Covert Iranian Military Network Brings in Equipment and Circumvents US Sanctions

A Reuters investigation has concluded that Iran established a global network of secret military entities to import equipment, explosives, and heavy trucks worth at least $2 billion since January 2025, circumventing the U.S. naval blockade and Western sanctions.

These clandestine entities, which operate under names beginning with the letters “Vedaj” – an acronym for Iran’s Ministry of Defense – form a vast financial and military system comprising more than 5,000 organizations. Their financial transactions can be traced through shipping manifests and other import data dating back to 2016. Some are linked to the Islamic Revolutionary Guard Corps (IRGC) and commercial groups known as “Bonyads,” which are controlled by Iran’s elite.

During the 18-month period from January 2025 to June 2026 – a timeframe that includes the first four months of this year’s war – a single entity among these, Vedaj 346428, imported large quantities of rocket fuel, explosives, and weapons components essential for manufacturing drones and missiles, as well as heavy trucks that could be used as missile launch platforms. This equipment reached Iran by land, sea, and air, and records show that a significant portion originated from China, Russia, and Germany.

All the secret entities share the same address in Tehran, which is also the address of Iran’s Ministry of Defense and Armed Forces Logistics. These agencies list their founding date as February 11, 1979, the day Ayatollah Khomeini assumed power in Iran following the overthrow of the Shah’s regime. However, records indicate that most of these entities were actually established in 2013, while Iran was struggling under sanctions that had caused its crude oil exports to plummet and its currency to collapse.

Identified by Reuters for the first time in collaboration with the Israeli-American risk advisory firm 240 Analytics, these entities form the backbone of Iran’s military procurement system and its efforts to evade sanctions. They operate a network of individuals acting as fronts and foreign shell companies, known as “trustees,” who use proceeds from illegal oil sales to purchase goods on behalf of the Islamic Republic.

Senior military commanders involved in Iran’s ballistic missile and drone programs utilize this network. Phone numbers registered under 91 of these entities appear in records of Sepah Bank, the state-owned bank, belonging to IRGC members who hold accounts there. Among them are at least two commanders accused by the United States of committing abuses against civilian protesters.

While the Iranian military has been subject to multiple U.S. sanctions for decades, Reuters found no evidence that any of the entities mentioned in the documents have been included on Western sanctions lists.

Mead Kalantari, a former senior official at the U.S. Treasury Department who helped design the U.S. sanctions program against Iran, said, “What we see here is the military lifeline of the regime during this conflict and for many years prior. This is the entire integrated system of the Iranian military’s business operations.”

The arms import network has supplied Tehran with a significant amount of raw materials needed to manufacture missiles and drones. These weapons have been responsible for Iran’s sustained, precise attacks on energy facilities in the Gulf, enabling the Islamic Republic to mitigate the impact of the U.S. military offensive. In other reports this year, Reuters demonstrated how Iran withstood U.S. pressure by exploiting cryptocurrency trading platforms and illegal gambling networks to generate illicit revenue and circumvent sanctions; how the Islamic Revolutionary Guard Corps (IRGC) strengthened its control over the Strait of Hormuz; and how the war ushered in a new era of repression in Iran.

One of four sanctions and arms experts on Iran who reviewed the findings of Reuters’ investigation confirmed that much of these materials can be used in Iran’s missile and drone programs.

None of the Iranian government entities or companies contacted by Reuters responded to detailed requests for comment, including Iran’s mission to the United Nations in Geneva and the Iranian presidency.

As part of its tracking of imports, Reuters reviewed a portion of approximately 19,000 import records by cross-referencing them with shipping documents, social media video clips, and official media reports. The data show that nearly all materials imported by Iran were exempt from customs duties and specifically classified as military equipment. Experts noted that many of the imports, including explosives, could be considered dual-use and thus potentially have civilian applications.

The Wall Street Journal published a report on some shipments from China on September 23.

Maleki, who until last year served as Deputy Director of the Office of Foreign Assets Control at the U.S. Department of the Treasury, stated that clandestine military entities operate a parallel foreign trade system alongside the formal global economy, enabling Iran to spend funds earned abroad from illegal oil sales on military equipment.

