Aftermath Operation Midnight Hammer. What Iran Does Next

Aftermath Operation Midnight Hammer: What Iran Does Next

Description:
In this week’s Global Intelligence Weekly Wrap-Up, Neil Bisson — retired CSIS Intelligence Officer and Director of the Global Intelligence Knowledge Network — unpacks the global fallout from Operation Midnight Hammer, the escalating grey-zone conflict with Iran, and the national security vulnerabilities now facing Canada.

🇺🇸 Did the CIA just contradict the Pentagon on how badly Iran’s nuclear sites were hit?

📞 Why did the FBI and DHS urgently brief U.S. governors after the strikes?

⚖️ Are Iran’s new spy trials real counterintelligence wins — or political theatre?

🪦 Were the executions of three alleged Mossad agents about justice — or intimidation?

🕵️ Could the IRGC already have sleeper cells embedded in Canadian cities?

🔐 Did Canada’s own spy agency improperly share private citizen data with foreign partners?

💻 How did Chinese hackers from Salt Typhoon compromise a Canadian telecom provider?

Plus: 🇨🇦 Don’t miss Neil’s guest appearance on the Canada Day episode of Spyscape’s True Spies podcast, airing July 1st — where he reveals covert meeting tradecraft in the episode “Cover of Darkness.”

🎧 Tune in for critical insights, informed by 25 years on the front lines of intelligence and national security.

🔗 Support the podcast:
Patreon | Buzzsprout

📚 Explore more at:
www.globalintelligenceknowledgenetwork.com

📅 Chapters
00:00 – Introduction
01:45 – CIA: Iran’s Nuclear Program ‘Severely Damaged’ by U.S. Strikes
06:00 – FBI, DHS Host Emergency Call with Governors After Iran Strike
09:25 – Iran Moves to Punish ‘Spying’ as it Proclaims Victory Over Israel and the U.S.
12:55 – Iran Executes Three Alleged Mossad Agents in Retaliatory Crackdown
16:05 – Former CSIS Director Warns of Iranian Sleeper Cells in Canada
19:05 – CSE Shared Canadians’ Data with Foreign Partners Without Proper Safeguards
21:35 – Salt Typhoon: China-Linked Hackers Breach Canadian Telecom Infrastructure
23:00 – Outro & Canada Day Message

Transcript

2025 06 27 Global Intelligence Weekly Wrap Up


INTRO: 
Welcome to this week’s edition of Global Intelligence Weekly Wrap-Up — your trusted source for high-impact stories from the front lines of espionage, covert action, cyber warfare, and national security.

Neil Bisson — retired CSIS Intelligence Officer and Director of the Global Intelligence Knowledge Network — draws on more than 25 years of operational experience to decode the world’s most pressing intelligence developments and what they mean for your safety, your data, and your country’s resilience.

This week, the spotlight is on Iran and the ripple effects of Operation Midnight Hammer:

• The CIA says U.S. bunker-buster strikes have crippled Iran’s nuclear program for years, directly contradicting a leaked Pentagon estimate of mere months’ delay.

• In Washington, the FBI and DHS brief governors on an elevated threat environment as intelligence agencies brace for Iranian retaliation against U.S. and Jewish targets.

• Tehran answers with spectacle and steel — announcing new spy trials and executing three men it claims were Mossad assets in a bid to project strength and sow fear.

• Former CSIS Director Richard Fadden warns of IRGC sleeper cells in Canada, underscoring the grey-zone dangers facing the Iranian diaspora and Canadian critical infrastructure.

• A scathing oversight report reveals Canada’s signals agency, CSE, improperly shared identifying data on Canadians with foreign partners, raising hard questions about privacy and trust.

• And in cyberspace, a joint alert from the Canadian Cyber Centre and the FBI confirms the Chinese state-sponsored group Salt Typhoon breached a Canadian telecom network by exploiting a critical Cisco flaw.

From nuclear bunkers in Natanz to backbone routers in Toronto, this episode exposes how modern conflict is fought in the shadows — and sometimes right in our own backyard.
Let’s get started.

MUSIC

Hello everyone and welcome back to another episode Global Intelligence Weekly Wrap-Up. 

