The Tradecraft Behind a Two-Decade Campaign of Targeted Killings (2006–2026)
A Pattern, Not a Series of Isolated Acts
On a cold November afternoon in 2020, a convoy carrying Iran’s most prominent nuclear scientist came under attack east of Tehran. Within hours, Mohsen Fakhrizadeh was dead. Iranian officials alleged a remotely operated weapon system; Israeli officials declined comment. The killing was not unprecedented — it was the culmination of a long-running pattern.
Over two decades, Iranian nuclear scientists, Revolutionary Guard commanders and security officials have been assassinated in operations widely attributed — though rarely admitted — to Mossad, sometimes in coordination with Western partners. Other incidents, including the 2020 U.S. drone strike that killed Qasem Soleimani in Baghdad, were openly acknowledged by Washington and reshaped the region’s deterrence logic.
The campaign, as reconstructed through court documents, investigative reporting, intelligence memoirs and on-the-record interviews, was not a single-method effort. It was layered tradecraft: long-term human networks, signals interception, cyber reconnaissance, supply-chain exploitation, remote execution technologies, and the opportunistic use of third-country territory.
“This wasn’t magic, and it wasn’t one breakthrough,” said Daniel B. Shapiro, a former U.S. ambassador to Israel, speaking at a Washington security forum in 2021. “It was years of intelligence accumulation and operational patience.”
Understanding how these operations were executed — and why they continued — is essential to assessing the broader geopolitical consequences now unfolding.
The Strategic Problem: Locate, Confirm, Execute
Every targeted killing must solve three unforgiving requirements:
- Locate — establish the target’s residence, travel patterns, meeting sites and security routines.
- Confirm — positively identify the individual at the right time and place.
- Execute — neutralize with minimal collateral damage and plausible deniability.
Failure at any stage risks diplomatic catastrophe or operational exposure.
Efraim Halevy, a former head of Mossad, has repeatedly emphasized the primacy of intelligence over force. “The key to any such operation is precise intelligence,” he told Israeli radio in 2020, declining to discuss specific cases. “Without it, you do not act.”
Iran’s counterintelligence apparatus — divided among the Ministry of Intelligence, the Islamic Revolutionary Guard Corps (IRGC), and other bodies — hardened considerably after 2009. Yet the pattern of strikes suggests foreign services repeatedly solved the locate-confirm-execute equation.
The Toolkit: A Composite Intelligence Architecture
No single tool explains the campaign. Instead, evidence points to a composite architecture refined over time.
1. Long-Term Human Networks (HUMINT)
Recruitment remains foundational. Agents with access to compounds, research institutes, logistics chains or personal staff can provide granular details satellites cannot: vehicle swaps, family routines, guard rotations.
Between 2010 and 2013, Iranian authorities announced the arrest of alleged Mossad-linked cells following the assassinations of nuclear scientists in Tehran. In televised confessions broadcast on Iranian state television, suspects described being recruited abroad and trained to attach magnetic bombs to vehicles. Independent verification is limited, but the arrests underscored both domestic penetration and the inherent risk of HUMINT operations.
“Running assets in a hostile state is slow, expensive and dangerous,” said Ronen Bergman, author of Rise and Kill First, in a 2018 interview. “But without local access, you cannot reach high-value targets.”
2. Signals Intelligence (SIGINT)
Metadata — not necessarily content — can be decisive. Call patterns, encrypted app usage, location pings and vehicle telematics create a digital pattern-of-life map.
A former European intelligence official, speaking on background to The International Wire, noted: “In modern urban environments, total invisibility is nearly impossible. Phones, security cameras, license-plate readers — they all leave traces.”
Open-source reporting after several assassinations cited communications interception as narrowing operational windows. Western agencies have long possessed robust signals capabilities in the Gulf region; cooperation between Israel and allied services reportedly expanded in the 2010s.
3. Cyber Reconnaissance and Supply-Chain Access
The 2010 exposure of the Stuxnet worm — widely attributed to the United States and Israel — demonstrated the feasibility of penetrating Iran’s nuclear infrastructure digitally. While Stuxnet targeted centrifuges at Natanz rather than individuals, it illustrated a broader model: compromise contractor systems, map networks, and harvest internal data.
David Sanger of The New York Times, who reported extensively on Stuxnet, wrote in 2012 that the operation marked “a new era in covert warfare.” Access to contractor laptops, industrial control systems and CCTV networks can yield facility schematics and personnel rosters — intelligence that feeds kinetic planning.
Cyber operators can also disable surveillance cameras, manipulate data logs or erase digital footprints post-operation, complicating attribution.
4. Remote Execution Technologies
As Iranian protection hardened, reported methods evolved.
In the Fakhrizadeh case, Iranian officials claimed a remote-controlled machine gun mounted on a vehicle, operated via satellite link. Israel did not confirm. Several international outlets, including The New York Times and The Times of Israel, reported that the operation involved sophisticated remote components.
Yossi Melman, an Israeli intelligence analyst, observed in 2021: “The fewer operatives physically present, the lower the exposure. Technology allows that reduction.”
Earlier assassinations — notably the 2010–2012 motorcycle bombings — relied on magnetic explosives attached to vehicles by riders who escaped quickly. These attacks were low-tech compared with later innovations but highly targeted.
