Iran-Linked Networks Shift Operations in Latin America After Venezuela Disruption
Iranian-linked threat networks are adapting across Latin America following the arrest of Venezuelan leader Nicolás Maduro and the country’s subsequent destabilization in early 2026.
According to cybersecurity firm Resecurity, the loss of Venezuela as a permissive environment has disrupted long-standing safe havens for operatives tied to Iran’s Islamic Revolutionary Guard Corps (IRGC) and Hezbollah.
These networks are now shifting activity toward countries including Colombia and Ecuador, where they remain involved in espionage, failed terrorist plots, and collaboration with local criminal groups.
Network Mapping
The firm’s analysis shows that Iran-linked communities maintain a significant presence across the region, including in Argentina, Brazil, Colombia, Cuba, Ecuador, and Peru.
Using graph-based analysis and AI tools, Resecurity mapped key actors and network structures, drawing on metadata such as phone numbers, email addresses, and IP data to support law enforcement targeting.
Propaganda Push
Beyond physical operations, the IRGC is expanding its influence in the information space.
Its propaganda ecosystem includes state-backed outlets such as HispanTV and PressTV, alongside proxy platforms like Hezbollah’s Al-Manar.
These channels, combined with coordinated social media campaigns, are used to spread disinformation, amplify anti-Western narratives, and recruit sympathizers — particularly during periods of heightened tensions with the United States.
Experts also point to the expanding role of Iranian Cultural Centers in the region.
Originally framed as cultural diplomacy hubs, they are increasingly viewed as vehicles for intelligence gathering, recruitment, radicalization, and logistical support.
While earlier estimates identified around 36 such centers across 17 countries, more recent assessments suggest the number has surpassed 80, with some operating unofficially.
Resecurity assesses that some of these centers are linked to criminal and narco-terrorist cells in Ecuador, including groups such as Los Lobos, Los Choneros, and Los Tiguerones, providing training, financing, and logistical assistance.
Ecuador Crackdown
Regional authorities have begun responding.
In March 2026, Ecuador detained an individual identified as M.K. or M.H., allegedly linked to Hezbollah and a longstanding drug trafficking network supporting the group.
The arrest, alongside other detentions including a Syrian suspect, is part of a broader crackdown announced by Interior Minister John Reimberg, aimed at preventing the establishment of international terrorist cells.
The operation is being carried out with support from the United States.
Shift to Colombia
Colombia is also emerging as a growing area of concern.
While IRGC-linked activity in the region is not new, the firm’s analysis suggests operations are expanding.
Iran is believed to maintain transactional relationships with local criminal and insurgent groups, including the Oficina de Envigado and factions linked to the National Liberation Army and Revolutionary Armed Forces of Colombia, primarily for money laundering and logistical coordination.
As pressure mounts in Venezuela, analysts expect further dispersion of these networks across Latin America, complicating regional security dynamics and stretching law enforcement capacity.
