1.0 Introduction
Recent disruptions of clandestine Iranian cells across Europe, the Gulf, and North America have drawn attention to Tehran’s covert action capabilities beyond its country’s borders.* Against the backdrop of this environment, this article examines the role of Unit 840, the Islamic Revolutionary Guards Corps (IRGC) Quds Force’s dedicated covert operations unit for assassination, abduction, and surveillance operations against dissidents, opposition figures, and Western and Israeli targets outside of Iran, including its recruitment of foreign operatives and mercenaries to conduct attacks.
*Background: In May 2026, Kuwait arrested four IRGC-affiliated individuals who were trying to enter the country by sea, and Bahrain sentenced three individuals to life in prison over links to the Corps. In March, the UAE dismantled the second of two Iran-linked groups accused of covert activities and sabotage since the outbreak of regional hostilities in late February, and Qatar arrested members of two IRGC-cells within its borders. Meanwhile, US prosecutors charged an Iran-backed Kataib Hezbollah suspect involved with attacks in the United States, Canada, and Europe. Publicly available information has not tied these operatives to Unit 840, but they reflect a wider pattern of Iranian covert action that aligns with Unit 840’s mission and capabilities. [source, source, source, source, source, source]
2.0 Organisation
2.1 Place within broader government
Unit 840 is a covert operational unit of the Quds Force, a specific branch of the Islamic Revolutionary Guards Corps (IRGC), which falls under the direct command of Iran’s Supreme Leader, who also appoints the commander of the IRGC. The Quds Force was originally established to create a structured framework for Iran’s external operations while adhering to the doctrine of exporting the Islamic Revolution outside of Iran.
The IRGC is separate from Iran’s regular military, known as the Artesh, and functions as a parallel military-security institution tasked with protecting the Islamic Republic and advancing its ideological and strategic interests. For a broader understanding of Iran’s security and intelligence structure, see Grey Dynamic’s article Iranian Intelligence Community: An Overview.
The Corps is also different from the Ministry of Intelligence and Security (MOIS), Iran’s civilian intelligence service, although both the MOIS and IRGC carry out external surveillance, recruitment, and targeting operations. Within the IRGC, the Quds Force is responsible for external operations, including sponsoring, training, and supervising paramilitary and militant groups across the Middle East and elsewhere. Unit 840 operates within this mission, focusing especially on surveillance, source recruitment, assasination plots, and attacks against perceived enemies of the state.
In recent years, the IRGC—especially the Quds Force and the IRGC Intelligence Organisation—has been responsible for attacks abroad, as has the MOIS. [source]
Within the Quds Force, Unit 840 is one of several units specialised in external covert operations. While Unit 840 is associated with recruitment through criminal networks, Unit 400 is associated with “special operations” overseas. Other Units operating alongside them are Unit 340, the Quds Force technical wing in charge of developing weapon technology and distributing it to regional militias, and Unit 190, which smuggles arms and aids terrorist networks. [source]
2.2 Known IRGC-QF 840 individuals
Yazdan Mir, alias Sardar Bagheri: Former Commander
The latest reporting designating Bagheri as commander dates from November 2025, but Israel in early April 2026 announced the killing of Bagheri in an overnight strike. [source, source]
Mohammad Reza Ansari: (Deputy) Commander
Ansari is/was responsible for the unit’s operations in Syria and executing orders for the targeting of Jewish sites in South America. He was sanctioned by the UK government in January 2024 for planning and conducting attacks and assassinations in countries outside of Iran, including the UK, and sanctioned on 15 July 2025 by the EU council for ordering the assasination of journalists critical of the Islamic Republic of Iran.The UK sanctions list designated him as ‘commander’, though a source from the IDF press release designates him as deputy commander as of September 2025. [source, source, source]
Ashgar Bakari: Commander
A joint Israeli Security Agency (ISA) and Israeli Defense Forces (IDF) announcement designated Bakari as commander of the unit as of September 2025. [source, source]
Hassan Sayyad Khodayari/Khodaei: Former Deputy Commander
Khodayari operated under Bagheri until his assassination by Israel in May 2022. He was allegedly responsible for operations in the Middle East and the surrounding region, and was killed to pressure Iran to cease the unit’s activities. [source, source]
Meysam Sahraei: Alleged member
Reza Ghabadi: Alleged member
Abbas Mohammad Naeim: Alleged member
