Iran and Hezbollah in Brazil: From Soft Power to Security Threat

Background

For years, the discussion about Iran and Hezbollah in Latin America has focused primarily on terrorism, fundraising, and the Tri-Border Area between Brazil, Argentina, and Paraguay. That framework is no longer sufficient. The more important question today is not simply whether Hezbollah has operatives in Brazil, or whether Iran is planning a specific attack. It is whether Tehran and Hezbollah have developed an ecosystem of religious, financial, diplomatic, informational, and community networks that can be activated when circumstances require.

Brazil deserves particular attention because many of these layers coexist there. The picture emerging from open-source information is not of a single clandestine terrorist organization waiting for instructions from Tehran or Beirut. Rather, it is of an infrastructure in which legitimate religious and cultural activity, ideological influence, diaspora relationships, financial networks, propaganda platforms, and individuals linked to Hezbollah or Iranian institutions can overlap. Soft power and terrorism are not the same thing. But soft-power infrastructure can create access, relationships, legitimacy, recruitment opportunities, and logistical networks that hostile actors may exploit.

In several key Latin American countries, political shifts toward conservative and pro-Western governments have been accompanied by closer security cooperation with the United States and a tougher approach toward Iran and Hezbollah. This has translated into new legal, financial, and counterterrorism measures that have progressively constrained the ability of Iranian and Hezbollah-linked networks to operate freely. For example, in January 2026, Argentina’s Milei government designated Iran's Islamic Revolutionary Guard Corps-Quds Force (IRGC-QF) and thirteen associated individuals under its terrorism registry, subjecting them to financial sanctions and operational restrictions. Brazil represents a significant gap in this emerging regional security architecture. Despite investigations and allegations concerning Hezbollah-linked financing, recruitment, and facilitation networks on Brazilian territory, Brazil has not designated Hezbollah as a terrorist organization. As neighboring jurisdictions increase legal, financial, and operational pressure, Brazil may become increasingly attractive to the organization as an environment for influence operations, fundraising, financial activity, religious and cultural outreach, recruitment, and logistical facilitation.

Academia and Religious Infrastructure

Iran’s efforts to expand its influence in Brazil extend well beyond diplomatic relations and political engagement. Religious education has become an important way to build lasting connections between Iranian institutions and local communities. One way Tehran has pursued this objective is by bringing international students to Iran for religious training, allowing them to build personal relationships with Iranian clerics and institutions while becoming familiar with the Islamic Republic’s religious and political worldview.

Latin America has longstanding Muslim communities, many of which originate from immigrants from Lebanon, Syria, and other parts of the Middle East. Brazil is home to one of the region's most established Muslim communities, with mosques, religious centers, and cultural institutions across the country. These communities, particularly Shiite Muslims with family and historical ties to Lebanon, have also become an important focus of Iran's efforts to expand its religious and cultural influence in the region.

Al-Mustafa International University in Iran, based in Qom, plays a central role in this effort. Brazilian students have been drawn to the university through recommendations from local mosque imams, friends and family members, as well as recruitment initiatives promoted through social media. Some graduates subsequently return to Brazil, where they become involved in mosques, religious education, and cultural activities, often maintaining the connections they developed during their studies in Iran. Al-Mustafa's importance therefore extends far beyond its campuses in Iran. Its graduates can join a wider network of religious figures and institutions that maintain close ties with Tehran and contribute to its influence abroad. This does not mean that studying at Al-Mustafa automatically implies involvement in Iranian intelligence or other illicit activities. Nevertheless, relationships built through these educational programs can give Iranian institutions access to local communities and opportunities that Iranian security organizations may seek to exploit.

The Latin American model of Al-Mustafa University involves seminars, Iranian-funded study visits, clerical training programs, establishment of affiliated centers, university cooperation, and media platforms. Among Al-Mustafa alumni are those subsequently associated with mosques and cultural centers in Latin America, where Al-Mustafa-related activity or influence has been reported in numerous countries, including Brazil, Argentina, Colombia, and Venezuela. In December 2020, the U.S. Treasury Department imposed sanctions on Al-Mustafa International University for allegedly facilitating recruitment and intelligence activities on behalf of the IRGC-QF. According to the Treasury Department, the university's international student network had been exploited to recruit individuals for the IRGC-QF-supported militias, including those operating in Syria.

