Iranian Proxy Networks in Latin America Post-Maduro: IRGC

Executive Summary

Key Findings:

• The arrest of Nicolás Maduro in January 2026 has severely disrupted IRGC and Hezbollah operations in Venezuela, forcing these networks to adapt and relocate activities across Latin America.
• Colombia has seen confirmed Hezbollah espionage, failed terrorist plots, and deepening collaboration with criminal groups, while Ecuador has taken a proactive stance against Iranian activity, including recent successful arrests of operatives.
• IRGC and Hezbollah-linked actors continue to exploit cocaine trafficking, money laundering (including crypto and hawala), and new alliances with local cartels and guerrilla groups.
• Regional and international authorities have intensified countermeasures, including terrorist designations and targeted sanctions.

Introduction

Following the arrest of Nicolás Maduro and the destabilization of Venezuela in early 2026, Iranian threat actors have experienced significant disruption in Latin America. Venezuela’s loss as a safe haven has forced these networks to adapt in Colombia and Ecuador. IRGC and Hezbollah operatives remain active in espionage, failed terrorist plots, and criminal collaboration with local groups. Across the region, these actors continue to exploit drugs trafficking routes, money laundering schemes, and new alliances. 

Iran’s Cultural Diplomacy: A Dual-Use Strategy

IRGC (Islamic Revolutionary Guard Corps) uses Iranian Cultural Centers (ICCs) abroad to promote its activities and build proxy networks of operatives. These centers serve as platforms for intelligence gathering, recruitment, radicalization, and logistical support for IRGC and allied groups, under the guise of cultural diplomacy and religious outreach.

ICCs are managed by the Islamic Culture and Relations Organization (ICRO), which operates directly under the Supreme Leader. This ensures alignment with regime and IRGC objectives. Cultural attachés and staff at these centers are often appointed from within Iran’s intelligence and security apparatus, including the Ministry of Intelligence and Security (MOIS). Iranian-backed cultural and religious centers have been identified as nodes for ideological influence and recruitment pipelines. Reports indicate these efforts are linked to broader Iranian efforts to build a "terror pipeline" in the region. For example, Mohsen Rabbani, Iranian cultural attaché in Argentina, was indicted for orchestrating the Argentine Mutual Israelite Association (AMIA) bombing in 1994, demonstrating direct operational use of cultural cover to conduct radical activities. This dual-use strategy is recognized bylaw enforcement, intelligence agencies, and independent experts, with concrete examples spanning the United States, Europe, Latin America, Africa, and Asia. Just recently the IRGC was implicated in a plot to assassinate Israel's ambassador to Mexico, Einat Kranz Neiger. 

Cultural centers project Iranian culture and religion, but also disseminate regime ideology (e.g., Velayat-e Faqih), promote anti-Western narratives, and suppress dissent. Like strategies used in other regions, Iran-linked centers have engaged in "scouting" and cultural events, which have been linked to the recruitment of youth into paramilitary-type training, specifically using local, pro-government networks like the circulos bolivarianos (Bolivarian Circles) in Venezuela. These centers often promote Shiite ideology blended with revolutionary doctrine. Through institutions such as Qom-based Al-Mustafa University and local "Islamic centers," Latin American converts are targeted for recruitment and sometimes sent to Iran for specialized training. Resecurity identified the increase of malicious activity originating from ICCs across Latin America - especially, in Ecuador and Colombia.

Example of ICC (based in Quito, Ecuador):

ICC, which has been operating in Quito (Ecuador) since 2006, experienced its greatest expansion in 2008, following the arrival of Rafael Correa's government and its realignment with cells already operating in Venezuela.

Based on the Resecurity assessment, ICCs are involved in providing training, logistics and financial support to criminal and narco-terrorist cells in Ecuador, such as GDO Los Lobos, Los Choneros, and Los Tiguerones.

According to multiple sources, there were at least 36 Iran-linked cultural centers operating across 17 Latin American countries. Some of these centers operate unofficially. As of recent estimates, the number has grown to more than 80 cultural centers. These centers are part of Iran's broader strategy to counter U.S. influence in the region and foster ideological and cultural ties.

In March 2026, Ecuador arrested and initiated deportation proceedings against an individual, identified as M.K. or M.H., linked to Hezbollah and previously involved in a 2005 drug trafficking network supporting the group. This action is part of a broader crackdown on foreign nationals with ties to terrorist groups, including the arrest of a Syrian national and reports of an Iranian cleric linked to local crime, as announced by Interior Minister John Reimberg. The operation is part of an initiative to prevent international terrorist cells from operating in Ecuador, with support from the U.S. government.

Propaganda Activity Across Latin America

IRGC is deeply involved in propaganda activities in Latin America, both during and after periods of conflict or heightened tensions with the United States. This activity is carried out through a sophisticated infrastructure of state-sponsored media (notably HispanTV and PressTV), proxy networks (such as Hezbollah’s Al-Manar), social media disinformation campaigns, and alliances with sympathetic Latin American peers. These efforts intensify during US-Iran confrontations and are amplified by regional partners, making the IRGC a significant player in the information environment of Latin America. Even after the peak of conflict, these channels continue to shape narratives, recruit sympathizers, and maintain anti-Western sentiment in the region.

