🚨On the morning of September 30, 2026, the last American soldier left Iraq.
On the afternoon of September 30, 2026, Treasury published three enforcement actions.
The first designated 10 individuals and entities across five countries for procuring weapons for Iran's military. Operation Economic Outcast. China. Hong Kong. Pakistan. Saudi Arabia. Turkey. The financial pipeline that feeds Iran's missile and drone programs mapped and sanctioned.
The second designated 50 Sinaloa Cartel leaders and corruption networks in Baja California, including the ex-husband of the sitting governor. The cartel's captured-institution architecture mapped and sanctioned.
The third designated 10 targets in Tren de Aragua's financial network for stealing millions from American banks through ATM jackpotting attacks. A Venezuelan gang's cyber-fraud operation mapped and sanctioned.
Three actions. Three different target classes. Three different regions of the world. Same building. Same afternoon. Same day the military mission ended.
The TdA action is the one that tells you where this is going.
His name is Prometheus. Anibal Alexander Canelon Aguirre. FBI Ten Most Wanted. He engineered the malware. The software forces ATMs to dispense every bill inside them without debiting an account. The criminals break into the machine, install the code, activate it remotely, and a facilitator stands at the ATM while it empties itself.
They call it jackpotting.
$40.73 million stolen. Over 1,500 attacks. Across the United States. The proceeds laundered through cryptocurrency and transferred to TdA members in Venezuela, Mexico, Colombia, and elsewhere.
Prometheus designed the malware from outside the country. His crews deployed across American cities. They hit the ATMs, collected the cash, converted it to crypto, and sent it home. A Venezuelan terrorist organization funding itself by robbing American banks through their own machines.
98 people indicted by the Department of Justice. 10 designated by OFAC today. The charges include material support for a Foreign Terrorist Organization — because TdA was designated as an FTO on February 20, 2025.
Without the FTO designation, these are bank fraud cases. Federal crimes, serious penalties, but ordinary. With the FTO designation, they're terrorism cases. The defendants face 20 to 335 years. The designation is the multiplier. Same tool that turned CJNG drug cases into narco-terrorism charges in the Czech Republic. Same tool that produced the first guilty pleas for material support in Texas. The FTO designation doesn't change what the defendants did. It changes what the law can do to them.
Joint Task Force Vulcan ran this investigation. Vulcan was created in 2019 to eradicate MS-13. It has now been expanded to target TdA. The task force built for one gang was repurposed for another without starting over. The institutional architecture was already in place. The target changed. The tool didn't.
Vulcan includes U.S. Attorney's Offices in New York, North Carolina, Virginia, Florida, Texas, Oklahoma, Indiana, Nevada, Arizona, and Nebraska. Plus the National Security Division. Plus the Criminal Division. Plus the FBI, DEA, HSI, ATF, U.S. Marshals, and the Bureau of Prisons. Plus international partners through the DEA office in Bogotá.
That's not an investigation. That's a standing enforcement infrastructure that points at whatever target the government assigns it.
MS-13 in 2019. TdA in 2026. The tool was built once. It's been used twice. It will be used again.
Now hold all three actions against the morning's news.
The last American soldiers left Erbil Air Base. Operation Inherent Resolve twelve years of fighting the Islamic State ended. The military mission closed. The AUMF that authorized the presence was repealed. The boots are packed. The planes are home.
And Treasury published three designations covering Iranian weapons procurement, Mexican cartel leadership, and Venezuelan cyber-terrorism financing. Before the day was over.
The military left Iraq. The financial enforcement hit three continents. The pen didn't wait for the boots to clear the runway. The pen was already working.
This is what the transition looks like in practice. Not in theory. Not in a policy paper. In the Federal Register on a Tuesday afternoon.
The 2002 Authorization for Use of Military Force gave the president the authority to keep soldiers in Iraq for twenty years. The repeal closed that door. Every military action now needs current authorization with current receipts.
OFAC doesn't need an AUMF. OFAC needs an executive order, a designation package, and a press release. The authority is permanent. The instrument is instant. The reach is global. No base required. No deployment. No authorization vote. A designation from a desk on Pennsylvania Avenue reaches every bank on earth before close of business.
A soldier in Fallujah could secure one city block. A Treasury designation freezes assets in every jurisdiction that touches the dollar which is every jurisdiction on earth.
The soldier came home today. The designation went out today. One door closed. Three opened. Same government. Same afternoon. Different tool.
September 30, 2026.
Iran's weapons pipeline designated across five countries.
Sinaloa's leadership designated down to the governor's ex-husband.
Tren de Aragua's ATM jackpotting network designated down to the malware engineer on the FBI's Ten Most Wanted list.
And the last soldier walked off a base in Iraq and boarded a plane.
Three designations. One withdrawal. Same day. The pen replaced the rifle. The financial rail replaced the kinetic rail. And the transition happened in plain sight, on a Tuesday, documented in Treasury press releases that 159,000 people saw on Twitter before dinner.
Follow the pen. The pen doesn't need a base. The pen works from everywhere. And the pen never leaves.
