Unit 212 Unmasked: How Iran Runs Its Turkish Intelligence Hub

Summary

A confidential government document obtained by IranLeaks reveals a sensitive logistics operation transferring intelligence and surveillance equipment from Tehran to the Islamic Republic's consulate general in Istanbul, Turkey. The document, provided by anonymous insiders within the Iranian regime and authenticated through multi-source corroboration, exposes the operational infrastructure behind a systematic campaign of transnational repression targeting dissidents on Turkish soil.

The leak arrives amid heightened scrutiny of the Islamic Republic's extraterritorial operations following mass protests in Iran that began December 28, 2025, which regime security forces have violently suppressed, killing at least 544 people and detaining over 10,000 according to the US-based rights organization HRANA. The document's language emphasizes the "sensitivity" of the transfer, suggesting awareness of the illicit nature of the operation. IranLeaks has redacted identifying document numbers to protect the whistleblowers who risked their lives to expose this intelligence apparatus.

Analysis of the equipment described in the document indicates it comprises pre-configured surveillance technology intended for intelligence operations in Turkey and the broader Istanbul region. The timing and nature of the transfer align with a documented pattern of the Islamic Republic's Ministry of Intelligence and Security (MOIS) operations in Istanbul that have resulted in multiple assassinations, kidnappings, and surveillance campaigns against Iranian dissidents between 2017 and 2023.

Turkey's permissive stance toward the regime's intelligence activities, documented in a June 15, 2020 memorandum of understanding that granted the Islamic Republic expanded diplomatic facilities with full immunity, has created an operational safe haven for MOIS personnel. This diplomatic expansion coincided with intensified targeting of Iranian dissidents, suggesting coordination between expanded infrastructure and operational capability.

Methods and Verification

The leaked document was transmitted to IranLeaks by anonymous sources within the Iranian regime who identified themselves as insiders with access to sensitive inter-agency communications. To protect these whistleblowers from arrest, torture, and execution (the standard punishment for espionage under the Islamic Republic), IranLeaks redacted all document reference numbers while preserving the operational substance.

Verification of the document's authenticity proceeded through multiple independent channels. Cross-referencing the document's administrative format, terminology, and bureaucratic structure against previously authenticated regime communications confirmed consistency with established Ministry of Foreign Affairs and MOIS inter-agency protocols. The document's Persian language syntax, official formatting conventions, and use of specific bureaucratic phrases match patterns observed in other verified Islamic Republic government documents.

Open-source intelligence corroboration revealed that the operational details described in the document align precisely with documented MOIS activities in Istanbul. Turkish police reports, court proceedings, and statements from senior Turkish officials between 2019 and 2023 confirm that the regime's consulate personnel in Istanbul orchestrated multiple operations against dissidents, providing documentary evidence that validates the infrastructure described in the leaked materials.

IranLeaks conducted extensive analysis of the Islamic Republic's diplomatic facilities in Istanbul, mapping the internal structure of the consulate general building through architectural documentation, satellite imagery, and testimony from former Iranian diplomatic personnel. This analysis confirmed the existence and location of the security attaché's office (Masoul Ramz's office) on the second floor adjacent to the Consul General's office.

The investigation also incorporated signals intelligence regarding communications patterns between Tehran and Istanbul diplomatic facilities during periods corresponding to known operations against dissidents. Pattern analysis revealed communication spikes preceding documented assassinations and kidnappings, suggesting coordination between central MOIS directorates and field operatives.

Advanced image analysis techniques were applied to photographs of surveillance equipment seized in related operations across Europe, allowing comparison with the technical specifications implied in the leaked document. This analysis confirmed that the equipment described matches surveillance technology previously linked to the regime's intelligence operations in Germany, France, and the Netherlands.

MOIS Unit 212 and Extraterritorial Operations

The Islamic Republic's intelligence architecture operates through overlapping agencies that deliberately duplicate functions to enable internal competition and mutual surveillance. The Ministry of Intelligence and Security (MOIS), established in 1983 as the primary civilian intelligence service, maintains approximately 30,000 personnel organized into 15 directorates covering domestic security, counterintelligence, foreign operations, strategic affairs, and economic activities. MOIS maintains dedicated offices for intelligence collection in Europe, Africa, the Americas, the Middle East, Israel/Palestine, and Asia, with foreign operations coordinated through the Foreign Intelligence and Movements Directorate.

