Reuters: A secret Iranian network of 5,000 entities to import equipment and bypass US sanctions

These entities, which operate in the shadows, bear names starting with the letters "VODJA," an acronym for the Iranian Ministry of Defense.

More than 5,000 entities form a massive financial and military system, whose transactions can be tracked through bills of lading and other import data dating back to 2016.

Some of these are linked to the Iranian Revolutionary Guard Corps (IRGC) and commercial groups known as "Bonyads," which are controlled by the Iranian elite.

The investigation's findings reveal one of the war's greatest puzzles: How does the Revolutionary Guard replenish its arsenal of missiles and drones while launching them by the thousands?

During the eighteen months from January 2025 to June 2026, a period including the first four months of this year's war, just one of these entities, "VODJA 346428," imported massive quantities of rocket fuel, explosives, and weapons components necessary for manufacturing drones and missiles, as well as heavy trucks that can be used as mobile missile launchers.

This equipment reached Iran by land, sea, and air, and records showed that a significant portion originated from China, Russia, and Germany.

The investigation into the Iranian Ministry of Defense network is based on thousands of Iranian banking and government records, company registration documents, and import data.

All the secret entities share a single address in Tehran—the same address as the Iranian Ministry of Defense and Armed Forces Logistics—and these agencies list their founding date as February 11, 1979, the day Khomeini took power in Iran after the overthrow of the Shah's regime.

However, records show that most of these entities were actually founded in 2013, when Iran was reeling under the weight of sanctions that led to a decline in its crude oil exports and the collapse of its currency.

These entities, identified by Reuters for the first time in collaboration with the Israeli-American risk consultancy firm "240 Analytics," form the backbone of the Iranian military procurement system and sanctions evasion.

These entities operate a network of people acting as fronts, alongside foreign shell companies—known as "trustees"—who use proceeds from illicit oil sales to purchase goods for the Islamic Republic.

The network is used by senior military commanders involved in Iran's ballistic missile and drone programs.

Furthermore, phone numbers registered to 91 of these entities in a semi-governmental bank's records show they belong to IRGC members who hold accounts at the bank.

Among them are at least two commanders accused by the United States of committing violations against civilian protesters.

While the Iranian military has been subject to multiple US sanctions for decades, Reuters found no evidence that any of the entities mentioned in the documents had been placed on Western sanctions lists.

Miyad Maleki, a former senior official at the US Department of the Treasury who helped develop the US sanctions program on Iran, said: "What we are seeing here is the regime's military lifeline during this conflict and for many years before it. This is the entire integrated system for the Iranian military's business operations."

The arms import network provided much of the raw material Tehran needs to build missiles and drones.

These weapons are responsible for persistent, precision Iranian attacks on energy facilities in the Gulf, allowing the Islamic Republic to limit the impact of the US military offensive.

In other reports this year, Reuters showed how Iran withstood US pressure by exploiting cryptocurrency trading platforms and illegal gambling networks to generate illicit revenue and bypass sanctions, how the IRGC strengthened its control over the Strait of Hormuz, and how the war ushered in a new era of repression in Iran.

Maleki was one of four experts on sanctions on Iran and weapons who reviewed the findings of the Reuters investigation and confirmed that many of these materials could be used in Iran’s missile and drone programs.

None of the Iranian government agencies or companies contacted by Reuters responded to detailed requests for comment, including Tehran’s mission to the United Nations in Geneva and the Iranian presidency.

As part of its tracking of imports, Reuters reviewed a portion of some 19,000 import records and compared them with shipping documents, social media clips, and state media reports. The data shows that nearly all the materials Iran imported were exempt from customs duties and specifically classified as military equipment.

Experts noted that many of the imports, including explosives, could be considered dual-use and thus could have civilian applications as well.

The Wall Street Journal published a report on some of the shipments coming from China on September 23.

Maleki, who until last year was the assistant director of the Office of Foreign Assets Control (OFAC) at the US Treasury, said the secret military entities constitute a parallel foreign trade system, allowing Iran to spend money it earns abroad from illicit oil sales on military equipment.

Money rarely crosses borders, as this could trigger an alert regarding a sanctions violation.

Instead, import data showed that 97% of the transactions for the shipments reviewed by Reuters were settled "without fund transfers." Trusted Iranian intermediaries living abroad would purchase the goods using funds deposited in foreign banks and then ship them to Iran.