I’m your host, Neil Bisson, a retired Intelligence Officer with the Canadian Security Intelligence Service, and the Director of the Global Intelligence Knowledge Network. 

Every week, I pull the most relevant news stories relating to espionage, national security, foreign interference and terrorism to give you a behind the scenes understanding of how the world of intelligence effects every aspect of your life. 

From your country to your career to your safety. 

This week’s episode is going to take a deep dive into the aftermath of the US military action on the Iranian nuclear program. We’ll talk about the aftermath and what western intelligence agencies are on the lookout for. 

So, without further ado let’s get into it. 

For our first story, we're diving straight into the major development in the Iran–Israel–US conflict: the CIA has confirmed that recent US strikes on Iran’s nuclear sites inflicted severe damage, setting back Tehran’s program for years.

CIA Director John Ratcliffe stated that a "body of credible intelligence" shows that multiple nuclear facilities—Natanz, Fordow, and Isfahan—were hit hard enough that reconstruction would take years, not months. 

That aligns with Israeli official estimates and Iran’s acknowledgment of significant destruction.

However, earlier leaked intelligence from the U.S. Defense Intelligence Agency suggested a more modest outcome: delays of only a few months before Iran could resume enrichment operations. 

This discrepancy reveals a classic intelligence dilemma: early, low-confidence field assessments often conflict with deeper agency evaluations.

From an intelligence standpoint, several factors come into play:

• Strike mechanics: The US used massive bunker-buster munitions and stealth bombers targeting hardened and underground facilities. Their effectiveness relies on hitting critical nodes—ventilation shafts or power supply—rather than penetrating every meter of rock.

• Iran’s mitigation: Tehran may have shifted enriched uranium out of harm’s way before the strikes. Underground centrifuge halls remain more resistant to direct damage.

• Strategic signaling: The CIA’s public statement bolsters U.S. and allied messages, reinforcing deterrence and justifying ongoing pressure. But behind the scenes, the contradictory low-confidence leak is fueling criticism—raising transparency and intelligence-sharing concerns.

These strikes, part of Operation Midnight Hammer, represent the U.S.’s most overt military involvement in the Iran–Israel conflict to date. 

Conducted on 22nd of June, the US strike followed earlier Israeli strikes targeting Iranian enrichment infrastructure. 

Months-long vs. years-long impacts are more than semantics: they determine whether Iran is delayed into a diplomatic window or merely paused for another attack cycle.

Analysts caution that damaged infrastructure doesn’t necessarily translate to destroyed capabilities. 

Without fully neutralizing centrifuges or uranium stockpiles, Iran retains the ability to recover.

But the psychological and deterrent effects—especially coming from the CIA—carry immediate strategic weight.

Politically, the contrasting intelligence narratives are also fueling domestic debate in Washington: about the timing of classified information, intelligence leaks, and executive accountability. 

Meanwhile, Iran is already reasserting its technical resilience and vowing retaliation. 

More on that later. 

Publicly, the message is clear: Iran’s nuclear program has suffered a crippling blow. 

Covertly, the true scale of damage is still under some scrutiny. 

Monitoring now shifts to Iran’s technical assessment, site restoration, and possible responses—whether cyberattacks, maritime disruption, or indirect proxy actions.

For intelligence professionals and policymakers, this episode underscores the layered complexity of strategic bombing, intelligence interpretation, and information warfare.

MUSIC

We continue our examination of the aftermath of the military action on Iran in our next story where the FBI and Department of Homeland Security convened urgent conference calls with state governors and law enforcement officials to discuss heightened threat levels in the wake of recent U.S. missile strikes on Iranian nuclear sites.

During the call, senior officials confirmed that the FBI is reinforcing its posture—bringing more staff into offices and intensifying monitoring of intelligence sources. 

While no immediate threats have been identified, agencies emphasized the need for vigilance, particularly regarding cyber activity and potential targeting of Jewish institutions and Israel-connected sites.

The coordinated communication aimed to ensure governors and local responders were fully informed, equipped, and ready to engage with relevant infrastructure and community partners should any threat materialize or evolve.

The alert follows recent U.S. strikes on Iranian nuclear facilities—part of a broader escalation in the Israel-Iran conflict. 

