Tracing the Supply Lines: How Open-Source Intelligence and Link Analysis Uncovered Secret Arms Networks in Sudan 🔗︎
This blog was written by Bashar Deeb from Lighthouse Reports. Lighthouse Reports is part of the Maltego Grants Program, and Bashar works at Lighthouse as an investigative journalist who specialises in Digital Investigations.
Lighthouse Reports is an award-winning pioneer of collaborative journalism that works with Europe’s leading media to deliver deeply reported, public interest journalism on migration, conflict and corruption among other topics. We put impact, and how we plan for it, at the center of our approach to the investigations we work on.
This investigation grew out of our earlier reporting on war crimes committed during the conflict in Sudan. Previous investigations examined abuses involving both major parties to the war, the Rapid Support Forces (RSF) and the Sudanese Armed Forces (SAF). This time, however, we wanted to look beyond the battlefield and examine the wider networks sustaining the conflict, including the role of international actors. Our investigation focused on arms transfers to the RSF, tracing supply routes, material support channels linked to the Libyan National Army in Libya, intermediary networks, key procurement figures, and the involvement of regional partner governments.
Investigation Context 🔗︎
Sudan’s war has been sustained in large part by external military support flowing through a web of intermediaries, transport companies, and regional partners that rarely leave a paper trail. Understanding how weapons and mercenaries move into the conflict meant looking well past the battlefield itself, toward the procurement figures, shipping routes, and training camps that keep the war supplied. That required opening multiple investigative fronts at once, rather than following a single thread.
Methodology and Approach 🔗︎
We combined confidential source input, field reporting with RSF defectors, and extensive social media analysis across hundreds of TikTok accounts showing RSF activity in Libya. Each strand on its own offered only a partial picture, but taken together they began to reveal a consistent network of names, locations, and connections worth pursuing further.
Maltego’s use in the Invesitgation 🔗︎
Maltego played a central role in bringing together fragmented information and turning it into actionable investigative leads. When confidential sources provided names and phone numbers linked to individuals involved in weapons procurement, we used Maltego Graph to expand those starting points and map their wider digital footprints. This helped surface associated Facebook profiles and other connections that could then be explored further within the graph.
By extracting posts, reactions, and interaction data, we were able to map networks around individuals already flagged by our sources and identify previously hidden relationships between key figures. Maltego Graph also supported the corporate side of the investigation. Using LinkedIn Transforms, we identified former employees of companies of interest and filtered those results to find individuals in locations where direct outreach and further verification were possible.
The value of Maltego was not only in finding individual data points, but in giving us a single investigative view in which people, companies, social media activity, and source information could be connected and analysed together. This made it easier to see where different strands of the investigation overlapped, identify gaps, and determine which relationships warranted deeper investigation.
We then enriched and cross-referenced the connections mapped in Maltego Graph with findings from other specialist OSINT sources. Customs shipment data from tradedata.pro provided additional insight into corporate transfers involving companies of interest, while PimEyes was used to analyse frames from open-source video material and help identify individuals relevant to the investigation. Ad-tech data provided another layer of information around activity at relevant geographic locations. Bringing these different sources back into the wider link-analysis process allowed us to compare findings, pursue emerging leads, and build a more complete picture of the networks under investigation.
Insights and Findings 🔗︎
This approach produced high-confidence findings on both supply networks and training infrastructure. Cross-referencing TikTok data with defector testimonies allowed us to pinpoint active RSF training camps in Libya. Ad-tech data analysis over these camp locations then revealed specific user profiles matching mercenaries reported to be Colombian nationals, corroborating defector claims and strengthening the evidence base considerably.
Tracing corporate entities through the graph, we uncovered connection points between a widely reported mercenary transport company and a UAE municipal structure.
Reflections on methodology 🔗︎
This investigation highlights the value of a fusion approach rather than relying on a single, predefined methodology. Complex transregional networks are often deliberately structured to obscure relationships between people, organisations, movements, and support structures, making any one source of information insufficient on its own. By combining confidential source information, defector testimony, specialist databases, social media analysis, and link analysis, we were able to test findings across multiple sources and bring greater clarity to otherwise opaque military supply networks.
With support from the Maltego Grants Program, Lighthouse Reports can continue using Maltego to connect people, organisations, digital traces, and open-source evidence across complex investigations. Bringing these fragmented pieces together in one investigative view can help journalists identify relationships, pursue new leads, strengthen verification, and ultimately support deeper reporting, accountability, and public-interest journalism.
