From Recruiting Hitmen to Trafficking Women: Disrupting Cartel Content on Your Platform

Latin American cartels deploy the online space as a critical tool to glorify, document, and recruit for their criminal enterprises. Through cross-platform investigation, open-source intelligence, and a nuanced understanding of microdynamics of different organized crime groups, ActiveFence has detected a range of online manifestations of abuse, often mirroring offline trends in criminality.

Weaponizing Online Platforms

The online cartel ecosystem is wide-ranging, similar to the expansiveness of their operations. Broadly, Latin American cartels leverage the online space as an intentional tool for recruitment; a central aspect of the threat landscape that poses the greatest risk of human exploitation and trafficking. In particular, cartels capitalize on the vulnerabilities of women and minors, rendering them key victims of physical abuse and personal danger. 

• Recruitment of Minors: Cartels operate through a hierarchical structure, often grooming children into active operations as they grow older. Online, organized crime groups share explicit recruitment posts mirroring benign employment posts. Here, cartels each have a unique brand, operating across social media platforms like a business, looking to source only the best talent. Offers of accommodation, training opportunities, and promises of wealth and social capital capture the attention of minors who readily interact with content, although these perceived employment benefits have the potential to restrict their liberty. The most ‘disposable’ recruits, minors are hired to commit violent crimes and are vulnerable to physical abuse or even murder if they disobey orders or if their identities are exposed to rival cartels or law enforcement.  
• Recruitment of Women: Women and girls are at a high risk of recruitment into sex trafficking, facilitated by cartels. For example, Venezuelan criminal groups, such as cells of the Tren de Aragua, are understood to traffic Venezuelan women and girls and force them into prostitution in commercial venues. Online, this can be detected through recruitment into more domestic roles, such as cooks for cartel members, that are understood to be synonymous with sex work. Moreover, cross-platform investigation has detected commercial establishments such as massage parlors and nightclubs run by cartels and used as smokescreens to conceal illicit activity. 

Online recruitment manifests through the creation of content tailored to specific operations of individual cartels. ActiveFence has identified patterns in content meant to recruit “sicarios” (“hitmen”) in Ecuador by rival groups Los Lagartos and Los Tiburones; while patterns in recruitment for Mexican organized crime groups such as the CJNG, appear to be increasingly tied to human smuggling operations across the US-Mexico border. 

• Recruitment of Hitmen: Content meant to recruit individuals into violent crime typically takes two forms: (1) general recruitment posts that offer benefits like training or accommodation, and state that individuals with military experience or personal traits such as “guts” or “no fear” will be hired, and (2) “death warrants” that are issued by cartels, featuring an image or information regarding an individual that the cartel would like murdered, alongside a hiring fee. The individuals that have death warrants issued against them are often members of rival cartels, or those who have not complied with the cartel and are dubbed as “traitors”. These death warrants also serve as a key indicator for criminal exploitation wherein cartel recruits become victims to physical abuse and threats of violence. 
• Recruitment of Smugglers: Cartels have been long associated with the smuggling of illegal goods such as weapons and drugs across international borders. Online, this can be mapped through key smuggling routes, such as the tri-border area between Paraguay, Argentina, and Brazil, and across the US-Mexico Border. Online content promoting human smuggling facilitated by organized crime across the US-Mexico border is rising at an alarming rate. Here, Mexican cartels such as the Sinaloa Cartel and the CJNG are seen explicitly recruiting individuals to facilitate human smuggling in both Mexico and the US. In the US, drivers are recruited to pick up migrants from the border and transport them to drop-off locations specified by cartels. In Mexico, recruitment posts are shared alongside combinations keywords and codewords associated with both human smuggling and individual cartels, signalling that the human smuggling operation is cartel-affiliated.

Disrupting Cartel Content

Tackling online cartel ecosystems requires a holistic understanding of individual organized crime groups alongside a multifaceted moderation strategy. In particular, cartels often act as a microcosmic social system, with their own language and structures that encompass a wide range of criminal activities; each with their own unique online manifestations. To mitigate harm, detection frameworks demand detailed behavioral research, proactive intelligence, automated detection tools and collaboration to combat such a range of online harms productively.

1. Embrace Narco Culture 

Social capital is intertwined with online cartel activity. Members of organized crime groups across Latin America readily glorify their lifestyle, often dubbed as “narco culture.” In an era where social media acts as a forum for artistic expression, an understanding of cartel tokens that are used online can be gleaned from understanding online user behavior. Members of cartels are also online users, sharing content in a very distinct way. Here, each cartel or groups within a geographical region uses strings of coded language and emoji’s in combination with specific lyrics from audio (such as narcocorridos songs in Mexico). When identified, codeword combinations and audios can be invaluable signals that can be leveraged for content moderation.

2. Navigate Complex Harm

Organized crime ecosystems are inherently complex, particularly as their operations are so expansive. To navigate organized crime and human trafficking violations in the online space, isolating these activities can facilitate an understanding of user behavior. For example:

• Accounts of members of cartels often feature glorification content that can serve as a recruitment tool, identified through user engagement.  
• Anonymous accounts affiliated with cartels often act as spaces for recruitment, with posts shared specifying roles required, and redirecting users to communication channels. 
• Cartel-dedicated online groups share content such as employment opportunities, and footage of ongoing operations, sometimes drawing attention of users who wish to participate.
• Seemingly benign accounts of business that following investigation are affiliated with cartels, sometimes as venues for money laundering or for a smokescreen of legitimacy.

3.Build Intricate Detection Strategies

Detection for such a wide range of content is a challenge, but through a multilayered approach with cogent research at its core, detection and moderation can be productive.

• Conceptual frameworks can be compiled to assess each human exploitation and organized crime violations, replicable for a range of organized crime groups.
• Keyword- and audio-based signals can be identified, decoded, and tailored for each organized crime group and then implemented within automated content moderation to surface potentially violative content at scale.
• Cross-platform investigation can enhance the detection and removal of large active networks that can sometimes be associated with seemingly legitimate businesses.

Staying One Step Ahead of Cartel-Driven Online Harm

As Latin American cartels continue to weaponize the internet to fuel recruitment, glorification, and exploitation, the digital front has become a critical battlefield in the fight against organized crime. From the grooming of minors and trafficking of women to the enlistment of hitmen and smugglers, online platforms are increasingly passively or directly implicated in the operational lifeblood of criminal networks.

Disrupting this digital ecosystem requires a deep understanding of how cartels function socially and strategically online: the symbols they adopt, the codewords they share, and the communities they build. By embracing behavioral intelligence, decoding the cultural nuances of narco content, and implementing cross-platform detection strategies, platforms can move beyond reactive takedowns toward proactive disruption.

With growing government pressure and the real-world consequences of cartel content reverberating across borders, online platforms have a responsibility — and a powerful opportunity — to dismantle the digital foundations of organized crime. By investing in research-driven frameworks and collaborative enforcement strategies, we can limit the reach of these networks, protect vulnerable populations, and reclaim the internet from cartel exploitation.