Criminal Gangs Go Digital: The Challenge for Law Enforcement

Criminal gangs no longer operate solely on the streets. They’re using digital platforms to scale a wide range of criminal activities, such as drug trafficking, extortion and money laundering, and to coordinate across borders with minimal physical presence.

From extortion and human trafficking to identity theft or fraud using encrypted apps and anonymous networks, criminal gangs are weaponizing the same digital tools that billions of law-abiding citizens use for communication and commerce.

Criminal organizations across the globe have embraced this shift—from street-level crews to powerful transnational networks. Groups like Mexico’s Sinaloa and Jalisco cartels and Europe’s Kinahan crime syndicate have used encrypted messaging apps, social media and crypto tools to expand their reach, coordinate operations and evade law enforcement.

Messaging apps like Telegram and Discord, cryptocurrencies and social media platforms have become key enablers for recruitment, coordination and monetization. As a result, law enforcement agencies (LEAs) face mounting challenges in identifying, investigating and dismantling these groups.

This digital evolution of crime requires law enforcement to adopt new investigative strategies that keep pace with fast-moving, tech-savvy criminal networks. Decision intelligence platforms are essential for analyzing vast volumes of multimedia data, messages and online interactions at scale, and are crucial for enabling law enforcement agencies to respond faster and more proactively to online criminal activities.

What Crimes Are Gangs Committing Online?

To fully understand the digital evolution of gangs, we must look at both what types of crimes they commit online and how they use digital tools to carry them out.

Here are the key areas where these groups are expanding their reach:

• Drug trafficking – Criminal gangs utilize a variety of digital platforms, including social media and encrypted communication tools, to advertise illicit drugs, coordinate transactions and arrange handoffs. These operations often bypass physical interaction, with payments made in cryptocurrency and drop locations shared through secure channels. Gangs also leverage messaging apps like Telegram to scale their distribution networks and communicate with buyers and suppliers in real time while maintaining operational anonymity. Visual marketing, including product images and related pricing information, has become increasingly prevalent on these forums.
• Human trafficking & migrant smuggling – Criminal gangs use online channels to recruit vulnerable individuals as “customers”, coordinate cross-border movements and advertise smuggling “packages.” Social media platforms and encrypted messaging apps serve as recruitment tools, while also being used for coordination and operational command. These communications often rely on coded language, slang and emojis — tactics that help traffickers avoid detection by law enforcement as well as content moderation by online platforms.
• Counterfeiting & document fraud – Fake IDs, passports, driver’s licenses and government credentials are widely sold through platforms like dark web marketplaces and private channels on Telegram and Discord. Many of these documents are created using AI-generated templates or commercially available design tools, making them extremely difficult to spot as fakes.
• Weapons trafficking & ghost guns – Criminal gangs increasingly rely on digital platforms to traffic firearms, coordinating sales and sourcing parts through encrypted messaging apps, forums and marketplaces. A growing share of this trade involves ghost guns: untraceable weapons assembled from kits or 3D-printed components. Online platforms are used to circulate blueprints and tutorials, enabling the sale and assembly of illegal weapons outside regulatory oversight.
• Online scams, blackmail & extortion – Criminal gangs are professionalizing digital scams, scaling up operations like sextortion, online impersonation, ransomware, phishing and love scams to reach more victims faster. These groups combine deceptive strategies with automation and anonymity, using social media and dating apps to manipulate targets into sharing compromising content. Victims are then blackmailed for payments under threat of public exposure, often without a clear path to trace or stop the perpetrators.
• Financial fraud & identity theft – Criminal gangs exploit digital platforms to execute a wide range of financial crimes. Dark web forums, Telegram channels and encrypted marketplaces are used to hawk stolen credentials, fake bank documents, cloned credit cards and step-by-step guides for defrauding individuals and institutions. Some gangs operate like service providers by selling tools, offering phishing kits or even renting access to compromised accounts, which fuels a growing crime-as-a-service (CaaS) economy. These operations often support larger schemes, including money laundering, benefit fraud and synthetic identity creation, making them both profitable and difficult to trace.

