From Unit 840 to Unit 600: Is Iran Rebuilding Its Intelligence Network?

Iran’s decision to rename Quds Force secret unit 840 as Unit 600 and appoint a new commander raises questions about Tehran’s ability to rebuild its overseas operations network after a series of intelligence breaches and assassinations exposed its leadership structure and the identities of several operatives.

The appointment of Mojtaba Hagh-Lesan, a former intelligence official within the unit, also raises questions about whether relying on insiders can address the network’s security failures and whether redistributing responsibilities across continents signals an effort to restore its global reach or merely a structural reshuffle that leaves accumulated vulnerabilities unresolved.

Rebuilding the Leadership

On October 14, 2026, the opposition outlet Iran International reported that Esmail Qaani, commander of Iran’s Islamic Revolutionary Guard Corps (IRGC) Quds Force, had appointed Mojtaba Hagh-Lesan as the new head of Unit 840, alongside a decision to rename it Unit 600. 

The changes followed the exposure of the unit’s organizational structure and the identities of several of its officials.

The appointment came after the unit’s previous commander, Yazdan Mir, known as Haj Asghar Bagheri, was killed in an Israeli attack on April 6. 

The unit went without a permanent commander for about six months before Hagh-Lesan, who had previously held intelligence responsibilities within it, was selected.

Hagh-Lesan, 64, had served as head of the unit’s intelligence department. In 1999 and 2004, he also published two articles in Strategic Studies, a journal affiliated with the Strategic Research Center of Iran’s Expediency Discernment Council. 

The articles were titled ‘Regional Turmoil and Internal Security and American Intervention in the Bosnian Crisis’.

According to two sources close to the Quds Force who spoke to Iran International, appointing figures who previously held positions within the unit reflects a leadership crisis following the targeting of senior IRGC commanders. The move has also fueled doubts among Quds Force personnel about the organization’s effectiveness.

Hagh-Lesan’s appointment therefore presents a central challenge: whether he can restore the unit’s operational effectiveness. His previous experience gives him insight into its structure and methods, but it also raises questions about whether he can overcome the security breaches that occurred while its current leadership was serving within the organization.

Based on the published reports, the name change does not appear to have been accompanied by any announced shift in the unit’s mission. 

Sources said it would retain its previous responsibilities for covert operations against opponents of the Iranian government, dissident journalists, and Israeli targets around the world.

The available information suggests that the restructuring is intended to address the fallout from the unit’s exposure and the loss of its leadership. 

However, it remains unclear whether the changes include fundamental revisions to its operational methods or intelligence security systems, leaving its ability to prevent further breaches uncertain.

A Global Network

The leadership chart reveals a new division of responsibilities within Unit 600. Mohammad Reza Ansari has been appointed deputy commander and head of the Israeli Occupation portfolio, while Mohsen Borhani has been assigned to lead special operations in the United States and Europe.

Morteza Babaei is responsible for special operations in the Middle East and Africa, while Javad Sharafaei oversees the Asia division. This geographic structure covers regions previously linked to assassination attempts and attacks attributed to the unit, according to media reports and published intelligence information.

The chart identifies Meysam Sahraei as one of the operatives responsible for carrying out attacks in Africa and India, alongside Gholam Hossein Hosseini and Mohammad Hosseinipour, whose names were cited among the unit’s prominent operatives.

The continued presence of specialized divisions covering multiple geographic regions suggests that the unit has retained an international structure despite the blows it has suffered. 

However, this does not provide conclusive evidence that it has restored its operational capabilities or overcome the security constraints imposed by previous exposures and investigations.

The unit was established in the first half of the 2010s on the orders of Qassem Soleimani, the former commander of the Quds Force, after splitting from Unit 400, which specializes in covert operations and has close ties to Lebanon’s Hezbollah.

A photograph of former Unit 840 commander Yazdan Mir alongside Hassan Nasrallah, the late Hezbollah secretary-general, and IRGC commanders Mohammad Reza Zahedi and Mohammad Hossein-Zadeh Hejazi illustrates the relationships surrounding the unit’s leadership during its earlier period of activity.

Media reports have linked the unit to operations in Syria, Turkiye, Europe, and Africa. On May 26, 2022, TRT reported that its activities extended across Africa and approximately 40 countries, highlighting the reported breadth of its operations.

