What if the cameras watching you could be turned against the people who installed them? On March the 7th, 2022, Iranian state television broadcast footage of an assassination in central Thrron.
A motorcycle pulled alongside a silver sedan on Madara’s expressway.
The rider drew a pistol.
Five shots.
The driver slumped forward.
The motorcycle disappeared into traffic.
The victim was Colonel Hassan Sedad Kodai, deputy commander of the Islamic Revolutionary Guard Corps unit responsible for planning attacks against Israeli targets across three continents.
Iranian officials called it terrorism.
Israeli media called it a Mossad operation.
But neither side mentioned how the Israelis found him.
Kday didn’t maintain a public profile.
He changed vehicles regularly.
He varied his roads.
He lived in a city where foreign intelligence operatives rarely survive more than one mission.
Msad [music] didn’t just kill Hassan Sedad Kay.
They hijacked Thran’s entire surveillance network to hunt him.
And when Iranian counter intelligence discovered what had been done, the operation that was supposed to prove Israel’s reach became the blueprint for shutting them out.
Hassan sayed Kday [music] spent 20 years making himself impossible to find.
Unit 84.
[music] Zero operatives don’t wear uniforms.
They don’t appear in organizational charts.
Their operations leave fingerprints across intelligence networks, but rarely photographs.
By early 2022, Mossad knew KOD coordinated weapons shipments through Syria, recruited militia networks in Yemen.
He had maintained [music] sleeper cells in East Africa.
They knew he reported directly to Kud’s force leadership.
They didn’t know what he looked like in person.
The problem wasn’t just identification.
[music] Tyrron operates under a security architecture specifically designed to prevent targeted killings.
[music] The city is divided into security zones.
Plane close basic militia monitor neighborhoods.
I RGC counter intelligence runs facial recognition at major intersections.
[music] Kodai lived somewhere in northern Thran.
He drove himself to work.
Those two facts took MSAD 6 months to confirm.
Everything else remained blank.
Standard doctrine called for placing a surveillance team inside Thran.
The team would track patterns, identify vehicles, confirm routes.
The operation would take months.
The exposure risk was near certain.
In January 2022, Israeli intelligence received reports that unit 840 was planning coordinated strikes against diplomatic targets in Kenya and Turkey.
The operational window was closing.
Mossad’s operations directorate proposed something no Israeli unit had attempted inside Iran.
A fully remote surveillance operation using Thran’s own camera infrastructure.
They would hack municipal traffic systems, private security networks, and IRGC monitoring stations simultaneously.
They would maintain access long enough to not just find Kday, but predict his movements with enough precision to position a hit team.
The proposal included one line of contingency.
If access was lost before target acquisition, the operation would abort with no backup plan.
Approval came on January 19th.
[music] The technical unit had 6 weeks.
Thrron’s surveillance ecosystem operates on three layers.
Municipal traffic cameras monitor major roads.
Private security systems cover [music] commercial districts.
IRGC counter intelligence maintains classified stations [music] at strategic choke points.
None of these systems communicate with each other.
The fragmentation was intentional, a security measure to prevent exactly what MSAD was planning.
Unit 82000, Israel’s signals intelligence division, had spent 18 months mapping the networks.
They knew which systems ran outdated firmware.
They knew [music] which contractors maintained which camera grids.
They knew Tyrron’s traffic management received software updates every third Thursday.
And during those [music] updates, authentication protocols temporarily relaxed.
On February 3rd, unit 82000 injected malware into a municipal server [music] during scheduled maintenance.
The malware created a hidden partition logging footage from 347 cameras across northern Thran.
Every 12 hours, compressed files uploaded to a server in Azerbaijan that Mossad controlled through a Kurdish technology company.
For 9 days, the system worked perfectly.
Then on February 12th, the upload stopped.
Iranian cyber defense hadn’t detected the intrusion.
Thrron’s IT department had deployed an unscheduled firmware update that automatically purged unauthorized partitions.
The malware was deleted.
The access was gone.
Mossad was blind with 5 weeks of operational runway remaining.
Intelligence indicated KD would travel to Damascus in mid-March.
If they lost him before reestablishing access, the window would close permanently.
The operations directorate violated standard doctrine.
Instead of abboarding, they authorized human penetration of a private security contractor.
Tehran’s commercial districts operate extensive private camera networks maintained by local contractors with administrative access to thousands of cameras.
These systems operate with minimal IRGC oversight because they’re considered low security infrastructure.
Unit 82000 identified one contractor whose network included cameras along Moderas Expressway and Valasar [music] Street.
The company employed 17 technicians.
Three had financial problems.
On February 19th, one technician received a phone call.
