Proxy criminal networks

Proxy criminal networks refers to the use of organized crime syndicates based in a foreign country by a state to conduct covert, illicit, or deniable operations, including espionage, sabotage, assassination, cyberattacks, arms trafficking, or money laundering, outside formal state channels.

Background

The concept of proxy criminal networks is the use of statecraft, organized crime, and covert operations in the target country by a foreign country. Unlike traditional proxies such as militias or paramilitary forces, criminal networks provide non-ideological, profit-driven services that are attractive to states seeking to advance their interests while minimizing diplomatic or legal repercussions. These networks often possess transnational reach, logistical expertise, and established underground infrastructure, making them effective tools for off-the-books operations.^[1][2][3][4]

Characteristics

Proxy criminal networks have several defining characteristics that make them Preferable tools for both state and non-state actors. One of their primary features is plausible deniability: by outsourcing operations to independent criminal groups, states can distance themselves from unlawful or controversial actions, avoiding direct attribution. These networks are built on transactional relationships, where both parties gain—whether through financial rewards, protection from prosecution, or political influence. They also benefit from jurisdictional insulation, as operating through syndicates based in foreign territories allows actors to exploit legal loopholes and evade international oversight. Finally, proxy criminal networks exhibit operational versatility, engaging in a broad spectrum of activities including cyberattacks, illicit trafficking, political assassinations, and efforts to destabilize rival states or regions.^[4][1]

Types of proxy criminal networks

Cross border state criminal proxy networks

This subtype involves a state actor covertly exploiting or collaborating with criminal organizations located in other countries to conduct operations that further the state's geopolitical, economic, or intelligence objectives. These proxy relationships provide deniability, reduce political risk, and allow extraterritorial influence without triggering formal conflict or direct intervention.^[1][4]

Features

Cross-border state criminal proxy networks refer to a strategic arrangement in which a state actor covertly engages with or exploits criminal organizations operating beyond its own borders to advance its geopolitical, economic, or intelligence goals. These relationships serve as proxies, offering the state plausible deniability, minimizing political risk, and enabling it to exert influence in foreign territories without resorting to formal conflict or overt intervention.^[1][2]

Strategic purposes

States engaging in proxy relationships with criminal networks often do so to serve a range of strategic purposes that align with broader national interests. One such objective is intelligence collection, where states exploit smuggling routes or leverage cybercriminal groups to gather surveillance data, monitor adversaries, or map critical infrastructure. Another key aim is the destabilization of rival states, accomplished through the deliberate spread of narcotics, the proliferation of illicit arms, or the orchestration of social unrest tactics designed to undermine internal stability and strain governmental capacity. Additionally, these relationships offer lucrative opportunities for revenue generation, particularly through illicit financial mechanisms such as cryptojacking, money laundering, and other forms of economic subversion that are difficult to trace and regulate. Crucially, these operations enable states to wage asymmetric warfare without deploying official military forces, thereby avoiding the costs and international consequences associated with conventional conflict while still advancing strategic objectives through deniable and decentralized means.^[5][6][1]

Russia

Russia’s entanglement with criminal enterprises around the world is a strategic and systemic phenomenon, not merely tolerated but actively utilized by elements of the Russian state to advance geopolitical, economic, and security objectives. This practice blurs the lines between intelligence operations, organized crime, corporate oligarchy, and conventional statecraft.^{[7][8][9][10]}

Regional criminal footprints in Europe

Spain & Cyprus

Longstanding hubs for Russian mafia laundering and illicit finance.^[11]

Germany & the Baltics

Used for logistics and as transit hubs for drugs, counterfeit goods, and espionage.^[12]

UK & France

Real estate and luxury assets bought with illicit funds; London known as “Londongrad” due to influx of Russian oligarch wealth.^[13]

Middle East & Africa

Russian PMC proxies like Wagner Group have collaborated with diamond and gold smuggling operations in:

CAR, Sudan, Libya, Mali.^[14]

• Russia-linked networks in Syria and Lebanon engage in captagon smuggling and illicit arms sales.^[15]

Asia

• Russian and Central Asian gangs collaborate on heroin routes from Afghanistan through Tajikistan, Kyrgyzstan, and Russia, feeding European markets.^[16]
• Arms and nuclear tech smuggling routes via Central Asia and Iran (sanctions evasion).^[16][17]

Latin America

While not as dominant as in Europe or Eurasia, Russian networks interact with:

Venezuelan Oil smuggling & gold‑laundering with elites and the military.