Among the entities obtaining their requirements through this network is the military unit overseeing Iran's ballistic missile programs, in addition to the company "Tender Sahra" (Desert Thunder), which Washington sanctioned in 2024 for manufacturing and supplying drones to Russia, which were used to cause destruction in Ukraine.

Reuters and the firm "240 Analytics" identified the Iranian military units by matching import data with company registers, emails, and documents collected by the "Wiki Iran" website.

Reuters could not identify those behind "Wiki Iran," a website that receives leaked documents from the Islamic Republic and states that it is run by Iranian anti-government dissidents "forced to live in exile."

According to import databases during the first six months of this year, shipments included detonators worth $1.9 million, tons of explosives, jet engine parts, rocket fuel components, and heavy launch vehicles.

Weapons and sanctions experts said all these materials could be used as key components to build and launch ballistic missiles and drones, including "Shahed" aircraft.

Peter Salisbury, a non-resident associate fellow at Columbia University, who has spent the last few years studying Iranian arms transfers and supply chains, said: "This appears to be a large-scale effort to rebuild or expand Iran's current arsenal" of drones and missiles.

"These data clearly show the Iranian system's ability to adapt and find new pathways," he added.

Salisbury and one weapons expert said they had previously used "Wiki Iran" data and found it to be accurate.

The United States and Israel have targeted Iranian operations related to ballistic missiles and drones since the start of this year's war on February 28, including factories that the US Department of Defense (Pentagon) said were producing munitions.

Reuters could not determine the extent of the damage, but Tehran continued to target its neighbors and ships attempting to transit the Strait of Hormuz.

Imports entered Iran on cargo ships via the Caspian Sea from Russia, by truck from Central Asia, and on cargo planes from China, according to the import data and documents obtained by Reuters.

In response to detailed questions regarding the findings of the Reuters investigation, the Chinese Foreign Ministry said it was "not aware of the situation you describe."

In a statement sent by fax, the ministry said: "We strongly reject attempts to maliciously link the hostilities in the region with China or to smear China."

The Russian Ministry of Defense, the US Treasury, the White House, and US Central Command did not respond to requests for comment.

Beyond individual components, Iran is purchasing precision machinery that can be used to manufacture its own military equipment.

Purchases include materials classified as sophisticated computer numerical control (CNC) lathes, electron-beam furnaces, and particle accelerators, according to import data covering the period up to June.

All of these items have industrial uses and can also be used in manufacturing military equipment, including drone and missile airframes.

On October 12, US President Donald Trump said he did not believe China and Russia were providing support to Tehran.

"If they are doing it, it's at a very limited level, but I don't think they are doing it at all," he wrote on social media.

He added: "They have a lot to lose, we will know that, and we will know it very quickly!"

The data shows that since the outbreak of the war, Iranian military imports worth $27 million have been recorded as coming from the UAE, almost all of which arrived by sea.

Iran targeted infrastructure facilities in the UAE until May, and continues to strike its crude oil tankers with drones and missiles.

The latest shipment from the UAE, listed as electronics, arrived by sea on June 27, 9 days after the US announced the suspension of its naval blockade. The blockade resumed in mid-July and remains in effect.

An Emirati official sent Reuters a statement after the report was published, stating that the government "categorically rejects and refutes these baseless allegations. These accusations are not based on any foundation at all, and misrepresent the UAE's policies and actions."

The statement added that the UAE is committed to "preventing any attempts to misuse its territory for illicit activities."

In addition to Maleki, the list of arms experts included Christian Bais and Henry Thompson, specialists in Iranian arms supplies, and Damien Spleeters, founder of the "Heimdall" organization, which specializes in illicit supply chains and arms procurement.

The Network

Noam Benstok, a senior analyst at 240 Analytics, which collects and analyzes terrorism risk and financing data for corporate and government clients, said: "These numbered entities are the hidden infrastructure of the Islamic Republic's network to circumvent international sanctions, and much more than that." He added: "The volume of money passing through these entities is staggering, and no one had ever paid attention to them before."

Benstok, a 35-year-old economist, added that he discovered these entities in June 2025, while downloading thousands of pages of Bank Sepah documents, freely available on the "WikiIran" website, onto the "240 Analytics" electronic platform.

