MOIS

The Ministry of Intelligence and Security of Iran (MOIS, Persian: Vezarat-e Ettela'at va Amniat-e Keshvar) is Iran's primary civilian intelligence agency, established in 1984 following the consolidation of post-revolution intelligence functions. MOIS is responsible for domestic surveillance, counterintelligence, and foreign intelligence collection. It operates independently of — though in parallel with — the IRGC's Intelligence Organisation (IRGC-IO), which handles military and paramilitary intelligence. MOIS runs Ward 209 inside Evin Prison, the Intelligence Ministry's own dedicated detention wing for political prisoners.

The 2026 Iran-Israel conflict brought MOIS into direct jeopardy. Esmail Khatib, the Intelligence Minister, was killed in an Israeli airstrike on Tehran, the third senior Iranian official killed within 48 hours of that strike. Ward 209 was subsequently evacuated — prisoners moved to an unknown location — distinct from the broader Evin reorganisation. MOIS was linked by Palo Alto Networks to Handala Hack, an Iranian-aligned cyber group that conducted a destructive wiper attack on Stryker Corporation. In May 2026, Hengaw's documentation of Kurdish arrests — including the five detainees on 16 May — reflects MOIS's domestic surveillance role in Kurdish-majority provinces.

MOIS has historically been implicated in targeted killings abroad, including assassinations of dissidents and exiled Iranian opposition figures. Western intelligence agencies routinely attribute Iranian state cyber operations and human intelligence networks to MOIS, which operates globally under diplomatic and commercial cover. The killing of its minister in 2026 and the disruption to Ward 209 represent the most significant structural damage to the ministry in its 40-year history.