SPECIAL REPORT-Iran’s hidden web of military agencies is slipping hardware past the US blockade

Iran has created a secret network of military agencies with global reach to import at least $2 billion in hardware, explosives and heavy-duty trucks since January 2025, evading both the US naval blockade and Western sanctions, a Reuters investigation has found.

Hidden behind names starting with the letters MOD, for the Ministry of Defense, are more than 5,000 agencies that form a formidable financial and military machine. Their financial footprints are on bills of lading and other shipping data dating back to 2016. Some are tied to the Islamic Revolutionary Guard Corps and to business conglomerates known as bonyads ​that are controlled by Iran's elite. The findings offer a window into one of the war’s great mysteries: How is the IRGC replenishing its missile and drone arsenals while firing them in their thousands?

In the 18 months from January 2025 to June 2026 – including four months into this year’s war – a single one of these agencies, MOD 346428, imported huge quantities of rocket propellants, explosives and weapons components that are critical for making drones and missiles, as well as heavy-duty trucks that can serve as missile launchers. The hardware came in ​by land, sea and air – much of it recorded as originating in China, Russia and Germany. This investigation of the MOD network is based on thousands of Iranian bank and government records, corporate filings and import data.

The secret agencies all share the same Tehran address as Iran’s Ministry of Defense and Armed Forces Logistics, or MODAFL. They list their incorporation ‌date as February 11, 1979, the day Ayatollah Khomeini took power ​in Iran after overthrowing the monarchy. Most were actually established in 2013, the records show, as Iran struggled under sanctions that saw its crude exports and currency plunge. The agencies, identified for the first time by Reuters in collaboration with the Israeli-American risk consultancy 240 Analytics, form the backbone of Iran’s military procurement and sanctions evasion apparatus. They operate a web of frontmen and foreign shell companies, collectively known as trustees, who use the proceeds from illicit oil sales to buy goods for the Islamic Republic.

Senior military leaders involved in Iran’s ballistic missile and drone programs use the network. Phone numbers registered to 91 of the agencies also appear in records from state-run Bank Sepah of IRGC personnel with accounts there. Among them are at least two commanders the US has accused of abuses against civilian protestors. While Iran’s military has been under multiple US sanctions for decades, Reuters could find no evidence that any of the numbered agencies referenced in the documents have been designated by Western governments.

“What you have here is the regime's military lifeline during this conflict and for many years before,” said Miad Maleki, a former senior official at the US Treasury Department who helped design the American sanctions program against Iran. “This is the complete ecosystem of the Iranian military’s trade business.” The weapons import network has provided many of the raw materials Iran needs to make missiles and drones. Those munitions are responsible for Iran’s relentless precision attacks against Gulf energy infrastructure, allowing the Islamic Republic to blunt America’s military assault. In other reports this year, Reuters has shown how Iran withstood US pressure by exploiting crypto exchanges and illegal gambling networks to tap illicit revenues and circumvent sanctions, how the IRGC consolidated control of the Strait of Hormuz, and how the war has ushered in a new era of repression.

Maleki ‌was one of four experts on Iranian sanctions and weapons who reviewed the Reuters findings and confirmed that many of the materials could be used in Iran’s missile and drone programs. None of the Iranian government entities or companies contacted by Reuters responded to detailed requests for comment, including Tehran’s UN delegation to Geneva and the presidency.

In a statement in response to the Reuters findings, a Treasury Department spokeswoman said the United States “has severed the regime’s economic lifelines.” “While the regime may continue its desperate attempts to evade our powerful sanctions, fund its military and weapons programs, and access foreign currency, we are always 10 steps ahead,” the spokeswoman said.

In tracking the materials, Reuters cross-checked a portion of some 19,000 import records using the shipping documents, footage from social media, and state media reports. Nearly all of the items that Iran imported were exempt from duty and specifically marked as military equipment, the data shows. The experts noted that much of the material, even explosives, can be considered dual-use, and so could also have civilian purposes. The Wall Street Journal reported some of the shipments from China on September 23.