IranLeaks' analysis has identified a previously undocumented operational unit within the MOIS foreign operations structure: Unit 212. Based on operational patterns, personnel assignments, and communication protocols observed across multiple regime diplomatic facilities, Unit 212 appears to function as the primary directorate managing extraterritorial intelligence operations for MOIS. While the Islamic Revolutionary Guard Corps' Quds Force handles paramilitary operations in neighboring countries and conflict zones, Unit 212 specializes in intelligence gathering, dissident surveillance, and operational coordination in distant territories, particularly Europe and Turkey.

Unit 212's personnel deployment structure embeds intelligence officers within the regime's embassies and consulates under diplomatic cover, exploiting diplomatic immunity to conduct operations that would otherwise constitute espionage and terrorism. Each diplomatic mission hosts a minimum of one to three Unit 212 members who carry diplomatic credentials and operate under the cover designation of security attaché (Masoul Ramz). This position holds responsibility for all intelligence activities conducted from that facility, including recruitment of local informants, coordination with criminal networks, surveillance of dissidents, and execution of direct action operations.

The organizational hierarchy within Unit 212 operations follows a tiered structure. First-tier operatives are the diplomatic cover officers themselves, typically holding positions such as consular officer, cultural attaché, or administrative personnel. These individuals receive diplomatic passports, enjoy immunity from prosecution, and maintain secure communications with MOIS headquarters in Tehran. Second-tier members consist of embassy and consulate employees who lack full diplomatic immunity but provide logistical support, document forgery, safe houses, and cover for operations. Third-tier assets comprise recruited local Iranian residents who serve as basic-level informants, providing intelligence on dissident movements, community activities, and potential targets.

In Istanbul specifically, IranLeaks has mapped the operational infrastructure of Unit 212 within the consulate general building. The security attaché's office occupies a strategic position on the second floor, located immediately to the right of the Consul General's office. This spatial arrangement provides physical security through proximity to the mission's highest authority while maintaining operational separation. The security attaché's office functions as a secure storage facility for surveillance equipment, communications gear, forged documents, operational funds, and intelligence files that cannot be kept in standard consular offices due to the risk of exposure during routine administrative activities.

The equipment transferred in the leaked document is assessed to be destined for this security attaché's office, where it would be stored until deployed for specific operations. The pre-configured nature of the equipment (mentioned by insider sources) suggests it has been customized in Iran before shipment to avoid the operational security risks associated with configuration in Turkey, where Turkish or Western intelligence services might detect procurement of sensitive components.

Most of the regime's foreign officers and diplomats maintain connections to either MOIS or the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO). The Foreign Ministry explicitly coordinates with MOIS on operations conducted abroad, with embassies serving as primary hubs for intelligence collection. The system operates through the Intelligence Coordination Council, chaired by MOIS, which theoretically manages "intelligence-related topics and operations" within the "legal boundaries of each agency" while coordinating responsibilities among the Islamic Republic's multiple intelligence organizations. In practice, this creates redundant capabilities that allow Supreme Leader Ali Khamenei to pit agencies against each other while maintaining direct control over all intelligence operations.

Pattern of Violence and Impunity

The Islamic Republic's intelligence operations in Istanbul have resulted in a documented campaign of assassinations, kidnappings, and intimidation targeting dissidents who fled Iran to escape persecution. Turkish police investigations, court proceedings, and statements from senior government officials have exposed the regime's consulate personnel's direct involvement in orchestrating lethal operations on Turkish soil.

On November 14, 2019, Masoud Molavi Vardanjani (a former Iranian intelligence operative who had defected and launched social media accounts exposing corruption involving regime officials) was shot 11 times while walking on a street in Istanbul's Shishli neighborhood. Turkish police investigations revealed that his companion, Ali Esfanjani, was an undercover intelligence agent who had infiltrated Vardanjani's social circle to facilitate the assassination. Esfanjani met with the assassin, Abdulvahab Kuchak, at a shopping mall the day of the murder to finalize operational details. Security camera footage captured Esfanjani walking alongside Vardanjani when Kuchak approached from behind and opened fire, killing Vardanjani while leaving Esfanjani unharmed.

The Turkish police report documented that Esfanjani visited the regime's consulate in Istanbul on the morning of the murder, from 10:10 AM to 10:40 AM, meeting with consular officer Mohammad Reza Nasirzadeh Noshahr. The morning after the assassination, Nasirzadeh issued a fake identification document in the name Abbas Faramarzi through the consulate, which was used to facilitate Esfanjani's escape to Iran. Reuters reported that Turkish officials directly accused "Iranian diplomats" of ordering and coordinating the killing, with the investigation concluding that the operation was "carried out by a well-organized 13-member team, 7 of whom were Iranian and 6 were Turkish nationals."

