"The Silent Sabotage" Iran’s Hybrid Threat and Transnational Intelligence Operations Reshaping Gulf Security

By: Mukhlis R. Mukhlis

June 21, 2026

There is a persistent and dangerous blind spot sitting right at the center of U.S. foreign policy circles when it comes to understanding how Iran actually operates. U.S. analysts and policymakers routinely make the mistake of conflating Iran’s formal diplomatic channels with its parallel, ideological military machine, the state-within-a-state run by the Islamic Revolutionary Guard Corps (IRGC). While Washington and Tehran engage in highly visible diplomatic maneuvering over recent Memorandums of Understanding (MoU), activity-based intelligence (ABI) on the ground tells a completely different story. It reveals a dramatic, asymmetric pivot by Tehran.

Having temporarily paused its high-profile, loud kinetic operations, specifically ballistic missile strikes and large-scale attacks using one-way uncrewed aerial vehicles (UAVs), to see how recent back-channel understandings and tactical truces play out, Iran has quietly activated a far more insidious phase: “Transnational Hybrid Intelligence Operations.”

Reliable local Iraqi sources reported that IRGC-Quds Force (IRGC-QF) Commander Esmail Qaani has issued direct operational orders during recent secret visits to Baghdad. These directives mandate moving operational command and control (C2) nodes forward into sovereign Iraqi territory, specifically clustering these assets in Jurf al-Sakhar and Al-Najaf. By leveraging area specialists from the Yemeni Houthi movement and technical operatives linked to Lebanese Hezbollah, alongside pre‑positioned dissident elements inside the Gulf, Tehran is actively engineering an intelligence and sabotage network designed to spark internal security crises right inside the Gulf Cooperation Council (GCC). Right now, their immediate operational crosshairs are locked onto the vulnerable chokepoints of Kuwait and Bahrain.

Infrastructure and Forward Deployment: The Geography of IRGC Hybrid Nodes

Tehran has effectively pushed its operational borders forward by turning “Jurf al-Sakhar” (in North Babylon) and the strategic perimeters around “Al-Najaf” into forward operating bases. This geographic shift gives the IRGC massive tactical advantages on the ground:

Advanced C2 Nodes: These installations are no longer just basic training camps. They are now fully staffed and equipped by specialized technical units pulled straight from IRGC research laboratories. These teams are deploying high-level Cyber Warfare suites, Signals Intelligence (SIGINT) intercept arrays, and control platforms for intelligence-guided loitering munitions.

Plausible Deniability Architecture: 

Operating from Iraqi soil gives Tehran a built-in layer of deniability. By using local Iraqi proxies as front organizations, Iran insulates itself from direct international backlash and U.S. Department of the Treasury sanctions, shifting the entire risk profile onto the Iraqi fighters executing the missions.

The Transnational Vector Architecture

The IRGC-QF orchestrates this entire theater through a central forward command and vector control structure anchored in the Jurf al-Sakhar, Al-Najaf, Al-Jadriya district (Baghdad), and Tikrit’s southern outskirts axes, extending all the way through the Hamrin Mountains and the Samawah desert. This core command structure branches out into three distinct regional vectors designed to give Iran maximum asymmetric leverage:

·      Vector A targets Kuwait, focusing heavily on infiltrating critical infrastructure, executing sovereignty cyber breaches, and mapping out sub-surface infiltration paths.

·      Vector B targets Bahrain, designed to spark asymmetric sabotage, disrupt the operations of the U.S. Fifth Fleet, and exploit existing sectarian fractures.

·      Vector C handles the Houthi Liaison, managing long-range UAV logistics, sharing maritime SIGINT, and keeping a critical operational link alive to Red Sea interdiction efforts.

The IRGC-QF Clandestine Network and Auxiliary Nodes

Beyond the main hubs in Jurf al-Sakhar and Najaf, an interconnected network of auxiliary nodes has been mapped out to ensure supply chain resilience and allow teams to scatter tactically when needed:

1. The Baghdad Security Belt (Al-Jadriya District): High-sensitivity external communications and intelligence planning are run directly out of fortified, deniable residential compounds in Al-Jadriya. This political-security enclave provides state-level cover, allowing seamless, unmonitored transit for regional proxies, including Houthi emissaries and Gulf dissidents.