The concern is structural: Iran and the IRGC-QF have exploited infrastructure and an international network capable of building long-term relationships with local religious figures and communities. Where a mosque, cultural center, or clerical network is linked to Tehran or Hezbollah, it can provide long-term access to the community and create an infrastructure for influence, mobilization, fundraising, and network-building. These institutions matter strategically because they sit at the center of community life. They can connect clerics, families, businesspeople, students, and younger generations; organize religious and cultural events; shape political narratives; maintain relationships with Lebanon and Iran; and mobilize resources during political or military crises. In this sense, influence over a religious institution can provide something that a clandestine organization cannot easily create on its own: legitimacy, continuity, trust, and direct access to a community.

Brazil provides a documented example. In 2010, the U.S. Treasury designated cleric Bilal Mohsen Wehbe, head of Mesquita do Brás in São Paulo, as a terror operative, identifying him at the time as Hezbollah's chief representative in South America. The U.S. Treasury stated that he relayed information between Hezbollah leadership and elements in South America and was involved in transferring funds collected in Brazil to Hezbollah in Lebanon. This creates a potential “community-to-network” pipeline: religious legitimacy facilitates social access; social access creates trusted relationships; trusted relationships can support fundraising and logistical networks; and, in exceptional cases with evidence of tasking or recruitment, those networks may provide an enabling environment for clandestine activity. Within São Paulo, Mesquita do Brás merits enhanced scrutiny because of the reported overlap between religious activity and networks associated with Iran and Hezbollah. The mosque has hosted visiting Lebanese and Iranian clerics, organized commemorative events honoring Iranian political and religious figures, and engaged in fundraising activities. In addition, several clerics associated with the mosque have reportedly maintained ties to Hezbollah-linked networks. Independent open-source reporting has also identified Mesquita do Brás as an important center for Hezbollah-associated religious and community networks in Brazil.

The Iranian Model: Outsource the Last Mile

Iran's religious and educational activities represent only one dimension of its broader presence in Brazil. While these efforts primarily aim to cultivate long-term influence and relationships within local communities, Tehran has also developed more covert methods of operating abroad. These include relying on local intermediaries, criminal organizations, and individuals with no apparent connection to Iran to carry out intelligence gathering, surveillance, and, in some cases, attacks. Unlike religious and cultural networks, which operate largely in the public sphere, these clandestine arrangements are designed to conceal Iranian involvement and complicate efforts to identify those responsible. Understanding this distinction is essential to assessing the full range of Iranian activities in Brazil, from cultivating influence to potentially preparing covert operations.

In this context, Iran's overseas operations increasingly demonstrate an important characteristic: Tehran does not necessarily need to send Iranian operatives to conduct every mission. Iranian security organizations have repeatedly sought intermediaries, criminal networks, and locally recruited individuals to provide surveillance or conduct attacks abroad. The U.S. Treasury has documented this broader Iranian practice, noting that Tehran has used criminal organizations and third-party actors in overseas plotting to obscure Iranian involvement and preserve plausible deniability. This creates a particularly difficult counterintelligence problem. The individual who ultimately conducts surveillance, collects information, transfers money, or carries out an attack may have no obvious Iranian profile whatsoever. He may be a criminal recruited for money, an ideologically motivated local actor, or an intermediary several layers removed from the original tasking.

Lessons from Canberra and Rome for Brazil

The Australian case demonstrates why Iranian diplomatic and diplomatic-adjacent infrastructure should be treated as a counterintelligence concern, not merely as a foreign-policy issue. In August 2025, Australia's government announced that ASIO (the Australian Security Intelligence Organization) had gathered sufficient intelligence to assess that the Iranian government directed at least two antisemitic attacks: the October 2024 arson attack on Lewis' Continental Kitchen in Sydney and the December 2024 attack on Melbourne's Adass Israel Synagogue. ASIO assessed that the IRGC operated through layers of intermediaries and criminal proxies intended to conceal Tehran's role. For Brazil, the lesson is that Iran has demonstrated both the intent and capability to direct covert activity abroad while maintaining plausible deniability through intermediaries. This makes systematic monitoring of the broader Iranian state presence in Brazil strategically important: diplomatic personnel and their external contacts; relationships with Iranian-linked religious institutions and clerics; visiting delegations; financial and commercial intermediaries; travel between Brazil, Iran, and Lebanon; and the activities of cultural and educational structures associated with Tehran.

Italy also offers a relevant example. In January 2026, Italian media reports alleged that Iranian intelligence networks were operating in Rome. They identified the cultural center associated with the Iranian Embassy as a potential focal point for recruitment, intelligence-related activities, and cyber-monitoring. Although these allegations should not be treated as conclusive evidence of wrongdoing, they highlight the potential dual-use nature of diplomatic and cultural infrastructure.