Iran’s history of plotting retaliatory strikes on U.S. soil, including plots targeting political figures, has led to heightened domestic security awareness.

This measure mirrors previous responses to similar escalations, such as after the killing of Iranian General Qassem Soleimani in 2020, when domestic law enforcement also increased monitoring and cooperation with federal agencies.

A representative from the Secure Community Network, an organization supporting Jewish community security, noted that in the aftermath of U.S. actions alongside Israel, online threats surged—with more than 1,600 hostile social media posts aimed at the Jewish community.

Homeland Security analysts stressed that while Iran has not specifically called for violence inside the U.S., the broader “threat environment” is elevated. 

They stressed preparedness for any operational or inspired threat to manifest.

The federal briefing underscores a proactive approach to national security following major military actions overseas. 

Even in the absence of a direct threat, law enforcement and governors are urged to coordinate, maintain readiness, and engage vulnerable communities and critical infrastructure operators. 

In today’s volatile geopolitical landscape, awareness and preparation remain essential—even at home.

MUSIC

Now let’s discuss how Iran is reacting to setback in their nuclear capabilities. In an article from Al Jazeera entitled, “Iran moves to punish ‘spying’ as it proclaims victory over Israel, US.” 

The piece outlines Iran’s latest wave of arrests and public declarations against alleged spies, as well as its bold claims of defeating Israeli and American intelligence operations.

The Iranian judiciary has announced it will publicly try several unnamed individuals accused of espionage for the U.S. and Israel. 

These developments follow a series of Iranian intelligence operations that Tehran claims have “thwarted” major spy efforts targeting its nuclear and military infrastructure. 

This isn’t just a domestic legal matter — it’s part of a coordinated psychological campaign aimed at both internal consolidation and regional posturing. 

Iranian officials have framed these arrests as a major counterintelligence victory, while simultaneously using them to galvanize public sentiment and portray the regime as under siege by foreign enemies.

From an intelligence standpoint, the announcement serves multiple strategic objectives: it reinforces deterrence against internal dissent, discredits the West in the eyes of the Iranian public, and boosts the credibility of Iran’s own intelligence services at a time of heightened geopolitical tension.

Iran has a long history of publicly parading alleged spies to assert its sovereign security posture.

This tactic often blurs the line between actual intelligence activity and politically motivated arrests. 

In the past, dual nationals and individuals with tenuous links to Western entities have been swept up in these campaigns, often used as bargaining chips or propaganda symbols.

This latest proclamation of victory comes amid a broader regional conflict involving Israeli strikes in Syria, escalating Hezbollah activity along the Lebanon-Israel border, and ongoing nuclear negotiations — or lack thereof — with the West. 

Iran’s move appears timed to reinforce its image as resilient and uncompromising.

While the Al Jazeera article doesn't cite Western intelligence officials directly, the Iranian judiciary’s language suggests a familiar pattern: public trials, secretive charges, and sweeping claims of foreign interference. 

In my experience, regimes under pressure often resort to theatrical counterintelligence moves as a form of strategic signaling — not only to their enemies abroad but to their populations at home. This announcement likely serves that dual purpose.

Iran’s so-called “victory” over U.S. and Israeli spy networks should be viewed with cautious skepticism. 

While it may reflect legitimate counterintelligence activity, it’s equally plausible that these public declarations are more performative than factual. 

Still, the underlying reality remains: Iran is entrenched in an evolving grey zone battle with adversaries across multiple domains, from cyber to HUMINT to regional proxy wars.

As these tensions continue to mount, we can expect Iran to lean more heavily into psychological and legal warfare to assert control and project strength. 

MUSIC

As an extension of the previous story, we focus on Iran’s execution of three men—Azad Shojaei, Edris Aali, and Iraqi national Rasoul Ahmad Rasoul—after they were convicted of spying for Israel, according to Iran’s state-run media. 

The hangings took place on 25th of June at the Urmia Prison in West Azerbaijan province and form part of Tehran’s latest crackdown on alleged Mossad activity.

Iranian authorities claim the trio smuggled “assassination equipment” into the country and passed sensitive information to Israeli handlers. 

Publicizing these executions serves several strategic purposes:

1. Domestic deterrence: The regime reinforces the severe consequences of collaborating with foreign intelligence services.

