Dark Web Intelligence Uncovers Fentanyl Trafficking Networks Persisting on Telegram - Part 3

Other Drug Trafficking Channels

Beyond DragonLabz and Narko Wróżka, HUNTER investigators identified multiple other DTOs eluding Telegram’s censors. Some of the drug-themed channels openly advertise/mirror their services on X. Notably, these DTOs’ operating footprints span the world, with HUNTER investigators identifying Telegram drug sellers operating in jurisdictions as geographically diverse as Vietnam and Brazil.

‘Morty Smith’ (NgoaiVongPhapLuatMafia) is one Vietnam-based DTO that sells MDMA, various cathinones, GHB, cocaine and other drugs primarily though out the Asia-Pacific (APAC) region. Notably, the username ‘Ma Tuý Châu Âu’ associated with the Morty Smith shop operator’s Telegram handle translates to “European drugs” in English.

The Morty Smith shop operator’s Telegram username is particularly interesting considering that a significant amount of synthetic drugs produced in Europe are exported to more lucrative markets in Asia and Oceania, particularly methamphetamine.

Notably, Morty Smith lists 3-MMC and 4-MMC sourced from France. The link between the Morty Smith shop and European synthetic drug suppliers is interesting given the DTO’s operating base in Vietnam. In 2021, investigative news outlet The Diplomat published a report predominantly focused on how Vietnamese synthetic drug producers operate in Europe. While The Diplomat report primarily details the activities of Vietnamese synthetic drug rings in the Czech Republic, it is noteworthy that France has a large Vietnamese diaspora community in the context of Morty Smith’s cathinone supply chain.

Morty Smith also deals heavily in ‘Ferrari’ logo branded MDMA.

HUNTER investigators also identified a cluster of Telegram drug trafficking groups operating out of Germany, including ‘Drogs Berlin,’ ‘Candy store,’ and ‘El Diablo Shop.’ Collectively, these operations deal in the same assortment of illicit susbtances: Marijuana, cocaine, MDMA, ketamine, hash, LSD, 2-CB, mephedrone, and other cathinones.

But the most impressive Telegram DTO discovered by HUNTER investigators was ‘Cowboy Bebop,’ which claims to be the top online drug shop in Brazil.

Notably, the Portugese-language channel advertisement indicates that Cowboy Bebop provides an “international connection” and lists the emojis of various flags in addition to the Brazilian one: France, Pakistan, Spain, and the U.S.

Also noteworthy is Cowboy Bebop’s extensive and diverse selection of MDMA products. This finding is significant as the UNODC reported in 2021 that Brazil was quickly becoming a regional leader in the production of synthetic drugs in Latin America. At the time, the UNODC warned that “traditional organized crime groups may enter the market, particularly in the Brazilian state of Santa Catarina, where an InSight Crime investigation in 2020 identified a flourishing international barter trade of cocaine for European MDMA,” according to InsightCrime’s coverage of the UNODC report.

Regarding the fentanyl threat, HUNTER investigators discovered another Germany-based Telegram DTO called ‘Dijon Pharmacy’ that claims to offer the deadly drug in patch and nasal spray form.

Notably, Dijon Pharmacy claims in their ad that they offer worldwide shipping. Like DragonLabz and Narko Wróżka, this German DTO lists their full menu on the te.legra.ph blogging platform.

As the reader can see in the screenshot below, Dijon Pharmacy is offering fentanyl patches and nasal spray in quantities ranging in price from €140 to €825. The nature of these fentanyl products obviously suggests they have been illegally diverted as opposed to being clandestinely manufactured.

Also noteworthy is the OxyContin package displayed in the menu listing. The Mundipharma packaging is the same as brand of illegally diverted OxyContin being peddled by Narko Wróżka. The prevalence of Mundipharma products listed for sale on Europe-focused Telegram drug trafficking channels indicates that there are some significant breaches in the integrity of the company’s regional supply-chain and distributor network.

Another fentanyl-curious Telegram channel discovered by HUNTER investigators is ‘Ethio pharmaceutical and medical devices community.’ While many vendors advertise medicines with legitimate and non-abuse-related purposes in this channel, it is noteworthy that multiple sellers who post here casually claim to sell injectable forms of fentanyl.

Significance

Resecurity’s findings reveal the resilience of industrial-scale drug trafficking networks and operations on Telegram despite the company’s pledge to crack down on illegal content, products, and services. The lingering presence of fentanyl-related commerce is particularly troubling given the massive potential for deadly harm to recreational users.