For Brazil, Australia and Italy offer two complementary lessons. The Australian case illustrates the operational risks associated with Iranian activities conducted under diplomatic cover. The Italian reports highlight the possibility that cultural institutions may provide an environment for intelligence-related activities. Taken together, these cases underscore the importance of examining potential risks before they develop into identifiable security incidents. Waiting until an operational threat becomes visible may mean detecting it only at an advanced stage.

Information Warfare

Iran's activity is not limited to clandestine networks. Tehran also invests heavily in narratives. HispanTV, operated by Iran's state broadcaster IRIB, is one of the most prominent vehicles for Spanish-language messaging in Latin America. At the same time, Portuguese-language content expands Tehran's ability to reach Brazilian audiences.

Iranian information activity frequently combines anti-American, anti-Israeli, anti-”imperialist,“ and pro-“resistance” narratives. This dimension should not be dismissed as propaganda disconnected from security. Influence operations can shape the environment in which more aggressive activities occur. They can identify sympathetic audiences, normalize extremist narratives, amplify polarization, and create digital communities through which relationships can later move from online interaction to direct contact.

Crypto as Hezbollah’s Newer Financial Layer

The religious, cultural, and clandestine networks discussed above represent different dimensions of Iran and Hezbollah's activities in Brazil. Yet maintaining these networks, supporting operatives, and transferring resources across borders also require access to financial infrastructure. Traditionally, Hezbollah has relied on cash couriers, informal money-transfer systems, commercial businesses, and trusted intermediaries to move funds between Latin America and the Middle East. The growing use of cryptocurrency has added another dimension to these activities, allowing money to move through financial networks with no immediately visible connection to Iran or Hezbollah—which also helps circumvent Western sanctions.

This development is particularly relevant to Brazil, where a substantial cryptocurrency market and informal financial intermediaries create opportunities for cross-border transactions. Just as Iranian security organizations have relied on locally recruited individuals and criminal networks to carry out operations abroad, financial networks associated with Hezbollah can potentially benefit from intermediaries not formally affiliated with the organization. The challenge for law enforcement therefore extends beyond identifying known Hezbollah financiers. It also involves examining whether apparently unrelated financial actors and cryptocurrency transactions connect to networks already associated with terrorist financing.

Hezbollah’s heavy use of crypto is well documented, and authorities are consistently stepping up efforts to intercept this financial methodology. The most sizable examples include the U.S. Treasury’s sanctioning of a Lebanon-based Syrian money exchanger for supplying Hezbollah with digital wallets to receive funds from the IRGC-QF, and more recently, Operation Economic Outcast, which formally designated digital assets as one of five Iranian economic sectors now exposed to secondary sanctions. Meanwhile, Israel’s National Bureau for Counter Terror Financing continuously seizes USDT (U.S. dollar-pegged stablecoin) wallets, as well as other wallets that are linked to IRGC/Hezbollah-connected exchanges and entities in Syria, Iran, Iraq, Gaza, and beyond.

However, authorities in Brazil have not yet recognized the new phenomenon: individuals with no declared affiliation to Hezbollah or Iran, seemingly unconnected to any terror network, who are nonetheless sending significant funds to such networks. Some have already faced scrutiny for entirely unrelated matters, with their wallets even named in court proceedings. Still, no one has examined those wallets to see who sent money or from whom they received funds. That exposure only becomes visible once the transaction graph is traced.

The Braiscompany Case: Joel Ferreira

The findings of the Braiscompany case offer an instructive example of how individuals with no apparent terrorist affiliations or financial connections to Hezbollah may still be part of Iran-linked networks.

In April 2025, Joel Ferreira de Souza and several other executives associated with Braiscompany, a Brazilian cryptocurrency investment company implicated in a major financial fraud and money-laundering scheme, received combined prison sentences totaling 171 years for operating an unlicensed financial institution and laundering funds through shell companies and unregulated cryptocurrency wallets. Ferreira, identified as the scheme’s main operator, received a 128-year sentence for overseeing the creation and movement of funds across the network.

The prosecution’s court filings identified two wallets traced to Ferreira. The prosecution discussed funds movement from Ferreira’s wallets to Braiscompany’s founders, who have also received criminal sentences. But the prosecution’s case did not refer to any other transactional behavior.

NOMINIS's review of the findings—based on blockchain intelligence analysis combining publicly available blockchain transaction records, wallet attribution data, sanctions designations, and Brazilian judicial records—traced Braiscompany’s transactions to wallet clusters and financial services associated with Hezbollah and Iran's IRGC.