2. Psychological messaging: By framing the incident as a counter-espionage victory, Tehran projects vigilance and strength to regional adversaries.

3. Narrative control: Linking internal security to an external enemy helps deflect attention from Iran’s own vulnerabilities following recent Israeli and American covert strikes.

While genuine Israeli HUMINT activity inside Iran cannot be ruled out, the opaque nature of Iranian trials—often held behind closed doors—means the evidence underlying these guilty verdicts is rarely scrutinized.

The latest hangings bring to at least six the number of alleged Israeli spies executed since early June. 


Historically, Tehran has turned to high-profile espionage trials during periods of external pressure, using them to consolidate internal cohesion and signal resilience.

Human-rights organizations argue that these rapid-fire executions are designed to “instil fear” at home and strengthen the regime’s hand amid diplomatic isolation. 

Veteran counter-intelligence analysts note that highly publicized spy hunts can be both a warning to genuine clandestine networks and a convenient way to neutralize political dissenters under the guise of national security.

Whether these men were bona fide Mossad sources or victims of political theater, their deaths underscore the razor-sharp edge of Iran’s domestic security apparatus. 

Expect Tehran to continue blending legal, psychological, and information warfare as it battles Israel in the grey zone. 

Iran’s close relationship with Russia, could allow for Russian backed hacking groups to coordinate with Iranian hacking groups to conduct attacks on critical infrastructure on Israeli and Western targets. 

For intelligence professionals, the message is clear: the clandestine contest between Iran and Israel is escalating, and the stakes—for operatives on both sides—have never been higher. 

MUSIC

Concerns surrounding if and how Iran will retaliate aren’t limited to the US and Israeli Intelligence agencies. 

As discussed in a CBC news article entitled “Iranian sleeper cells ‘very real’ threat in Canada, former top spy warns.” 

The article highlights the warnings issued by former CSIS Director Richard Fadden about the growing risk posed by Iranian-backed operatives potentially embedded in Canada—an issue that dovetails with international tensions and Canada’s role in enforcing sanctions against Tehran.

The article reports that Iranian sleeper cells may already be in place on Canadian soil, posing a significant and underappreciated threat to national security. 

Richard Fadden, who once led Canada’s top intelligence agency and served as National Security Advisor to two prime ministers, warns that Iran’s Islamic Revolutionary Guard Corps or IRGC and associated proxy networks “have the capability to activate operatives already here” if Tehran decides to retaliate against Western actions.

The concern is especially pressing in light of Canada’s continued condemnation of Iran’s actions in the Middle East, its ongoing listing of the IRGC as a terrorist entity, and recent strikes against Iranian nuclear facilities by U.S. and Israeli forces. 

As Fadden notes, Canadian foreign policy alignment makes us a target, especially since we are one of the few Western countries with a sizable Iranian diaspora and relatively permissive borders and civil liberties, which adversaries can exploit.

Canada has had a complicated history with Iranian intelligence operations. 

The 2012 severing of diplomatic ties with Tehran was prompted in part by concerns over Iranian espionage, threats to Jewish institutions, and attempts to influence Canadian institutions. 

In recent years, CSIS and the RCMP have warned about Iranian efforts to monitor dissidents and conduct covert influence operations, particularly against the Iranian Canadian community.

As the article outlines, Iran has long leveraged proxy actors—including Hezbollah, Shia militias, and criminal enablers—to carry out retaliatory acts around the globe. 

This “plausible deniability” model means Canada wouldn’t necessarily face a direct military threat, but rather targeted sabotage, intimidation, or violence disguised as domestic crime or lone actor extremism.

Fadden’s warning is not an isolated concern. 

Current and former intelligence officials have for years pointed to the IRGC’s ability to recruit, embed, and activate sleeper agents, especially among individuals with dual citizenship or existing community ties. 

The lack of visibility into foreign influence operations in Canada makes the detection of sleeper cells exceptionally difficult, requiring proactive HUMINT, signals intelligence, and cooperation with international partners.

Former CSIS analyst Phil Gurski has also previously stated that Iran’s presence in Canada is not just ideological, but operational, particularly when it comes to collecting on exiles, monitoring Israeli and Jewish organizations, and possibly preparing for asymmetrical retaliation.