PARALLEL TRADE SYSTEM The secret military agencies form a foreign-trade system parallel to the formal global economy that allows Iran to spend the money it earns abroad selling illicit oil on military hardware, said Maleki, who was the associate director of the Treasury’s Office of Foreign Assets Control until last year.

Money rarely crosses borders, where it might trip a sanctions alarm. Instead, for 97% of the shipments Reuters reviewed, the transactions were settled “without currency transfer,” the import data shows. Trusted frontmen in the diaspora, using cash held in foreign banks, bought the goods and shipped them home. One end user of the network is the military unit overseeing Iran’s ballistic missile program. Another is Sahara Thunder, which was sanctioned by the US in 2024 for manufacturing and supplying drones to Russia that have devastated Ukraine. Reuters and 240 Analytics identified the Iranian military units by cross-referencing the import data with corporate registry filings, and emails and documents compiled on the website WikiIran.

Reuters could not determine the identities of the people who run WikiIran, a website that solicits leaked documents from the Islamic Republic and says it is operated by Iranians opposed to the government and “forced into exile.” During the first six months of this year, according to the import data, deliveries included $1.9 million worth of detonators, tonnes of explosives, aircraft engine parts, rocket fuel ingredients and heavy-duty launch vehicles. All could be used as key components to build and fire ballistic missiles and drones ‌including the Shahed series, according to weapons and sanctions experts.

“This looks like an industrial-scale effort to rebuild or expand Iran's existing fleet” of drones and missiles, said Peter Salisbury, an adjunct assistant professor at Columbia University who has spent the past several years researching Iranian arms transfers and supply chains. “This data clearly shows the Iranian ecosystem’s adaptability and its ability to find new routes.” Salisbury and one of the other experts said they have used WikiIran’s data in the past and have found it to be accurate.

The United States and Israel have targeted Iran’s ballistic missile and drone operations from the start of this year’s war on February 28, including factories the Pentagon said were turning out munitions. Reuters could not determine the extent of the damage, but Iran has continued to fire on its neighbors and on ships trying to transit Hormuz. The material entered Iran by cargo ship across the Caspian Sea from Russia, by truck from Central Asia, and by freight planes from China,, according to documents reviewed by Reuters and records provided by ImportGenius, a platform that aggregates import-export data.

In response to detailed questions about the Reuters findings, China’s Foreign Ministry said ‌it was “unaware of the situation you describe.” “We firmly oppose attempts to maliciously link regional hostilities to China or smear China’s reputation,” the Foreign Ministry said in a faxed statement.

Russia’s Defense Ministry, the White House and CENTCOM did not respond to requests for comment. Beyond individual components, Iran is buying precision machinery that could be used to manufacture its own military equipment. The purchases include items coded as sophisticated computer-controlled lathes, electron-beam furnaces and particle accelerators, according to import data that runs to June. All have industrial purposes and can also be used to make military equipment, including drone and missile bodies.

On October 12, US President Donald Trump said he did not believe China and Russia were providing support to Iran. “If they are, it’s at a very low level, but I don’t believe they are at all,” he posted on social media. “They have too much to lose, and we would know about it, and know about it very fast!” Since the war started, the data shows that $27 million worth of goods purchased by Iran’s military were recorded as originating in the United Arab Emirates, nearly all arriving by sea.

Iran targeted UAE infrastructure through May and continues to hit its crude tankers with drones and missiles. The most recent shipment from the UAE, listed as electronics, was on June 27 by sea, nine days after the United States announced it was suspending its naval blockade. The blockade resumed in mid-July and remains in effect.

The UAE government did not respond to a request for comment about the shipments. In addition to Maleki, the arms experts included Henry Thompson and Wolf-Christian Paes, both specialists in Iranian weapons supplies; and Damien Spleeters, founder of Heimdall, a specialist organization focused on illicit supply chains and weapons procurement.

THE PLUMBING “These numbered agencies are the plumbing behind the Islamic Republic’s global sanctions evasion network and so much more,” said Noam Binstok, a senior analyst at 240 Analytics, which collates and analyzes data on terrorism risk and financing for corporate and government clients. “The amount of money going through these agencies is staggering, and no one has noticed them before.”

