The informant was supposed to be untraceable.

He was a mid-level IRGC officer stationed in Vienna.

Recruited by the FBI 3 years earlier through a patient cultivation operation, he provided invaluable intelligence on Iranian operations in Europe, agent identities, procurement networks, assassination planning.

His FBI handlers took extraordinary precautions.

His identity was compartmentalized at the highest level.

Communications used encrypted channels that changed weekly.

Meetings occurred in third countries with elaborate counter surveillance protocols.

On a Tuesday morning in March, his body was found in a Vienna apartment.

He had been tortured before death.

His fingers had been broken.

His teeth had been extracted.

Whatever secrets he possessed had been ripped from him before a bullet ended his suffering.

The Austrian police ruled it a professional assassination.

The FB I knew it was something worse.

Someone inside the bureau had betrayed him.

This wasn’t the first informant to die under suspicious circumstances.

Over the previous 18 months, seven FBI sources with access to Iranian intelligence had been killed, arrested, or disappeared.

Operations that should have succeeded had failed.

Surveillance targets had vanished hours before raids.

The Iranians seemed to know every FBI move before it happened.

The impossible conclusion could no longer be avoided.

that there were moles inside the FBE.

An internal investigation code named Mirror Hunt would eventually identify five FBI employees who had been recruited by Iranian intelligence.

For 4 years, they had been systematically betraying American operations, burning sources, and sabotaging investigations.

and they were four days away from exposing the identity of the FBY’s most valuable asset inside Iran.

An individual whose intelligence had prevented multiple terrorist attacks and provided crucial insight into Iran’s nuclear program.

This is how the FBI hunted traitors within its own ranks and saved the source whose exposure would have been the greatest counterintelligence disaster in bureau history.

The investigation began with a pattern that shouldn’t exist.

FBI counterintelligence operations against Iran had been failing at a statistically impossible rate.

Between January 2022 and September 2024, the bureau had launched 23 significant operations targeting Iranian intelligence activities in the United States and abroad.

18 had failed.

Surveillance targets had changed routines hours before coverage began.

Recruitment approaches had been rejected by targets who seemed to know they were being assessed.

Raid locations had been emptied before tactical teams arrived.

Sources had been identified and neutralized.

The failure rate was 78%.

Random chance couldn’t explain it.

Operational security failures couldn’t explain it.

Even exceptional Iranian counter inelligence couldn’t explain it.

The only explanation was betrayal from within.

FBI director authorized the most sensitive investigation in bureau history.

Mirror Hunt would operate outside normal channels.

Its existence would be known to fewer than a dozen people.

Its investigators would report directly to the director, bypassing the entire chain of command.

The assumption had to be that the moles could be anywhere, including in positions that would normally oversee counter inelligence investigations.

Trust no one.

The mirror hunt team was assembled from agents with unimpeachable records and no connection to Iran operations.

They were told only that they were investigating a potential security breach.

The full scope, multiple moles, years of betrayal, dead sources was too sensitive to share even with them.

They began with the failures, every compromised operation, every dead source, every suspicious coincidence.

The team mapped access, who knew what and when they knew it.

The pattern that emerged was damning.

The first suspect was identified through process of elimination.

Of the 18 failed operations, 14 shared a common element.

They had been briefed to a weekly inter agency coordination meeting that included representatives from FBI, CIA, NSA, and Defense Intelligence Agency.

The meeting was designed to prevent duplication of effort and ensure coordinated approaches to Iranian targets.

Attendees had access to operational summaries, source information, and planned activities.

Someone in that meeting was reporting to Tran.

Mirror Hunt investigators narrowed the list.

They examined each regular attendee, analyzing personal finances, travel patterns, communications, and behavioral indicators.

One FBI representative stood out.

A supervisory special agent in the counter intelligence division.

16 years with the bureau.

Solid performance reviews.

No obvious red flags in his background, but subtle anomalies appeared under scrutiny.

His personal finances showed patterns inconsistent with his salary.

Nothing dramatic, but small deposits that didn’t trace to obvious sources.

His travel included side trips that didn’t appear in official records.

His phone showed gaps in location data during certain periods.

Surveillance was authorized.

The supervisor was meeting with an individual who shouldn’t exist.

FBI surveillance teams documented meetings at restaurants, parks, and shopping centers.

The meetings were brief, rarely more than 20 minutes.

They involved handoffs of envelopes and packages.

The individual he met was identified through facial recognition.

He was an Iranian intelligence officer operating under diplomatic cover at Iran’s UN mission in New York.

He was a known IRGC operative previously identified in connection with surveillance of Iranian dissident in the United States.

An FBI supervisor was meeting regularly with Iranian intelligence.

The betrayal was confirmed, but Mirror Hunt investigators knew he couldn’t be operating alone.