Sahraei, Ghabadi, and Naeim were identified as members whilst attempting to recruit a Ugandan construction worker to surveil Israeli embassies in Uganda and Senegal. Tehran has since denied claims of the individual’s affiliation with Unit 840 and the operation. [source]
Mansour Rasouli: Alleged member
Arrested by the Mossad in Iran. Previously, was tasked to create an operational network in Turkey by recruiting locals to carry out attacks. Allegedly recruited by Khodayari. [source]
Bashir Biazar: Alleged member
Former director of Iran’s state television. “Connected” to the unit, according to French Ministry of Interior reporting in June 2024. [source]
Qasem Salah al-Husseini: Former key operative, northern sector
The IDF in December 2025 announced the elimination of al-Husseini. [source, source]
Hussein Mahmoud Marshad al-Jawhari: Key operative
Eliminated by the IDF in December 2025 for allegedly plotting attacks on Israel from Syria and Lebanon. [source, source]
3.0 Operational History
3.1 Confirmed plots
Israeli Embassy, London (2025) – thwarted attack
The United Kingdom Special Forces (UKSF), following a prolonged surveillance operation by MI5, in 2025 arrested five Iranians who allegedly belonged to Unit 840 and were plotting an attack on the Israeli embassy. Some of the operatives allegedly entered the country by small boats, sailing across the English Channel and impersonating migrants. A former British military intelligence officer claimed that UK security services were almost certainly tipped off by Mossad, which has long infiltrated Iran’s security services. [source]
The German Network (2023) – aborted assasination
In September 2023, Unit 840 plotted the assasination of Iranian artist and dissident Shahin Najafi through a network of three assasination squads, known as the German Network. This network targeted Iranian dissidents and European Jews. Originally planned for 7 September 2023 at the Theater am Aegi in Hanover, the attack was aborted following instructions from Tehran warning that increased security measures at the theatre risked exposing the network. [source]
Golan Heights (2020) – thwarted attacks
In 2020, the Israeli government addressed the UN with concerns regarding the repeated discovery of IEDs and anti-personnel mines between Israel and Syria, including multiple devices found on 3 August and 17 November. The explosives allegedly were placed by Syrian proxies working for Unit 840 to attack and intimidate Israelis in the Golan Heights. [source, source]
“The Wedding” (2020) – thwarted assassinations
Unit 840 was allegedly behind the attempted assasination of two Iran International news anchors in London. The plot consisted of hiring a people smuggler to assassinate Fardad Farahzad, known as the ‘groom,’ and former anchor Sima Sabet, known as the ‘bride,’ in November 2020. Iranian intelligence officers based in Europe in 2016 hired the smuggler as a proxy. [source]
3.2 Area of Operation
Unit 840 generally operates in every region that is of interest to the Islamic Republic. Specialising in foreign recruitment and attacks, the unit consists of various operational departments divided by geographic regions: the Middle East and Africa, the Caucasus and Asia, Europe and the United States. Specifically known areas in which the unit operates include “Lebanon, Bahrain, Iraq, South America, Asia, Africa, Afghanistan, Syria, Western Europe, and North America.” [source, source]
4.0 Tradecraft and Recruitment
4.1 Proxies
Unit 840 relies on proxies to carry out attacks and does not directly recruit operatives for operations to maintain plausible deniability. According to MI5 Director General Ken McCallum, the proxies range from international organised crime leaders to petty criminals. For example, the 2020 thwarted assassinations of Fardad Farahzad and Sima Sabet were tasked to a recruited people smuggler by the IRGC. This individual began collaborating with Iranian intelligence in 2016 and was recruited for his role as a transnational criminal in Europe. In January 2024, the UK government, together with the US government, announced new sanctions against Unit 840 to tackle domestic threats from Iran. The designation of the unit cited the Iranian Regime’s reliance on criminal gangs across the world to “deliver” its threats. [source, source]
Beyond Unit 840, Iran’s growing reliance on criminal proxies more broadly complicates detection and disruption and precludes the positive identification of which units are behind many uncovered attack and assination attempts. Iranian proxies used as covert action operatives in recent years include Swedish gangs in Scandinavia, such as Foxtrot and Rumba. Additionally, the MOIS and IRGC have increasingly recruited European minors as proxies given their low cost, accessibility online, and maturity issues that facilitate recruitment. [source, source]
4.2 Recruitment