The sources are the U.S. Department of the Treasury press releases sb0637, sb0638, and sb0640, OFAC Recent Actions September 29-30, 2026, and CNN's reporting on the completion of the U.S. military withdrawal from Iraq.
Timelines. Patterns. The general's words, not mine. All I did was read the receipts.
I am the guy on the couch, and you have been debriefed.
🤔Timelines, Patterns, Five Countries, One Pipeline
On September 29, 2026, Treasury designated 10 individuals and entities for procuring weapons and weapons components for Iran's Ministry of Defense and Armed Forces Logistics.
MODAFL. The entity responsible for weapons research, production, and acquisition for Iran's armed forces. The same entity that oversees Iran's ballistic missile program and its unmanned aerial vehicle development. The drones hitting Saudi infrastructure. The missiles fired at U.S. Navy warships in the Strait of Hormuz. The weapons start here.
The 10 targets are spread across five countries.
China. Seyyed Asghar Alizadeh Tabatabai a MODAFL representative stationed in Beijing. His job: coordinate the procurement of finished weapons systems and dual-use components in China on Iran's behalf. He sits in the Chinese capital, working for the Iranian military, buying the parts that become the missiles.
Hong Kong. EC Mojo Technology Limited a front company facilitating procurement through Hong Kong's commercial channels. Same Hong Kong that appeared in the Banque Misr §311 case through Kameng Trading. Same node. Different network. Same corridor.
Pakistan. Tajammal and the affiliated Cavalier Group third-party intermediaries leveraging professional networks to procure and distribute weapons on MODAFL's behalf. Pakistan, which signed a trilateral defense pact with Saudi Arabia and Turkey six weeks ago.
Saudi Arabia. Named in the designation as a jurisdiction where procurement activity occurred. The same Saudi Arabia that signed the AML MoU between its security agencies, detained 1,700 officials through Nazaha, reversed the burden of proof for corruption, and deployed 10,000 troops to Somalia on the Red Sea corridor. Saudi Arabia is simultaneously an enforcement partner AND a jurisdiction where Iranian weapons procurement is operating.
Turkey. Named in the designation as a jurisdiction where procurement activity occurred. The same Turkey whose Golden Global Bank was designated for IRGC money laundering. The same Turkey that shut down Iran's Bank Mellat after 44 years. Turkey is simultaneously shutting down Iranian banking AND hosting Iranian weapons procurement.
Five countries. Three of them are U.S. partners. One has a defense pact with two of the others. And all five have Iranian military procurement networks operating inside their jurisdictions.
Treasury said it took this action "in coordination with Saudi government partners."
That sentence deserves its own line.
In coordination with Saudi government partners. The United States and Saudi Arabia jointly identified these procurement networks. The intelligence was shared. The designation was coordinated. The same plumbing this series has documented the MoUs, the FinCEN Exchanges, the intelligence-sharing infrastructure built over decades produced this action.
Saudi Arabia helped identify Iranian weapons procurement happening inside Saudi Arabia. The sovereign flagged the network operating within its own borders and asked the United States to designate it.
That's the Bank Sorting Mechanism operating at the sovereign level. Saudi Arabia didn't protect the network because it was on Saudi soil. Saudi Arabia identified the network because it was on Saudi soil and handed the map to Treasury.
Here's what this designation actually targets.
MODAFL doesn't just buy finished weapons. It buys components dual-use technology, specialty metals, electronics, precision instruments. The parts that go into guidance systems, propulsion, airframes. The supply chain that turns a commercial circuit board into a missile component.
The procurement network works through front companies, intermediaries, and commercial channels that look legitimate from the outside. A technology firm in Hong Kong. A trading company in Pakistan. A representative in Beijing who files ordinary purchase orders for items that end up inside Iranian weapons systems.
The enforcement has to work at the component level not the missile, but the circuit board inside the missile. Not the drone, but the engine that powers the drone. That's why the designation spans five countries. The pipeline is distributed. No single country holds the entire supply chain. The procurement agent in Beijing buys the component. The intermediary in Pakistan routes it. The front company in Hong Kong processes the payment. The component arrives in Iran and becomes part of a weapon.
Dismantle any one node and the pipeline reroutes. Designate all of them and the pipeline has nowhere to go.
This is the sixth phase of Operation Economic Outcast in 36 days.
August 24: "Economic D-Day" announced. ~60 entities designated across digital assets, technology, gold, aviation, and shipping.
August 28: Banque Misr §311 Egyptian bank severed from the dollar for $1.8 billion in Iranian shadow banking.
September 14: VTB Bank designated through the Iran door Russia's second-largest bank.
September 16: FinCEN Exchange private-sector briefing, arming financial institutions with the map.
September 29: MODAFL procurement networks across five countries.
Six phases. 36 days. Digital assets, banking, oil revenue, financial intelligence sharing, and now weapons procurement. Each phase targets a different lifeline. Each phase reaches deeper into the network. Each phase spans more countries.
Bessent: "Treasury will not tolerate any support to the regime and will continue to identify, expose, and isolate Iran's enablers."
The source is the U.S. Department of the Treasury, Press Release sb0637, September 29, 2026.
I am the guy on the couch, and you have been debriefed.