The pattern of compromised operations was too broad.

A single mole couldn’t explain all the failures.

There were more.

The investigation expanded methodically.

If one supervisor could be recruited, others could be as well.

The Mirror Hunt team examined every FBI employee with significant access to Iran related operations.

The criteria were specific.

Access to the compromised operations, opportunity to communicate with external handlers, and any behavioral indicators that might suggest compromise.

Over 3 months, four additional suspects emerged.

a counterintelligence analyst who prepared briefing materials for senior leadership.

Her work product was distributed to every compromised operation.

She had access to source identities that should have been compartmentalized.

A special agent in the New York field office who handled liaison with allied intelligence services.

He attended briefings on joint operations that had subsequently failed.

His finances showed unexplained improvements.

A technical specialist in the FBI’s communications division who had access to encrypted channels used for source communications.

She could have compromised the secure systems that protected source identities.

A staff operations specialist who managed logistics for sensitive operations.

He knew when and where operations would occur.

information that had clearly reached Iranian hands, five FBI employees, four years of betrayal, dozens of compromised operations, at least seven dead sources.

The scope of the penetration was catastrophic.

The most urgent concern was a source known only by a cryptony.

Cardinal was the FBI’s most valuable human intelligence source inside Iran.

Recruited 12 years earlier, Cardinal had provided intelligence that prevented multiple terrorist attacks, exposed Iranian assassination operations, and revealed critical details about Iran’s nuclear program.

Cardinal’s identity was the most closely guarded secret in American counter intelligence.

Only eight people within the FBI were supposed to know Cardinal’s true name.

The source’s intelligence was laundered through multiple channels before reaching analysts, specifically to protect against the possibility of penetration, but the protections had been breached.

Mirror Hunt investigators discovered that the compromised analyst had accessed files she shouldn’t have been able to reach.

Through a combination of social engineering and system vulnerabilities, she’d obtained fragments of information that combined could identify Cardinal.

She had been assembling the puzzle for months, and intercepted communications indicated she was preparing to transmit her findings.

The transmission was scheduled for 4 days away.

If Cardinal was exposed, Iranian security services would arrest, torture, and execute one of America’s most important intelligence sources.

12 years of irreplaceable access would be destroyed.

The intelligence that had protected American lives would end, and a human being who had risked everything to help America would die because of treachery within the FBY itself.

Operation Looking Glass was authorized immediately.

The operation faced unprecedented challenges.

Five FBI employees had to be arrested simultaneously.

Any warning would allow them to alert their handlers, potentially triggering immediate action against Cardinal.

The arrests had to be perfect, but arresting FBI agents was extraordinarily complex.

They had training in surveillance detection.

They had access to FBEI systems that might reveal investigation activity.

They had colleagues who might inadvertently warn them.

The operation would be conducted by FBI personnel who had no idea they were arresting fellow agents until the moment of execution.

Cover stories were prepared.

Each target would be summoned to a meeting location under plausible pretexts.

Tactical teams would be positioned at each location.

The arrests would occur within a 60-second window.

No room for error.

The final four days were excruciating.

Mirror hunt investigators monitored the five suspects around the clock.

any indication that they suspected investigation would require immediate action, potentially compromising the operation.

The analyst continued her normal routine.

She attended meetings.

She prepared briefing materials.

She accessed files that she carefully logged to avoid suspicion.

She had no idea she was being watched.

The supervisor continued meeting his Iranian handler.

The meetings were documented but not interrupted.

Premature action would alert the network.

The other three suspects maintained their routines.

Work, home, weekend activities, normal lives, concealing extraordinary betrayal.

72 hours before the scheduled transmission, Mirror Hunt was ready.

The arrests launched at 6:00 a.m.on a Thursday.

Each suspect received a summon to a meeting that seemed routine, a briefing, a personnel matter, an operational consultation.

Nothing that would trigger suspicion.

At five locations across Washington, New York, and Quantico, tactical teams waited.

The supervisor arrived at FBY headquarters for what he believed was a budget meeting.

As he stepped off the elevator, he was surrounded by agents he didn’t recognize.

His credentials were seized.

His phone was taken.

He was informed he was under arrest for espionage.

He said nothing.

At the New York field office, the liaison agent was arrested in a conference room.

He’d been told he was receiving accommodation.

Instead, he received handcuffs.

At Quantico, the technical specialist was detained at her workstation.

FBI cyber team simultaneously locked her access to all systems, preventing any attempt to send warning communications.

At an offsite location, the analyst was arrested as she arrived for a supposed source meeting.

She had brought documents she intended to photograph, evidence that would be used against her at trial.

The operations specialist was taken at his home where tactical teams found $47,000 in cash hidden in his garage.