By Pishtaz | 2025-01-21

Iran's Islamic Revolutionary Guard Corps (IRGC) has been orchestrating a large-scale sanctions-evasion network that has sold and transported billions of barrels of crude to China and around the world, leaked emails reveal.

In special report on how Iran moves sanctioned oil, published January 7, Reuters examined around 10,000 emails leaked last February by PRANA Network hackers targeting Sahara Thunder, a front company of the Iranian military.

The US blacklisted the company last April for supporting IRGC shipping operations.

Leaked communications show Sahara Thunder deployed 34 ships to move nearly 20 million barrels of oil between March 2022 and February 2024.

They revealed systematic deception methods, including falsified shipping documents, crew instructions for vessel renaming, painted-over identifiers and manipulated tracking signals.

In a detailed analysis of nearly five years of satellite images published in 2024, Bloomberg showed how billions of dollars of sanctioned Iranian oil are flowing annually to China -- the primary destination for Iranian oil.

Oil trade revenues support Iran's "nuclear program, its development and proliferation of provocative ballistic missiles, and financing of terrorist proxy groups such as Hizbullah, Hamas and the Houthis," per the US Treasury.

'Ghost fleet' activity

Operating under the alias "Deep Ocean," the Panama-flagged "Remy" falsified documents claiming its cargo came from Iraq's Basra region, Reuters reported.

It was in fact carrying Iranian oil received through a ship-to-ship transfer in the Gulf.

In the Strait of Malacca, which connects the Indian Ocean with the South China Sea, it divided its cargo between two vessels, the leaked emails reveal.

Satellite imagery confirmed the ships' side-by-side positioning on March 9, with both vessels later delivering the Iranian oil to China's Lanqiao port.

The Strait of Malacca is "a common flashpoint for bad actors to obscure the movements of vessels involved in illegal activities like oil smuggling, sanctions evasion, or illegal ship-to-ship (STS) transfers," according to HawkEye 360.

"With these congested waterways, it’s difficult to monitor legitimate vessel activity – let alone those who intentionally try to evade detection," the radio frequency data analytics company said.

United Against Nuclear Iran has identified more than 470 vessels in Iran's "ghost fleet" used for sanctions evasion.

The US Treasury has kept steady pressure on this fleet -- including 34 of Sahara Thunder's ships -- through a sanctions regimen that includes a December 19 tranche blacklisting entities and vessels involved in the illicit oil trade.

Iran allocated almost half of its 2024 third quarter crude loadings to Southeast Asia, underscoring the region’s pivotal role in facilitating Iranian crude to China, S&P Global reported October 18.

These barrels typically undergo blending and are reclassified as Malaysian or Singaporean-origin before reloading aboard vessels bound for China, it said.