Former CSIS Director Richard Fadden is raising the alarm about the very real possibility of Iranian sleeper cells in Canada—a concern made more urgent by global tensions, Iran’s history of extraterritorial operations, and Canada’s perceived vulnerability.

If these threats materialize, they may not look like overt acts of war. Instead, they may appear as coordinated but deniable incidents of sabotage, violence, or intimidation, designed to punish Western nations without triggering a direct military response.

As Canada strengthens its support for allies and condemns Iranian aggression, we must be equally prepared to defend against asymmetric threats from within.

MUSIC

We switch gears now from discussing Iran to what’s happening right here in Canada’s cyber and signals intelligence agency—the Communications Security Establishment, or CSE. 

According to a recent review by the Intelligence Commissioner, CSE shared information with foreign intelligence partners that included identifying data about Canadians, without fully applying required privacy protections.

The breach occurred between 2020 and 2023 and involved operational reports shared with Canada's international partners. 

These reports were supposed to have any identifiable Canadian information removed before dissemination. 

However, the Commissioner found that in multiple cases, this filtering process either failed or was inconsistently applied.

While none of the information shared was said to have been maliciously used, the incident raises significant concerns about how CSE handles incidental collection—information gathered on Canadians even when they are not the targets of surveillance.

For an organization tasked with protecting Canadians in cyberspace, and one that collaborates extensively with partners like the U.S., UK, and Australia, such lapses pose operational and reputational risks. 

Sharing data without proper checks can jeopardize trust—not just with Canadians, but with oversight bodies and international allies.

CSE operates under legal mandates that strictly prohibit targeting Canadians or people in Canada. However, during routine intelligence gathering—particularly in global cyber operations—incidental information about Canadians can sometimes be swept up. 

This is expected, but regulations require that this type of data be carefully vetted and anonymized before being stored or shared externally.

Over the last few years, CSE’s operational tempo has increased dramatically, with growing responsibilities in cyber defense, foreign signals intelligence, and the protection of government networks. 

The expansion in scale and scope, while necessary, may have outpaced internal safeguards meant to prevent exactly this kind of disclosure.

Although the article doesn’t directly quote legal or intelligence experts, the takeaway is clear: even inadvertent privacy violations can have consequences. 

Incidents like this offer ammunition to critics who argue that intelligence agencies operate with too much secrecy and not enough accountability. 

From a intelligence sharing perspective, this is less about intent and more about oversight—ensuring that compliance mechanisms are up to the task as the mission set grows more complex.

CSE has since updated its processes and pledged to improve safeguards, but the damage—at least reputationally—is done.

In intelligence work, precision isn’t just preferred—it’s required. 

For Canadians to have confidence in their intelligence institutions, agencies like CSE must demonstrate that they can handle sensitive data with care and consistency.

As the digital threat landscape expands, ensuring non authorized sharing of information doesn’t happen will become a major priority among SIGINT partners like CSE, or further loss of the public’s confidence in these organizations will increase significantly. 

MUSIC

We stick with Cyber in Canada for our last story this week, which focuses on a major cybersecurity alert. 

The Canadian Centre for Cyber Security, alongside the FBI, has issued a warning that network devices belonging to a Canadian telecommunications company were compromised in an attack linked to the Chinese state-sponsored group known as Salt Typhoon.

According to the advisory, Chinese-backed hackers exploited a critical vulnerability in Cisco IOS XE software to breach at least three network devices in mid-February. 

Intruders modified configuration files to install a stealthy Generic Routing Encapsulation or GRE tunnel—enabling persistent access and data collection from those networks.

Although the activity appears primarily geared toward reconnaissance, this type of foothold can quickly evolve into broader surveillance or lateral infiltration. 

The advisory suggests that telecom and infrastructure providers nationwide must urgently reinforce their device security.

Salt Typhoon is affiliated with China’s Ministry of State Security and is known for targeting telecom and internet infrastructure on a global scale. 

This latest incident mirrors previous Salt Typhoon activity: exploiting network vulnerabilities to establish long-term access for counterintelligence operations.

Canada has taken steps in the past to mitigate Chinese-linked network threats, including the removal of Huawei equipment from 5G infrastructure by June 2024. 