Binstok, a 35-year-old economist, said he discovered the numbered entities in June 2025 while uploading thousands of pages of Bank Sepah documents that he found on Telegram and on WikiIran – where they are freely available – to 240 Analytics’ online platform. Bank Sepah is the Iranian lender that handles salary and pension payments for the IRGC. Bank Sepah did not respond to a request for comment about the hack. The heist was claimed by a group called Codebreakers that later announced other hacks of Iranian government data.

“We can confirm that the materials are authentic and that their origin was verified through our sources and contacts both inside and outside Iran,” WikiIran said in an emailed response to Reuters questions about the data. 240 Analytics was founded as a service for companies and governments to vet potential business partners and clients. Binstok said he thought the documents would help reveal Iran’s financial operations. He soon realized that thousands of those accounts were held by agencies with the same naming ⁠pattern. All began with the letters MOD – or VODJA in Farsi – followed ​by a five- or six-digit number that was spelled out longform, rather than as numerals. And all shared the same registration date and address.

The bank records, which Reuters reviewed, included the account holder’s name, various ID numbers, and balances. When he first saw the size of the Sepah account balances, Binstok said, he thought he had misplaced ⁠a decimal point. He found that 36 of the agencies had foreign exchange accounts with $1.2 billion on deposit at the end of 2024. The rest of the network had around $1.8 billion in local currency, averaging about $360,000 per account.

At the time juggling a doctoral thesis, his job at 240 Analytics and a newborn, Binstok mothballed the project. He returned to it this August, searched more recent documents, and found the same agencies receiving money from contraband oil sales and buying large quantities of dual-use equipment. “That was the major breakthrough that led me to start understanding the actual scope that we are talking about, and to find actual examples of imports,” said Binstok. “It was then I knew we were onto something really big.”

Each MOD agency was also identifiable by a unique 11-digit government identity number and appeared in Iran’s corporate registry, an official database of thousands of Iranian businesses. That 11-digit number or the MOD number itself cropped up repeatedly on bills of lading, invoices, and bank accounts, making the network traceable even when the agency was using a front company, Binstok realized. That’s when 240 Analytics approached Reuters to help map the network of agencies. Using the 11-digit identity numbers from Binstok, Reuters reviewed confidential shipping documents and up-to-date import data, and used Iran’s corporate gazette to expose the scope of the network and how it allowed Iran to restock during the war.

One agency with purchases dating back to 2016 stood out: MOD 346428. The overseas purchases of MOD 346428 ⁠had steadily increased over the years, from $442 million in the 12 months ending March 2023, to $988 million the following year, according to customs statistics published in Iranian media. That placed the agency in Iran’s top 10 importers.

From January 2025 through June 2026, Reuters found that MOD 346428 imported $2.3 billion of military hardware, according to the ImportGenius records. Between January and April 2025, MOD 346428 imported 886 tonnes of chemicals into the Iranian port complex of Bandar Abbas, the import data shows. Their origin was listed as China under the code which includes sodium chlorates and other perchlorates, key precursors for solid rocket fuel. Three days after the final shipment, an enormous explosion shook the port.

Two people with knowledge of the April 26 explosion said it was caused when sodium perchlorate ignited while in dockside shipping containers. Iranian state media reported that the chemicals were stored by Sina Port and Marine Services Development Co, which is owned by Bonyad Mostazafan, a multi-billion dollar foundation directly controlled by the supreme leader of Iran. The explosion killed at least 70 people and injured more than 1,200. Sina’s chief executive officer at the time said the explosion stemmed from a “false statement” about the contents of a consignment which was delivered “without documents and tags.” Reuters could not determine whether the chemicals in the final 75-tonne shipment were responsible for the explosion.