5. Exploiting Transit and Third-Country Vulnerabilities
Targets do not remain within national borders. Meetings in Dubai, Istanbul or Doha offer windows of vulnerability.
While the 3 January 2020 killing of Qasem Soleimani in Baghdad was conducted openly by the United States, it demonstrated the logic of striking during travel. U.S. President Donald Trump described Soleimani as planning “imminent attacks” in remarks following the strike.
Strikes or surveillance abroad can reduce the protective depth available inside Iran — but they risk diplomatic fallout. Host governments may be unaware, embarrassed or compelled to respond.
6. Allied Cooperation
Intelligence rarely operates in isolation. Cooperative arrangements — formal and informal — expand reach.
Former CIA director John Brennan acknowledged in a 2012 interview that the United States had worked closely with Israel on Iran-related intelligence, though he declined to detail operations. Shared satellite imagery, intercepted communications and forensic analysis can raise confidence thresholds for high-risk missions.
Case Studies: Methods in Convergence
2010–2012: The Motorcycle Bombings
Between January 2010 and January 2012, at least four Iranian nuclear scientists were killed in Tehran.
Masoud Ali-Mohammadi was killed by a remote-controlled bomb on 12 January 2010.
Majid Shahriari died in November 2010 after a magnetic bomb was attached to his car.
Darioush Rezaeinejad was shot in July 2011.
Iran blamed Israel and arrested suspects who allegedly confessed to Mossad links. Israel did not comment. The pattern — motorcyclists attaching explosives during traffic stops — suggested detailed knowledge of routines and minimal collateral damage intent.
“These were precision hits,” said Ali Vaez of the International Crisis Group in a 2012 panel discussion. “They were meant to delay, not to terrorize.”
January 2020: The Soleimani Strike
Qasem Soleimani, commander of the IRGC’s Quds Force, was killed by a U.S. drone strike near Baghdad International Airport. Washington openly acknowledged responsibility.
Secretary of State Mike Pompeo stated at the time: “We disrupted an imminent attack.” Iran retaliated with missile strikes on U.S. bases in Iraq.
Though not a Mossad operation, the strike illustrated the strategic logic of decapitation: remove a central planner to disrupt adversary coordination.
November 2020: The Fakhrizadeh Assassination
Mohsen Fakhrizadeh had long been identified by Western and Israeli officials as central to Iran’s nuclear program.
Following his killing, then–Iranian Foreign Minister Javad Zarif accused Israel of “cowardly terrorism.” Israeli Prime Minister Benjamin Netanyahu did not comment directly but had previously referenced Fakhrizadeh by name in a 2018 presentation unveiling seized Iranian nuclear archives.
Multiple outlets reported a hybrid operation involving explosives and remote weaponry. The complexity suggested years of preparation.
Tehran’s Countermeasures — and Constraints
Iran responded with hardened security for key personnel: armored vehicles, route randomization, tighter background checks and surveillance upgrades. It announced arrests and claimed to have dismantled foreign-linked networks.
Yet structural constraints persisted:
- Bureaucratic fragmentation among intelligence bodies.
- Economic sanctions limiting access to cutting-edge counter-surveillance technology.
- The operational necessity for scientists and commanders to travel.
“Total security is impossible,” said Karim Sadjadpour of the Carnegie Endowment in a 2021 interview. “The more you lock down, the more you disrupt your own system.”
Attribution and Deniability
Public confessions from perpetrator states are rare. Intelligence agencies operate in ambiguity to preserve methods and manage diplomatic fallout.
Circumstantial attribution rests on:
- Consistent operational signatures.
- Strategic motive alignment.
- Historical precedent.
As Amos Yadlin, former head of Israeli military intelligence, once noted in a public lecture: “In the Middle East, ambiguity is a strategic asset.”
Strategic Calculus: Why Take the Risk?
Targeted killings aim to:
- Delay nuclear or weapons programs.
- Signal reach and deterrence.
- Disrupt command hierarchies.
But they carry risks of retaliation and escalation. The cycle of strike and counter-strike contributed to broader confrontation in the mid-2020s, including direct exchanges between Israel and Iran.
An EU diplomat summarized privately: “Every decapitation buys time. It does not buy peace.”
What Remains Unknown
- The depth of domestic penetration networks.
- The precise extent of allied technical assistance.
- The long-term efficacy of cyber-enabled targeting.
As both sides adopt more advanced surveillance and counter-surveillance tools, the contest intensifies.
Final Analysis: Tradecraft, Not Mystique
The repeated targeting of Iranian figures from 2006 to 2026 reflects patient, adaptive intelligence work. It blended human access with digital mapping, mechanical innovation and geopolitical opportunism.
Each success triggered countermeasures. Each countermeasure drove innovation. The result was a feedback loop of covert competition — one that reshaped deterrence dynamics and contributed to open confrontation.
As one retired Israeli security official told The International Wire: “Operations like these are not about revenge. They are about buying time.”
Whether that time altered the strategic trajectory of Iran’s programs remains debated. What is clear is that the campaign demonstrated the reach — and limits — of modern intelligence tradecraft.