2. Amerli and the Hamrin Mountains: This rugged, difficult terrain serves as an alternate assembly zone and a hardened underground storage network for precision-guided munitions (PGMs) and UAV components, deliberately hidden away from conventional aerial imagery and reconnaissance.

3. Tikrit Outskirts: This area serves as a vital logistical transit hub securing the northern Baghdad belt, ensuring the fluid, safe movement of personnel and material between central Iraq and forward operational nodes.

4. Cenral Al-Samawah Desert: This vast, open desert represents the single most dangerous geographic vector. The IRGC exploits this unmonitored space to set up highly mobile launch platforms and ultra-covert overland smuggling corridors leading straight to the Gulf borders, offering perfect concealment for precision operations targeting GCC states.

Regional Alignment Engineering: The Jurf al-Sakhar-Gulf Joint Cell

Activity-Based Intelligence referred to high-level coordination taking place inside joint operations rooms in Jurf al-Sakhar and Baghdad. These meetings bridge elite, heavily sanctioned Iraqi militia leaders with external regional actors:

·      Ansar Allah (Houthis): Houthi technical liaisons bring battle-tested expertise in long-range UAV vectoring and maritime tracking data gathered from their operations in the Red Sea and Gulf of Aden, seamlessly integrating these capabilities into the broader Arabian Gulf theater.

·      Bahraini and Kuwaiti Dissident Cells: Sleeper agents from these factions have been integrated into advanced intelligence tracks. Their training focuses heavily on domestic infrastructure reconnaissance (targeting energy grids and desalination plants), tracking U.S. military movements at shared facilities, and deploying psychological operations designed to widen local socio-political fault lines.

Operational Objectives and Vulnerability Windows: Kuwait and Bahrain

Tehran is operating within a critical “60-day window of vulnerability”, attempting to force favorable terms in back-channel negotiations or offset the strategic losses its proxies suffered during counter-strikes earlier this year. The threat vectors split into two distinct geographic lines:

1-    The Bahraini Front (Deep Security and Sectarian Vector)

IRGC-QF directives are aimed at shifting passive political dissident elements into active, violent sabotage cells. By exploiting Bahrain's unique demographic landscape and its status as the host of “U.S. Naval Forces Central Command (NAVCENT) and the U.S. Fifth Fleet”, Tehran intends to ignite a localized security crisis capable of completely paralyzing Manama’s regional defense coordination.

2-    The Kuwaiti Front (Economic and Political Soft Underbelly)

Kuwait is currently assessed as Iran's primary target for what can be described as “Silent Blackmail”. Operations here focus on utilizing elite cyber and infiltration cells to penetrate critical oil infrastructure and compromise the internal networks of sovereign ministries. The IRGC aims to exploit Kuwait's domestic political fractures, its immediate geographic proximity to Basra, and the direct, unmonitored overland access provided via the southern desert in Iraq.

Predictive Analysis: Immediate Threat Scenarios

Over the short-term horizon, this command structure is projected to deploy three distinct operational styles:

Scenario I: High-Impact Infrastructure Sabotage: Coordinated sabotage attacks launched targeting Kuwaiti and Bahraini port authorities and petrochemical refineries to trigger localized economic paralysis.

Scenario II: Deniable Hybrid Sabotage: Low-signature kinetic actions, such as targeted assassinations or localized improvised explosive device (IED) detonations, inside the Gulf, which will be claimed by fictitious domestic groups. This is engineered to inflame sectarian divisions and strain internal security services.

Scenario III: Low-Altitude Probing Actions: The deployment of low-radar-signature, small-scale UAVs launched from Basra or the southern desert into northern Kuwait. These unacknowledged incursions will serve as quiet kinetic warnings to shape GCC foreign policy positions.