Bank Sepah is the Iranian bank that handles salary and pension payments for members of the Revolutionary Guard.

A group called "Code Breakers" claimed responsibility for hacking Bank Sepah, and later announced other operations to seize Iranian government data.

Bank Sepah did not respond to a request for comment regarding the hack.

In an email response to Reuters' questions about the data, the "WikiIran" website said: "We can confirm that the materials are authentic, and their source has been verified through our sources and contacts inside and outside Iran."

240 Analytics was established to provide services to companies and governments to verify potential partners and clients. Benstok said he thought the documents would help reveal Iran's financial operations, but he soon realized that thousands of those accounts belonged to entities following the same naming pattern.

All their names began with the letters "Waja", followed by a five- or six-digit number written in letters rather than numbers, and they were all registered on the same date and at the same address.

The bank records reviewed by Reuters showed the names of the account holders, different identification numbers, and financial balances.

Benstok said that when he first saw the size of the account balances at Bank Sepah, he thought he had miscounted the decimal point. He found that 36 of these entities had foreign currency accounts, with deposits totaling $1.2 billion at the end of 2024.

The rest of the network held about $1.8 billion in local currency, with an average of about $360,000 per account.

At that time, while balancing his PhD thesis, his work at 240 Analytics, and caring for his newborn, Benstok put the project on hold. He returned to it last August, searched through more recent documents, and found that the same entities were receiving funds from smuggled oil sales and purchasing large quantities of dual-use equipment.

Benstok noted: "That was the big breakthrough that made me start to realize the actual scale of what we are talking about, and finding actual examples of imports... that was when I realized we had stumbled upon something really big."

Each entity affiliated with the Ministry of Defense could also be identified by a unique 11-digit government ID number, and these entities were listed in the Iranian Commercial Register, an official database containing thousands of companies.

Benstok realized that the 11-digit ID number, or the Ministry of Defense number itself, appeared repeatedly in bills of lading, invoices, and bank accounts, which allowed the network to be tracked even when the entity was operating through a front company.

At that point, 240 Analytics contacted Reuters to help map the network of entities. Using the 11-digit ID numbers provided by Benstok, Reuters reviewed confidential shipping documents and recent import data, and used the Iranian Commercial Register to reveal the scope of the network and how it enabled Iran to replenish its stocks during the war.

One entity whose purchases date back to 2016 stood out, which bears the ID number "Waja 346428".

"Waja 346428's" overseas purchases increased steadily over the years, from $442 million in the twelve months ending in March 2023, to $989 million in the following year, according to customs statistics published by Iranian media. This placed the entity among the top ten importers in Iran.

Reuters found that "Waja 346428" imported military equipment worth $2.3 billion in the period from January 2025 to June 2026, according to records provided by ImportGenius, a platform specializing in collecting import and export data.

Import data show that "Waja 346428" imported, between January and April 2025, 886 tons of chemicals through the Iranian port complex of Bandar Abbas.

The data indicated that the origin of these materials was China, and that they fall under a customs category that includes sodium chlorate and other types of perchlorates, which are key precursors used in the production of solid rocket fuel.

Three days after the last shipment arrived, a massive explosion rocked the port.

Two people familiar with the April 26 explosion said that the ignition of sodium perchlorate inside shipping containers on the port's pier caused it. Iranian state media reported that the "Sina Port and Marine Services Development Company" was storing the chemicals. The company is owned by "Bonyad Mostazafan" (Foundation of the Oppressed), a multi-billion dollar foundation whose activities are under the direct control of the Iranian Supreme Leader.

The explosion killed at least 70 people and injured more than 1,200. The CEO of Sina company said at the time that the explosion resulted from "incorrect information" regarding the contents of a shipment delivered "without documents or identification labels."

Reuters could not determine whether the chemicals in the 75-ton shipment were what caused the explosion.

The United States imposed sanctions on the Foundation of the Oppressed in 2020. Although it presents itself as a charity to serve the poor, the US Treasury Department said it is used by the Supreme Leader to enrich his office and reward his allies.

Hossein Dehghan manages the foundation, and he had been appointed Minister of Defense in 2013, when most of these entities began their activities. Dehghan held this position for four years.