The US sanctioned Bonyad Mostazafan in 2020. Ostensibly a charity serving ​the poor, the US Treasury alleged it was used by the supreme leader to enrich his office and reward allies. The bonyad is run by Hossein Dehghan, who was named Iran’s defense minister in 2013, when most of the agencies got their start. Dehghan served in that post for four years. Earlier, he was the commander of IRGC forces in Lebanon during the deadly bombing of international peacekeeping forces in Beirut in 1983 that killed 241 US troops in their barracks and 58 French paratroopers along with Lebanese civilians, according to the US Treasury sanctions statement about him. The United States has blamed the attack on Iran.

Dehghan did not respond to a request for comment about the explosion, the MOD agencies or his position sent via the bonyad and its legal representative. Alongside ingredients that could be made into missile fuel, the data also shows Iran importing heavy-duty trucks that the military uses as camouflaged mobile launchers for missiles and drones.

One example of such imports surfaced early for Binstok. In autumn of 2022, an Iranian car dealer living in Italy ⁠purchased six Iveco Eurocargo trucks for 426,000 euros, records from WikiIran show. He shipped the trucks to another company called Deilami Trading Co. in Dubai. Deilami delivered them to Bandar Abbas. The end buyer’s 11-digit ID number belonged to MOD 346428. According to the packing list, the vehicles were ultimately delivered to Sahara Thunder, which has a key role in manufacturing and selling drones. Deilami did not respond to a request for comment about the transaction.

MATCHING VINS Between January 2025 and June 2026, MOD 346428 imported 435 more Iveco trucks. Using satellite imagery and social media, Reuters tracked some of those vehicles to a customs lot on the outskirts of Tehran in February 2025 and used the import data to match three of their VIN numbers – unique codes that track a vehicle’s manufacturer and origin.

Another Iveco truck appeared during the war, when the US Central Command released footage on social media in March showing what it said was a strike on a disguised Iranian mobile missile launcher. Reuters could not determine if the vehicle was among those imported by MOD 346428. But the truck shown being blown up in the footage is an Iveco model of a type imported by Iran, according to analysts at Janes, a UK-based open-source defense intelligence company. “Official distributors are required to guarantee that these products are not utilized for military, chemical, biological, or nuclear purposes," Iveco said in response to the Reuters findings. The company said it has contractual safeguards to ensure its products do not go to “prohibited destinations, entities or individuals.”

Iveco, which is based in Italy, said it had no ⁠control over “products transferred or ​exported by third parties with whom there is no direct contractual relationship.” “We have confirmed that any presence of Iveco vehicles in Iran occurred beyond Iveco Group's control and responsibility,” the company said. The company said it had no record of the 2022 sale to the Iranian in Italy and said most of the trucks Reuters identified in the customs yard in 2025 had been destined for Central Asia.

Using MOD 346428, Iran also imported thousands of Toyota Hilux and Land Cruiser trucks, which the IRGC and its proxies modify to mount heavy machine guns on the flatbed. Video footage from protests in Iran earlier this year shows security forces with machine guns in a convoy of Land Cruisers driving through the streets of the city of Tonkebon in northern Iran.

In January 2025, MOD 346428 imported four Toyota Tundras – a vehicle the IRGC uses to haul drones. A Toyota spokesman said the company doesn’t conduct any business in Iran. “Toyota was not involved in, and has no knowledge of, the purchases reported by Reuters,” the spokesman said.

Japan’s Ministry of Economy, Trade and Industry said it could not comment on the specifics of the Reuters investigation but said it maintains strict controls over goods related to national security. “We also conduct awareness-raising and outreach activities to inform businesses about these export control regulations,” the Japanese ministry said.

On February 9, 2026, a ship arrived in Bandar Abbas with 93 tonnes of unwrought Chinese titanium, a high-strength metal that the weapons and sanctions experts said can be used to build missile airframes and rocket motor casings. In all, throughout the month leading to the war’s start on February 28, ships also brought in a total of 268 tonnes of nitrocellulose and 276 tonnes of other chemicals originating in China and listed under the code that includes perchlorate – ingredients for both rocket propellant and explosives.

Even with the war in full swing and a blockade on its ships, Iran’s military kept bringing in materials from abroad. According to the data, monthly import volumes initially plunged by 47% to $54 million in March compared to the previous month, but by May they had increased to $77 million. A June 2026 shipment of $1.9 million in Russian detonators, which can be used to trigger high explosives such as those in drone and missile warheads, was the last of five similar Russian shipments, which have delivered a total of $7.6 million worth of detonators since the start of 2025.

