The Security and Humanitarian Nexus of Illicit Activity by Non-State and Threat Actors

Author: Anonymous

August 18, 2026

[Image source: ub emerging practices/Openverse]

Overview

Certain state and non-state actors have, and will continue to use grey zone ^{1, 2, 3} tactics, clandestine proxies, and protracted illicit operations to exploit humanitarian disasters, contributing to insecurity, economic, and/or political fragmentation, as it affords them opportunities to cement their own objectives, according to UK HC, NIC, NATO, and judging from historical CIA reporting.^{4, 5} 

Analysis

Humanitarian disasters provide sufficient opportunities for state actors to exploit vulnerabilities in resource allocation, infrastructure (financial, energy, and telecommunications), and weakened institutional governance through locally based intermediaries. As a result, peace and humanitarian efforts are hindered, increasing instabilities, and allowing actors to expand their soft and hard power in the region. 

From early 2021 to mid-2025, the Chinese government bolstered pro-Russian and pro-Iranian actors to to exploit weakened systems and create further instability in the U.S. state of Florida during hurricane season through the following tactics:

(1) Denial of Service (DDoS) campaigns against state and local websites, website defacements, and the leaking of sensitive exfiltrated information from victims;⁶

(2) cyberattacks by the Russian state-sponsored group Killnet that targeted Florida airports, taking them offline and severely disrupting operations;⁷ and (3) the poisoning of water supply systems⁸, according to the National Security Agency (NSA) and press reporting. 

In 2024, a Syrian national⁹ supported by a Chinese national¹⁰ with proximity to a Chinese intelligence agency and access to specialised resources, diverted $9 million USD allocated for humanitarian aid from the U.S. Government¹¹ to the Al-Nusrah Front (ANF)¹² and the Iranian Islamic Revolutionary Guard Corps Quds Force (IRGC-QF) via U.K.- and U.S.-based proxies,^{13, 14, 15} according to FBI, TREASURY, DOJ, NSA, USAID, and HMT reporting.

The North Korean government (Pyongyang) is sexually exploiting children¹⁶ to fund illicit arms trading^{17, 18} and generate hard currency^{19, 20} in certain African Union states (Côte d’Ivoire, Ghana, and Nigeria)²¹, Turkey (a NATO Member) ²² and Cairo (a NATO defence partner).²³ Pyongyang is disguising these activities under the cover of as construction materials,²⁴ medical clinic training,²⁵ and machinery for humanitarian projects,²⁶ according to Treasury, U.S. Congress, USIP, UK Home Office, INTERPOL, UN, think tank, and press reporting. 

Threat actors clandestinely seek to legitimize their regimes and actions by exploiting humanitarian disasters for economic and/or political leverage, to launder their public image, for recruitment, and in some instances, for military defensive assets. 

In mid-2025, Hamas,²⁷ with the assistance of the Qatari Government,²⁸ co-opted humanitarian supplies & clean water that were intended for refugees,²⁹ construction materials for refugee camps,³⁰ and vital medicines³¹. These were delivered to terrorist fighters, according to the NIH, USAID, think tank, and press reporting. 

In early 2022, the Egyptian Government supplied COVID-19 medicines and supplies to the U.S.³² to obtain favour in support of $4.7 billion USD in military assets (SAMs, APKWSs, and Hellfire Missiles)^{33, 34} via the FMF Program. The military assets were clandestinely supplied to the Kremlin (the Russian Government), who used the weapons, resulting in the deaths of innocent civilians and non-combatants in Ukraine until 2023, according to DOD, STATE, and press reporting. 

In late 2020, al-Shabab (an al-Qaeda affiliate) hijacked COVID-19 medical supplies and equipment from the WHO and the African CDC intended for humanitarian relief efforts, which were used for its terrorist fighters who opened several COVID-19 medical centers³⁵ for persons in their occupied territories, according to press reporting. 

Conclusion and Recommendations

These types of exploitation are likely to intensify, as certain actors will continue to leverage weapons and illicit activities, which afford them the opportunity to cement their strategic, tactical, and operational interests. There needs to be greater support and access to tactical and strategic reporting for the UN, the ICC, the ICRC, INTERPOL, and for humanitarian and military-legal practitioners. These organizations and practitioners will be better equipped with the ability to combat these behaviors and thwart potential or actual threats of violence or exploitation. Lastly, these should be done without state interference, as states typically seek objectives and resources that serve their own self-interests. 

