Tradecraft Note & Confidence Tiering
This closing installment of the IRGC series follows CommandEleven’s standard sourcing discipline: every substantive claim is tiered CONFIRMED / ASSESSED / SPECULATIVE rather than folded into a single narrative. Unit 910’s compartmentalized, deliberately opaque structure means much of the open-source record is built on convergent reporting from Israeli, U.S., and regional counterterrorism sources rather than a single authoritative account , that convergence is noted where it exists and flagged where it does not.
[CONFIRMED] Reported by named officials, courts, or governments on the record, or independently corroborated by multiple credible outlets/agencies citing primary documents (indictments, Treasury designations, court records).
[ASSESSED] Consistent with converging reporting from research centers, government hearings, and named experts, but resting on pattern inference, informed-source reporting, or historical extrapolation rather than a single confirmed operational fact.
[SPECULATIVE] Plausible given the unit’s history and the broader IRGC-Hezbollah relationship, but not independently confirmed in public reporting at this time.
Key Judgments
- [CONFIRMED] Unit 910 , Hezbollah’s External Security Organisation, also known as the Islamic Jihad Organization, the “Shadow Unit,” or the “Black Unit” , is Hezbollah’s clandestine overseas operations and intelligence arm, structurally distinct from Hezbollah’s Lebanon-facing military wing and reporting through Hezbollah’s senior leadership to a command relationship with Iran’s IRGC-Quds Force.
- [CONFIRMED] As of 20–21 August 2026, the U.S. Treasury has formally re-designated Hezbollah as acting “in service to the Iranian regime under the command of” the IRGC-Quds Force , moving the U.S. government’s own designation language from parallel terrorist organization to explicit IRGC subordinate, alongside new sanctions on a ten-person cash-courier network.
- [CONFIRMED] Latin America , principally the Argentina-Brazil-Paraguay Tri-Border Area and Venezuela , is Unit 910’s most durable and longest-running theater outside the Middle East, combining historical attack precedent (Buenos Aires, 1992 and 1994) with an active, decades-deep financial and logistics infrastructure.
- [ASSESSED] Unit 910’s Latin American financial infrastructure has evolved from cash- and trade-based laundering (used-car sales, charcoal exports, bulk cash) toward crypto and stablecoin-enabled channels, reflecting the network’s adaptation to sanctions pressure rather than any reduction in scale.
- [ASSESSED] The August 2026 OFAC action is best read as incremental disruption of a known courier architecture (Lebanon-Turkey-UAE-Iran commercial-flight cash smuggling) rather than a structural blow to Hezbollah/IRGC financing , consistent with a decades-long pattern in which designated networks are replaced rather than eliminated.
- [ASSESSED] Venezuela’s post-Maduro political trajectory is the single largest variable affecting Unit 910’s regional posture going forward; loss of state-level protection would degrade the group’s documentation, banking, and intelligence-liaison advantages even if criminal and financial networks persist independently.
Doctrine and Command Relationship
Structure and Chain of Command
[CONFIRMED] Unit 910 , Hezbollah’s al-Amn al-Khariji (External Security Organisation) , is Hezbollah’s dedicated overseas covert-action and intelligence branch, distinct from Amn al-Muddad (external/encounter security) and Amn al-Hizb (internal/leadership protection). It is commanded by Talal Hamiyah (“Abu Jaafar”), a member of Hezbollah’s Jihad Council.
[ASSESSED] The unit is understood to be organized into compartmentalized cells with limited cross-visibility , operatives are briefed only on what their specific role requires , a structure researchers attribute in part to Iranian and, per some accounts, North Korean intelligence tradecraft training provided to Hezbollah’s counterintelligence apparatus.
[CONFIRMED] Unit 910 answers up through Hezbollah’s senior leadership, and multiple government and research-center assessments describe it as Iran’s long-range strategic arm , used by Tehran, and particularly the IRGC-Quds Force, as an extension of Iranian intelligence reach into theaters where direct Iranian state action would be more exposed.
The August 2026 Formal Re-Designation
[CONFIRMED] On 20–21 August 2026, OFAC announced it was “re-designating Hizballah for service to the Iranian regime under the command of Iran’s Islamic Revolutionary Guard Corps-Qods Force (IRGC-QF)” as part of the same action sanctioning ten individuals , nine Turkish nationals and one Iranian national , for operating a cash-courier network moving up to hundreds of millions of dollars to Hezbollah via commercial flights between Lebanon, Turkey, the UAE, and Iran. Treasury Secretary Scott Bessent tied the action explicitly to Hezbollah’s continued militant activity and obstruction of Lebanese state authority and disarmament efforts.
This is a meaningful doctrinal shift in the U.S. government’s own framing, not merely a routine sanctions update. Since 2001 OFAC has treated Hezbollah as a Specially Designated Global Terrorist organization in its own right; the new language explicitly subordinates Hezbollah to IRGC-QF command. For a client audience, the practical effect is that future Hezbollah-linked designations , including Unit 910 and Latin American financial nodes , can now be pursued and framed by Treasury as direct IRGC actions rather than as a parallel, merely Iran-aligned organization. This dossier treats the Unit 910/Latin America/financing material that follows as, per that redesignation, functionally an extension of IRGC-QF’s own external operations architecture.
Capability and Operational History
Historical Attack Record
[CONFIRMED] Unit 910 (under its earlier Islamic Jihad Organization designation) has been linked by Argentine and international investigators to two landmark Buenos Aires attacks: the 1992 bombing of the Israeli embassy and the 1994 bombing of the AMIA Jewish community center , the deadliest terrorist attacks in Argentine history. It has also been linked to the 2012 Burgas, Bulgaria bus bombing that killed five Israeli tourists and a Bulgarian driver.
