by

June 9, 2026

9 minutes

Read Time

Iran’s proxies moving towards ‘violent gig economy’, but no imminent threat to Southeast Asia: Expert

While there are no reports of Iran-linked “violent gig economy” activities in Southeast Asia, “well-to-do” societies may be more vulnerable to threats, says a counterterrorism expert at a dialogue in Singapore.

New: You can now listen to articles.

This audio is generated by an AI tool.

Savanna Tai

Read a summary of this article on FAST.

Get bite-sized news via a new
cards interface. Give it a try.

Click here to return to FAST
Tap here to return to FAST

FAST

SINGAPORE: Iran’s proxy groups may be moving towards what can be described as a “violent gig economy”, with a shift from traditional militant cells to global external operations that are more flexible and deniable, according to an ex-counterterrorism analyst with the United States’ Federal Bureau of Investigation (FBI).

While there is no imminent threat to Southeast Asia, Singapore’s developed economic system may make it vulnerable to Iranian-linked “shadow banking” activities that fund its proxy groups, said Matthew Levitt, now a senior research fellow at The Washington Institute, a US think tank.

He added the rise of encrypted online channels used to recruit individuals to carry out surveillance and attacks could raise concerns.

In recent years, these trends have been salient in Europe, where Lebanon-based Hezbollah, Palestinian group Hamas and most recently Harakat Ashab al-Yamin al-Islamia (HAYI) – a group that emerged in March 2026 operating on behalf of Iran’s Islamic Revolutionary Guard Corps – have tapped global intermediaries such as front companies and criminal networks to fund their operations, said Levitt.

According to its website, The Washington Institute seeks to advance a “balanced and realistic understanding” of American interests in the Middle East and to promote the policies that secure them.

Levitt was speaking at a dialogue titled “Iran and its proxies: Implications for Southeast Asia”, organised by the Centre of Excellence For National Security at Singapore’s S Rajaratnam Institute for International Studies (RSIS) on Tuesday (Jun 9).

Activities undertaken in the “violent gig economy” include shadow banking through financial intermediaries issuing loans without regulation, trade-based money laundering, online recruitment campaigns targeting individuals with no affiliation to Iran and untraceable cryptocurrency deals, he added.

“Increasingly, we are seeing Iranians, either through cut-outs – an intermediary that isolates two parties – like organised criminal groups in Europe that use Russian-affiliated mobs to then either carry out attacks themselves or, in several cases in Europe, hire other people to carry out attacks,” Levitt said.

Guess Word
Crack the word, one row at a time

Buzzword
Create words using the given letters

Mini Sudoku
Tiny puzzle, mighty brain teaser

Mini Crossword
Small grid, big challenge

Word Search
Spot as many words as you can

Show Less

Houthi rebel fighters march during a rally of support for the Palestinians in the Gaza Strip and against the US strikes on Yemen outside Sanaa on Jan 22, 2024. (Photo: AP)

In “at least two dozen cases, they’re recruiting 14 year-olds, 13 year-olds, 18 year-olds … who don’t know that they’re (the recruiters) working from Iran, don’t know what exactly they’re going to do until the last minute,” he said, citing the “Foxtrot” network – a Swedish organised group whose leader has ties to the Iranian government.

On Mar 19, a Norwegian teen was arrested with two guns and 12 rounds of ammunition after travelling to the United Kingdom on an emergency passport. He was allegedly recruited by the Foxtrot network under a deal that he would be paid to “travel here and undertake a hit”.

In September 2025, five Swedish teens, recruited through encrypted messaging apps such as Telegram and Snapchat, had allegedly attempted to murder a dissident Iranian researcher in the country for money. The Iranian researcher later told local media that he believed the attack was ordered by Iranian authorities.

Levitt noted that Hamas, which historically focused on Israel, the West Bank and Gaza, has turned to external plotting in Europe – something that the group considered before but never carried out.

Amid decimated capabilities in Gaza following Israel’s retaliation for Hamas’ Oct 7, 2023 attacks and growing popular support for Palestinian cause, Hamas has to find other ways to carry out its attacks and protect against attacks outside of the Middle East, according to Levitt’s research.

People carry bodies identified by mourners as Hamas’ military wing commander Mohammad Odeh, who was killed in an Israeli strike on Tuesday, and his wife and children, during a funeral, in Gaza City, May 27, 2026. (Photo: Reuters/Mahmoud Issa)

Iran’s proxy groups also include the Houthis in Yemen and other Iraqi groups including Iran-aligned Shia militias, all of which are listed as terrorist organisations by the US.

He pointed to Hamas weapon caches in Bulgaria and Denmark that were reportedly found in early 2024 and 2019 respectively, years before the group’s attacks on Israel on Oct 7, 2023 that led to the Israel-Hamas war.