On the bright side, the branding and pill-pressing conventions that have long been standard practice in the global drug trafficking industry – and their projection across illicit Telegram markets globally – empower law enforcement with significant clues to piece together the crisscrossing jigsaw puzzles that comprise the international narcotics trade.

Conclusion

Resecurity’s investigation into illicit Telegram drug markets largely corroborates the Global Initiative Against Transnational Organized Crime think tank’s “realization” that “synthetic drugs have become the future of drug trafficking.” The HUNTER unit’s research also reveals the rapidly growing global threat to recreational users and civil society posed by novel psychoactive substances (NPS) like mephedrone, Alpha-PVP, and their cathinone analogs.

Last March, GIATOC authored a report that noted how “organized criminal networks leverage the profits generated from synthetic drug production, trafficking and distribution to fund their criminal operations.” Synthetic drug funding streams thus contribute to the perpetuation of “cycles of violence and instability that are affecting an ever-greater proportion of countries around the world,” according to GIATOC.

The think tank also identified the “rapid expansion of online platforms, particularly on the dark web” as a key trend shaping the growing trajectory of illicit synthetic drug markets. As noted by GIATOC, these “anonymous marketplaces provide a convenient and relatively secure environment for the sale and distribution of illicit substances, allowing vendors and buyers to operate with a degree of anonymity.”

Of course, Telegram has firmly established itself as an integral node in this sprawling deviant metaverse colloquially referred to as the dark web. Resecurity’s investigation proves that this dynamic persists to this day despite a ferocious content moderation campaign announced by Telegram last September.

Additionally, GIAOTC hit the nail on the head with its assessment that the “globalization of supply chains has enabled the widespread dissemination of synthetic drugs across borders.” This precise dynamic explains why Vietnam-based Telegram dealers with usernames that literally say “European Drugs” offer cathinones sourced from France.

Similarly, this finding underscores the apparent proliferation of synthetic drug production and international trafficking in and out of Brazil. GIAOTC also noted that “production hubs in countries with lax regulations and enforcement mechanisms serve as primary sources of supply for a diverse array of substances to markets around the world. The decentralization of production and distribution networks complicates efforts to disrupt these illicit activities.”

The recent emergence of Poland as a synthetic drug production hub is a prime example of this phenomenon. With Poland rapidly emerging as top regional producer of 4-MMC, 4-CMC, 3-CMC, and Alpha-PVP, Europe’s youth are increasingly in the crosshairs of a particularly dangerous class of NPS drugs. Also troubling is the rise of synthetic opioid production in Poland.

Given the trail of carnage left by the opioid epidemic in North America, European law enforcement is closely monitoring the Central European drug underworld to ensure that Poland doesn’t become a logistical base for the importation or production of fentanyl.

On this note, GIATOC noted in a November 2024 report that the “dual-use character of fentanyl precursors such as NPP, which is traded legally for pharmaceutical purposes, creates a risk for illegal diversion of small amounts.” GIATOC also found that France is the biggest exporter of NPP (followed by India), while the UK is the second-biggest importer (after the US).

More systemically, the rise of Poland as a regional synthetic drug production and trafficking hub highlights the impact of the war in Ukraine and how it has displaced and rerouted the operations and logistics of regional DTOs. Notably, numerous Polish media outlets have highlighted the growing role of Ukrainian organized crime in the local synthetic drug trade.

Overall, Resecurity’s Telegram research reveals how the impact of geopolitical and supply-chain disruptions in the real-world drug trade projects itself onto illicit digital markets. Today, anyone with access to a European DTO telegra.ph menu, for example, can observe market dynamics like the precipitous drop in wholesale cocaine prices in the EU by roughly 50% over the last three years.

At the same time, sharper observers may notice the global abundance of certain designer drug brands and the prevalence of certain legitimate but illegally diverted pharmaceuticals on dark web menus. The narcotics intelligence collected by Resecurity provides authorities and researchers with substantive leads that illuminate the real-world dynamics driving the illegal drug trade.

Most troublingly, this investigation reveals how some DTOs may be grooming European opioid users in anticipation of an industrial-scale fentanyl pivot. Most immediately, Resecurity’s findings reveal that Telegram needs to enforce stronger content moderation controls on its messaging platform and on its anonymous blogging platform, telegra.ph.