
According to court documents, Ehsan Afrashteh first established contact with Mossad operatives in Turkey.
After assessing Afrashteh’s family connections to sensitive state institutions, the Mossad officer instructed him to return to Iran and attempt to gain employment in a sensitive organization. Although he ultimately failed to infiltrate that specific body, Mossad paid him 1,000 euros before his return to build trust.
Initially, Afrashteh operated under the cover of a ride-hailing driver, carrying out Mossad’s orders. Following Mossad’s training, he documented targeted locations, filmed the vicinity of the Ministry of Intelligence, attended public gatherings, and provided personality profiles of individuals to his handler.
He later secured a position as a cybersecurity expert in a company affiliated with a military institution. Once employed, he immediately disclosed details to Mossad, marking a new phase in his collaboration. He relayed employee identities, organizational charts, and company missions to the Israeli spy agency.
The convict became fluent in English, French, and Hebrew during his espionage activities. His operational codename within Mossad was “James.” Technical analysis of recovered emails revealed that he exchanged at least four to five encrypted messages monthly with his handlers, not including voice calls. Over 300 messages were exchanged between them.
Afrashteh traveled to Nepal, where he met Mossad officers in Kathmandu and was later moved to a safe house in Pokhara. Three Mossad operatives accompanied him on his flight via the UAE. During his stay in Pokhara, he was denied access to his personal laptop and phone. There, he received advanced in-person training and new operational missions, according to Press TV.
Upon returning to Iran via Istanbul, he was arrested immediately upon disembarking from his flight at Imam Khomeini International Airport. Judicial authorities had issued an order for his detention.
Despite attempts to mislead investigators, forensic evidence and recovered communications left no doubt about his espionage activities. Afrashteh eventually confessed upon being presented with the evidence.
The investigation into Afrashteh was triggered by multiple red flags, including unusual financial growth, contacts with Jewish individuals, efforts to learn Hebrew, cryptocurrency trading through Southeast Asian exchanges, and suspicious travel to Turkey and the UAE.
MNA