Money rarely crosses borders, as doing so could trigger alerts regarding sanctions violations. Instead, import data revealed that 97 percent of the shipments reviewed by Reuters were settled “without money transfer.” Trusted intermediaries, Iranian residents abroad, purchased goods using funds deposited in foreign banks and then shipped them to Iran.

Among the entities benefiting from this network is the military unit overseeing Iran’s ballistic missile programs. Another is Tander Sahra (Desert Thunder), which Washington sanctioned in 2024 for manufacturing and supplying drones to Russia that have caused devastation in Ukraine.

Reuters and 240 Analytics identified Iranian military units by matching import data with corporate records, email correspondence, and documents collected by the Wiki Iran website.

Reuters was unable to identify the operators of Wiki Iran, a website that hosts leaked documents from the Islamic Republic and claims to be run by Iranian opposition figures “forced into exile.”

According to import data for the first six months of this year, the shipments included $1.9 million worth of detonators, tons of explosives, aircraft engine parts, rocket fuel components, and heavy launch vehicles. Arms and sanctions experts said all these materials could be used as key components in the manufacture and launch of ballistic missiles and drones, including Shahed drones.

Peter Salisbury, a non-resident associate professor at Columbia University who has spent the past few years studying Iranian arms transfers and their supply chains, said, “This appears to be a wide-ranging effort to rebuild or expand Iran’s current arsenal of drones and missiles.” He added, “These data clearly demonstrate the Iranian system’s ability to adapt and find new routes.”

Salisbury and another arms expert said they had previously used WikiLeaks data and found it to be accurate.

The United States and Israel have targeted Iran’s ballistic missile and drone operations since the start of this year’s war on February 28, including factories that the U.S. Department of Defense (Pentagon) said were producing munitions. Reuters was unable to determine the extent of the damage, but Tehran continued to target its neighbors and ships attempting to navigate the Strait of Hormuz.

Imports into Iran arrived by cargo ships via the Caspian Sea from Russia, by trucks from Central Asia, and by cargo planes from China, according to import data and documents obtained by Reuters.

In response to detailed questions about Reuters’ findings, the Chinese Foreign Ministry said it was “not aware of the situation you describe.”

The ministry stated in a faxed statement: “We strongly reject attempts to link with ill intent the combat operations in the region to China or to smear China.”

In addition to individual components, Iran purchases precision machinery that can be used to manufacture its own military equipment. Purchases included items classified as advanced computer-controlled lathes, electron beam furnaces, and particle accelerators, according to import data covering the period through June. All of this equipment has industrial uses and can also be used in the manufacture of military equipment, including drone and missile airframes.

On October 12, U.S. President Donald Trump said he did not believe that China and Russia were providing support to Tehran. He wrote on social media, “If they are doing it, it is at a very limited level, but I don’t believe they are doing it at all.” He added, “They have a lot to lose, and we will know it, and we will know it very quickly!”

The data show that since the outbreak of the war, $27 million in imports for the Iranian military were recorded as coming from the United Arab Emirates, with almost all arriving by sea.

Iran targeted infrastructure facilities in the UAE until May and continues to attack its crude oil tankers with drones and missiles.

The latest shipment from the UAE, listed as electronics, arrived by sea on June 27, nine days after the United States announced the suspension of its maritime blockade. The blockade was resumed in mid-July and remains in effect.

In addition to Maleki, the list of arms experts included Christian Bæhr and Henry Thompson, specialists in Iranian arms supplies, and Damien Splitters, founder of Heimdall, an organization focused on illicit supply chains and arms procurement.

Niamh Benstock, a senior analyst at 240 Analytics, which collects and analyzes data on terrorism risks and financing for corporate and government clients, said, “These entities, which are identified by numbers, serve as the hidden infrastructure of the Islamic Republic’s network for circumventing international sanctions, and much more.” He added, “The volume of funds flowing through these entities is staggering, and no one has ever paid attention to them before.”