European cyber security firm contract work exceptional pay installed diagnostic software that would run for 3 weeks then selfdelete.
He accepted.
He was paid $15,000.
He didn’t know the software would create a back door into every camera his company maintained.
He didn’t know MSAD would use it to track an IRGC commander.
By February 23rd, Mosed had access to 89 cameras covering 12 km through northern Thyran.
Analysts [music] began cross referencing vehicle patterns.
They were looking for driving behavior consistent with counter surveillance training, [music] variable routes, irregular timing, avoidance of predictable patterns.
After 9 days, they identified four possible vehicles.
On March [music] 4th, facial recognition flagged a driver in a silver Kia Serado.
Match confidence 73%.
Not definitive, but close enough.
The operations team made an assumption.
This was KD’s [music] vehicle.
They began modeling his route.
They identified three intersections where traffic created predictable slowdowns.
They calculated approach vectors for a motorcycle team.
But what happens when you build an entire operation around one vehicle and discover someone else has been driving it? On March 5th, 2 days before the planned strike, [music] the Silver Kia appeared on cameras along a route Mossad had never seen it travel.
It moved south through residential neighborhoods.
It stopped outside a building for 40 minutes, then it vanished from the grid.
Analysts ran the new footage through facial recognition.
The confidence score dropped to 61%.
Someone else was driving the car.
This wasn’t a pattern variation.
This was a different person behind the wheel.
If the vehicle wasn’t exclusively code, if he shared it with family or colleagues, then the hit team might execute the wrong target.
Killing a civilian or low-level operative in central tan would trigger a counter intelligence sweep that would burn every asset Mosed had in Iran.
It would expose the camera network intrusion.
It would end operations inside Tran for years.
The operations [music] directorate convened an emergency assessment.
Three positions emerged immediately.
The first abort now preserve the network.
Wait for cleaner confirmation.
The second continue surveillance for 48 hours.
execute only if the original driver reappears on a predictable route.
The third, the confidence score was acceptable operational risk.
Execute as planned.
The debate wasn’t just tactical, it was institutional.
Mossad [music] had spent 3 months and significant resources building this capability.
Unit 82’s network intrusion represented a technical achievement that wouldn’t be repeatable once Iranian cyber defense [music] upgraded their systems.
Kday was planning operations that would kill Israelis.
The intelligence [music] was time-sensitive, but 73% confidence meant a 27% chance of killing the wrong person.
And the entire operation rested on access that was never supposed to be discovered.
If the hit went wrong, Iranian counter intelligence wouldn’t just investigate the assassination.
[music] They would audit every security system in Thran until they found the breach.
The decision landed on one assessment.
Could they afford to wait 48 hours? or would waiting cost them the target entirely? They chose to wait.
The motorcycle team was already in Thran.
Two riders, both native Farsy speakers, recruited from Iranian opposition groups.
They had entered separately using Turkish passports.
They carried no weapons.
The pistol would be delivered 4 hours before the strike.
The shooter was 29 years old.
Former Iranian army defected in 2019.
He had been part of three previous Mossad operations inside Iran.
document thefts, dead drops, surveillance runs, never a killing.
This would be [music] his first direct action mission.
On March 6th, he received an encrypted message.
Standby for confirmation.
He spent the day in a rented apartment in eastern Thyran.
No television, no internet, no contact except with the driver.
The protocol was clear.
If confirmation came, they would execute the following morning.
If it didn’t, they would extract within 24 hours.
That evening, a second message arrived.
It contained one line he hadn’t [music] seen in any previous briefing.
Confidence level 73%.
He understood what that meant.
There was better than a one in4 chance he would kill the [music] wrong person.
He also understood that questioning the order wasn’t an option.
The operational chain had already made the assessment.
His role was execution, not evaluation.
But the number stayed in his head, 73%.
High enough to proceed, low enough to be wrong.
What the shooter didn’t know, what no one on the operational side knew, was that the decision to continue had fractured [music] something inside Mossad’s command structure.
The head of unit 82000’s Thran division had argued for a board.
His position [music] was technical, not moral.
The camera network represented months of preparation and millions in operational investment.
Using it for a 73% confidence strike meant risking the entire infrastructure for one target.
If the hit failed or hit the wrong person, [music] Iranian counter intelligence would trace the intrusion within days.
Every access point, [music] unit 82000, had established over 2 years would be burned.
Future operations inside Thran would require starting from zero.
The [music] operations directorate overruled him.
Their assessment was strategic.
Kay’s unit 840 was actively planning attacks.
Waiting for perfect confirmation meant accepting that Israeli civilians might die while Mossad sat on actionable intelligence.