This global footprint raises questions about whether the new leadership can maintain the unit’s worldwide reach. 

The redistribution of responsibilities comes after several of its networks were exposed, while published information offers few clear indications of the resources and capabilities available to reactivate them.

A Series of Intelligence Breaches

Unit 840 has suffered a series of intelligence setbacks in recent years, as Western and Israeli Occupation security agencies uncovered locations and operatives linked to it. 

The breaches have increasingly complicated its covert operations and raised questions about the security of its organizational structure.

About six years ago, an intelligence agency from a Western country identified and targeted a major Unit 840 facility in Damascus, the Syrian capital. Israeli reports indicated that the unit’s activities had been detected as early as May 2019, before more information about its operations became public.

In May 2022, “Israel’s” Mossad released a video of the interrogation of Mansour Rasouli, an Iranian smuggler from Urmia. 

In the recording, Rasouli said he had been tasked with assassinating an Israeli citizen in Turkiye, a senior U.S. general in Germany, and a journalist in France.

Two weeks later, Hassan Sayyad Khodaei, a senior unit official, was killed in Tehran. The New York Times later quoted an intelligence official as saying that “Israel” had informed the United States it was responsible for his killing. The incident showed that targeting operations had reached senior figures within Iran itself.

These developments were followed by the dismissal of Hossein Taeb, then head of the IRGC Intelligence Organization. But the breaches continued. 

A month later, the Mossad released a recording of the interrogation of Yadollah Khedmati, a commander in the IRGC’s logistics and support division, near the Iranian capital.

The setbacks also included the disruption of operations abroad. The latest disclosed case involved a plot in April to target the Baku-Tbilisi-Ceyhan oil pipeline, the Israeli Embassy, and Jewish centers in Azerbaijan. A joint statement by Israeli security agencies said suspects had been arrested.

The United States, Britain, and the European Union have also imposed sanctions on the unit and some of its officials, including Mohammad Reza Ansari, over accusations that they helped plan the assassinations of U.S. officials, journalists, and Iranian dissidents abroad. The sanctions added political and security pressure to the unit’s organizational problems.

These developments leave the new leadership facing a challenge that goes beyond replacing personnel and reshuffling positions. Its central task is to address the reasons its networks and senior figures were exposed, particularly as the available information reveals no new security measures that would prevent similar breaches from recurring.

Overseas Networks

In recent years, Unit 840 has been linked to assassination plots targeting U.S. and Israeli officials and Iranian dissidents. Security investigations have also uncovered networks linked to the IRGC that relied on members of organized crime groups to carry out operations abroad.

In August 2022, the U.S. Department of Justice charged Shahram Poursafi, an IRGC operative, with plotting to assassinate former U.S. National Security Adviser John Bolton in exchange for $300,000. Former Secretary of State Mike Pompeo was also named among the potential targets.

In Britain, investigations uncovered a plot codenamed Wedding to assassinate Iran International journalists Fardad Farahzad and Sima Sabet for £200,000. The plot was foiled after investigators discovered that one of the network’s contacts was a double agent.

In Germany, Ramin Yektaparast, a member of the Hells Angels, was linked to attacks targeting two Jewish synagogues and a failed attempt to assassinate Iranian rapper Shahin Najafi. Yektaparast was later killed in Tehran on April 28, 2024, amid conflicting accounts of the circumstances surrounding the incident.

In Sweden and Denmark, reports indicated that the Quds Force had enlisted Rawa Majid, leader of the Foxtrot criminal network, to carry out attacks against targets linked to “Israel” before he moved to Iran. The Iranian Embassy in London denied any connection between Tehran and the network.

The unit’s reactivation comes amid statements by Iranian officials invoking revenge and vengeance for the bloodshed following the killing of former Supreme Leader Ali Khamenei. 

U.S. and Israeli officials have also been named as potential targets, according to information reported by Iran International.

Meanwhile, Iranian authorities have launched a system called ‘Elaj’ to gather information on opponents living abroad. 

The IRGC-affiliated Fars News Agency has also called on the public to provide information about them. These efforts coincide with the restructuring of the organization responsible for covert operations overseas.

Despite the name and leadership changes, Unit 600’s effectiveness will ultimately depend on the results of the restructuring. 

Questions remain over whether it can rebuild its global networks and overcome its security breaches or whether sustained pressure will force it to scale back its activities and reprioritize its operations.