC Intelligence Organization’s covert attack arm, Unit 4000, and said its senior officers had been killed or struck. In October, reporting from sources close to the Quds Force said that the Quds Force’s own assassination unit, Unit 840, had been renamed Unit 600 and given a new commander after its predecessor was killed. A renamed unit is not a smaller one. The new structure, if the reporting holds, is organized by region and reaches further than before.
Key Judgments
- [CONFIRMED] On April 20, 2026, Mossad, the IDF and Shin Bet publicly identified Unit 4000, the Special Operations Division of the IRGC Intelligence Organization, as the directorate behind attack plots against Israeli and Western targets abroad. Israel said the head of the IRGC Intelligence Organization, Majid Khademi, and senior Unit 4000 official Mohsen Suri were killed during the war, and that unit chief Rahman Moghadam was struck. These are Israeli government claims; Iran has not confirmed them.
- [SINGLE-SOURCE] Iran International reported on October 13, citing sources close to the Quds Force, that Unit 840 has been renamed Unit 600 after its structure was exposed, and that Quds Force commander Esmail Qaani appointed Mojtaba Hagh-Lesan, 64, the unit’s former intelligence chief, to lead it. His predecessor, Yazdan Mir, was reportedly killed in an Israeli strike in April. Israel Hayom carried the report on October 14. No government has confirmed the renaming, and Iran International is opposed to the Iranian government.
- [SINGLE-SOURCE] The same report published a leaked command chart naming five regional deputies: Mohammad Reza Ansari (the “Israel file”), Mohsen Boroujeni (United States and Europe), Morteza Babai (Middle East and Africa), Javad Sharifi (Asia) and Meysam Sahraei (India and Africa).
- [CONFIRMED] The plotting has not stopped. A Hamburg court on October 15 jailed two men for spying on prominent Jewish figures for the Quds Force. On October 20, UK Counter Terrorism Policing re-arrested two men in the RAF Fairford case on a National Security Act charge of assisting Iranian intelligence, and said Iranian state involvement is “highly likely.”
- [ASSESSED] The renaming reads as damage control after exposure, not a retreat. Iran replaced killed commanders with veterans from inside the same structures and kept the regional desks. The “Asia” and “India and Africa” portfolios point to a wider reach than the European and Israeli targeting that dominates the public record.
- [ASSESSED] The method is still the one MI5, ASIO and European prosecutors have described: hiring criminals and other deniable intermediaries rather than sending Iranian officers. Decapitation strikes do not remove that model, because it depends on contacts and money more than on any single commander.
- [EXCLUDED] There is no public evidence that Unit 600 commands Hezbollah’s external operations arm, Unit 910. Iran International’s separate October 8 report describes Unit 910 recruiting foreign nationals inside Iran under Quds Force supervision, but names no link to Unit 600. CommandEleven Intelligence treats them as distinct organizations.
Three Arms, Not One
Public reporting often blurs Iran’s external plotting into a single “Quds Force” story. The record supports at least three separate organizations, each with its own chain of command.
The Quds Force is the IRGC’s foreign arm. Its older special operations unit, Unit 400, worked closely with Hezbollah. Unit 840 was separated from it after 2010, under Qassem Soleimani, to run assassinations and kidnappings abroad, relying mainly on foreign operatives and criminal networks rather than Iranian officers. That is the unit now reported as Unit 600.
The IRGC Intelligence Organization is a different service, answering to the IRGC rather than to the Quds Force. Israel says its Special Operations Division, Unit 4000, ran its own attack network, recruiting and training operatives in Iran and abroad, and smuggling weapons toward Israel. The overlap in names (Unit 400 and Unit 4000) is coincidental, and the two should not be merged.
Hezbollah’s Unit 910, led by Talal Hamiyah, is the Lebanese group’s external operations arm. It works alongside Iranian services but is not part of the IRGC.
Iran’s Ministry of Intelligence (MOIS) runs a fourth track of its own, mostly against dissidents. It is outside the scope of this dossier.
Unit 4000: What Israel Disclosed in April
Israel’s April 20 disclosure described Unit 4000 as the IRGC’s “covert terrorism apparatus.” The named chain ran from Majid Khademi, head of the IRGC Intelligence Organization, through unit chief Rahman Moghadam to senior official Mohsen Suri. A fourth officer, Mehdi Yekta-Dehghan, known as “the Doctor,” reportedly ran the effort in Azerbaijan.
Israel attributed several plots to the network:
- Azerbaijan. Azerbaijan’s State Security Service said in March that it had foiled an IRGC plot against the Baku-Tbilisi-Ceyhan pipeline, the Israeli Embassy, a Baku synagogue and Jewish community leaders, and published a video with confessions. Local journalists have since questioned the case, saying some of those presented as plotters had earlier drug convictions. The Azerbaijani claims have not been tested in an open court outside the country.
- Turkey and Cyprus. Israel says an operative arrested in Turkey in January 2026 smuggled explosive drones from Iran toward Cyprus and gathered intelligence on Incirlik Air Base. Turkey has not published its own account.
- Iraq. Israel says Unit 4000 operatives worked with pro-Iranian militias on attack plans.
Nearly all of these specifics come from Israeli agencies, which have an interest in the story. What is independently established is narrower: Azerbaijan made arrests and convictions, and Turkey made an arrest in January. The attribution of all of it to a single Unit 4000 network is Israel’s.
Unit 840 Becomes Unit 600
The October report is more specific about personnel than about operations. Hagh-Lesan, the new commander, previously ran the unit’s intelligence section. His appointment, along with other former senior officials, is described by the sources as a response to a “command crisis” after a string of killings inside Iran.