“The biggest thing to me is not a series of (terrorism) plots that have been exposed, but it’s that years earlier, someone in Hamas decided to pre-position small caches of weapons, handguns … well-maintained in three different places in Europe years before,” Levitt said. This helps Hamas build up military capacity in Europe to carry out attacks there if directed, he said.

Proxy groups have also relied on networks of companies serving as a front to facilitate the sale of illicit oil, including through Iraq, with much of the trade routed to Asian markets, particularly China, Levitt added.

He explained that proceeds are laundered through trade-based schemes, such as purchasing and reselling electronics in Asia, while increasingly using hard-to-trace payment channels including cryptocurrencies.

Meanwhile, recruitment campaigns by groups such as Hamas and Hezbollah targeting locals have been increasingly hard to crack down on, Levitt said. He cited a spike in cases in Brazil where local criminals – such as those selling illegal vapes – were recruited by Hezbollah and Iranians to attack Jews in Brazil, with intel provided to Brazilian authorities by the US.

“They’re just finding people who are comfortable engaging in violence and saying to them, ‘How would you like a trip to Lebanon?’” Levitt added.

“It’s financial, it’s not ideological … The only reason the Brazilians were able to get on top of this is because the United States has a very robust international intelligence collection.”

Levitt, who is director of The Washington Institute’s Jeanette and Eli Reinhard programme on counterterrorism and intelligence, also raised concerns on youth radicalisation, citing a commentary by RSIS on the enduring impact of self-radicalisation in Singapore amid the Israel-Hamas war.

“This is not an issue of religion … Hamas… has been trying to be very, very careful not to be seen as an international terrorist group … at least maybe only to the people it was trying to recruit to engage in international crime,” Levitt said.

“The bottom line is that Iran and its proxies now are the way we have to look at the threat of violent attacks from this milieu, more broadly as an entity,” he added.

While there is no reported evidence of Iran-linked “violent gig economy” activities in Southeast Asia, Levitt stressed that “well-to-do” societies may be more vulnerable to threats.

Singapore’s strength as a global commercial node and major trade, finance and transshipment hub may raise exposure to such “violent gig economy” activities, he added.

“There is a huge role for Singapore to play to make it more difficult for Iran to be able to finance its (activities),” said Levitt, who focused on fundraising and logistical support networks for Middle Eastern terrorist groups as an FBI counterterrorism intelligence analyst.

Levitt added that Singapore’s Financial Intelligence Unit, under the Suspicious Transaction Reporting Office, has been actively looking into “suspicious activity report data”. He noted that the unit has published alerts on the use of front companies, financial facilitators and crypto infrastructure to evade sanctions for oil sales.

The growing “violent gig economy” also spells concerns for Southeast Asian countries that have previously felt the presence of Iranian proxy groups, Levitt said.

Levitt referred to past Hezbollah-linked activity in Singapore and Thailand, including alleged surveillance of US and Israeli diplomatic targets in Singapore in the early 1990s, and a failed 1994 bombing attempt against the Israeli embassy in Bangkok.

In September 2013, a Thai court sentenced a Swedish man of Lebanese origin for possessing ammonium nitrate, a compound that could be used to make explosives.

Thai authorities had accused him of links to Hezbollah, but the man denied this throughout his trial, claiming he was a businessman involved in Thai exports to other countries, including Lebanon.

In Malaysia, Hamas had reportedly maintained fundraising, recruitment and support and alleged training networks for years since the early 2000s, although Malaysian authorities had denied that the country hosts Hamas operational or training bases.

“Each place is going to be different. Singapore, by virtue of being so small, being so open, there are some unique threats … some unique vulnerabilities. (Singapore has) excellent partnerships with the United States and with others,” Levitt said at the sidelines of the dialogue.

Singapore and the US have longstanding economic, defence and security partnerships, which have expanded to cybersecurity and emerging technologies in recent years, according to Singapore’s foreign ministry.

“I know of no pending threats … I’m just worried. I see these things happening. I see them happening in places,” Levitt said.

Smoke billows following an Israeli strike in Tyre, Lebanon, Jun 9, 2026. Picture taken with a mobile phone. (Photo: Reuters/Stringer)

In recent years, local counterterrorism operations in Singapore have primarily focused on threats from Al Qaeda, the regional network Jemaah Islamiyah, and self-radicalised lone actors inspired by the Islamic State.

On Jul 29 last year, Singapore’s home affairs ministry released a report noting that the terrorism threat to the nation remains high amid the Israel-Hamas war, though intelligence suggests there is no imminent attack.

The ongoing war in Iran, which began on Feb 28 with Israel and the US launching strikes, passed its 100th day on Monday (Jun 8). Despite a ceasefire in place since April, Israel renewed strikes on Iran on Monday after Iran fired missiles at Israel in what Tehran said was retaliation for Israeli strikes on Lebanon’s capital.