Iran and Hezbollah Are Relocating Terror Networks Across Latin America

A major shift in the geopolitical and cyber-threat landscape of Latin America is underway following the arrest of Nicolás Maduro in January 2026. According to a comprehensive intelligence report from Resecurity, the removal of Maduro has “severely disrupted IRGC and Hezbollah operations in Venezuela,” effectively dismantling what was once a secure regional hub for Iranian-backed activities.

However, this disruption has not eliminated the threat; rather, it has forced these networks to evolve and relocate their strategic focus to Colombia and Ecuador.

One of the most concerning findings in the report is the weaponization of Iranian Cultural Centers (ICCs). While appearing to be hubs for “cultural diplomacy and religious outreach,” Resecurity warns they act as a “terror pipeline” for the Islamic Revolutionary Guard Corps (IRGC).

The report notes that these centers serve as platforms for:

• Intelligence Gathering: Staffed by members of Iran’s intelligence apparatus (MOIS) to monitor regional movements.
• Radicalization and Scouting: Identifying and recruiting local youth for “paramilitary-type training”.
• Logistical Support: Providing cover for operatives involved in criminal activity.

“ICCs are involved in providing training, logistics and financial support to criminal and narco-terrorist cells in Ecuador, such as GDO Los Lobos, Los Choneros, and Los Tiguerones,” the report states.

With Venezuela’s destabilization, Colombia has surfaced as an attractive relocation point. Recent developments include the arrest of two Iranian operatives in the country and confirmed Hezbollah surveillance of diplomatic targets in Bogotá.

In Ecuador, the government has taken a more proactive stance. In March 2026, authorities arrested and began deportation proceedings against an individual linked to Hezbollah drug trafficking networks. Interior Minister John Reimberg announced these actions are part of a broader crackdown to prevent “international terrorist cells from operating in Ecuador”.

The IRGC and Hezbollah continue to finance their operations through a complex mix of “cocaine trafficking, money laundering (including crypto and hawala), and new alliances with local cartels”.

Beyond physical threats, the IRGC manages a massive disinformation infrastructure including:

• State-sponsored media like HispanTV and PressTV.
• Thousands of social media accounts designed to disseminate anti-Western propaganda and “shape narratives” even after peak conflict periods.
• Strategic alliances with leftist movements (especially ALBA states) to circumvent international sanctions.

Resecurity emphasizes that “cyber intelligence is essential for mapping, tracking, and disrupting IRGC and Hezbollah networks”. By utilizing graph-based analysis and blockchain forensics, researchers have already mapped key actors across 12 Latin American countries, enriching datasets with IP addresses, phone numbers, and emails to assist global law enforcement.

As these networks adapt to the loss of their Venezuelan safe haven, the focus moves to regional collaboration. The report concludes that by partnering with advanced technology providers, Latin American nations can better combat the “corruption, terror, and violence promoted by Iran to spread its influence”.