---

List of Abbreviations & Terminologies

• African CDC: The Africa Centres for Disease Control and Prevention

• AFRIPOL: The African Union Mechanism for Police Cooperation

• APKWS: Advanced Precision Kill Weapon System 

• AU: The African Union

• CIA: Central Intelligence Agency 

• DOD: The United States Department of Defense 

• DOJ: The United States Department of Justice 

• DOS: The United States Department of State 

• FBI: The Federal Bureau of Investigations 

• FMF: The United States Foreign Military Financing Programme

• HMT: The Treasury Department of the United Kingdom

• ICC: The International Criminal Court 

• ICJ: The International Court of Justice 

• INTERPOL: The International Criminal Police Organization

• MOD: UK Ministry of Defence 

• NATO: The North Atlantic Treaty Organization 

• NGA: The National Geospatial-Intelligence Agency

• NIC: The United States National Intelligence Council 

• NIH: The National Institute of Health 

• SAM: Surface Air Missile 

• TREASURY: The United States Department of Treasury 

• UK HC: The U.K. House of Commons – Defence Committee 

• UN: The United Nations 

• USAID: The United States Agency for International Development

• USIP: The United States Institute of Peace 

• WH: The United States White House 

• WHO: The World Health Organization 

---

Glossary

• Al-Shabab: A Sunni Islamist political and militant organization, primarily based in Somalia, with operations in East Africa. It is allied to the pan-Islamist militant organization al-Qaeda. It is also, in a more limited capacity, active elsewhere in East Africa. It has forged ties with other insurgent groups like Al-Qaeda in the Islamic Maghreb (AQIM) and Al-Qaeda in the Arabian Peninsula (AQAP). 

• Al-Nusrah Front: An al-Qaeda affiliate in Syria, formed in 2012, and they are a militant Sunni Islamist group that sometimes operates under the umbrella group Hay’at Tahrir al-Sham (HTS). 

• Bolster: To strengthen, support, reinforce, or boost something to make it more effective or secure.

• Clandestine: An operation sponsored or conducted by governmental departments or agencies in such a way as to assure secrecy or concealment.

• Defacement: Refers to two distinct concepts: (1) the physical destruction and vandalism of political or cultural symbols, and (2) the legal prohibition against the desecration of the dead or cultural property. 

• Denial Measure: An action to hinder or deny the enemy the use of territory, personnel, or facilities, to include destruction, removal, contamination, or erection of  obstructions.

• Exfiltrated: The unauthorized, covert, or planned removal of personnel, data, or equipment from a hostile or sensitive: (1) troop withdrawal, (2) cyber warfare,  and (3) intelligence gathering. 

• Grey Zones: These are military conflicts that typically involve the use of instruments beyond normal international interactions. Occupying a space between normal diplomacy and commercial competition, whilst falling short of the threshold of war. They tend to employ the following techniques: 

  (a) Cyber and information operations. 

  (b) Arcane, covert, or clandestine operations under state control, espionage, infiltration, and may include the use of subversion tactics. These operations may include the enlistment of aid from non-governmental actors, including organized criminal groups, terrorists, and extremist political, religious, ethnic, or sectarian groups/organizations. 

  (c) Establishing a logistical, political, and financial support framework to deter, detect, or predict insurgent and terrorist movements. 

  (d) Antagonists seek limited political victories, as opposed to outright military triumphs that would be easier to identify and respond to. 

  (e) The manipulation and discrediting of democratic institutions, including electoral and judiciary systems. 

  (f) Calculated ambiguity, use of covert/unacknowledged operations, and deception and denial. 

  (g) Implied or implicit threat use, or threats of use of armed force, terrorism, and abuse of civilian populations, and of escalation. 

  (h) Military deception, intended to deter hostile actions and/or increase the success of friendly defensive actions.

• Hamas: A Sunni Islamist Palestinian nationalist political organization with a military wing known as the al-Qassam Brigades. It has governed the Israeli-occupied Gaza Strip since 2007. Hamas and Israel have engaged in the protracted Gaza–Israel conflict, as part of the broader Israeli–Palestinian conflict. 

• Hard Power: The use of military and economic means to influence the behaviour or interests of other political bodies. This form of power is often aggressive (coercion), and is most immediately effective when imposed by one political body upon another of less military and/or economic power. 

• Illicit: Refers to the transnational, unlawful, or shadow networks where states, criminal syndicates, and non-state actors use cross-border exchanges—such as smuggling, illicit finance, and cybercrime—to bypass official laws and pursue (soft/hard) power, influence, and/or profit. 