Benstock, a 35-year-old economist, said he discovered the entities in June 2025 while uploading thousands of pages of freely available documents from Sepah Bank to the 240 Analytics online platform. Sepah Bank is the Iranian bank responsible for processing salary and pension payments for members of the Islamic Revolutionary Guard Corps.

A group calling itself “Code Breakers” claimed responsibility for hacking Sepah Bank, and later announced additional operations to seize Iranian government data.

In response to Reuters’ questions about the data via email, Wiki Iran stated, “We can confirm that the materials are authentic and that their source has been verified through our sources and contacts inside and outside Iran.”

240 Analytics was founded to provide services to companies and governments for verifying potential partners and clients. Benstock said he initially believed the documents would help expose Iran’s financial operations. However, he quickly realized that thousands of those accounts belonged to entities following the same naming pattern. All their names began with the letters “Vaja,” followed by a five- or six-digit number written out in letters rather than numerals. They were all registered on the same date and at the same address.

Benstock said that when he first saw the size of the account balances in Sepah Bank, he thought he had misplaced a decimal point. He found that 36 of these entities held foreign currency accounts with deposits totaling $1.2 billion by the end of 2024.

The rest of the network held approximately $1.8 billion in local currency, with an average of about $360,000 per account.

At the time, while balancing his PhD dissertation, his work at 240 Analytics, and caring for his newborn child, Benstock put the project on hold. He returned to it last August, reviewed newer documents, and found that the same entities were receiving funds from smuggled oil sales and purchasing large quantities of dual-use equipment.

Benstock said, “That major breach made me start to realize the actual scale of what we were talking about, and to find concrete examples of imports... At that point, I realized we had uncovered something truly significant.”

Each entity affiliated with the Ministry of Defense could also be identified by a unique 11-digit government identification number. These entities were listed in Iran’s Commercial Registry, an official database containing thousands of companies. Benstock realized that the 11-digit identification number, or the same Ministry of Defense number, repeatedly appeared in shipping documents, invoices, and bank statements, enabling the tracking of the network even when an entity operated through a front company.

240 Analytics then contacted Reuters to help map the network of entities. Using the 11-digit identification numbers provided by Benstock, Reuters reviewed confidential shipping documents and recent import data, and consulted Iran’s company registry to uncover the scope of the network and how it enabled Iran to replenish its stockpiles during the war.

One entity stood out, with purchases dating back to 2016, identified by the registration number Vaja 346428.

Pardis 346428 steadily increased its foreign purchases over the years, rising from $442 million in the 12 months ending in March 2023 to $989 million in the following year, according to customs statistics published by Iranian media. This placed the entity among the top ten importers in Iran.

Reuters found that Pardis 346428 imported $2.3 billion worth of military equipment between January 2025 and June 2026, according to records provided by Import Genius, a platform that aggregates import and export data.

Import data showed that between January and April 2025, Pardis 346428 imported approximately 886 tons of chemicals through Iran’s Bandar Abbas port complex. The data indicated that the origin of these materials was China and that they fell under a customs heading covering sodium chlorate and other types of perchlorates, which are key raw materials used in the production of solid rocket fuel. Three days after the arrival of the final shipment, a massive explosion shook the port.

Two people familiar with the April 26 explosion said it was caused by the ignition of sodium perchlorate while it was stored in shipping containers on a port dock. Iranian state media reported that Sina Port and Marine Services Development Company was storing the chemicals. The company is owned by the Bonyad Mostazafan (Foundation of the Oppressed), a multi-billion-dollar institution whose activities are under the direct control of Iran’s Supreme Leader.

The explosion killed at least 70 people and injured more than 1,200. The then-CEO of Sina Company said the blast was caused by “incorrect information” regarding the contents of a shipment delivered “without documents or identification cards.” Reuters was unable to determine whether the chemicals in the 75-ton shipment were responsible for the explosion.

The United States imposed sanctions on Bonyad Mostazafan in 2020. Although it presents itself as a charitable institution serving the poor, the U.S. Treasury Department stated that it is used by the Supreme Leader to enrich his office and reward his allies.