Imports didn’t just originate in Russia and China. Companies in ⁠the European Union, which has sanctioned Iran’s Defense Ministry, also shipped goods to Iran’s military. Hundreds of millions of dollars worth of trucks, airplane engine components and electronics – including $34 million in Iveco trucks – were all listed in import data as coming from Germany and elsewhere in the EU. On all of it, the paperwork listed MOD 346428.

Not all of the import data contained detailed descriptions of the shipments. In many instances, Reuters relied on customs codes to identify their contents and declared origins without being able to independently confirm them. A European Union spokesperson said member states are responsible for enforcing EU sanctions, which include Sahara Thunder and others.

“The EU continues to assess very carefully information related to Iran’s reinforcement of its drones and missiles programs,” the spokesperson said. The governments of Germany and Italy did not respond to requests for comment. THE PINK DRONE

Much of Iran’s economy is controlled by quasi-governmental foundations known as bonyads, which are run by the country’s elite. Many were created after the 1979 Islamic Revolution using assets confiscated from the ousted royal family and other people deemed enemies of the new state. The bonyads are how ⁠Iran’s elite holds on to power, binding loyal lieutenants through a vast network of patronage, according to a Reuters investigation from 2013 and multiple sanctions documents from the US government. Like the IRGC, the bonyads play a critical role in the violent repression of Iranians dating back years, both the US and Europe allege in years of sanctions.

One of them, ⁠the Foundation for the Preservation of Relics and Publication of Sacred Defense Values, shows how deeply the MOD network runs through Iran’s economy and its apparatus of repression. Transactions include not just imports, but also internal cash transfers, as Reuters saw in years of documents linking the foundation to at least two separate MOD agencies. Tasked with promoting “the culture of resistance, sacrifice, jihad and martyrdom,” the foundation is a key propaganda arm of the government, responsible for safeguarding the legitimacy and ideology of the Islamic Republic.

In 2017, the foundation took delivery of four shipments of electronics and refrigeration units, according to the WikiIran data. The ID on the shipments – yet again – matches that of MOD 346428. How the foundation used those materials is unknown, but it counts senior IRGC commanders in each of Iran’s 31 provinces among its leadership. In Khuzestan that includes Brigadier General Hassan Shahvarpour, the longtime commander of its elite troops in the restive region.

Shahvarpour did not respond to a detailed request for comment. Units under Shahvarpour’s command killed at least 100 Iranian civilians in Mahshahr in 2019 during protests against high gas prices, according to a US sanctions document. They encircled people trying to flee in armored vehicles and fired machine guns into the crowd, the US said.

A local human rights activist who described witnessing the killings said Shahvarpour’s troops then set fire to sugarcane fields where some of the fleeing protestors were hiding. His account was backed by a second activist who was present that day. After the US sanctioned Shahvarpour in 2020 for alleged human rights abuses, a prominent cleric kissed him on the head during a religious ceremony and told him sanctions are a “source of pride.”

In 2021, Shahvarpour asked for 50 billion rials, then the equivalent of more than $1 million under the official exchange rate, from a ‌state-owned steel company to finance a new IRGC building in Khuzestan, according to a document reviewed by Reuters. The holder of the account into which the money was to be paid, according to paperwork that bears his ‌signature, was MOD 424000. At the start of this year, according to the two activists, Shahvarpour’s men crushed new demonstrations in Khuzestan that were part of a nationwide uprising to protest Iran’s economic collapse. Across Iran, thousands died and tens of thousands were jailed. In Khuzestan, the activists said they documented the names of 46 dead and said most of them were killed on January 8 and 9 when the IRGC opened fire on demonstrators.

State media footage from a parade earlier this year shows Shahvarpour’s IRGC troops driving through a town in Khuzestan in white Toyota Tundras of the sort favored by the ​MOD network. One of the trucks hauled a bright pink Shahed drone.