According to NOMINIS analysis, the broader transaction graph for both of Ferreira’s wallets shows direct exposure to a cluster of Hezbollah-linked and terror-financing services. It also reaches a wallet associated with IRGC-linked infrastructure within three hops. One of the wallets is connected to PagCripto, a Brazil-based over-the-counter (OTC) cryptocurrency trading desk that still operates under the name PagFinance. OTC desks facilitate large cryptocurrency transactions outside conventional exchanges, potentially making it more difficult to identify the individuals behind transactions and trace the movement of funds between digital assets and traditional financial systems. This connection is therefore relevant to understanding how cryptocurrency networks with potential exposure to illicit financing can intersect with legitimate financial services. However, it does not, by itself, establish wrongdoing by PagCripto or PagFinance.

By analyzing direct and indirect transaction relationships, NOMINIS identified financial exposure that the original criminal proceedings may not have examined. These connections do not, by themselves, establish that the wallet holders knowingly financed Hezbollah or acted on behalf of Iranian organizations; rather, they identify potential financial links that warrant further investigation.

Ferreira is a working example of the model described above: a locally recruited, financially motivated intermediary with no visible Iranian or Hezbollah profile, running an ordinary-looking, albeit illegal, financial business whose infrastructure sits one or two hops away from terror networks.

The Braiscompany case shows how a prosecution proceeds on its own narrow terms and never asks questions about a wallet's onward connections, let alone answers them. Ferreira was convicted and sentenced, and the case was closed, without ever asking where his funds ultimately traveled. If that gap holds for one Brazilian financial crime prosecution of this scale, there is little reason to assume it does not hold for others running in parallel that remain unexamined to this day.

Brazil Needs to Move from Monitoring to Prevention

Iranian-linked religious and ideological networks exist in Latin America; Hezbollah has a documented history of financial and organizational activity in the region; U.S. authorities have identified Brazil-linked Hezbollah figures; and Brazilian authorities themselves have investigated alleged Hezbollah recruitment for attacks.

The correct response from Brazil should therefore focus on intelligence-led prevention: designating Hezbollah as a terrorist organization; mapping networks; tracing suspicious financial flows (including through blockchain analysis of wallets, even in the case of individuals with no declared affiliation to any of the networks described above); strengthening cooperation between federal and state authorities; examining links between overseas actors and local intermediaries; and monitoring the boundary where legitimate religious or political activity may be exploited for intelligence collection, recruitment, or operational preparation. One positive example is Brazil's Federal Police launching Operation Trapiche (Operação Trapiche) on November 8, 2023. The operation targeted an alleged Hezbollah-linked network suspected of planning attacks against Jewish and Israeli targets in Brazil. Brazilian authorities arrested two suspects and executed eleven search warrants across São Paulo, Minas Gerais, and the Federal District. It demonstrated that Hezbollah-linked networks may pose a tangible security threat in Brazil, extending beyond ideological influence, political engagement, and fundraising to the potential planning of attacks against Jewish and Israeli targets on Brazilian soil.

Brazil can serve as an arena of influence, a financial environment, a recruitment pool, and a potential target. The central question is no longer whether Iran or Hezbollah could build an operational infrastructure in Brazil. The more important question is whether elements of that infrastructure already exist—and whether Brazilian authorities can identify the moment when influence turns into operational preparation before it happens.

President Lula’s election victory and his continued rule in Brazil may give Iran and Hezbollah a significant opportunity to deepen their activity in the country. As right-wing, pro-Western governments gain strength in several Latin American countries—expanding security cooperation with the United States and taking steps to restrict Iranian and Hezbollah activity—Tehran is likely to see Brazil as an arena of growing strategic importance. Lula’s continued tenure, together with his diplomatic relations with Iran and the absence of any Brazilian designation of Hezbollah as a terrorist organization, could encourage Tehran and Hezbollah to expand their influence activities, build ties with local actors, and develop financial and logistical infrastructure.

It is precisely under these circumstances that Brazil’s leadership must not mistake its relatively good relations with Iran for immunity from Iranian intelligence or operational activity on its soil. International experience shows that Tehran can exploit diplomatic, economic, and cultural ties to advance covert aims as well, and that the absence of political confrontation does not guarantee the absence of a security threat.

At the same time, despite the political tensions between Israel and Brazil, Israel should continue to help the Brazilian authorities confront Iranian and Hezbollah activity—through intelligence sharing, professional know-how, and assistance in exposing financing networks and covert infrastructure. This is a shared interest of both countries: the activity of these networks could endanger not only Israeli and Jewish targets but also Brazil’s own security and sovereignty. Political disputes between Jerusalem and Brasília should not stand in the way of security cooperation against a threat that both countries could pay dearly for ignoring.