The 73% threshold met doctrinal requirements for high-v value target elimination.
The risk was acceptable, but acceptable risk and acceptable cost aren’t the same thing.
The unit 82000 division head submitted a formal descent to the operational record.
The descent outlined a scenario no one had fully considered.
What happens after a successful strike when Iranian investigators discover their security cameras had been compromised? The IRGC wouldn’t just close the breach.
They would reverse engineer the methodology.
They would use it to hunt for other intrusions.
They would upgrade every system in Thran to prevent future access.
The operation that was supposed to give Mossad persistent surveillance capability inside Iran’s capital might instead teach Iranian counter intelligence exactly how Israel operates and how to stop them.
The descent was noted.
The operation continued.
On the morning of March 7th, the Silver Kia appeared on cameras at 9:17 a.
m.
It was traveling north on Modaras Expressway.
[music] The driver matched the original facial recognition profile.
Mossad analysts ran one final cross reference.
The route was consistent with someone traveling from northern residential areas towards central command facilities.
At 9:31 a.
m.
, Operations Command sent final authorization.
The motorcycle team had a 12-minute window.
They were already in position 2 km south.
The shooter carried a checkmade CZ75 with a custom suppressor, five rounds, no backup magazine.
The plan allowed one pass.
If the shot wasn’t clean, abort [music] and extract.
At 9:39 a.
m.
, traffic cameras showed the Kia approaching a section where morning congestion [music] typically created slowdowns.
The motorcycle entered the expressway from a side ramp.
The driver accelerated into the left lane.
The shooter drew the pistol and held it low against his leg.
The Kia was three cars ahead.
The shooter had trained for this moment for 6 weeks.
He knew the mechanics.
Five rounds in 3 seconds.
Center mass then head.
Clean execution meant instant incapacitation.
[music] But mechanics don’t account for the number that was still in his head.
73%.
What happens when you execute with 73% confidence and discover afterward that you should have waited? Traffic slowed at 9:41 a.
m.
The Kia was boxed between a bus and a delivery truck.
The motorcycle moved into position in the left lane.
The shooter raised the pistol.
At this range, less than 2 m, the suppressor would reduce the sound to something between a cough and a [music] book dropped on pavement.
In thyron traffic, it would disappear.
The shooter had been trained to fire from a moving motorcycle.
The technique required [music] anticipating micro movements.
Acceleration, braking, road texture.
Each shot had to fall between those disruptions.
Five rounds in 3 seconds.
The mechanics were simple, but mechanics assumed the target stays predictable.
The Kia’s brake lights flashed.
The vehicle decelerated harder than expected.
The gap between the motorcycle and the sedan opened by half a meter.
The shooter’s firing angle shifted.
He pulled his arm back.
Not yet.
>> [music] >> Wait for position to stabilize.
The motorcycle driver adjusted, accelerating slightly to close [music] distance.
But now a taxi was merging from the right lane.
The driver had two choices.
Break and lose momentum, or accelerate into a tighter gap.
He accelerated.
[music] The motorcycle surged forward past the optimal firing position.
They were now ahead of the Kia by nearly a full car length.
First false start.
The shooter tapped the driver’s shoulder twice the abort [music] signal.
The driver eased off throttle and let the motorcycle drift back into the middle lane.
They would need to circle back, re-enter traffic, and attempt the approach again.
But circling meant another 3 minutes.
It meant other vehicles would fill the space around the target.
[music] It meant the window was narrowing.
The driver took the next exit ramp, looped [music] through a side street, and re-entered Modarus Expressway 800 m behind the Kua.
Traffic was heavier now.
Morning Rush building toward peak density.
The kaya was seven cars ahead, blocked by a delivery van and a white sedan.
The motorcycle accelerated into the left lane again.
At 9:44 a.
m.
, the shooter saw something that hadn’t appeared in any of the surveillance footage.
A uniformed traffic [music] police officer on a motorcycle two lanes over.
The officer was moving slowly through traffic, scanning vehicles, standard patrol behavior.
But his presence meant witnesses.
It meant someone who might react faster than civilian drivers.
It meant someone who carried a radio.
The shooter’s hand was on the pistol grip beneath his jacket.
He didn’t draw.
Not yet.
The patrol officer was 20 m behind and drifting right.
If the hit happened in the next 10 seconds, the officer might not have line of sight.
Might not hear the suppressed shots over traffic noise.
Might not understand what he was seeing until the motorcycle was already gone.
The driver made the decision.
He maintained speed.
The gap to the Kia closed.
The officer continued drifting right, [music] boxed in by a truck.
The shooter’s window was open.
5 seconds, maybe less.
The motorcycle pulled alongside the Kia.