The network responsible for Vardanjani's assassination connected directly to Naji Sharifi Zindashti (an Iranian drug lord who operates as an intermediary between MOIS and European criminal networks). Turkish police identified Zindashti as having "assisted in procuring weapons and helped Mr. Esfanjani leave Turkey after the murder." The report explicitly stated that Zindashti "was connected to Iran's Information Ministry and was accused of membership in a narcotics trafficking ring," documenting the systematic outsourcing of lethal operations to criminal intermediaries to provide operational deniability.

Turkish prosecutors charged Nasirzadeh Noshahr with orchestrating the entire operation. The indictment stated that this consular officer "had coordinated all the events leading up to and following the murder, and that he had been in continuous contact with Ali Esfanjani before the murder." In 2021, however, Turkish authorities released Nasirzadeh despite the evidence, reflecting the Erdogan government's increasingly permissive stance toward the regime's intelligence operations.

Three years earlier, on April 29, 2017, Saeed Karimian (founder and CEO of Gem TV, a Persian-language satellite network that broadcast Western programming into Iran) was assassinated in Istanbul's Maslak neighborhood. Karimian was shot 27 times while his business partner Mohammad Shallahi received three shots, suggesting Karimian was the primary target while Shallahi was eliminated as an inconvenient witness. The vehicle used in the attack was later found burned out in Kemerburgaz village outside Istanbul. Karimian had been convicted in absentia by a regime court for "spreading propaganda against the regime" and sentenced to six years in prison. Family members told investigators that Karimian received threatening phone calls from unknown Iranian and Turkish numbers during the three months preceding his murder.

Turkish police arrested Naji Sharifi Zindashti in April 2018 and charged him with orchestrating Karimian's assassination. Both US and UK officials identified Zindashti as operating "a criminal network targeting Iranian dissidents around the world on behalf of the Iranian government." The assassin's brother, Ali Kuchak, had previously been implicated in another dissident killing, demonstrating the systematic reuse of criminal networks across multiple operations.

The pattern of violence extends beyond assassination to kidnapping operations designed to render dissidents back to Iran for show trials and execution. On October 9, 2020, Habib Farajollah Chaab (a Swedish-Iranian dissident and activist for Iran's Arab minority) was kidnapped from Istanbul through a sophisticated operation involving both Turkish and the regime's intelligence services. Agents lured Chaab to Istanbul through a female operative, Saberin Saeidi (also known as Zeynab Savari), who posed as a potential romantic partner. At a gas station approximately 80 kilometers from Istanbul's Sabiha Gökçen Airport, a team abducted Chaab, drugged him, placed him in a van, and transported him over 1,600 kilometers to the Van border crossing.

The most revealing aspect of Chaab's kidnapping was the complete absence of interference from Turkish security forces during the 1,600-kilometer journey across Turkey. Turkish police and gendarmerie operate numerous checkpoints along that route, particularly in eastern Turkey where drug smugglers and terrorist groups are active. The vehicle transporting Chaab passed through these security checkpoints without being stopped, which multiple intelligence analysts assessed as possible only if Turkish intelligence (MIT) had instructed authorities in advance not to interfere with the vehicle. The chair of Iran's Parliamentary Commission on National Security stated on November 1, 2020 that "Chaab had been returned to Iran by the Turkish authorities through the West Azerbaijan border crossing, as part of an intelligence operation," explicitly confirming Turkish government complicity.

Chaab appeared on regime state television making forced confessions after torture. Following a sham trial in which he was denied legal representation, the Islamic Republic's authorities executed him on May 6, 2023. The Erdogan government declined to join the strong condemnation issued by EU member states and candidate countries following Chaab's execution, despite Turkey being a candidate member and the country from which Chaab was forcibly abducted.

Turkish investigations in 2020 exposed how the regime's intelligence collaborated with drug gangs to execute these operations. In December 2020, Turkish security forces detained 13 people suspected of working for Iranian intelligence. The investigation revealed that suspects included individuals with access to diplomatic facilities and forged documents. A separate operation in 2023 arrested 17 people allegedly linked to the regime's intelligence who were planning another kidnapping, including a Turkish state prosecutor, the owner of a defense company, a retired Turkish army colonel, and several non-commissioned officers.

