|
2026-01-15 Cyber
|
|
Locusts with Starlink: Iranian hackers crack Mossad's largest network
|
Direct Translation via Google Translate. Edited
by Leonid Tsukanov
[REGNUM] While mass unrest rages in the streets and squares of Iran, an equally active struggle is unfolding on the “invisible front.”
Recently, official Tehran announced that security forces, with the support of patriotic hackers, had managed to uncover a large-scale network of more than 600 agents and loyalists of the Israeli intelligence agency Mossad, which coordinated riots and pogroms, and exposed the main figure of this structure.
And although the Iranians significantly embellished the results in their official reports, they did achieve some successes in the fight against the underground, including the timely identification of a hidden threat.
AGAINST THE "FIFTH COLUMN"
The hunt for the organizers of anti-government protests in Iran began almost immediately, following a pattern honed during previous protests.
"Arrest the Usual Suspects"
Although the presidential office initially severely restricted the actions of the security forces, fearing further escalation, Masoud Pezeshkian's government even attempted to negotiate a compromise by replacing the leadership of the national central bank, which had failed to address catastrophic inflation, in advance. However, this failed to stop the violence.
However, the decision naturally provoked discontent among the "hawks," who proposed deploying the army to problem cities and jamming the country's internet.
Nevertheless, the ruling reformists maintained a dialogue with the streets for some time, limiting themselves to a minimal number of arrests and violent actions. However, after the protesters suddenly acquired firearms and street activists suddenly showed a penchant for smashing mosques and desecrating Shia holy sites, the soft-liners ran out of arguments.
The security forces were given carte blanche and immediately put it into effect.
In total, since the beginning of the protests, according to Iranian police reports, more than two thousand "agents and accomplices" of Israeli intelligence have been detained.
This category included both simple street provocateurs (such as student anarchists) and underground fighters from banned ethno-separatist parties who attempted an unsuccessful breakthrough across the Iran-Iraq border and seized power in the border province of Ilam.
Also targeted were the "communications workers"—operators of the Starlink systems (mostly students), which billionaire Elon Musk had previously donated to protesters to prevent Tehran from "silencing the voice of freedom." Much of this equipment was subsequently confiscated by the authorities and donated to the army.
THE PUPPETEER OF PROTESTS
However, Iranian security officials consider the biggest victory so far to be the "exposure" of an Israeli spy network that masqueraded as protesters, provoked pogroms, and clashed with security forces.
The "network" included over 600 people, which can be considered a new record—previously, the largest Israeli influence structure uncovered in Iran after the 12-day war in June 2025 barely exceeded 90 people. The record-breaking network was jokingly dubbed "Locusts" for its size and its tendency to operate in agricultural areas.
The active phase of the exposure began in the first half of January 2026, when the Iranian hacker group "Handala," which is linked to the national intelligence services, published the first part of an archive containing personal data of "Locust" members, including photographs, documents, and fragments of correspondence.
The network's leader, Mehrad Rahimi, was also de-anonymized. The hackers described him as a senior Mossad operative in Iran and the "chief coordinator" of the protests.
Based on the fragmentary data currently available in the public domain, it can be established that Rahimi was of Iranian origin and came from a prosperous family close to the Shah's court.
After the 1979 revolution, his family fled abroad, losing a significant portion of their capital. Rahimi himself eventually ended up in Israel, where he was spotted by Mossad handlers.
It's unclear how long Rahimi remained in Iran. It's also unclear where exactly he entered the country from or under what cover. Iranian intelligence agencies are remaining tight-lipped on the matter, although they hint that the agent may have been posing as a "specialist from a country friendly to Iran."
The "Locust" network, created with Rahimi's participation, according to available data, underwent its baptism of fire during the 12-day war—but was then subservient to other major networks, and therefore remained under the radar of security forces after the end of hostilities.
But at the end of December 2025, when protests swept Iran, Rahimi’s group went into full swing.
In particular, a separate content center was created within the network, which promoted defeatist materials on social networks (up to several thousand materials per day), spread rumors about the army and police going over to the side of the rebels, and also created AI videos of monarchists, led by Shahzade Reza Pahlavi, ceremoniously entering Iran.