These illicit activities thrive on the scalability, reach and anonymity of the internet and all are difficult to detect without advanced investigation and intelligence tools.

How are Criminals Using Online Channels?

What was once scrawled on alley walls or whispered in backrooms is now posted, shared and amplified online. Gangs use the internet to project power, signal loyalty and expand their criminal footprint.

Understanding how criminal gangs exploit the digital space is just as important as knowing what crimes they commit. Their online behavior mirrors that of legitimate digital actors, leveraging social platforms, communication tools and brand-building tactics to pursue illicit goals. Below are the key ways gangs use the internet to recruit, coordinate, intimidate, and profit:

Promotion, Identity and Recruitment

Gangs use digital spaces to promote affiliations and build a reputation. These platforms have become key arenas for showcasing gang identity, often through stylized displays of wealth, weapons, drugs and parties. This behavior, referred to as “cyberbanging,” reinforces gang culture and status while serving as a tool for intimidation, recruitment and recognition.

For law enforcement, these posts are more than digital bravado, they can be mined for actionable intelligence. The content provides law enforcement with valuable OSINT. Investigators have successfully used visual cues like tattoos, graffiti, and hand signs captured in social media posts to identify gang affiliations and trace connections across broader criminal networks.

Digital platforms now serve as powerful recruiting grounds for criminal gangs. According to a 2024 report from the Maryland Coordination and Analysis Center, the rise of “cyberbanging” shows gangs increasingly using social media to recruit new members, intimidate rivals and advertise criminal activity to validate their street cred.

The glorification of gang life online creates a powerful recruitment pipeline, especially for youth. Social platforms enable gangs to target vulnerable individuals with aspirational content, promises of money or protection, and direct contact via private messages. Gaming platforms and encrypted chat apps are also used to groom potential recruits outside the traditional reach of community policing.

On TikTok, so-called “narco content” or videos of cartel convoys, luxury cars, gold-plated weapons and stacks of cash, has been used by groups like the Sinaloa Cartel to glamorize cartel life and attract new members. As reported by the New York Times, some posts even featured cartel music with hashtags like #CartelTikTok to promote affiliation while staying under moderation radar. An analysis by the Igarapé Institute further confirms that drug cartels and criminal organizations exploit Instagram, Facebook and TikTok to showcase power, recruit members and normalize violence. These digital displays serve both as propaganda and as tactical tools to build influence and draw in younger followers, often well before law enforcement can intervene.

Coordination of Activities

Gangs use online communication tools, including encrypted messaging apps, to coordinate their operations allowing them to:

• Organize illegal sales and logistics
• Share alerts about law enforcement activity
• Arrange payments and handoffs

As explored in Cognyte’s TechHorizon report, Telegram alone saw cybercrime-related messages jump from 27 million in 2019 to a staggering 1.4 billion in 2024.

Criminals gravitate to these encrypted messaging apps because they offer massive group sizes (Telegram supports up to 200,000 users), as well as the ability to create and abandon channels and groups quickly to avoid detection. Criminals are migrating towards platforms that require fewer identifying details and offer end-to-end encryption by default.

Law enforcement has been forced to respond. In 2024, Telegram’s founder was detained in France over criminal activity on the platform, prompting a significant policy shift: Telegram now shares users’ phone numbers and IP addresses with investigators, but only when served with a judicial order. This rare cooperation has already driven some major cyber gangs to relocate to other, more anonymous platforms.

Profit-Making Activities

Beyond digital threats and posturing, criminal gangs use online platforms as profit engines. Encrypted messaging apps, dark web marketplaces and forums enable gangs to sell drugs, weapons, counterfeit goods, and traffic in stolen data or hacked accounts. Some even operate as full-scale “criminal service providers,” offering phishing kits, forged IDs and cloned payment cards to other actors in the underground economy.

This commercial layer of illicit activity increasingly mirrors legitimate e-commerce structure, complete with price lists, customer support and logistics coordination. Encrypted apps like Telegram and WhatsApp are often used to arrange transactions, share tutorials, or promote illegal goods with limited risk of detection.