However, the reliance on ubiquitous platforms like Cisco—still present in many telecom backbones—means that the country remains exposed, especially if patching practices lag behind.

Cybersecurity experts warn that edge devices—routers, switches, firewalls—are increasingly appealing targets because of their privileged network position. 

Once these are compromised, attackers can monitor traffic, exfiltrate proprietary data, or manipulate routing. 

And given the high CVSS score of 10.0 for the exploited Cisco flaw, rapid and widespread patching is critical to interrupt potential attack chains.

Canada’s alert underscores a persistent truth in cybersecurity: vulnerabilities in foundational network devices can quickly ripple across critical infrastructure. 

Telecom firms now face urgent mandates—not just to patch systems, but to review configurations, tighten access controls, and monitor continuously for hidden tunnels. 

As Salt Typhoon and similar groups push deeper into supply chains, defensive vigilance must match the sophistication of their tactics.

Well, there you go, an in-depth examination of what the potential repercussions of setting Iran’s nuclear program back by years could mean for the west, with a side order of Canadian cyber security concerns. 

As always, links to the open-source stories are in the transcript of the episode. 

I’d like to wish all the Canadian listeners a Happy Canada Day, as July 1st is quickly approaching.

In celebration of Canada Day, I will have a guest appearance on the Spyscape podcast “True Spies”, where I will discuss some of the covert actions that keep spies, and their sources, safe when they meet in denied and dangerous operating environments. 

So don’t miss this True Spies episode entitled, “Cover of Darkness”. 

Until next week folks, stay curious, stay informed and stay safe. 

OUTRO:

That’s a wrap for this week’s Global Intelligence Weekly Wrap-Up.

From the CIA–Pentagon rift over the true impact of U.S. strikes on Iran’s nuclear sites, to Tehran’s retaliatory executions and psychological warfare, to warnings of IRGC sleeper cells right here in Canada — this episode shows just how quickly grey-zone conflict can jump from underground bunkers to our own city streets.

Add in CSE’s data-sharing missteps and a Chinese state threat actor tunnelling into Canadian telecom gear, and the message is unmistakable: Canada is not a bystander in today’s shadow war — we’re part of the battlefield.

Delivering clear, unfiltered insight every week draws on decades of frontline intelligence experience — and on listeners like you who value independent analysis. If today’s episode helped you see past the headlines, please share it, subscribe, or leave a quick review. It widens our reach and keeps this mission going.

You can also support the show directly on Buzzsprout or Patreon — every contribution keeps the podcast independent and focused on what matters. For deeper resources, training, and articles, visit the Global Intelligence Knowledge Network.

To all our Canadian listeners, have a safe and happy Canada Day.

Until next time — stay curious, stay informed, and stay safe.

LINKS: 

Story 1: CIA: Iran’s Nuclear Program ‘Severely Damaged’ by US Strikes
Link: https://www.nbcnews.com/politics/national-security/cia-says-irans-nuclear-program-severely-damaged-us-strikes-rcna215121

Story 2: FBI, DHS host call with governors over US threat environment after Iran strikes
Link: https://abcnews.go.com/Politics/fbi-dhs-host-call-governors-us-threat-environment/story?id=123108041

Story 3: Iran Moves to Punish ‘Spying’ as it Proclaims Victory Over Israel, US
Link: https://www.aljazeera.com/news/2025/6/25/iran-moves-to-punish-spying-as-it-proclaims-victory-over-israel-us

Story 4: Iran executes three more prisoners over allegedly spying for Israel, state media says
Link: https://abcnews.go.com/International/wireStory/iran-executes-prisoners-allegedly-spying-israel-state-run-123183110

Story 5: Iranian sleeper cells ‘very real’ threat in Canada, former top spy warns
Link: https://www.cbc.ca/news/politics/iranian-sleeper-cells-canada-1.7569480

Story 6: Spy agency says it 'improperly' shared Canadians' data with international partners
Link: https://www.cbc.ca/news/politics/cse-intelligence-commissioner-shared-information-1.7566777

Story 7: Canada Says Network Devices Compromised in China Linked Hack
Link: https://financialpost.com/cybersecurity/canada-network-devices-compromised-china-linked-hack