The cover story was simple.
The Trading Company of the Kyrgyz Republic, an official government entity, was paying $1 million for a bulk shipment of car floor mats, auto body polish, safety glasses and rope.
In reality, the money was for the kind of drone parts that have helped power Russia’s war machine.
The scheme from early last year was one of thousands of instances of sanctions evasion orchestrated by A7, a Moscow-based financial services firm whose internal documents were leaked online by hackers late last year.
Since the full-scale invasion of Ukraine in 2022, Russia has been largely locked out of the global financial system. The country’s financial institutions are blocked from using the dollar, and most international banks have stopped processing payments for Russian companies. That was intended to make buying both consumer and military goods abroad incredibly difficult.
But A7 has found a reliable way to sidestep restrictions, conducting an ever-expanding network of shell companies to launder funds and orchestrate international payments on behalf of Russian businesses, the documents show.
Along with those documents, a New York Times analysis of internal software used to falsify transactions, interviews with current and former employees, and databases of business transactions and other previously unreported records offers the first detailed blueprint of Moscow’s rampant circumvention of the financial firewall built by the West.
The company helps Russian businesses send money abroad, often through shell companies that it has established in Asia, Africa and elsewhere and that have little purpose other than to mask the purchases of goods.
It uses cryptocurrency to exchange rubles and other currencies for dollars and euros in ways that obscure the origin of the money.
It has even built a custom app, powered by OpenAI’s advanced artificial intelligence, to forge trade records to deceive banks and regulators.
In just the first four months of 2025, the period detailed by the leaked documents, A7 brokered more than $500 million in prohibited transactions on behalf of Russian businesses and individuals. More than $130 million of that was for products that could be used by Russia’s military-industrial base, the Times analysis found.
This is a growing business for A7 and its influential owner, Ilan Shor, an Israeli Moldovan oligarch who three Western intelligence officials say reports directly to the Kremlin.
The leaked documents, which were disclosed in June by Open Source Center, an intelligence think tank in Britain, did not specify the total amount of money or goods that A7 handled. The think tank estimated that tens of billions of dollars had passed through the A7 network. The Financial Times, citing the leak and other documents, reported on Monday that A7 had done nearly $7 billion in business. The company said in a news release this year that it handled a fifth of Russia’s annual foreign trade, the equivalent of $130 billion.
A7 did not respond to a detailed request for comment.
Western sanctions have raised the cost of Russia’s war effort in Ukraine, but they have also spawned increasingly sophisticated schemes to evade them, said Elina Ribakova, the director of the international affairs program at the Kyiv School of Economics.
“We’ve created a monster,” she said of A7 and Russia’s sanctions evasion.
Mr. Shor created the company in 2024 with the goal of “developing foreign trade” and stimulating Russia’s domestic economy in defiance of Western sanctions, according to a Russian-language news release.
As it expanded its footprint, A7 needed a beachhead in the global financial system. It found one in Kyrgyzstan, the former Soviet republic in Central Asia.
The documents did not reveal the extent to which Kyrgyz officials or banks were aware of the A7 operations, but influential officials had close ties to the company and Mr. Shor, documents show. Payment records obtained by The Times show that A7’s shell companies established 6 accounts with Kyrgyz banks, handling more than $100 million in dollars and Chinese renminbi.
So far, Western efforts to stop A7’s sanction-breaking activities have been scattershot.
Since early 2025, the European Union, Britain and the United States have targeted some companies and individuals linked to the firm, as well as the ruble-pegged cryptocurrency it controls.
But the operation is built to be resilient.
Pressured by Western nations, Kyrgyzstan shut down elements of A7’s network, including the Trading Company, this year.
Kyrgyzstan takes misuse of its financial system seriously, Bakyt Sydykov, the country’s minister of economy and commerce, said in a statement this week. The country has taken concrete action to address sanctions evasion, including appointing a special representative to coordinate policy across the government, he added.