The operations the report attributes to the unit are not new. They include the plot against former US national security adviser John Bolton, which US prosecutors charged in 2022 against an IRGC member, plots against Iran International presenters Fardad Farahzad and Sima Sabet in London, and plans against Jewish sites in Europe. In other words, the report links a known history to a new name. It does not describe a new campaign.
The regional deputies are the most useful part of the leak, if it is genuine. A structure with dedicated desks for the United States and Europe, Asia, and India and Africa is organized for reach, not retrenchment. It also matches the direction of the public record, which over the past two years has moved from Europe and Israel to Australia and Latin America.
The Record Since the Strikes
Killing commanders has not ended the plotting, and the arrests of the past year show the model at work:
- Australia, August 2025. Prime Minister Anthony Albanese expelled Iran’s ambassador after ASIO concluded that the IRGC directed at least two antisemitic arson attacks in Australia, using local criminals.
- Mossad, October 2025. Israel named an IRGC commander it calls Sardar Amar as the head of a network behind foiled plots in Greece, Australia and Germany in 2024 and 2025.
- United Kingdom, October 2025. MI5 Director General Ken McCallum said the service had tracked “more than 20 potentially lethal Iran-backed plots” in a single year.
- Germany, October 15, 2026. A Hamburg court jailed two men for spying on Jewish figures and preparing attacks on behalf of the Quds Force.
- United Kingdom, October 20, 2026. Two men arrested in the RAF Fairford case were re-arrested on a charge of assisting Iranian intelligence. Police said Iranian state involvement is “highly likely.” The US has withdrawn its B-1B bombers from the base. Iran denies involvement.
None of these cases has been publicly tied to Unit 600 or Unit 4000 by name. That is normal: charging documents rarely name the Iranian unit. It also means the new names cannot yet be tested against court evidence.
The Hezbollah Track
Iran International reported on October 8 that Hezbollah runs a recruitment network inside Iran, using four safe houses in Qom and Tehran and the cover of Al-Mustafa International University, the Qom-based seminary network the US has sanctioned for Quds Force links. The report names an Indonesian graduate of the university, Mohammad Hassan, as recruiting foreign nationals for Unit 910 chief Talal Hamiyah under Quds Force supervision, and says several recruits had trained for years as a sleeper cell.
This is single-source reporting from a regime-opposed outlet, and its details cannot be checked publicly. If it is accurate, it matters for two reasons. It points to recruitment of Southeast Asian nationals, who draw less scrutiny in Europe and the Gulf than Lebanese or Iranians. It also shows the Quds Force supporting Hezbollah’s external work from inside Iran at a time when Hezbollah’s own base in Lebanon is under pressure. We examine Unit 910 in more detail in our Hezbollah coverage.
What to Watch
These are the indicators that would confirm, or undercut, the Unit 600 reporting:
- Designations. A US Treasury, UK or EU sanctions listing that names Unit 600 or Hagh-Lesan would be the first government confirmation of the renaming.
- Charging documents. Any prosecution that names Unit 600, Unit 4000 or one of the five regional deputies.
- Geography. Plots or arrests in South or Southeast Asia, or in Africa, consistent with the new regional desks.
- Recruits. Cases involving Southeast Asian nationals linked to Al-Mustafa or Qom seminaries.
- Timing. The US has said it will not strike Iran before the November 3 midterms. A resumption of strikes, or a strike on a senior Iranian figure, would raise the risk of retaliation abroad through these networks.
What This Does and Doesn’t Establish
This record establishes that Israel publicly identified an IRGC Intelligence Organization attack unit in April, that Iran-linked plotting against Jewish, Israeli, dissident and Western military targets has continued through October, and that European and British courts and police are still charging people for it.
It does not establish that Unit 840 has in fact been renamed Unit 600. That rests on one regime-opposed outlet’s sources and a leaked chart, carried by a second outlet without independent confirmation. It does not establish that Yazdan Mir is dead, or that the five named deputies hold the posts described. It does not tie any specific 2026 prosecution to either unit by name, and it does not show that Unit 600 directs Hezbollah’s Unit 910. We will update this dossier if a government designation or a court filing confirms any of these points.
Frequently Asked Questions
Is Unit 600 the same as Unit 4000?
No. Unit 600 (formerly Unit 840) is reported to be part of the Quds Force. Unit 4000 is part of the IRGC Intelligence Organization, a separate service. Both run attack plots abroad.
Why would Iran rename a unit?
According to the sources cited by Iran International, because its structure and chain of command had been exposed. Renaming does not change the people or the contacts. It can complicate sanctions and legal designations that name the old unit.
Has any government confirmed the renaming?
Not as of publication. The report comes from Iran International’s sources and was carried by Israel Hayom.
Does this raise the threat in the United States?
The reported structure includes a desk for the United States and Europe, and the Bolton plot shows past intent. CommandEleven Intelligence’s broader assessment is in Iran’s Homeland Threat to the US.
Sources
- Israel Hayom, Israel reveals Iran’s secret Unit 4000
- Israel Hayom, Iran names new commander for renamed Quds Force unit
- Iran International, Hezbollah recruitment network in Iran exposed, four safe houses identified
- OC Media, Azerbaijan says it foiled Iranian terror plot against BTC pipeline, Jewish sites
- OC Media, Social media users claim Azerbaijan presented drug convicts as Iran-linked terrorists
- Iran International, German court jails two men over spying for Iran’s Guards
- The National, RAF Fairford suspects face new charges of working for Iranian intelligence
- The National, Iranian threat to UK ramps up with 20 plots uncovered last year
- NPR, Australia accuses Iran of organizing antisemitic attacks and expels ambassador
- The Algemeiner, Mossad reveals foiled Iranian terror plots in Australia, Greece, and Germany