Digital ecosystems also enable more nefarious forms of exploitation. Child grooming, human trafficking on social media, and online scams often begin with seemingly innocuous posts designed to manipulate vulnerable individuals, especially minors.

Threats, Violence and Intimidation

Social media platforms also facilitate threats and online aggression. Posts may include veiled warnings, direct insults or violent imagery designed to provoke rivals or assert territorial claims. While not every online threat leads to violence, studies suggest a growing link between digital escalation and real-world retaliation, especially among younger gang subsets.

The Rise of AI-Enabled Fraud

Criminal gangs are using generative AI tools to enhance fraud schemes and avoid detection. Deepfake videos, synthetic voices and AI-generated documents are employed to impersonate victims, create fake identities and bypass biometric verification. These tools enable even low-skilled individuals to scale phishing, social engineering and benefits fraud. Some gangs now offer “deepfake-as-a-service,” providing realistic digital identities for scams, money laundering, or accessing secure systems.

For law enforcement, this presents a new layer of complexity. Traditional identity verification techniques are less reliable when criminals can generate near-perfect forgeries or mask their voices in real time. Without AI-enabled investigation tools, many of these crimes go undetected until significant damage is done.

Investigative Challenges in the Digital Age

The shift from street-level crime to digitally driven operations has placed immense pressure on law enforcement agencies, exposing critical gaps in traditional investigative methods. Today’s cases rarely start with a clear suspect or location. Instead, they often begin in the digital unknown, where signals are fragmented across platforms, devices and jurisdictions.

Criminal activities like identity theft, online extortion and drug trafficking, often facilitated through encrypted apps, social media or other digital platforms, are no longer tied to a single incident or place. They evolve rapidly and often remain hidden until the damage is done. Tracking digital behaviors, uncovering online networks, and responding to cross-platform threats now requires entirely new investigative capabilities, ones equipped to navigate scale, anonymity and speed.

These challenges stem from fundamental shifts that now define the digital crime landscape:

• Scale of data: Massive volumes of online conversations, videos and social media posts must be sifted through.
• Cross-jurisdictional hurdles: Gangs operate across borders, exploiting legal differences to evade prosecution, a hallmark of transnational crime.
• Volume of unreported crimes: Studies estimate that a vast percentage of cybercrimes go unreported, making detection and response highly reactive.

In addition, the sheer fragmentation of suspect activity across open sources, messaging platforms and media formats makes intelligence gathering more complex than ever. Gathering open-source intelligence, applying the correct methodologies and fusing data from disparate systems is challenging, but essential.

Criminal gangs have embraced digital-first operating models. For law enforcement to keep up, investigations must to be agile, integrated and intelligence driven.

Using Decision Intelligence to Stay Ahead of Criminal Gangs

The evolution of crime demands an evolution in crime fighting. Enter decision intelligence platforms like Cognyte’s NEXYTE, a holistic solution designed for modern law enforcement.

Unlike traditional data analytics tools, NEXYTE operates as a mission-centric intelligence workspace that accelerates investigations and decision-making. Investigators can quickly trace digital aliases, identify illicit payment trails and locate hotspots of online crime.

NEXYTE is purpose-built for law enforcement investigations. It enables analysts and investigators to bring together critical intelligence into one unified environment, including:

• Open source intelligence (OSINT) and cyber threat intelligence (CTI) give visibility into the open web, deep web and dark web.
• Blockchain analytics tools directly link suspects to their illicit crypto wallets, without relying on third-party cooperation.
• AI-powered media analytics to process and extract insights from massive volumes of text, video, image and audio data, including speech-to-text transcription and facial/object recognition.

Toward a Safer Digital World

Criminal gangs are no longer confined to alleys and borders, they now thrive behind screens and usernames. To combat today’s digital-first criminal gangs, agencies must anticipate their tactics and stay one step ahead. Decision intelligence platforms like NEXYTE equip law enforcement agencies to lead smarter and faster digital investigations.

Contact Cognyte to discover how our decision intelligence platform can help lead to a safer digital world.