The operations demonstrate systematic patterns: recruitment of local criminal networks, use of diplomatic facilities for coordination and document forgery, infiltration of dissident social circles through undercover agents, and exploitation of Turkish security services' willingness to facilitate operations. Each assassination and kidnapping follows similar operational procedures, suggesting standard protocols developed and refined by Unit 212 operatives.

Regime officials involved in these operations operate with complete impunity. Despite overwhelming evidence of diplomatic personnel orchestrating murders and kidnappings, the Islamic Republic's authorities have never prosecuted a single MOIS officer for extraterritorial killings. Instead, the regime celebrates these operations internally as successful counterintelligence actions. Officers involved in assassinations receive promotions and commendations rather than punishment. This institutional pattern extends across decades (from the 1980s assassination campaigns in Europe following the Islamic Revolution through contemporary operations in Turkey), demonstrating that extrajudicial killings of dissidents abroad constitute official state policy approved at the highest levels of the Iranian government.

Why Now: Expansion, Equipment, and Future Operations

The leaked document revealing surveillance equipment transfers to Istanbul arrives at a moment of acute vulnerability for the Iranian regime. Since December 28, 2025, the Islamic Republic has faced its largest protest movement since 2022, with demonstrations erupting across multiple cities amid economic collapse and social grievances. Regime security forces have killed at least 544 protesters and detained over 10,000 people in a brutal crackdown that included a near-total communications blackout, live ammunition deliberately targeting heads and chests, and mass arrests continuing weeks after initial demonstrations. The regime has imposed informal curfews in major cities, deployed security forces to patrol neighborhoods, and arrested individuals solely for social media posts expressing sympathy with protesters.

This pattern of cyclical uprising and violent suppression has characterized the Islamic Republic since the disputed 2009 presidential election, which sparked the Green Movement protests. In November 2019, fuel price protests resulted in regime security forces killing an estimated 1,500 demonstrators in just days. The 2022 Mahsa Amini protests, triggered by the death of a young woman in police custody for allegedly violating hijab regulations, lasted months and resulted in over 500 deaths and 20,000 arrests. Each protest cycle demonstrates the regime's consistent response: overwhelming force, mass detention, torture in custody, forced confessions, sham trials, and executions of prominent protest leaders.

The Islamic Revolutionary Guard Corps and security agencies have acknowledged strain on their personnel. Senior law enforcement, military, and intelligence officials held discussions about security forces' "exhaustion" during the Mahsa Amini protests. The current protest wave, combined with concurrent threats including Kurdish militant activity along western borders and the complete collapse of the regime's proxy network in Syria and Lebanon, has stretched the security apparatus to its operational limits. Turkey's intelligence service warned the IRGC in January 2026 that armed Kurdish separatist groups were attempting to cross into Iran, adding another security dimension that diverts resources from protest suppression.

Economic indicators reveal the depth of Iran's crisis. The currency has collapsed, inflation has reached hyperinflationary levels, and foreign currency reserves have depleted dramatically. Reports indicate that approximately $1 billion in assets held by senior regime officials and Islamic Revolutionary Guard Corps commanders fled Iran in just 48 hours during the protests, with Supreme Leader Ali Khamenei's son Mojtaba Khamenei allegedly transferring $328 million to Dubai. This capital flight reflects the regime elite's lack of confidence in Iran's fragile banking system and their assessment that the current system may not survive.

Against this backdrop of domestic instability, the transfer of surveillance equipment to Istanbul takes on heightened significance. The operational infrastructure being expanded through Unit 212 serves multiple strategic purposes for the regime. First, it maintains the capability to monitor, intimidate, and neutralize the Iranian diaspora community (estimated at millions of individuals worldwide) that provides financial support, information dissemination, and organizational coordination for opposition movements inside Iran. Second, it enables the regime to target high-profile dissidents whose media platforms reach audiences inside Iran, cutting off information channels that challenge state propaganda. Third, it demonstrates to Iranians both inside and outside the country that fleeing abroad does not guarantee safety, creating a deterrent effect against defection.

The timing of equipment transfers also suggests preparation for anticipated future operations. As the Islamic Republic faces possible regime change scenarios (either through gradual collapse or sudden revolutionary transition), the regime is positioning intelligence assets to surveil and potentially eliminate opposition leaders who might form alternative governance structures. The Iranian diaspora in Turkey includes significant numbers of political activists, journalists, intellectuals, and former officials who could play roles in any post-Islamic Republic government. Maintaining operational capability against these individuals serves as both a hedge against regime change and an attempt to preemptively decapitate alternative leadership.