Iranian intelligence operatives reportedly have recruited individuals to carry out attacks through online contact with communication moved to encrypted messaging applications, such as Whatsapp. The recruits are paid, often in cryptocurrency, for individual tasks. The IDF, following interrogations of captured Unit 840 recruits, has observed that some individuals were unwitting of who recruited, tasked, and paid them and that the unit rarely discloses their identity and motives. These recruitment operations may sometimes involve the use of foreign nationals to recruit other foreign nationals, a model known as “proxy-of-a-proxy.” [source, source, source]
4.3 Diplomatic cover
The Quds Force, including Unit 840, leverages diplomatic postings and embassies to advance its mission. Operatives stationed at Iranian embassies are normally under official covers—political or economic officers or defence, cultural, or press attachés—for access, flexibility, and diplomatic protection. According to the Institute for National Security Studies (INSS), the Quds Force has appointed diplomatic representatives as high as the rank of ambassador to advance its goals. On the other hand, Quds Force operatives with no official diplomatic positions sometimes carry out diplomatic missions. For example, the former commander of the Quds Force, Soleimani, had a prominent role in extra-territorial negotiations, despite officially holding no diplomatic title. After the 2018 foiled plot to bomb a National Council of Resistance of Iran (NCRI) rally in Paris, the US State Department warned all nations that “Iran uses embassies as diplomatic cover to plot terrorist attacks.” [source, source, source]
4.4 Surveillance methods
Past interrogations and public records of captured operatives have revealed that surveillance linked to Iranian overseas plots is delegated and carried out by untrained surveillants. In some cases, proxies are recruited solely to surveil people or places of interests in exchange for financial compensation. For example, in 2025 a Ugandan construction worker was caught after being recruited to surveil the Israeli embassy in Uganda. [source]
5.0 Disruption and Exposure
- On 15 July 2025, the European Council sanctioned Unit 840 Commander Mohammed Ansari for “ordering the assassination of journalists critical of the Islamic Republic.” [source]
- On 29 January 2024, the UK sanctioned Unit 840 for involvement in “hostile activity by the Government of Iran, namely threatening, planning or conducting attacks, including assassinations and threats to life, in countries other than Iran, including the UK.” [source]
- In July 2018, following the foiled plot to bomb a National Council of Resistance of Iran (NCRI) rally in Paris, the US State Department warned other nations of Iran’s capabilities to plot bomb attacks anywhere in the world. In January 2019, the European Union responded by adding to its terrorist list the Directorate for Internal Security of the MOIS and two Iranian officials. [source, source]
6.0 The Future
A complete overview of Unit 840 remains hard to establish. Despite DOJ indictments and European sanctions, the unit’s secretive nature complicates the development of a more complete picture. Recent exposure has placed the unit under the public eye and made its operations increasingly costly. This may prompt the unit to seek even greater deniability through dependency on criminal proxies.
Recent tensions with the West following the US-Israeli war on Iran, initiated on 28 February 2026, may lead to one of several outcomes regarding Unit 840’s future. They may, for instance, spur interest in Tehran for an increase in the unit’s operations abroad, especially targeting Israeli and American targets. However, the killings of senior IRGC and intelligence figures by the US and Israel has disrupted existing leadership structures, countrywide communications, and (presumably) funding and planning of operational units in general, which could push Unit 840 further underground or at least slow down its nearterm activity.
Deteriorating tensions between Iran and the West could also lead to greater security vigilance in, and cooperation between, countries that are potential targets of Unit 840, complicating the unit’s ability to operate. The most recently arrested suspected Iranian-linked operatives across the UAE, Bahrain, Kuwait, and the US have not been publicly linked to the unit, but they reflect a growing pressure on Iran’s broader external covert operations.
7.0 Conclusion
Unit 840 exemplifies the complex and intricate layers of Iran’s external covert capabilities through criminal proxies, reliance on embassies and diplomats, surveillance mechanisms and prolonged secrecy. This structure exposes an internal architecture that is neither improvised nor reactive, one designed for plausible deniability. Its global reach makes it potentially deadly and a continuing threat, demonstrating that Iran can compensate for geopolitical isolation and conventional military operations through asymmetrical, clandestine power. Understanding its hidden structures is a necessity for Western intelligence agencies to thwart plots and ensure safety amid heightened tensions with the United States and Israel.