Research confirms a “web of corruption” linking Russia to Venezuela’s oil and gold trades, reinforcing Russian influence via illicit financial networks.^[13]

Cartel linked arms trade & cybercrime platforms

While evidence is largely indirect, cross‑regional investigations (e.g., Panama Papers, FinCEN leaks) imply that Russian financial institutions and intermediaries have engaged in laundering narcotics-related funds from Latin America into global financial system.^[18][19]

Russian banks and intermediaries

help launder proceeds of Latin American corruption and narcotics sales.^[20]

Iran

Iran’s involvement with criminal enterprises in Latin America and Europe is part of its broader asymmetric strategy aimed at extending influence, evading sanctions, financing proxy operations, and sustaining illicit revenue streams. This activity is primarily coordinated through the Islamic Revolutionary Guard Corps Quds Force (IRGC–QF) and Hezbollah, Iran’s most capable and globally connected proxy. Below is a detailed overview.

Latin America

Hezbollah’s Criminal Operations

Hezbollah, with logistical, financial, and ideological ties to Iran, plays a pivotal role in Latin America, particularly in the Tri-Border Area (TBA) where Argentina, Brazil, and Paraguay intersect.^[21][22]

Activities

Drug trafficking

Collaborates with cartels like FARC (historically) and Brazilian organized crime (e.g., PCC) to traffic cocaine to West Africa and Europe.^[23][21][24]

Money laundering

Hezbollah-linked operatives use front companies, currency exchanges, and contraband operations to launder drug revenues.^[24]

Cigarette smuggling & counterfeit goods

A lower-risk, high-profit mechanism for funding.^[21][25]

Charity fraud and Hawala networks

Used to send proceeds back to Lebanon or Iran.^[26][23]

Notable cases

Assad Ahmad Barakat

Key Hezbollah financier arrested in Paraguay; managed import/export and real estate businesses as fronts for laundering.^[27][28]

2018 U.S. DEA Operation "Cassandra"

Operation "Cassandra" Eexposed Hezbollah’s involvement in a $1B global narcotics and money-laundering operation stretching from Colombia to West Africa and Europe.^[29][30]

Diplomatic & Political Footprint

Iran has expanded its diplomatic missions in Venezuela, Bolivia, Nicaragua, and Cuba, often using diplomatic cover to shield intelligence operatives and IRGC-linked actors.^{[31][32][33][34]}

Venezuela

Collaboration includes oil-for-gold schemes, cyberintelligence sharing, and the use of Venezuelan territory for money laundering and illicit transport.^[35][36][37]

Civil aviation links (e.g., Mahan Air)

Used to transport illicit materials and personnel under diplomatic immunity.^[38][39]

Europe

Hezbollah's Financial and Operational Networks

While Hezbollah is often bifurcated into a “military” and “political” wing in European policy (with only the former designated a terrorist group by some states), its entire infrastructure is deeply embedded in criminal economies across Europe.^[40][22]

Operations

Drug trafficking and laundering

Hezbollah-linked individuals operate in Germany, France, the Netherlands, and Spain, using front businesses and real estate.^[41][42][43]

Money laundering hubs

Particularly in Germany and Belgium, where lax enforcement allowed dual-use charities and small businesses to send funds to Lebanon.^[44][41]

Organized crime collaborations

Hezbollah networks cooperate with Albanian, Turkish, and North African gangs for logistics and street-level distribution.^[43][22]