• Intermediary:  A neutral third party—such as an organization, nation, (a non-state actor in grey-zone conflicts), or individual—that acts as a go-between to negotiate, de-escalate conflict, or deliver humanitarian aid between hostile groups. Their participation in a grey-zone conflict could be either covert or overt.

• IRGC-QF: The Iranian Islamic Revolutionary Guard Corps Quds Force is one of the Iranian regime’s primary organizations responsible for conducting covert lethal activities outside Iran, including asymmetric and terrorist operations. They have and still are plotting and conducting covert operations worldwide, and it provides guidance, training, funds, and weapons to partners and proxies, primarily Shia militants in the Middle East. These partners and proxies allow the IRGC-QF to maintain military capability across multiple theaters whilst denying involvement in operations. 

• Launder: To legitimize and/or disguise the illicit origins of conflict-related assets, resources, or reputations. 

• Leverage: A strategic framework where a state or actor wins a conflict by maximizing their unique, asymmetric advantages while minimizing direct military confrontation.  Instead of relying solely on raw battlefield numbers, a nation uses external points of pressure to drain, isolate, and defeat an adversary (maximizing a non-military advantage).

• Nexus: The multilateral framework linking humanitarian aid, long-term development, that requires both military/police security & economic/poliical development, and peacebuilding in crisis zones. 

• Non-Combantant: A person who does not take an active part in hostilities. This group includes civilians, medical and religious military personnel, and combatants who are hors de combat (sick, wounded, shipwrecked, or captured prisoners of war). 

• Non-State Actor: Lacks the formal sovereignty, defined territory, and government status of a traditional nation-state. They participate in global affairs either outside of state control or alongside sovereign governments.

• Protracted: An armed conflict that lasts a long time, stretching well beyond initial expectations or normal limits.  It relies heavily on attrition, wearing down the enemy's resources, morale, and political will over months or years rather than seeking a quick, decisive victory.

• Practitioner: They separate "war" from general competition or low-level conflict by looking for specific operational markers. 

• Proxy: A conflict characterised by a direct, long-term, geopolitical relationship between the third-party sponsor states and their client states or non-state clients, thus the political sponsorship becomes military sponsorship when the third-party powers fund the soldiers and their materiel to equip the belligerent proxy-forces to launch and fight and sustain a war to victory, and government power.

• Refugee: There are two-distinct definitions: (1) An external refugee is a person who is outside their country of nationality or habitual residence, and is unable or unwilling to return due to a well-founded fear of persecution based on race, religion, nationality, political opinion, or membership in a particular social group. (2) An internal refugee (in some reporting, the term Internally Displaced People is utilized), is someone forced to flee their home due to conflict, violence, human rights violations, or disasters, but who stays within their own country's borders instead of crossing an international boundary.

• Soft Power: This process entails the strategic shaping of others' preferences through the use of diplomacy, appealing, non-coercive, and attractive means, using culture, political values, and foreign policies to enact change.

• Thwart: To successfully oppose, block, or prevent an enemy's plans, attacks, or ambitions from succeeding, by using tactical tasks.

---

Endnotes

1. The U.K. House of Commons. Defence in the Grey Zone.The Defence Committee, the Fifth Report of Session 2024 - 2025, 09 July 2025. https://publications.parliament.uk/pa/cm5901/cmselect/cmdfence/405/report.html (Last Accessed: 20 June 2026). 

2. The National Intelligence Council. Updated IC Gray Zone Lexicon: Key Terms and Definitions. Document Number: NIC-SG-2024-20319-A, July 2024. https://www.dni.gov/files/ODNI/documents/assessments/NIC-Unclassified-Updated-IC-Gray-Zone-Lexicon-Jul y2024.pdf (Last Accessed: 20 June 2026). 

3. The North Atlantic Treaty Organization. Re-orienting NATO Deterrence: The Reality of Strategic Gray Zone Threats. 27 July 2023. https://www.sto.nato.int/document/re-orienting-nato-deterrence-the-reality-of-strategic-gray-zone/ (Last Accessed: 20 June 2026). 

4. The Central Intelligence Agency. Egypt may lead Hamas and Iran, to resume relationship. Document Serial Number: PLL20l3072367254203, 13 July 2013. https://www.cia.gov/readingroom/docs/palestinian%20article%20%20egyp%5B15377430%5D.pdf (Last Accessed: 20 May 2026). 

5. The Central Intelligence Agency. Global Humanitarian Agencies. Document Number: NEB 0542, 03 April 1997. https://www.cia.gov/readingroom/docs/DOC_0000771909.pdf (Last Accessed: 20 May 2026). 