Soon after the shutdown of elements of its network, A7 turned to shell companies and subsidiaries in Bahrain, the United Arab Emirates, Nigeria, Mongolia and elsewhere, according to internal records, website forensics and corporate registration records. The Times identified 71 shell companies around the world with links to A7.
Countless one-off schemes to obtain materials for Russia’s war effort have popped up and been halted by the West since the full-scale invasion of Ukraine. A7 is an evolution, consolidating disparate operations, said Zach Tvarozna, the lead author of a June report about the company for the Open Source Center.
Many of A7’s payments are for common goods: frozen beef from Uruguay, lighting fixtures from Italy, children’s toys from China. A7 was frequently used to pay for extravagant vacations: Receipts show more than $2 million to a travel agency in the Maldives, a popular destination for Russians.
Other purchases, however, were for goods that the United States has restricted from sale to Russia because they have both civilian and military uses. Xi’an Heavy Equipment and Technology Company, a Chinese state-owned industrial machinery maker, received more than 30 payments from A7 totaling over $27 million in late 2024 and early 2025 for steel manufacturing equipment that could help produce artillery shells and vehicle armor, The Times found.
Nearly $1 million from a Russian shell company went to Insight Global Technology, a Hong Kong company that sells Nvidia computer servers for A.I. development — technology that Western nations have tried to restrict from Russia. And nearly $4 million went to Walksnail, a Chinese maker of radio and video components for drones used on the front lines in Ukraine.
Xi’an Heavy Equipment, Insight Global Technology and Walksnail did not respond to requests for comment.
A7 has “no particular problems transferring funds anywhere in the world,” Mr. Shor said in an interview this month with Kommersant, a Russian newspaper. Last year, he said he got “personal satisfaction” from evading sanctions.
The Kremlin’s Man in Central Asia
Before founding A7, Mr. Shor was probably best known as the mastermind convicted of stealing $1 billion from Moldova’s banking system in 2014. The scandal, known in Moldova as the “theft of the century,” led to his exile.
He now lives in Russia with his two young children and wife, Sara Shor, the pop singer and social media influencer known as Jasmin. Instagram photos document a life of lavish parties and luxury vacations, including recent Alpine skiing trips and a stay at the Waldorf Astoria Maldives.
According to three Western intelligence officials, Mr. Shor reports to Sergei V. Kiriyenko, a member of President Vladimir V. Putin’s administration who oversees influence operations across former Soviet republics that include Moldova and Kyrgyzstan.
Mr. Shor and his wife were placed under U.S. sanctions in 2022 for working with Russian security services to interfere in Moldovan elections, but those restrictions did little to slow him. In 2024, the Russian government funneled hundreds of millions of dollars through a nonprofit, where Mr. Shor is a director, to pay Moldovans to vote against joining the European Union in a referendum. (The effort failed; Moldova voted to join the bloc.)
In Kyrgyzstan, Mr. Shor’s influence grew as economic restrictions pushed Russia closer to it. Russia came to depend on Kyrgyzstan to import restricted goods, while Kyrgyzstan profited on the trade.
After the invasion of Ukraine, bank profits in Kyrgyzstan ballooned to $354 million in 2024 from $42 million in 2021, according to government data. Over that same period, shipments from Chinese and European businesses to Kyrgyzstan increased to nearly $23 billion from about $8 billion, United Nations data shows.
Experts have concluded that many of those shipments ultimately went to Russia. The boom was too large and abrupt to reflect real demand from within Kyrgyzstan, wrote Robin Brooks, an economist at the Brookings Institution, in a 2024 article. He assessed that Kyrgyzstan, a country of only seven million people, was merely a pit stop for goods on their way to Russia.
In September that year, Mr. Shor created A7 with Promsvyazbank, a state-owned Russian bank tied to the military. Less than two weeks earlier, Kyrgyzstan’s economy minister at the time, Daniyar Amangeldiev, who was also involved with the nonprofit tied to the Moldovan influence campaign, helped establish the Trading Company of the Kyrgyz Republic. A state entity, it was created to “monitor trade and financial transactions” and “reduce the risks of sanctions evasion and illegal payments.”