The shooter drew the pistol and raised it toward the driver’s window.
His hand was steady.
The target was less than 2 m away.
The angle was clean.
Then the Kia’s window exploded outward, not from gunfire.
The driver had opened the window manually, rolling it down.
The glass descended into the door frame.
The shooter saw the driver’s face clearly for the first time.
Male, 40some, short beard.
The face matched the surveillance photos, 73% [music] confidence.
But now, seeing the target in person, something felt wrong.
The beard was darker than it appeared in the footage.
The face was thinner.
Or maybe that was just the angle.
Maybe that was just the two seconds of doubt that happens when you’re about to kill someone [music] and you’re not completely certain they’re who you think they are.
The target turned his head slightly, looking toward the passenger side of his [music] vehicle.
He was reaching for something.
A phone.
A bag.
The shooter couldn’t see.
The movement shifted the target’s position.
The angle was no longer clean.
The shot would enter at an oblique trajectory.
It might miss vital [music] structures.
It might leave the target conscious long enough to react.
The shooter hesitated.
1 second.
2 seconds.
The motorcycle was starting to pull ahead.
The driver couldn’t maintain matched [music] speed indefinitely without drawing attention.
In another 3 seconds, the angle would be gone entirely.
The target’s hand came back into view.
He was holding a phone.
He raised it [music] to his ear.
His attention was divided.
He wasn’t looking at the motorcycle.
He wasn’t looking at the shooter.
He was talking to someone.
His face turned slightly away, presenting the left side of his head and neck.
The shooter made a decision that violated his training.
Instead of waiting for the optimal center mass angle, [music] he adjusted his aim, left side, neck, and upper chest.
If the first round landed, the target would be incapacitated before he could process what was happening.
If it missed, abort and extract.
No second chance.
The shooter fired.
The first round punched through the open window and struck Hassan Sed Kay in the upper left chest just below the collar bone.
The impact threw his body right against the center console.
The phone dropped.
His hand went to his chest reflexively.
His face contorted, but he didn’t slump [music] forward.
He was still conscious, still moving.
The shooter fired again.
Second round.
This one entered the left side of the neck.
Blood sprayed across the passenger seat.
Oay’s [music] head snapped back.
His right hand was still moving, reaching towards something the shooter couldn’t see.
Was he armed? Was he trying to reach a weapon? A panic button.
The surveillance had never confirmed whether he carried personal security equipment.
Third round.
The shooter aimed for the head.
The motorcycle was accelerating now, pulling ahead.
The angle was degrading.
The round [music] entered behind Code’s left ear.
His body went slack, but his foot must have been on the accelerator because the Kia lurched forward suddenly, ramming into the back of the delivery truck ahead.
Fourth round.
Insurance.
The shooter fired into the target’s upper body as the motorcycle passed the now stationary Kia.
Fifth round.
The last shot shattered what remained of the driver’s side window.
The motorcycle cut across two lanes.
The shooter lowered the pistol.
Behind them, car horns began blaring.
The bus driver was shouting something.
The delivery truck driver was getting out of his vehicle.
The traffic police officer was 40 m back, still blocked by trucks, not yet aware that anything had happened.
The motorcycle exited onto a side street at 9:47 a.
m.
4 minutes since the first approach.
3 minutes since the kill.
The shooter’s hand was shaking now, not from fear, from the physiological aftermath of an adrenaline spike.
He ejected the magazine, dropped the pistol into a storm drain at the first intersection.
The suppressor went into a trash bin two blocks later.
They continued south for another kilometer.
The driver pulled into an underground parking garage.
Both riders dismounted and walked out separately through different exits.
The shooter entered a waiting taxi.
The driver took a bus to a safe house in southern Thran.
By 10:15 a.
m.
, Iranian state media was reporting an assassination on Madera’s expressway.
By 11:0 a.
m.
, IRGC officials confirmed the victim’s identity.
Colonel Hassan Seyad Kay, unit 840.
The operation was successful.
The target was confirmed dead.
The hit team had extracted without compromise.
Everything had worked.
But at 2 p.
m.
, Mossad’s technical [music] team discovered something no one had anticipated.
The entire sequence had been recorded, not just by the hacked cameras, by Tyrron’s primary traffic management system.
Every frame, the approach, the kill, the escape route.
And when IRGC counter intelligence reviewed that footage, they would discover something worse than an assassination.
They would discover that their cameras had been watching for someone else.
The technical team [music] discovered the problem within 3 hours of the assassination.
Thrron’s traffic management system had logged the entire kill sequence.
The motorcycle entering the expressway, the approach, the five shots, the escape route through side streets.
