“These cases reflect a broader phenomenon that began with the outbreak of the war, with Iranian operatives showing a strong drive to recruit from within Israel,” said Peretz.

Amid the Israel-Hamas War that erupted on October 7, 2023, a troubling trend began to take shape: the recruitment of Israeli citizens by Iranian operatives for espionage purposes.

This development comes at a time of war, endangering state security. Thanks to intelligence provided by the Shin Bet and investigations conducted by the Israel Police, 25 cases of espionage involving Israelis working for Iranian intelligence agencies have been thwarted.

Indictments have been filed, with 40 Israelis expected to face charges. Of these cases, 17 were managed by the National Unit for Serious and International Crime Investigations within LAHAV 433while eight cases were handled by the central units in various police districts.

In every case, investigators succeeded in gathering evidence that led to the arrest of the suspects. Lt. Col. Sarit Peretz, head of the security department in Lahav 433, shared insights on the matter with Maariv.

“Our unit has worked on 17 espionage cases so far,” says Lt. Col. Peretz. “These cases reflect a broader phenomenon that began with the outbreak of the war, with Iranian operatives showing a strong drive to recruit from within Israel.”

She continued, “The first case we uncovered involved a young Haredi man from Beit Shemesh in July 2024. At the time, it seemed like an isolated incident. It wasn’t clear that this was part of a larger trend until another significant case came to light. This was the case that brought attention to the phenomenon, with several suspects tied to Iran who had carried out operations for them over the past two years.”

Lt. Col. Peretz further explained, “From that point, we began to uncover cases involving two or three suspects each, all linked to Iran. Most of these connections began on social media platforms. Initially, it wasn’t obvious that they were Iranian operatives—sometimes they posed as journalists or used friendly or romantic connections. But it quickly became clear that the entity behind these contacts was Iran, with the goal of harming the State of Israel.”

Money is the primary motive

When asked if the suspects’ motive was always financial, Peretz confirmed: “Yes, always. The motive is money—easy money. They are motivated by the desire to receive payments as quickly as possible. There’s also the issue of anonymity—getting money from someone they don’t know.”

Peretz further explained that the money is often funneled through digital cryptocurrencies: “Exactly. The use of cryptocurrencies allows for greater anonymity and ease of transfer.”

Lahav 433 Cyber Unit was key to investigation success

Peretz emphasized the crucial role of the Lahav 433 Cyber Unitwhich specializes in investigating digital wallets: “Our cyber unit is the most professional in the Israel Police when it comes to investigating digital wallets. They have the expertise, the global network, and the necessary tools to trace fund transfers and open digital wallets.”

Types of tasks assigned to the Israeli suspects by Iran

“The tasks assigned to the Israelis progressed in stages,” said Peretz. “It starts with identification tasks—confirming the individual is indeed Israeli. They are asked for ID cards and other personal details to verify their identity. Once the operative is satisfied, the tasks become more personal. Israelis are asked to take pictures of themselves or even of supermarket products, or to photograph certain streets. These tasks help build trust between the operator and the Israeli.”

She continued, “As the relationship deepens, the tasks escalate: graffiti such as ‘Children of the Spirit of Allah’ or ‘Bibi Dictator,’ burning IDF uniforms, defacing the Israeli flag. Eventually, the tasks become more dangerous: photographing military bases or strategic locations. In some cases, suspects were asked to handle explosives, purchase weapons, or participate in operations intended to harm people or national security.”

“No one left the country for training,” Peretz confirmed. “We arrested suspects before that could happen. However, some were willing to travel to places like Cyprus or Greece, with the idea that they could reach Iran by sea. They even explored how to leave Israel without drawing attention.”

Collaboration between police and Shin Bet

Peretz stressed the importance of collaboration between the Israel Police and Shin Bet: “When we identify an Israeli element in contact with an Iranian operative, both we and Shin Bet act quickly. Our goal is to assess the extent of the potential damage. Many of those involved caused significant harm before their arrests. Take, for instance, the soldier working with the Iron Dome who transmitted a video from the defense system. Another case involved a suspect renting an apartment in Haifa, with the aim of monitoring the port for information on ships entering and leaving Israel. The goal was to smuggle ammunition into the port.”

Additionally, Peretz explained that not all espionage cases are handled by the Lahav 433. “Due to the large number of cases, central police units in various districts are also involved in these serious cases,” she said.

“These units have experience in organized crime investigations, and like us, they collaborate with Shin Bet.”

“The amounts involved ranged from 800,000 shekels to a million shekels,” Peretz stated.

Suspects’ defenses

“Most suspects don’t deny their involvement,” she noted. “They acknowledge the cases we’ve exposed but attempt to distance themselves by claiming they didn’t intend to harm Israel. They often argue that they didn’t fully understand the consequences of their actions.”

“While one or two suspects expressed discontent with the state, it was not clearly ideological,” said Peretz. “The majority of suspects claimed they loved Israel. But their motivation was always about easy money—they didn’t fully consider the implications of their actions.”