V32 is a station sending numbers in the Persian (aka Farsi) language, spoken in Iran. It is believed to be a US intelligence operation against the Islamic Republic regime of Iran as part of the 2026 Iran war. It first appeared on the air the day the war started, and is broadcast from a US military base near Stuttgart, Germany. Its transmissions have been recurrently targeted back by the Iranian so-called "bubble" jammer.

V32 transmits daily on 7910 kHz, at 02:00 UTC and 18:00 UTC; the 18:00 UTC transmission repeating the previous 02:00 UTC one. Transmissions always contain 6 messages; each individual message has a fixed length of 20 minutes, and full transmissions last 2 hours. The message format is as follows:

1. The word tavajjoh (توجه, "attention") spoken three times
2. A first 5-digit group header field, so far always one of three known values: 64096, 11050 or 56173
3. A second 5-digit group header field
4. 181 unpaired 5-digit groups, taking almost 20 minutes to speak out
5. An optional silent pause of a few seconds, accomodating for numbers variability, that pads the message runtime to exactly 20 minutes

That structure is then repeated for each of the 6 messages in the transmission. So far, each message position seems to normally use the same headers every time:

• Message 1: 64096 22521
• Message 2: 64096 46553
• Message 3: 11050 90128
• Message 4: 11050 63884
• Message 5: 11050 32315
• Message 6: 56173 29771

The operational practice of using a fixed number of messages with a fixed length is commonly considered to be a way of obfuscating and concealing the actual amount of traffic and traffic patterns of the station.

Location

Multilateration and triangulation efforts, then local signal characteristics and investigations, have pinpointed the origin of V32 to a shortwave transmission facility within a US military base in Böblingen, 15 km southwest of Stuttgart, Germany - in the forest between Panzer Kaserne and Patch Barracks, inside a restricted area marked as a training field. Technical operations are possibly provided by the 52nd Strategic Signal Battalion headquartered at nearby Patch Barracks - regardless of what intelligence agency these technical operations would really be provided for.

Operation quirks

In the first days of the station, dual-tone, 620 Hz / 925 Hz beeps were transmitted in the background every few seconds: these were identified as artifacts from an L3Harris Falcon III or Falcon II radio transmitter, such as for example the AN/PRC-160. These American-made military radios support encrypted communications, and would by default insert these tones when operating in unencrypted mode, as an auditory warning for the insecure channel (example). This implies that V32 has used such a radio as transmitter, and also that nobody had even bothered to configure it properly for operations in the clear, to remove these warning tones. Notably, this military hardware is not only American but ITAR-restricted: while a grey market still exists, the US government would typically control and ban their sale and export to adversaries.

During the March 7th, 2026, 18:00 UTC transmission, Windows 10 system sounds were leaked onto the air, followed by the transmission getting interrupted. Additional Windows 10 system sounds were also heard during the March 9th, 2026, 18:00 UTC transmission.

Sample from March 9th, 2026, with Windows 10 Notify System Generic system sound

Sample from March 9th, 2026, with Windows 10 Background system sound

Moreover, audio glitches have been noticed, that could be the result of computer lag causing audio stutter during playback.

Sample from February 28th, 2026, with audio stutter glitch (at 0:23) and possible ambient sounds

Some V32 messages have contained plain English words, just spoken out normally among the numbers:

Excerpt of message from March 8th, 2026, featuring the word "SPECIALLY"

Excerpt of message from March 11th, 2026, featuring the word "SPECIFICALLY"

History

V32 was first logged on February 28th, 2026, about 12 hours after the first strikes against Iran that started the war: the station was reported by the Priyom team within the first minute of its 18:00 UTC transmission, which is believed to be its very first transmission ever. Its initial transmission frequency at the time was 7910 kHz. The first iteration of the station, during its first two days, featured a human operator, most likely prerecorded, reading numbers as regular unpaired 5-digit groups; it transmitted each time just one 20-minute message.