Both the IRGC and Latin American leftist movements (especially ALBA states) share opposition to US influence, which forms the basis for their cooperation. The IRGC’s revolutionary narrative aligns with the Bolivarian socialist ethos of Venezuela, Cuba, and Nicaragua. Partnerships with leftist help Iran circumvent international sanctions and facilitate illicit financial flows. Destabilization of pro-US governments is a tool, not the end goal. The IRGC’s overarching aim is to create leverage and deterrence against the US by embedding itself within the region’s anti-American bloc. Resecurity identified multiple communities, groups and channels on social media and IM:

Typically, actors in such groups provide invitation-based access to information circulating within them, due to frequent bans by social media networks. Later the information provided is distributed to variety of external resources. The IRGC is estimated to manage TV and radio channels, broadcasting and online streaming platforms, multiple online news sites, and thousands of social media accounts and disinformation assets.

The IRGC is still actively trying to influence Palestine and Venezuela through military, political, economic, and ideological means, with substantial evidence of ongoing and, in some cases, expanding operations. In Cuba, Iran maintains a close relationship and leverages available channels to disseminate anti-Western propaganda.

According to recently expanded sanctions on Cuba and an Executive Order (EO) issued on May 1 by President Donald Trump, Cuba has maintained 'close ties' with major state sponsors of terrorism—singling out Iran—and has provided safe haven for terrorist groups such as Hezbollah. Nevertheless, Iranian capabilities in the region are affected by the successful collaboration of the US and regional authorities; their malicious efforts, however, remain ongoing.

Cyber intelligence collected by Resecurity from the identified communities managed by Iran showed a strong presence of members located in Argentina, Bolivia, Brazil, Colombia, Cuba, Ecuador, Honduras, Nicaragua, Venezuela, Peru, Paraguay, and other countries in Latin America. Using graph-based analysis and our intelligence platform, we mapped the key actors involved and enriched data sets with their phone numbers, emails, IP addresses, and other metadata to assist law enforcement with further targeting.

Emerging Fronts of Influence

Colombia, along with other parts of Latin America, is becoming a region of interest for the IRGC and its affiliated networks. While the IRGC's activities in Latin America are not new, recent developments indicate an expansion of its influence and operations.

1. Recent Arrests in Colombia: Two Iranian operatives were arrested in Colombia, highlighting the IRGC's covert activities in the country. This incident is part of a broader pattern of IRGC-linked operations in South America, including terrorist plots and support for proxy groups like Hezbollah.
   
2. IRGC's Broader Latin American Strategy: The IRGC, particularly through its Quds Force, has been expanding its presence in Latin America. This includes cooperation with local criminal networks, such as drug cartels, to fund its operations. The region's porous borders and governance frameworks in some areas make it an attractive base for illicit activities, including money laundering and arms smuggling.
   
3. Connections to Hezbollah: Hezbollah, a key IRGC proxy, has a well-documented presence in Latin America, particularly in the Tri-Border Area (Argentina, Brazil, and Paraguay). This network is involved in fundraising and logistical support for IRGC operations. Colombia's proximity to these activities makes it a potential target for further IRGC expansion. Hezbollah operatives have conducted surveillance of diplomatic targets in Bogotá, with high-profile figures like Hussein Ahmad Karaki (using a Colombian passport) orchestrating operations. Notably, a failed bombing attempt in Bogotá was linked to Hezbollah, with ongoing cell activity and arrests in border regions such as Cúcuta.
   
4. Strategic Importance of Colombia: Colombia's geopolitical position and its history of conflict with drug cartels and insurgent groups make it a focal point for IRGC interest. The IRGC has been known to exploit such environments to establish footholds and build alliances with local actors.

Hezbollah has established transactional relationships with Colombian cartels (e.g., Oficina de Envigado) and guerrilla groups (ELN, FARC dissidents), primarily for money laundering and logistical support. 

Front companies (e.g., Zanga SaS) and business ventures are used to launder drug proceeds and embed operatives. Colombia is increasingly seen as an attractive relocation point for these networks, with high-profile operatives and business fronts surfacing. 

Ecuador and Colombia, being critical allies of the US in the fight against terrorism and malicious nation-state actors like Iran, continue to collaborate effectively to disrupt their activities in the region.

Appendix A. Criminal Collaboration: Trafficking, Laundering, and New Alliances

Appendix B. Activity Summary

Significance

IRGC, primarily via Hezbollah and alliances with leftist regimes, has provided substantial support to radical and revolutionary groups in Latin America. This support includes weapons, training, intelligence, and financial assistance, and has contributed to the destabilization of some governments—especially those aligned with the US. However, the IRGC’s primary motivation is strategic: to build operational depth, circumvent sanctions, and create leverage against objectives.

Conclusion

The arrest of Maduro has fundamentally altered the landscape for IRGC and Hezbollah operations in Latin America. While Venezuela’s role as a hub has been dismantled, Colombia has emerged as an attractive point for espionage, criminal collaboration, and potential relocation of operatives. 

Ecuador, meanwhile, has taken robust preventive measures but remains primarily a transit country for illicit flows. Across the region, Iranian-linked networks continue to adapt, leveraging sophisticated laundering schemes and new alliances, even as regional and international authorities escalate countermeasures.

The disruption of Venezuela’s safe haven has not eliminated IRGC/Hezbollah activity in Latin America—it has forced these networks to evolve, with Ecuador and Colombia now at the forefront of both threat and transit state.

Cyber intelligence is essential for mapping, tracking, and disrupting IRGC and Hezbollah networks in Latin America. Integrated methodologies—including OSINT, SIGINT, dark web monitoring, SOCMINT, blockchain forensics, and malware attribution—have already exposed and disrupted IRGC-linked plots, financial flows, and covert communications.

Resecurity highlights the importance of supporting law enforcement in Latin America with effective and cutting-edge tools to collect, analyze, and investigate Iranian threat actors and groups. By partnering with American defense leaders and technology providers, countries in the region gain strong security guarantees in the fight against corruption, terror, and violence promoted by Iran to spread its influence.