6. National Security Agency. NSA, CISA, FBI, and DC3 Warn Iranian Cyber Actors May Target Vulnerable U.S. Networks and Entities of Interest. 30 June 2025. https://media.defense.gov/2025/Jun/30/2003745375/-1/-1/0/JOINT-FACT-SHEET-IRANIAN-CYBER-ACTO RS-MAY-TARGET-VULNERABLE-US-NETWORKS-AND- ENTITIES-OF-INTEREST-508C.PDF (Last Accessed: 17 May 2026). 

7. Six South Florida News. SW Florida Int'l Airport Site Goes Offline After It Was Named a Target by Hacktivist Group. 10 October 2022. https://www.nbcmiami.com/news/local/sw-florida-international-airport-site-briefly-goes-offline-due-to-cyberattac k/2879603/ (Last Accessed: 17 May 2026). 

8. New York Times. ‘Dangerous Stuff’: Hackers Tried to Poison Water Supply of Florida Town. 08 February 2021. https://www.nytimes.com/2021/02/08/us/oldsmar-florida-water-supply-hack.html#:~:text=%27Dangerous%20St uff%27:%20Hackers%20Tried,U.S (Last Accessed: 17 May 2026). 

9. The Federal Bureau of Investigations. Most Wanted – Mohmood Rashid Amur Al Habsi. 25 January 2024. https://www.fbi.gov/wanted/counterintelligence/mahmood-rashid-amur-al-habsi (Last Accessed: 19 May 2026). 

10. The Federal Bureau of Investigations. Most Wanted – Shaoyun Wang. 25 January 2024. https://www.fbi.gov/wanted/counterintelligence/shaoyun-wang (Last Accessed: 19 May 2026). 

11. The U.S. Department of Justice. Syrian National Charged with Diverting $9 Million in U.S.-funded Humanitarian Assistance to a Terrorist Organization Affiliated with Al-Qaida. 19 November 2024. https://www.justice.gov/usao-dc/pr/syrian-national-charged-diverting-9-million-us-funded-humanitarian-assistance -terrorist (Last Accessed: 19 May 2026). 

12. The U.S. Agency for International Development. Syrian National Charged with Diverting $9 Million in U.S.-funded Humanitarian Assistance to a Terrorist Organization Affiliated with Al-Qaida. 19 November 2024. https://oig.usaid.gov/node/7283 (Last Accessed: 19 May 2026). 

13. His Majesty's Treasury. Financial Sanctions Notice – Iran. 27 February 2024. https://assets.publishing.service.gov.uk/media/65ddbfbab8da63001dc86275/Notice_Iran_270224.pdf (Last Accessed: 07 June 2026). 

14. The U.S. Department of Justice. Two Individuals Charged in Trafficking Illicit Iranian Oil Using U.S. Financial System to Fund Terrorist Group in Violation of U.S. Sanctions. 02 February 2024 https://www.justice.gov/usao-dc/pr/two-individuals-charged-trafficking-illicit-iranian-oil-using-us-financial-system fund (Last Accessed: 19 May 2026).

15. The U.S. Department of Treasury. U.S. and U.K. Target IRGC-QF Support to Hamas and Other Proxy Groups. 14 December 2023. https://home.treasury.gov/news/press-releases/jy1987 (Last Accessed: 07 June 2026). 

16. The U.S. Department of State. Trafficking in Persons Report. June 2019. https://www.state.gov/wp-content/uploads/2019/06/2019-Trafficking-in-Persons-Report.pdf (Last Accessed: 21 June 2026). 

17. The Office of the United Nations High Commissioner for Human Rights. North Korean Children's Forgotten Cry: Forced Labour and Military Conscription. September 2025. https://www.ohchr.org/sites/default/files/documents/issues/slavery/sr/cfis/worstforms/subm-worst-forms-child -cso-center-asia-pacific-strategy.pdf (Last Accessed: 18 May 2026). 

18. U.S. Congress. Combating Terrorism: Axis of Evil, Multilateral Containment or Unilateral Confrontation? 107th. Congress, 16 April 2022. https://www.congress.gov/event/107th-congress/house-event/LC17653/text (Last Accessed: 18 May 2025). 

19. U.K. Home Office. Policy Paper - Fraud Strategy: Stopping Scams and Protecting the Public. 1 June 2023. https://www.gov.uk/government/publications/fraud-strategy/fraud-strategy-stopping-scams-and-protecting-the-pu blic (Last Accessed: 18 May 2026). 