Strategic Assessment of the Baghdad Political Environment

The window for proactive deterrence is closing fast. Any U.S. policy built on the assumption that the official Government of Iraq (GoI) can act as a reliable partner in restraining these entities represents a fundamental misunderstanding of the Iraqi state's structural reality.

Systemic State Capture

The government apparatus in Baghdad is fundamentally compromised. The political-security landscape has been structurally captured by Iran-backed Shiite fronts ever since 2003. Former opposition figures who matured under the direct tutelage of the IRGC now run the state's legislative, judicial, and state-security organs, actively utilizing state resources to shield IRGC-QF operations.

The State Capture Triad

True power in Baghdad is consolidated within a state‑capture triad supported by a broader constellation of Iran‑aligned factions that collectively redirect state institutions and resources to protect and advance Iranian forward operations. At its core, the Badr Organization anchors extensive paramilitary networks and maintains deep penetration of the Ministry of Interior; the Islamic Dawa Party provides the judicial and bureaucratic scaffolding that secures long‑term political dominance; and Kata’ib Hezbollah functions as the Axis of Resistance’s advanced kinetic and tactical arm, interfacing directly with IRGC‑QF elements. Surrounding this triad, groups such as Asa’ib Ahl al‑Haq, Harakat al‑Nujaba, and other aligned militias reinforce the system by supplying additional manpower, political leverage, and parallel security structures, ensuring that the state apparatus remains structurally subordinated to the IRGC’s strategic objectives.

Consequently, expecting the current administration in Baghdad to dismantle the Jurf al-Sakhar network or stop operations targeting the Gulf is an exercise in Strategic Illusion. The government of Iraq (GoI) simply does not possess the political will or the monopoly on force required to counter these actors; it is, fundamentally, an extension of them.

Actionable Countermeasures and Recommendations

To truly disrupt this forward-deployed Iranian threat network, the United States must move past conventional diplomatic engagement with Baghdad and execute a direct deterrence strategy:

1- Bypass Sovereign Channels for Direct Interdiction: Stop treating Iraqi installations, institutions, front organizations, and political bodies utilized by the IRGC-QF as sovereign Iraqi spaces. U.S. forces and intelligence community (IC) must treat these specific entities as hostiles and execute direct, unilateral kinetic and tactical interdictions against them.

2. Establish an Integrated Gulf Defense Array: Build a real-time, tri-lateral intelligence-sharing and early-warning mechanism linking Saudi Arabia, UAE, Kuwait, Bahrain, and perhaps Jordan. This network must integrate low-altitude air defense systems and cyber defense monitoring to detect and neutralize UAV and electronic vectors originating from southern Iraq long before they ever enter Gulf airspace.

3. Target the Organizational Infrastructure: Direct severe financial, cyber, and gray-zone operations against the core leadership and logistical pipelines of these factions. Rather than seeking mediation through an impotent Iraqi executive branch, the U.S. must impose severe costs directly on the organizations facilitating Tehran's regional strategy.

The transformation of Iraq into a forward-deployed, hybrid intelligence launchpad represents a structural shift in how Iran projects power across the region. By moving its C2 infrastructure across its borders and embedding technical IRGC assets into deniable Iraqi nodes, Tehran has engineered an operational posture that minimizes direct risk to itself while maximizing the vulnerability of U.S. partners in the Gulf.

This 60-day window is a critical inflection point. Passive reliance on diplomatic engagement with a structurally captured government in Baghdad will not stall this momentum. Protecting strategic U.S. naval assets in Bahrain and neutralizing quiet economic extortion against Kuwait requires an immediate pivot toward aggressive, unilateral interdiction of these specific operational nodes, coupled with a unified, cross-border Gulf defense framework.

---

Mukhlis Mukhlis is a senior executve and strategic consultant with extensive experience in foreign affairs and strategic relations, with over two decades of experience in U.S. foreign policy, counterterrorism, national security, and Middle Eastern Affairs with an in-depth focus on Iraq and the Levant.