Ministry of Intelligence and Security (MOIS)
BLUF (Bottom Line Up Front)
The Ministry of Intelligence and Security (MOIS, Persian: Vezarat-e Ettela’at va Amniat-e Keshvar — VEVAK) is the primary civilian intelligence and counterintelligence service of the Islamic Republic of Iran. Operating under the direct authority of the Supreme Leader and accountable through the President, MOIS conducts domestic surveillance and political repression, foreign intelligence collection, counterespionage, and overseas covert action — including assassination operations against dissidents and opposition figures abroad. It operates in parallel and frequent competition with the IRGC Intelligence Organisation, which in practice has superseded it in strategic prominence since 2009.
Organizational Profile
- Type: National Intelligence Agency (Civilian)
- Established: 1984 (post-revolution consolidation of SAVAK successor structures)
- Oversight: Supreme Leader (primary); President (administrative)
- Headquarters: Tehran
- Personnel: Estimated 15,000–30,000 (highly classified)
- Budget: Classified; estimated $1–2B annually
- Predecessor: SAVAK (pre-revolution; dissolved 1979), SAVAMA (transitional)
Primary Functions
| Domain | Function |
|---|---|
| Domestic Counterintelligence | Surveillance of political dissidents, journalists, reformists, and ethnic minorities; monitoring of universities and cultural institutions |
| Foreign Intelligence | Collection on Iranian diaspora communities; penetration of opposition groups abroad; liaison with aligned intelligence services |
| Covert Action | Assassination and harassment of dissidents and regime opponents in Europe, North America, and the Middle East |
| Counterespionage | Identifying and neutralising foreign intelligence networks operating in Iran — including the dismantlement of CIA HUMINT networks (2010–2012) |
| Cyber Operations | Operates threat actors assessed as APT34 (OilRig) and elements of Charming Kitten for espionage; attributed to Void Manticore coordination for destructive operations |
Key Operations
Dismantlement of CIA Networks (2010–2012) In one of the most damaging counterespionage successes against US intelligence in a generation, MOIS (in coordination with IRGC intelligence) systematically identified and neutralised the CIA’s human intelligence network in Iran. Through a combination of compromised covert communication systems and physical surveillance, MOIS identified dozens of assets — effectively blinding US HUMINT collection inside Iran for years. The operation exploited a flaw in CIA’s web-based communication platform that was subsequently also exploited by Chinese intelligence against CIA networks globally.
Dissent Suppression Abroad (Vienna, Paris, Istanbul) MOIS has conducted documented assassination plots and physical harassment campaigns against Iranian dissidents and opposition figures across Europe. The 2018 Vienna plot against an opposition rally (foiled by Belgian/French intelligence) and multiple plots in Germany have led to diplomatic expulsions and MOIS officer identifications by European services.
Coordination with Proxy Networks MOIS provides intelligence support and targeting data to Quds Force proxy operations — including Hamas and Hezbollah network security, counter-surveillance of Israeli operatives, and identification of potential human intelligence recruits in diaspora communities.
MOIS vs. IRGC Intelligence: The Internal Rivalry
A critical structural feature of Iranian intelligence is the parallel architecture between MOIS (civilian) and the IRGC Intelligence Organisation (military). Since the 2009 Green Movement, the IRGC Intelligence Organisation has increasingly encroached on domestic security functions, reducing MOIS to a subordinate role in internal repression. The IRGC’s deeper integration with the Supreme Leader’s office and its economic empire gives it structural advantages in inter-agency competition.
Under the Mojtaba Khamenei succession (2026), the IRGC Intelligence Organisation is assessed to have further consolidated its primacy, with MOIS increasingly relegated to diaspora surveillance and liaison functions.
Key Connections
- Islamic Republic of Iran
- Void Manticore — attributed cyber coordination
- Counterintelligence
- Advanced Persistent Threats
- Iranian Gray Zone Operations
- Strategic analysis on Iran conflict
Sources
- US Treasury OFAC designations — MOIS officials (2019–2024)
- Bellingcat — MOIS assassination network Europe investigations (2020–2023)
- CIA Inspector General Report references — Iran HUMINT failures (declassified summaries)
- Mandiant/Google TAG — Iranian APT ecosystem mapping and MOIS attribution