Some of the fakes were so well made that they made the front pages of foreign publications.
It is noteworthy that a significant part of the network worked remotely (responsible for the media "warming up" of the protests) from other countries; no more than a quarter of the agents, personally selected by Rahimi, operated "on the ground."
It's also interesting that when choosing "street fighters," the head of Sarancha tended to rely on Kurds and Lurs, who, in addition to their loyalty to the new leadership, had their own ideological scores to settle with the republic. This allowed him to minimize the "foreign influence" on the unrest and give it a veneer of ethnic strife.
A random check of the hacked databases confirms that they include many "nominal Iranians," who were either ethnic Persians who had never lived in the republic or representatives of ethnic minorities.
Some members of the Locust served in the Israeli military and worked for companies founded by people from the Israeli intelligence services—and not all of them managed to remove this information from their biographies before deanonymization.
THE KEY TO THE LOCUST
The question remains open as to how exactly Iranian intelligence agencies managed to shut down Sarancha.
The hackers themselves claim to have hacked the Starlinks donated by Musk and, through their internal infrastructure, penetrated the very heart of the network. However, this appears to be a tall tale aimed at an internal audience.
It's far more likely that security forces managed to hack Rahimi's phone, which he used for official duties, and access his chats and internal memory. Furthermore, Handala has previously bypassed digital security in attacks on leading Israeli politicians, including former Prime Minister Naftali Bennett.
True, even in the more streamlined version, there are still gaps—for example, the question remains unanswered: how exactly did the hackers realize they were dealing with the leader of the "Locust" group?
Especially considering that before the events described, Rahimi led a fairly calm lifestyle and preferred to work quietly in Iran, without risky operations.
It was likely a coincidence that helped Iranian security forces track down the "puppeteer"—his contact information could well have been discovered during operations to hack monarchist websites.
To this end, "Locust" prepared a considerable amount of material and maintained contacts with émigré circles. Even if Rahimi himself didn't interact with them, one of the many "remote" journalists could have been careless.
THE RETURN OF QAJAR
At the same time, despite statements about identifying the “main organizer” of the protests, the Iranian authorities are in no hurry to show him to the public.
This is very different from the usual behavior of official Tehran, which does not like to delay such public actions for long and, as a rule, discloses in detail the biography of each detained spy.
There could be two possible explanations for this.
First, Rahimi managed to leave Iran before investigators had irrefutable evidence of his ties to Israel and the émigré underground.
This appears to be true, as the released video evidence (such as CCTV footage from near Rahimi's home) is mostly dated to early January 2026. Iranian hackers have not yet provided more recent material about him.
There's also an alternative theory: the operation against the "Locust" was a distraction, and the real work of Iranian intelligence is proceeding along a completely different track. In this case, such obvious attention to Rahimi is necessary to lull the primary target into a false sense of security.
It doesn't take long to find a candidate for the role of a new potential threat.
In recent days, an aggressive campaign has begun on international social media to promote Qajar Prince Sultan Babak Mirza Khan as the new contender for the role of "savior of Iran," in defiance of the waning Shahzade Reza.
The danger that the descendants of the Qajars pose to official Tehran is more serious than the threat posed by the Pahlavi clan, since they have a greater claim to the throne and, more importantly, enjoy authority among the republic's ethno-confessional minorities.
For the republic's opponents, such a figure would be a real gift if they began military operations against Iran in the near future.
For this reason, it is crucial for Iranian security forces to find those behind the "Sultan Babak" project before their opponents attempt to fully exploit this card and breathe new life into the protests.
# id) ?>
|
Posted by badanov 2026-01-15 00:00||
E-Mail||
Front Page|| [1847 views ]
Top
File under: Govt of Iran Proxies
|
|
Posted by Skidmark 2026-01-15 01:42||
2026-01-15 01:42||
Front Page
Top
|
|
03:43 trailing wife
00:29 Clyde Thaviling6482
00:14 Besoeker
00:13 Skidmark
Merry-Go-Blog
|