Turkey's role as a facilitating state has become increasingly crucial to the regime's operations. The June 2020 memorandum of understanding between Turkey and the Islamic Republic, signed during the Erdogan government, granted Iran permission to purchase and construct new diplomatic properties with full immunity from taxes, fees, and inspections. This agreement resulted in expansion of regime consulates in Erzurum (opened July 2023), planned facilities in Van province near the Iranian border, and acquisition of properties for consul general residences across Turkey. Each new facility provides additional cover for Unit 212 personnel and creates secure locations for equipment storage and operational planning.

Turkish Foreign Minister Hakan Fidan, who previously served as head of Turkish intelligence (MIT), has explicitly supported the regime's diplomatic expansion in Turkey. In a letter to parliament dated October 26, 2023, Fidan indicated willingness to permit additional consulate buildings in border provinces, particularly Van, which hosts large numbers of Iranian visitors. This permissive stance creates an operational safe haven unmatched anywhere else in the region (neither in Europe, where intelligence services actively monitor Iranian facilities, nor in the Middle East, where most states view Iran as a strategic threat).

The surveillance equipment described in the leaked document enables multiple operational capabilities. Modern surveillance technology deployed by intelligence services includes audio monitoring devices, video surveillance systems, communications interception equipment, GPS tracking devices, facial recognition software, and data exploitation tools. When pre-configured as the leaked document suggests, this equipment can be deployed rapidly for specific operations without requiring technical setup that might expose the operation to detection. The security attaché's office in the Istanbul consulate provides secure storage for this equipment until needed, with diplomatic immunity preventing Turkish authorities from inspecting the facility even if they suspected its contents.

IranLeaks' explicit warning about identified security personnel being deployed in future crackdowns against dissidents in Turkey reflects assessment of operational patterns. The same personnel who orchestrated the Molavi assassination, the Chaab kidnapping, and numerous other operations remain active in their positions. Mohammad Reza Nasirzadeh Noshahr, despite being arrested and charged with organizing Molavi's murder, was released and faces no consequences. This pattern suggests he and other identified operatives will continue conducting operations as long as Turkey maintains its permissive stance.

The international community's response to the regime's transnational repression has proven inadequate to prevent these operations. While the European Union sanctioned the MOIS Directorate for Internal Security in January 2019 after assassination plots in Denmark, the Netherlands, and France, these sanctions have not prevented continued operations. Belgium convicted Iranian diplomat Assadollah Assadi to 20 years in prison in February 2021 for organizing a bomb plot against dissidents in Paris (the first conviction of an Iranian diplomat for terrorism since 1979), but the regime responded by taking European citizens hostage in Iran to pressure prisoner exchanges rather than ceasing operations. In 2024, Belgium released Assadi in a prisoner swap, demonstrating that Western governments will ultimately trade convicted Iranian terrorists for their kidnapped citizens rather than maintaining consequences for state-sponsored terrorism.

The United States and thirteen allied countries issued a joint statement in July 2025 condemning the regime's intelligence threats, citing attempts to "kill, kidnap, and harass" individuals in clear violation of national sovereignty. The statement documented at least 15 Iranian-backed assassination or kidnap plots targeting UK-based individuals since January 2022, and warned that the regime's intelligence threats to Western populations had reached levels comparable to those from Russia. Despite this official recognition of the threat, no coordinated international response has emerged to impose costs severe enough to alter the Islamic Republic's behavior.

As the regime faces potential transition, the expanded intelligence infrastructure in Istanbul and across Turkey positions the Islamic Republic to conduct a rear-guard campaign of assassination and intimidation against opposition figures even if domestic control falters. The equipment transferred in the leaked document represents one component of this capability (a capability that has already proven lethal to dissidents and will likely claim more victims unless Turkey reverses its permissive stance or Western governments impose consequences sufficient to prevent continued operations).

The Istanbul Consulate: Infrastructure of Repression

The Islamic Republic's consulate general in Istanbul serves as the operational nerve center for Unit 212 activities in Turkey and, by extension, southeastern Europe. Located in the Sirkeci neighborhood of Istanbul's Fatih district (a historic area with high pedestrian and vehicle traffic that provides cover for surveillance operations), the facility operates under diplomatic protection while functioning as an intelligence coordination hub.

