IRGC Unit 840 is a secretive part of Iran’s Islamic Revolutionary Guard Corps that mixes intelligence, proxies, and criminal networks to carry out covert operations around the world. It was founded by veteran operative Mohammad Reza Shahlai and is now led by his son, Mohammad Jafar Shahlai. This is not a conventional military unit. It operates in the shadows, using insider recruitment and local intermediaries to get things done while staying invisible. Understanding Unit 840 is key to understanding how Iran wages covert war today.
The unit reports to both the Quds Force, which handles Iran’s expeditionary and proxy operations, and the IRGC Intelligence Organization for covert intelligence work. Unlike most militaries, Unit 840 takes advantage of Iran’s system, blending intelligence, military power, and criminal networks. It adapts to the environment: using militias where useful, criminal networks in cities, and local insiders when access is needed. This flexibility lets the unit operate globally while staying hard to stop.
Unit 840’s tradecraft relies on patience, secrecy, and layers of protection. Examples include the December 2025 assassination of General Ikramuddin Sari in Tehran, Iran, carried out as a joint operation between the Taliban’s General Directorate of Intelligence (GDI) and Unit 840; the 2023 German plot against Iranian rapper Shahin Najafi; and a suspected plot against the Israeli embassy in London in 2025, in which four Iranians were arrested for their involvement. They also manage covert supply chains, such as the Iranian weapons caches seized in Syria in 2024 that were reportedly headed for the West Bank. Across all these operations, insiders, expendable intermediaries, and layered networks keep the unit alive and effective.
Unit 840 works through functional partnerships, not ideology. Hezbollah in Lebanon provides safe houses and infrastructure in Europe. In Yemen, the Houthis allow Unit 840 to coordinate proxies directly, strengthening Iran’s influence in the region. Criminal networks in Europe and Turkey handle surveillance, logistics, and introductions. This setup allows Unit 840 to operate across Syria, Lebanon, Afghanistan, Europe, and the Middle East while keeping its core planners protected and operations deniable.
Unit 840 is a real and growing threat we cannot ignore. Its ability to adapt, use expendable layers, and keep operations running even when operatives are arrested or eliminated makes it especially resilient. As pressure on Iran increases, Unit 840 continues to extend its reach, including networks in the West and potential touchpoints on U.S. soil. The rise in assassination plots, cross-border coordination, and covert supply operations shows the danger clearly. For anyone tracking Iranian covert activity, the message is simple: Unit 840 is not just a hidden actor—it’s a strategic tool Iran uses to influence and coerce abroad, quietly, patiently, and with real global reach.