Iranian Intelligence and Assassination Plots

Iranian state intelligence has used criminal contacts and pseudo-diplomatic infrastructure in Europe for assassinations and surveillance Including plots against dissidents in Denmark, the Netherlands, and France.^[45]

2018 Paris bomb plot

An Iranian diplomat was arrested for planning a bombing of a dissident rally; the operation was linked to MOIS (Iran's Ministry of Intelligence) and involved European-based logistical support.^[46][47]

North Korea

North Korea’s involvement in transnational criminal enterprises is not an auxiliary phenomenon—it is a core pillar of the regime’s survival strategy, directly orchestrated by state organs. These enterprises help generate hard currency, evade international sanctions, fund the nuclear and missile programs, and maintain elite loyalty. Here are some examples of North Korea’s criminal operations around the world:

State sanctioned criminal economy

Key Institutions Involved

Reconnaissance General Bureau (RGB)

Military intelligence wing overseeing covert operations, cybercrime, and overseas agents.^[48]

Office 39 (Room 39)

Office 39 secretive bureau under the Workers’ Party, responsible for generating illicit revenues for Kim Jong-un’s regime.^[49][50]

Ministry of State Security (MSS)

Oversees foreign agents and ensures ideological and financial loyalty among overseas operatives.^[51][52]

Major criminal enterprises

Cybercrime

North Korea is considered a global leader in state-sponsored cybercrime, with attacks estimated to have generated billions in stolen assets.^[48]

• Groups Involved: Lazarus Group, Andariel
• Bank hacks: Bangladesh Central Bank ($81 million, 2016), and several SWIFT-targeted attacks.^[48]
• Crypto theft: Over $3 billion stolen from crypto exchanges since 2017.^[48]
• Ransomware: WannaCry (2017) infected systems in 150+ countries.^[48]

Drug trafficking

North Korea has long been a producer and trafficker of methamphetamine and opiates, often using diplomatic cover.

• State production: Meth labs allegedly operated by state chemists.^[51][52]
• Distribution routes: Through Chinese triads, Southeast Asian networks, and sometimes Japanese Yakuza.^[51][52]
• Notable incident: In 2003, Australian authorities seized 125 kg of heroin on a North Korean ship (Pong Su), tied to DPRK’s government-linked operatives.^[51][52]

Counterfeiting (currency & goods)

North Korea has been involved in the production and distribution of high-quality counterfeit goods, including U.S. currency and luxury products. Among the most notable are the so-called "supernotes" counterfeit $100 bills that are nearly indistinguishable from authentic currency and are believed to be manufactured by the regime’s secretive Bureau 39. In addition to currency, North Korea has produced counterfeit pharmaceuticals, such as fake Viagra, which have been distributed across East Asia and the Middle East. The regime has also engaged in the illicit production and smuggling of alcohol and cigarettes, often using its own shipping networks to transport these goods covertly.^{[53][54][55][56]}

Smuggling & sanctions evasion

North Korea uses a global logistics and front company network to procure sanctioned goods and sell embargoed items like coal, seafood, and weapons.^[57]

• Ship-to-ship transfers: In international waters, often falsifying Automatic Identification Systems (AIS).^[50][52]
• Dual-use goods: Illicit imports of nuclear and missile components, including from European and Chinese vendors.^[50][52]
• Luxury imports: Including armored cars, designer items, and electronics—smuggled via Southeast Asia or Russian Far East.^[50][52]

Labor exploitation and human trafficking

Tens of thousands of North Korean workers are sent abroad to countries such as China, Russia, and various nations in the Middle East and Africa, where they are employed in sectors including construction, logging, textiles, restaurant work, and IT services. Despite their labor, up to 90% of their wages are seized by the North Korean regime, with much of the revenue believed to be directed to Kim Jong-un’s personal funds. This practice not only contravenes international sanctions and labor rights but also places workers under strict surveillance and coercive conditions.^[58]

See also

• Transnational organized crime
• United Nations Convention Against Transnational Organized Crime
• State-sponsored terrorism
• Iranian external operations