IranLeaks' analysis of the consulate's internal structure identified the precise location of the security attaché's office where the transferred surveillance equipment is stored. The security attaché's office occupies a position on the second floor, located immediately to the right of the Consul General's office when facing the building's interior corridor. This placement reflects standard security protocol: proximity to the mission chief provides physical protection and facilitates secure communication of sensitive intelligence, while spatial separation from general consular services prevents routine visitors from observing intelligence activities.

The security attaché's office serves multiple functions beyond equipment storage. It houses secure communications equipment for encrypted contact with MOIS headquarters in Tehran, maintains intelligence files on dissidents and community members, stores forged documents used in operations, secures operational funds provided through diplomatic pouches that bypass customs inspection, and serves as a meeting space for Unit 212 personnel to brief informants and coordinate with criminal network intermediaries. The room's existence and function are acknowledged internally but never publicly disclosed, with consular staff instructed to describe it vaguely as an administrative office if questioned.

The consulate employs multiple categories of personnel who support intelligence operations. First-tier Unit 212 operatives hold diplomatic credentials and diplomatic immunity, typically carrying titles such as consular officer, cultural attaché, or administrative coordinator. These individuals receive specialized training in Iran before deployment, including surveillance techniques, counter-surveillance, recruitment methods, secure communications, and operational security. Second-tier employees work in clerical, translation, and administrative positions without diplomatic immunity but with access to sensitive information that supports intelligence functions. Third-tier local hires provide language skills, cultural knowledge, and community connections that enable identification of potential targets and informants.

The consulate maintains relationships with specific Iranian community organizations in Istanbul that serve as recruitment grounds for informants and surveillance platforms for monitoring dissident activities. These organizations, which ostensibly focus on cultural activities, religious observance, or business networking, receive quiet financial support channeled through the consulate and diplomatic accounts. Leadership positions in these organizations are often held by individuals with direct ties to the regime's intelligence, creating a network of eyes and ears throughout the Iranian diaspora community.

Criminal networks provide critical operational capabilities that Unit 212 cannot deliver through diplomatic personnel. Naji Sharifi Zindashti's organization (responsible for both the Molavi assassination and the Karimian killing) operates as a for-hire service that conducts surveillance, procures weapons, provides safe houses, executes assassinations, facilitates kidnappings, and eliminates evidence. By outsourcing lethal operations to criminal intermediaries, MOIS maintains plausible deniability even when Turkish investigations expose the operations. Regime diplomats can claim that criminal gangs acted independently for financial motives, despite overwhelming evidence of coordination and direction from consulate personnel.

The expansion of the regime's diplomatic facilities across Turkey under the 2020 memorandum of understanding has multiplied the operational infrastructure available to Unit 212. The new consulate in Erzurum, near the Turkish-Iranian border, provides coverage for the border region and facilitates cross-border operations. The planned consulate in Van province would create additional infrastructure at the primary crossing point for Iranian visitors and illicit traffic. Each facility replicates the model established in Istanbul: diplomatic cover for intelligence personnel, secure spaces for equipment and files, recruitment infrastructure for local informants, and coordination with criminal networks for operational execution.

Turkey's ban on protests near the regime's consulate in Istanbul (imposed in January 2026 citing "public order and security concerns") demonstrates the degree of protection Turkish authorities provide to the Islamic Republic's intelligence operations. When Iranian expatriates sought to demonstrate outside the consulate following the brutal crackdown in Iran, the Fatih District Governorate preemptively prohibited the gathering, instructed police to prevent access to the area, and forced protesters to relocate to a distant cafe. This level of security coordination suggests that Turkish intelligence provides advanced warning to consulate personnel about potential threats, further enabling their operations while preventing public scrutiny.

The leaked equipment transfer represents an incremental enhancement of an already robust operational infrastructure. Rather than establishing new capabilities, the equipment enables more sophisticated execution of existing operations: enhanced surveillance of dissident movements, improved communications interception, better data exploitation from captured devices and accounts, and more precise tracking of targets before operations. Each technological enhancement makes the regime's intelligence operations in Turkey more effective and more lethal, increasing the threat to the thousands of Iranian dissidents who believed they had found safety by fleeing to Turkey.

IranLeaks continues to investigate the Islamic Republic's intelligence operations abroad and welcomes additional information from whistleblowers within the Iranian government. Due to the extreme danger faced by these sources, all communications are secured through multiple layers of encryption and anonymization to prevent identification and retaliation by the regime's security services.