Before that, he was a commander of the Iranian Revolutionary Guard forces in Lebanon during the deadly bombing that targeted international peacekeeping forces in Beirut in 1983, which resulted in the death of 241 American soldiers, 58 French paratroopers, and Lebanese civilians, according to the US Treasury Department statement regarding the sanctions imposed on him. The United States held Iran responsible for the attack.

Dehghan did not respond to a request for comment regarding the explosion, the entities affiliated with the Ministry of Defense, or his position, sent to him via the foundation and its legal representative.

In addition to components that can be used in rocket fuel manufacturing, data shows that Iran is importing heavy trucks used by the military as mobile camouflaged launch platforms for missiles and drones.

Benstok discovered an example of those imports early on. In the fall of 2022, an Iranian car dealer living in Italy bought six "Iveco EuroCargo" trucks for 426,000 euros, according to records from the "WikiIran" website.

The dealer shipped the trucks to another company called "Delmi Trading" in Dubai, which in turn delivered them to the port of Bandar Abbas.

The 11-digit ID number for the end buyer belonged to "Waja 346428".

According to the shipping list, the trucks were eventually delivered to "Sahra Thunder," which plays a key role in the manufacturing and sale of Iranian "Shahed" drones. "Delmi" did not respond to a request for comment on the deal.

Between January 2025 and June 2026, "Waja 346428" imported an additional 435 Iveco trucks.

Using satellite imagery and social media, Reuters tracked some of these trucks to a customs yard on the outskirts of Tehran in February 2025, and used import data to match the ID numbers of three of the vehicles, which are unique codes identifying the vehicle manufacturer and its origin.

Another Iveco truck appeared during the war, when the US Central Command posted a video on social media in March, which it said showed a strike targeting a camouflaged Iranian mobile missile launcher.

Reuters was unable to determine if the truck was among those imported by "VODJA 346428," but analysts at the British defense intelligence firm Janes said the truck seen being destroyed in the clip is an "Iveco" model, of a type imported by Iran.

In response to Reuters' findings, Iveco stated: "Authorized dealers must ensure that our products, after being sold, are not used for military, chemical, biological, or nuclear purposes." It added that it has contractual safeguards to ensure its products do not reach "prohibited destinations, entities, or individuals."

The company, which is based in Italy, said it has no control over "products transported or exported by third parties with whom we have no direct contractual relationship."

It added: "We have verified that any presence of Iveco trucks in Iran occurred outside the control and responsibility of the Iveco Group." The company stated it has no record of the sale made to the Iranian dealer located in Italy in 2022, and that most of the "Iveco" trucks spotted by Reuters in the customs yard in 2025 were headed to Central Asia.

Using "VODJA 346428," Iran also imported thousands of "Toyota Hilux" and "Land Cruiser" trucks, which are modified by the Iranian Revolutionary Guard Corps (IRGC) and loyalist militant groups to mount heavy machine guns on their rear beds.

Video footage from protests in Iran earlier this year shows security forces accompanied by vehicles equipped with machine guns, as part of a convoy of "Toyota Land Cruiser" vehicles patrolling the streets of Tonekabon, a city in the north of the country.

In January 2025, "VODJA 346428" imported four "Toyota Tundra" vehicles, a vehicle used by the IRGC to transport drones.

A Toyota spokesperson said the company does not conduct any business in Iran, adding: "Toyota was not involved in and has no knowledge of the purchases reported by Reuters."

Japan's Ministry of Economy, Trade and Industry said it could not comment on the details of the Reuters investigation, but added that it imposes strict controls on goods related to national security.

It continued: "We also implement outreach and communication activities to inform companies about these export control regulations."

On February 9, 2026, a ship arrived at Bandar Abbas carrying 93 tons of raw Chinese titanium, an extremely hard metal that weapons and sanctions experts say can be used to manufacture missile airframes and engine casings.

In total, and over the month preceding the outbreak of war on February 28, ships also transported a total of 268 tons of nitrocellulose and 276 tons of other chemicals from China, listed under the customs heading that includes perchlorates, which are components used in the manufacture of missile fuel and explosives.

Even with the war raging and a blockade imposed on Iranian ships, the Iranian military continued to bring in materials from abroad. According to the data, monthly import volumes initially dropped by 47% to $54 million in March compared to the previous month, but rose to $77 million by May.