20. U.S. Department of Treasury. Treasury Targets DPRK Actors Illicitly Generating Revenue Abroad. 01 March 2023. https://home.treasury.gov/news/press-releases/jy1313 (Last Accessed: 17 May 2026). 

21. The International Criminal Police Organization. INTERPOL Support Programme for the African Union in relation to AFRIPOL (ISPA). August 2026. https://www.interpol.int/Who-we-are/Our-partners/Our-partnerships-with-regional-policing-bodies/Support-for AFRIPOL (Last Accessed: 18 May 2026). 

22. The Middle East Forum. Erdoğan Ally’s North Korean Ties Further Demonstrate Turkey’s Turn Against the West. 09 October 2024. https://www.meforum.org/mef-online/erdogan-allys-north-korean-ties-further-demonstrate-turkeys-turn-against-th e-west (Last Accessed: 18 May 2026). 

23. New York Times. Need a North Korean Missile? Call the Cairo Embassy. 03 March 2018. https://www.nytimes.com%2F2018%2F03%2F03%2Fworld%2Fmiddleeast%2Fegypt-north-korea-sanctions-arms dealing.html&usg=AOvVaw2sADnWlptRcQtHWBZ_3yDc&opi=89978449 (Last Accessed: 18 May 2026). 

24. The Global Initiative against Transnational Organized Crime. Diplomats and Deceit: North Korea’s Criminal Activities in Africa. September 2017. https://globalinitiative.net/wp-content/uploads/2017/09/TGIATOC-Diplomats-and-Deceipt-DPRK-Report-1868 -web.pdf (Last Accessed: 18 May 2026). 

25. NK News. North Korea pursues medical cooperation with African countries during pandemic. 31 March 2022. https://www.nknews.org/2022/03/north-korea-pursues-medical-cooperation-with-african-countries-during-pande mic/ (Last Accessed: 18 May 2026). 

26. U.S. Institute for Peace. North Korea in Africa: Historical Solidarity, China’s Role, and Sanctions Evasion. 

27. The U.S. Agency for International Development. Gaza Response: USAID Ensured Health Supply Chain Plans Addressed Quality Risks but Did Not Actively Monitor All Project Components. 02 February 2026. https://oig.usaid.gov/node/8013 (Last Accessed: 20 May 2026). 

28. Al Jazeera. Qatar announces Israel-Hamas deal for medicine and aid to enter Gaza. 24 January 2024. https://www.aljazeera.com/news/2024/1/16/qatar-announces-israel-hamas-deal-for-medicine-and-aid-to-enter-gaz a (Last Accessed: 19 May 2026). 

29. NGO Monitor. In Their Own Words: Hamas Turns Hospitals into Military Assets with NGO Compliance. 10 September 2025. https://ngo-monitor.org/reports/hamas-misuse-hospitals-docs/ (Last Accessed: 20 May 2026). 

30. American Jewish Committee. Humanitarian Aid in Gaza: What’s Really Happening. 28 August 2025. https://www.ajc.org/news/humanitarian-aid-in-gaza-whats-really-happening (Last Accessed: 20 May 2026).

31. The National Institutes of Health. The ongoing Israel-Hamas conflict: a humanitarian health crisis. 20 June 2024. https://pmc.ncbi.nlm.nih.gov/articles/PMC11305804/ (Last Accessed: 20 May 2026). 

32. The Washington Post. Egypt sends military plane filled with medical aid to help U.S. with coronavirus. 20 April 2020. https://www.washingtonpost.com/religion/2020/04/20/egypt-military-planes-coronavirus-trump-sissi/ (Last Accessed: 19 May 2026). 

33. U.S. Department of Defense. Major Arms Sales – Egypt. Defense Security Cooperation Agency, 26 February 2026. https://www.dsca.mil/Press-Media/Major-Arms-Sales/Tag/47558/egypt (Last Accessed: 19 May 2026). 

34. The U.S. Department of State. Joint Statement on the U.S.-Egypt Strategic Dialogue. 09 November 2021. https://2021-2025.state.gov/joint-statement-on-the-u-s-egypt-strategic-dialogue/ │ Last Accessed: 19 May 2026. 

35. The Hill. Al Qaeda-linked group sets up coronavirus care facility in Somalia. 19 May 2026, https://thehill.com/policy/international/africa/502455-al-qaeda-linked-group-sets-up-coronavirus-care-facility-in/ (Last Accessed: 19 May 2026).