Sample from March 1st, 2026, of the first, human-voiced iteration of the station, with background dual-tone beeps

Full transmission recordings

• February 28th, 2026, 18:00 UTC
• March 1st, 2026, 18:00 UTC

Starting on March 2nd, the station switched to a new voice, and to its current behavior of always sending 6 messages per transmission. Individual messages were usually between 12 and 15 minutes long - often, messages appeared to cut off as they reached a maximum 15-minute length. Full transmissions lasted up to 90 minutes. Additionally, the first positively confirmed 02:00 UTC transmission took place on March 3rd; the following 18:00 UTC transmission repeating the exact same audio as the 02:00 UTC slot. It is unclear whether that iteration of the station featured a human operator different from the first one, or used an AI text-to-speech system: numbers were read with widely varying inflections, and inconsistent grouping from message to message - ranging from properly formatted 5-digit groups, to digits spoken one by one with clean separation, with in between any loose inconsistent free-form grouping apparently made up on the go.

Sample of the second iteration of the station

Starting on March 4th, 2026, the Iranian "bubble" jammer showed up on 7910 kHz, during and after the 18:00 UTC transmission. After that, V32 coincidentally suspended its operations, and then reappeared on March 6th using the 7842 kHz frequency instead. Meanwhile, the Iranian jammer kept covering 7910 kHz during V32's transmission times, even though V32 wasn't transmitting there anymore; until March 9th after which the jamming attempts were discontinued.

On March 16th, the Iranian bubble jammer reappeared, on 7842 kHz, for the first time actually jamming V32 - or at least part of its 18:00 UTC transmission. It jammed following transmissions as well. On March 18th, 02:00 UTC, V32 switched back to its original 7910 kHz frequency, with a new, third iteration of the station, this time based on classic, automated prerecorded voice sample playback, as widespread among numbers stations. This version returned to proper, unpaired 5-digit groups, and bumped the message length up to 20 minutes, for a total transmission runtime to 2 hours. This time, the Iranian jammer followed suit to 7910 kHz during that very transmission.

On March 20th, in addition to the bubble jammer, V32 started being targeted by an unidentified, presumed new "jammer": a continuous 1000 Hz tone transmitted in AM.

Analysis

Considering the topical interest in this station, the Priyom team shares its further expertise regarding V32's attribution, beyond being transmitted from a US military facility. While this remains unconfirmed speculation, and not facts, a prime candidate for the operator of this station would be the CIA. Contrary to popular belief, US intelligence has not entirely moved away from numbers stations. Sources in the intelligence community indicate that the CIA provides extra training about numbers stations and one-time pads to clandestine agents assigned to locations with a very hostile operating environment, such as Iran or North Korea: it is envisioned as a last-resort means of communication with high-value sources. So according to this, numbers stations are actually still an institutional part of the CIA playbook. The war in Iran, and the Internet blackout installed by the regime, fulfill the very circumstances for which the CIA would have planned this.

We already know that the CIA has a significant presence in Iran and involvement in the war, having provided crucial intelligence tracking Iranian leaders that enabled the assassination strikes that kickstarted the war. They most probably have had a network of infiltrated assets already in place and organized, ready to be reached through a numbers station if need be right when the war started - which makes the CIA a candidate for running V32 consistent with a legitimate intelligence operation. However, what we've observed from V32's operations - technical quirks and shifting formats - suggest that the technical deployment of the numbers station and shortwave transmissions themselves may have been a little rushed by the circumstances.

Another noteworthy feature of V32 is how all its transmissions take place on the same frequency. Most other numbers stations in general are comprehensive operations targeting many different recipients in different countries, and making use of many different transmission times and frequencies suited to the particular signal propagation needs corresponding to all those areas. In contrast, the fact that V32 always uses a single, same frequency, at always two given times of the day, would be consistent with an operation that only needs to target a single geographical area: Iran.