But from the start, documents show, the Trading Company had the opposite effect.
Within weeks, Mr. Shor’s systems administrators were discussing how to install their own software on the official Kyrgyz website and use it to process orders, according to A7 chat logs. Within months, A7 was generating doctored invoices that made shipments of sensitive goods bound for Russia appear to be routine purchases for Kyrgyzstan.
“The Trading Company of the Kyrgyz Republic was established to regulate and enhance the transparency of foreign trade operations,” Mr. Amangeldiev said in a statement. “To the best of my knowledge, its creation was not linked to the interests of A7 or Ilan Shor.”
Fake Invoices
A case in point is the purchase last year of advanced American electronics critical for building electronic warfare systems.
The buyer was VPK Techno Systems, a distributor based in Moscow that has publicly promoted its ties to important Russian defense companies.
The seller was Ceyuan Electronic Technology Company, a Chinese supplier that, trade records show, regularly shipped sensitive electronics to Russia.
Invoices and trade records are the “bread crumbs that governments use to track shipments to Russia,” said Nick Grothaus, the vice president of research at Kharon, a trade data and analytics firm. Banks and distributors all over the world have cut business ties to Russia because “there’s always the possibility that sort of stuff ends up on the front lines,” he said.
On March 10, 2025, VPK sent A7 an invoice for nearly $46,000 for signal measurement sensors — advanced electronics with industrial and military applications that are among the most sensitive goods the United States has sought to keep out of Russia.
A7 employees uploaded it to their invoicing program, which used OpenAI’s ChatGPT to read the document and generate a falsified version for the same amount and date, according to an analysis of the source code. Employees then selected one of more than 6,000 stamps from a database and added it to the falsified invoice to make it appear authentic. In place of sensitive electronics bound for Moscow, the new invoice listed LED light boxes used for advertising, purchased by the Trading Company of the Kyrgyz Republic.
The credentials found in the A7 app are not in use now, a spokesman for OpenAI said, adding that the company does not allow access to its technology from Russia.
The strategy worked: Ceyuan’s bank did not raise any compliance issues, according to a document that confirmed the transaction.
A7 processed an additional $300,000 in purchases from the Chinese supplier. The Times analyzed more than 4,000 similar bank transactions from 40 different accounts tied to A7 shell companies. The firm was able to send payments from shell companies to banks in more than 80 countries over the five months covered by the documents.
Ceyuan and VPK did not respond to a request for comment.
Cash, Gas and Crypto
Shell companies that disguise payments solve only half of A7’s problem. To buy goods abroad, A7 also needs foreign currency, which U.S. and European sanctions made harder for Russian businesses to obtain.
But A7 found a way to tap some of the remaining sources of foreign revenue generated by real Russian companies, according to A7’s internal accounting records and documents, and a person familiar with the effort.
To stabilize energy markets, many countries, including members of the European Union and NATO, have continued buying Russian energy and nuclear material. Gazprom, Russia’s energy giant, still sells to several Western countries, generating payments in various currencies.
Those exports create opportunities for intermediaries to divert money, said Craig Kennedy, an associate at Harvard’s Davis Center for Russian and Eurasian Studies. Russian companies often have employees “feeding off little bits of money flows that they can get their hands on,” Mr. Kennedy said.
An internal A7 document diagrams one such effort to siphon small amounts of Russian offshore gas proceeds. In this case, proceeds from some Gazprom sales, in Emirati dirhams, were routed to A7 through a subsidiary, rather than returned to Gazprom’s accounts in Russia.
Gazprom did not respond to a request for comment.
Nearly 400 million dirhams, roughly $100 million, were deposited at regular installments over the first five weeks of 2025 into accounts at First Abu Dhabi Bank belonging to A7 shell companies in the United Arab Emirates, documents show.