In June 2026, a Russian shipment of detonators worth $1.9 million arrived, tools that can be used to trigger high explosives, such as those found in drone and missile warheads. This shipment was the last of five similar Russian shipments with a total value of $7.6 million since the beginning of 2025.

Imports did not come solely from Russia and China, as companies in the European Union, which has imposed sanctions on the Iranian Ministry of Defense, also shipped goods to the Iranian military.

Import data showed that trucks and components for aircraft engines and electronics worth hundreds of millions of dollars, including "Iveco" trucks worth $34 million, all came from Germany and elsewhere in the European Union. Their documents were all listed under the name "VODJA 346428."

Not all import data included detailed descriptions of the shipments. In many cases, Reuters relied on customs codes to determine their contents and declared origins, without being able to independently verify them.

A European Union spokesperson said member states are responsible for enforcing the bloc's sanctions, which include "Sahra Tondar" and others.

The spokesperson added: "The European Union continues to evaluate information regarding Iran's strengthening of its drone and missile programs with great care."

The governments of Germany and Italy did not respond to requests for comment.

The Pink Drone

A large part of the Iranian economy is controlled by quasi-governmental institutions known as "Bonyads" in Persian, which are managed by individuals from the country's elite.

Many were established after the 1979 Islamic Revolution, using assets confiscated from the deposed Shah’s family and other individuals deemed enemies of the new state.

According to a 2013 investigation by Reuters and numerous sanctions documents issued by the US government, the Iranian elite uses "Bonyad" institutions to maintain its grip on power by linking loyal officials to a vast network of patronage.

The United States and Europe say, in sanctions imposed over the years, that "Bonyad" institutions, like the IRGC, have played a pivotal role in the violent repression of Iranians for years.

One of these institutions, the Foundation for the Preservation of Antiquities and the Dissemination of Sacred Defense Values, illustrates the extent to which the Ministry of Defense's network is embedded in the Iranian economy and the country's security apparatus.

The transactions include not only imports but also internal cash transfers, according to documents dating back years and reviewed by Reuters, which link the foundation to at least two separate entities affiliated with the Ministry of Defense.

The foundation is tasked with promoting the "culture of resistance, sacrifice, jihad, and martyrdom," and is a key propaganda arm of the government responsible for maintaining the legitimacy and ideology of the Islamic Republic.

In 2017, the foundation received four shipments of electronic equipment and cooling units, according to "WikiIran" data.

Once again, the identification number recorded on the shipments matched the entity "VODJA 346428."

It is not known how the foundation used these materials, but its leadership includes senior IRGC commanders in each of Iran's 31 provinces.

In Khuzestan, this includes Brigadier General Hassan Shahvarpour, the long-time commander of the elite IRGC forces in the troubled region.

Shahvarpour did not respond to a detailed request for comment.

According to a US sanctions document, units under Shahvarpour's command killed at least 100 Iranian civilians in Mahshahr in 2019 during protests over rising fuel prices.

The United States said these units trapped people attempting to flee using armored vehicles and opened machine-gun fire on the crowds.

A local human rights activist, who said he witnessed the killings, stated that Shahvarpour's forces then set fire to sugarcane fields where some of the fleeing protesters were hiding. His account was corroborated by a second activist who was present that day.

After Washington imposed sanctions on Shahvarpour in 2020 due to accusations of human rights violations, a prominent cleric kissed him on the forehead during a religious ceremony and told him that the sanctions were a "source of pride."

In 2021, Shahvarpour requested 50 billion Iranian rials—which at the time was equivalent to more than $1 million according to the official exchange rate—from a state-owned steel company to fund a new IRGC building in Khuzestan, according to a document reviewed by Reuters.

The owner of the account where the funds were to be deposited, according to documents bearing his signature, was the entity "VODJA 424000."

At the beginning of this year, Shahvarpour's men crushed new protests in Khuzestan that were part of a nationwide uprising against the economic collapse, according to activists.

Across Iran, thousands were killed and tens of thousands imprisoned. In Khuzestan, the two activists said they documented the names of 46 dead, most of whom were killed on January 8 and 9, when the IRGC opened fire on demonstrators.

Footage broadcast by state media from a parade held earlier this year shows IRGC forces under Shahvarpour patrolling a town in Khuzestan in white "Toyota Tundra" trucks of the type favored by the Ministry of Defense network.

One of the trucks was carrying a bright pink "Shahed" drone.