Every camera along the path had captured footage.
The data was stored on municipal servers that IRGC [music] counter intelligence could access within minutes of beginning their investigation.
MSADA had two options.
Purge the footage remotely and expose their network access immediately or leave it intact and accept that Iranian investigators would eventually trace the intrusion back through every system they had comp
romised.
At 3:47 p.
m.
Thyran time, unit 82000 pushed a custom script into the traffic server.
The script didn’t delete the specific footage.
Instead, it corrupted 12 hours of data across 200 cameras citywide, including every camera along Modara’s Expressway.
The corruption would appear as a system malfunction, not a targeted deletion.
The script worked, but it also triggered an automated alert in Thrron’s IT operations center.
By 500 PM, [music] Iranian cyber defense units were investigating the malfunction.
By 900 p.
m.
, they had identified unauthorized access patterns.
By midnight, they had traced the intrusion to Omid Digital Security, the private contractor whose technician had installed MSAD’s back door.
The technician was arrested on March 9th.
Iranian intelligence questioned him for 6 days.
He admitted accepting money from foreign contacts.
He admitted installing diagnostic software on his company’s servers.
He didn’t know what the software actually did.
He didn’t know it had been used to track an IRGC commander.
On March 15th, [music] he was charged with collaboration with hostile intelligence services.
On April 2nd, he [music] was executed by hanging in Evan prison.
His brother Yao living in Turkey disappeared in late March.
Turkish authorities have no record of his departure.
Mossad has never confirmed whether they extracted him or whether Iranian operatives reached [music] him first.
Omid Digital Securities entire network was taken offline permanently.
Every contractor the company employed came under investigation.
[music] Three were detained.
17 commercial buildings across Thran lost their private security camera [music] systems.
The IRGC installed new monitoring infrastructure with updated encryption protocols and redundant authentication systems specifically designed to detect the type of intrusion Mossad had executed.
[music] Within two weeks of Kaday’s death, Iranian counter intelligence identified and arrested four Israeli assets inside Iran.
Two were communications facilitators managing dead drops in Thran [music] and Mashad.
One was a surveillance operative monitoring nuclear facilities near Natans.
The fourth was a logistics coordinator who arranged safe houses for visiting operatives.
All four were compromised through the same method.
IRGC [music] investigators had reverse engineered Mossad’s camera access technique and used it to trace communication patterns across Tehran.
They found encrypted data bursts that mirrored Israeli operational signatures.
They followed those patterns backward into cells that had been considered secure for years.
By May 2022, Unit 840 had activated retaliatory operations in three countries.
Iranian operatives attempted to kidnap an Israeli businessman in Istanbul.
Turkish authorities disrupted a plot targeting Israeli tourists in Cyprus.
Kenyan security arrested two Iranian nationals surveilling the Israeli embassy in Nairobi.
The retaliation wasn’t just tactical response.
It was institutional escalation.
Iran had learned that Israel’s operational advantage wasn’t human intelligence.
It was technical access.
The response was a comprehensive overhaul of Thrron’s entire digital security architecture.
By June, Mossad’s technical teams reported that every access point they had established in Thyron over the previous two years was now closed.
The camera network they had built to track one IRGC [music] commander had become the blueprint Iran used to lock Israeli intelligence out of the capital entirely.
Hassan Sed [music] Kay’s assassination eliminated one unit 840 commander.
It didn’t eliminate unit 840.
Within three weeks, the IRGC appointed Brigadier General Muhammad Raza Zahedi as COD’s replacement, a more senior officer with deeper connections inside Kud’s [music] force leadership.
Zahedi immediately escalated Unit 840’s operations.
Recruitment in Yemen intensified.
Weapons shipments through Syria increased.
[music] Sleeper cells in East Africa received new targeting instructions and operational funding.
In July 2022, Mossad’s operations directorate conducted an internal review.
The review concluded that the operation had succeeded [music] tactically but failed strategically.
It had demonstrated capability without achieving lasting effect.
It had exposed methodology without securing advantage.
One line in the summary became the unofficial assessment.
The operation proved Israel could see inside Tyran [music] and in doing so taught Iran exactly what to block.
The technician who installed the back door never knew what he was part of.
He thought he was accepting contract work from a European cyber security firm.
He died believing he had been manipulated into espionage, which was true, but not understanding that his access had enabled a targeted killing that would reshape how two intelligence services operate against each other.
That’s the cost of proving you can reach inside an adversar’s capital.
Sometimes the proof becomes the lesson they needed to shut you out permanently.
If you want to understand how intelligence operations succeed in one dimension while failing in another, our other videos examine covert actions where tactical victories created strategic losses that took years to recognize.