The offshore funds were then converted into other currencies and Tether, a cryptocurrency pegged to the U.S. dollar, that would allow A7 clients to make purchases without sanctions-related restrictions. In January 2025, the companies converted more than half of the deposits into dollars, euros and Tether.
At least two Emirati companies were connected to A7, according to records reviewed by The Times. The companies were registered by Shaheem Musthafa, a Dubai-based employee of Evocargo, a Russian autonomous-trucking company that does business with Gazprom, according to digital forensics, corporate records and news releases. The companies handled payments on A7’s behalf.
Evocargo and Mr. Musthafa did not respond to a request for comment. In a statement, First Abu Dhabi said it did not comment on specific matters but maintained “robust governance and compliance standards across all jurisdictions in which it operates.”
Whac-a-Mole
During the Biden administration, the Treasury Department made cracking down on sanctions evasion a centerpiece of its effort to punish Russia. The department imposed thousands of additional sanctions, targeting companies and networks designed to move money around financial restrictions.
The pressure has largely disappeared. Since President Trump returned to office, the administration has removed more restrictions than it has added, according to a Times analysis of Treasury data.
That has made it harder for banks to screen for illicit activity, in part because new actors and organizations can spring up without fresh information. A7 shell companies, for example, have facilitated payments to companies that banked at major American and European banks, The Times found.
“The activity of one company may fly under the radar, or even once it’s caught, they’ll just close the account and move to a new one,” said Claire O’Neill McCleskey, a sanctions consultant and former Treasury Department official.
A Treasury spokeswoman said that under Mr. Trump, the department had taken significant steps to disrupt Russia’s ability to fund its war, including imposing sanctions on the country’s two largest oil companies and A7.
Internal records show that A7 has a team dedicated to creating new shell companies when operational issues arise. New shell companies include Teracoretrade, in Qatar, which specializes in advanced industrial machinery. Vaydora, a general-purpose wholesaler, is based Kyrgyzstan. Nuvotra, in Bahrain, deals primarily in the oil-and-gas sector.
Teracoretrade, Vaydora and Nuvotra did not respond to requests for comment.
That ability to absorb a blow and re-form elsewhere is so central to A7’s DNA that the company has made it a symbol.
Its mascot is a nevalyashka, a children’s toy with a weighted base that rights itself whenever it is pushed over. “The nevalyashka symbolizes that, no matter which direction various restrictions try to push us, the company remains stable,” A7 told a Russian lifestyle magazine in June.
Paul Sonne contributed reporting from Bishkek, Kyrgyzstan, and Michael Schwirtz from London and Chisinau, Moldova.
Methodology
The Times reviewed tens of thousands of documents from A7, some of them posted online by hackers around August 2025 and others left by the company in publicly accessible cloud storage folders. A small number of documents were provided to The Times by people close to A7 under the condition of anonymity.
The materials included tens of thousands of internal chat messages, presentation slides, memos, accounting records and source code, as well as databases containing customer lists and other details. Among the documents were copies of genuine and falsified invoices, along with bank transactions that confirm that some of the transactions described in the documents had taken place. Using company source code, The Times was able to reproduce internal A7 software without connecting to A7’s servers, allowing reporters to examine the software’s features. After The Times contacted the developer of the software, who had posted some of the materials online, they were taken down.
The Times used independent methods to verify the authenticity of the documents. The Times contacted companies that had unwittingly sold goods to A7 and confirmed that invoices in the files were genuine. The Times also verified a bank transaction with a financial institution on the condition of anonymity and confirmed cryptocurrency trades with public blockchain data.
Reporters independently checked phone numbers, email addresses, social media posts and physical addresses, and cross-referenced details with people familiar with the inner workings of A7. The Times also consulted current and former intelligence officials who were familiar with A7’s operations.
The post The ‘Monster’ Behind Russia’s Global Effort to Evade Western Sanctions appeared first on New York Times.
