Iranian Spy Rings Linked by Shared Handler, Court Filings Reveal

A new indictment filed in Israel has revealed a direct operational link between two separate espionage cases involving Iran, with both defendants allegedly working for the same Iranian intelligence handler. Mohammed Khalaf, 25, from Baqa al-Gharbiyye, is accused of contacting an Iranian agent via Telegram in August 2026, using the aliases "Thomas" and "Martin." Khalaf allegedly agreed to carry out security missions in Israel in exchange for cryptocurrency payments.

One of Khalaf's key tasks was to retrieve a "package", an operational mobile phone, from a pre-arranged dead drop location in Kiryat Haim. It has now emerged that the person who planted this exact phone was Fares Abu Alheija, 32, who was convicted just last week of serious espionage for Tehran and sentenced to 55 months in prison. The indictment details that Khalaf and Abu Alheija operated completely separately, unaware of each other's identities, and were directed by the same Iranian handler.

Abu Alheija's previous missions included photographing the vicinity of former Defense Minister Yoav Gallant's home and planting devices in dead drops across the country. Khalaf, prior to his arrest, is alleged to have collected the operational phone planted by Abu Alheija, scouted new dead drop locations, and, leveraging his employment at a youth boarding school, provided sensitive information to his handler, including details about security cameras and night shift arrangements at the institution. Khalaf faces serious security offense charges, primarily contact with a foreign agent.