Hossein Dehghan runs the foundation. He was appointed defense minister in 2013, when most of these entities began their activities, and served in that post for four years. Before that, he was a commander of the Iranian Revolutionary Guard Corps in Lebanon during the bloody bombing that targeted international peacekeeping forces in Beirut in 1983, which killed 241 American soldiers, 58 French paratroopers, and Lebanese civilians, according to a U.S. Treasury Department statement on the sanctions imposed on him. The United States held Iran responsible for the attack.

In addition to components that can be used to manufacture rocket fuel, the data also show that Iran imports heavy trucks, which the military uses as mobile, camouflaged launch platforms for missiles and drones.

Benstock identified an example of such imports early on. In the fall of 2022, an Iranian car dealer living in Italy purchased six Iveco Eurocargo trucks for €426,000, according to records from the website Wiki Iran. The trucks were shipped to another company called Delmi Trading in Dubai, which in turn arranged their delivery to Bandar Abbas port.

The 11-digit identification number of the end buyer belonged to Pardis 346428. According to the shipping list, the trucks were ultimately delivered to Sahra Tender, which plays a key role in the manufacturing and sale of Iranian Shahed drones. Delmi did not respond to a request for comment on the deal.

Between January 2025 and June 2026, Wedja 346428 imported an additional 435 Iveco trucks, bringing its total to 346,428 units. Using satellite imagery and social media, Reuters tracked some of these trucks to a customs yard on the outskirts of Tehran in February 2025, and used import data to match the vehicle identification numbers of three of the vehicles—unique codes that identify the manufacturer and origin of the vehicle.

Another Iveco truck appeared during the war, when the U.S. Central Command posted a video on social media in March, claiming it showed a strike targeting a camouflaged Iranian mobile missile launch platform. Reuters was unable to determine whether the truck was among those imported by Wedja 346428. However, analysts at Jane’s, a British open-source defense intelligence firm, said the truck shown being destroyed in the video was an Iveco model imported by Iran.

In response to Reuters’ findings, Iveco stated, “Authorized distributors must ensure that our products are not used for military, chemical, biological, or nuclear purposes after sale.” The company said it has contractual guarantees ensuring its products do not reach “prohibited destinations, entities, or individuals.”

Iveco, headquartered in Italy, said it has no control over “products transported or exported by third parties with whom we have no direct contractual relationship.”

The company added, “We have confirmed that any presence of Iveco trucks in Iran occurred outside the control and responsibility of the Iveco Group.” It said it has no record of the sale to the Iranian trader located in Italy in 2022, and that most of the Iveco trucks Reuters observed in the customs yard in 2025 were heading to Central Asia.

Using Wedja 346428, Iran also imported thousands of Toyota Hilux and Land Cruiser trucks, which the Iranian Revolutionary Guard Corps and its allied armed groups modify to mount heavy machine guns on their rear beds.

Video footage from protests in Iran earlier this year showed security forces accompanying vehicles equipped with machine guns in a convoy of Toyota Land Cruisers patrolling the streets of Tonekabon, a city in northern Iran.

In January 2025, Wedja 346428 imported four Toyota Tundra vehicles, which the Iranian Revolutionary Guard Corps uses to transport drones.

A Toyota spokesperson said the company does not conduct business in Iran. He added, “Toyota was not involved in the purchases reported by Reuters and has no knowledge of them.”

Japan’s Ministry of Economy, Trade and Industry said it could not comment on the details of Reuters’ investigation, but added that it imposes strict controls on goods related to national security.

On February 9, 2026, a ship arrived in Bandar Abbas carrying 93 tons of raw Chinese titanium, a hard metal that weapons and sanctions experts say can be used to manufacture missile bodies and engine casings.

Overall, during the month preceding the outbreak of war on February 28, ships also transported a total of 268 tons of nitrocellulose and 276 tons of other chemicals from China, classified under the customs heading that includes perchlorates, components used in the manufacture of rocket fuel and explosives.

Even as the war intensified and a blockade was imposed on Iranian ships, the Iranian military continued to import materials from abroad. According to the data, monthly import volumes initially fell by 47 percent to $54 million in March compared with the previous month, but rose to $77 million by May.