[ASSESSED] Research centers tracking the unit (Alma Research and Education Center, GreyDynamics, and others) assess it maintains standing global reach across Europe, Africa, Asia, and the Americas, with operatives typically holding foreign citizenship and operating under civilian commercial cover, leveraging existing Shia diaspora networks and, in several documented cases, local criminal organizations for logistics.
[SPECULATIVE] Open-source reporting (including Wikipedia’s aggregation of prior press claims) describes established Unit 910 sleeper cells inside the United States “awaiting directives.” This dossier flags this consistent with its treatment of the parallel IRGC sleeper-cell claim in Part III: a serious, recurring concern shaping U.S. force-protection posture, but not backed in public reporting by a confirmed, named cell structure.
Operational Model
Consistent with CommandEleven’s editorial standard, this dossier does not detail Unit 910’s tradecraft, targeting methodology, or operational security practices beyond what is already in wide public circulation as historical description. The operationally relevant takeaway for a client audience is structural: Unit 910 functions as a deniable extension of state (Iranian) intelligence capability, using non-state cover, and its demonstrated attack history spans three decades and multiple continents , it is a standing capability, not an emergent one.
The Latin American Theater
The Tri-Border Area
[CONFIRMED] The Tri-Border Area (TBA), where Argentina, Brazil, and Paraguay converge, has been identified by U.S. and regional authorities as a Hezbollah-linked financial and logistics hub since at least the early 2000s, enabled by a large Lebanese-Shia diaspora community, porous borders, and constrained regional law-enforcement capacity.
[ASSESSED] Research centers (RAND, Latinoamérica21) assess the TBA functions as a money-laundering epicenter for Hezbollah, using front companies, currency exchange houses, and casinos to clean proceeds from drug trafficking and extortion, with established links to Mexican cartels and, historically, Colombia’s FARC to facilitate narcotics and weapons movement along established trafficking routes into Europe and the Middle East.
Venezuela
[ASSESSED] Under the Chávez and Maduro governments, Hezbollah is assessed to have obtained a direct line to Venezuelan officials that facilitated intelligence infrastructure, identity and passport documentation, and access to legitimate banking , a state-protection advantage distinct from, and more valuable than, the TBA’s simple permissiveness. Hezbollah’s Venezuelan activity is assessed to include drug trafficking, money laundering, illicit smuggling, and reported involvement in coltan and gold mining.
[ASSESSED] The Soufan Center assesses that Venezuela’s post-Maduro political trajectory is the key open variable for this theater: loss of sympathetic state cover would degrade Hezbollah’s documentation and banking access even if the underlying criminal and financial networks continue to operate independently of government protection.
Money Laundering and Financial Infrastructure
Documented Mechanisms
[CONFIRMED] U.S. Senate testimony and Treasury designations document a two-decade pattern of Hezbollah/Unit 910-linked financial schemes in Latin America: the Ayman Joumaa network, which laundered hundreds of millions of dollars through cocaine trafficking and used-car sales before U.S. agencies disrupted it; the Colombian charcoal-export scheme tied directly to ESO (Unit 910) financing, which led to a 2023 Treasury designation and a 2024 arrest; and trade-based schemes managed by members of the Rada family across the Tri-Border Area.
[ASSESSED] More recent reporting (GNET Research, 2025) assesses Hezbollah-linked actors are increasingly embedded in Venezuela’s informal cryptocurrency and stablecoin markets, using local crypto firms, OTC brokers, and cash-to-crypto conversion as a lower-visibility alternative to traditional bulk cash and trade-based laundering , an adaptation consistent with sustained sanctions pressure on prior channels rather than a reduction in overall financial activity.
The August 2026 Courier Network Designation
[CONFIRMED] The ten individuals sanctioned on 20 August 2026 , nine Turkish nationals (eight men, one woman) and Iranian national Masoud Mosafer , were designated for operating a network that used couriers on commercial passenger flights between Lebanon, Turkey, the UAE, and Iran to move up to hundreds of millions of dollars in bulk cash outside the formal financial system, providing Hezbollah foreign currency access and sanctions evasion capacity. OFAC’s release explicitly linked the action to Hezbollah’s broader designation as an SDGT since 2001 and cited its ties to IRGC-QF.
Analytic takeaway: this is a geographically distinct channel (Turkey/UAE commercial-flight cash smuggling) from the Latin American mechanisms in Section 4.1, illustrating that Hezbollah/IRGC-QF financing is a multi-theater, redundant architecture rather than a single pipeline. Treasury’s own framing , disruption of a specific network rather than claims of a decisive blow , is consistent with the historical pattern in which designated facilitators are replaced by successor networks within months to years.
Comparative Assessment
| Dimension | Confirmed Record | Current Trajectory | Key Open Variable |
| Command relationship | Hezbollah→IRGC-QF, now formally re-designated | Tightening, per Aug 2026 OFAC language | Durability of new designation framing |
| Attack history | Buenos Aires 1992/94, Burgas 2012 | No confirmed new attacks in this reporting window | Domestic cell status , unconfirmed |
| Latin America footprint | TBA hub since early 2000s | Diversifying (crypto, mining) | Post-Maduro Venezuela trajectory |
| Financing | Charcoal, used-car, bulk cash schemes documented | Shifting to crypto/stablecoin channels | Scale of crypto exposure , largely unquantified |