In June 2026, a Russian shipment of fuses valued at $1.9 million arrived. These are components that can be used to detonate high explosives, such as those found in drone and missile warheads. This shipment was among five similar Russian consignments totaling $7.6 million since the beginning of 2025.

Imports did not come solely from Russia and China. Companies in the European Union, which has imposed sanctions on Iran’s Ministry of Defense, also shipped goods to the Iranian military.

Import data showed that trucks, aircraft engine components, and electronics worth hundreds of millions of dollars, including $34 million worth of Iveco trucks, all originated from Germany and other EU countries. All of their documents were listed under the name Vadjah 346428.

Not all import data included detailed descriptions of the shipments. In many cases, Reuters relied on customs codes to identify their contents and declared origins, without being able to verify them independently.

A European Union spokesperson said that member states are responsible for enforcing the bloc’s sanctions, which include those against Sahra Tander and others.

A large part of Iran’s economy is controlled by semi-state institutions known as “Bonyads” in Persian, which are run by members of the country’s elite. Many were established after the 1979 Islamic Revolution using assets confiscated from the ousted Shah’s family and from other individuals deemed enemies of the new state.

According to a 2013 Reuters investigation and multiple documents on U.S. government sanctions, the Iranian elite use Bonyad institutions to maintain their grip on power by linking loyal officials to a wide network of cronyism. The United States and Europe, in sanctions imposed over the years, state that Bonyad institutions, like the Islamic Revolutionary Guard Corps (IRGC), play a central role in the violent suppression of Iranians for years.

One such institution, the Foundation for the Preservation of Historical Monuments and the Promotion of Sacred Defense Values, illustrates the extent to which the Ministry of Defense’s network is embedded in Iran’s economy and its repressive apparatus. According to Reuters’ review of documents dating back several years linking the foundation to at least two separate entities under the Ministry of Defense, the transactions include not only imports but also domestic cash transfers.

The foundation is tasked with promoting “the culture of resistance, sacrifice, jihad, and martyrdom.” It serves as a key propaganda arm of the government and is responsible for maintaining the legitimacy and ideology of the Islamic Republic.

In 2017, the foundation received four shipments of electronic devices and cooling units, according to Wikileaks Iran data. Again, the registration number on the shipments matched the entity Vadjah 346428.

It is unclear how the foundation used these materials, but its leadership includes senior commanders of the IRGC across all 31 provinces of Iran. In Khuzestan, this includes Brigadier General Hassan Shahvarpour, who has long commanded the IRGC’s elite forces in the troubled region.

According to a U.S. sanctions document, units under Shahwar Bor’s command killed at least 100 Iranian civilians in Mahshahr in 2019 during protests over fuel price hikes. The United States stated that these units trapped people who were attempting to flee using armored vehicles and opened fire on crowds with machine guns.

A local human rights activist, who said he witnessed the killings, reported that Shahwar Bor’s forces subsequently set fire to sugarcane fields where some fleeing protesters had taken shelter. His account was corroborated by a second activist who was present that day.

After Washington imposed sanctions on Shahwar Bor in 2020 over allegations of human rights violations, a prominent cleric embraced him during a religious ceremony and told him that the sanctions were “a source of pride.”

In 2021, Shahwar Bor requested 50 billion Iranian rials, then worth more than $1 million at the official exchange rate, from a state-owned steel company to fund a new building for the Islamic Revolutionary Guard Corps (IRGC) in Khuzestan, according to a document reviewed by Reuters. The account designated to receive the funds, according to documents bearing his signature, was entity 424000.

Earlier this year, Shahwar Bor’s men crushed new protests in Khuzestan that were part of a nationwide uprising against the economic collapse, according to activists. Across Iran, thousands were killed and tens of thousands imprisoned. In Khuzestan, the two activists said they had documented the names of 46 dead, most of whom were killed on January 8 and 9 when the IRGC opened fire on demonstrators.

Footage broadcast by state media from an event earlier this year showed Shahwar Bor’s IRGC units patrolling a town in Khuzestan in white Toyota Tundra trucks, a model favored by the Defense Ministry network. One of the trucks carried a bright pink Shahed drone.