Mapping illicit power: The RSF’s corporate network in the UAE
The October 2025 investigation by The Sentry into Sudan’s Rapid Support Forces (RSF) exposed a sophisticated business ecosystem that stretches from Darfur’s gold mines to company registers in Dubai.
Far from being an informal smuggling chain, the network resembled a distributed corporate structure — populated by real directors, legitimate-looking licences, and adaptive ownership. It demonstrates how paramilitary power in the 2020s relies less on weapons or ideology, and more on access to global markets and the ability to conceal that access through data-visible intermediaries.
What is the RSF
The Rapid Support Forces (RSF) are a powerful paramilitary group in Sudan, originally formed in 2013 from the remnants of the Janjaweed militias responsible for atrocities in Darfur. Officially integrated into Sudan’s security apparatus under former president Omar al-Bashir, the RSF evolved into a parallel army under the command of Mohamed Hamdan Dagalo (“Hemedti”). The group controls major gold mining areas, extensive business interests, and foreign mercenary operations, giving it significant economic and political autonomy. Since Sudan’s 2023 civil conflict, the RSF has fought the national army for control of the country, financing itself through commercial and cross-border networks that blur the line between state and private power.
The structure of a paramilitary economy
At the heart of the system lies the Dagalo family, led by RSF commander Mohamed Hamdan Dagalo (Hemedti) and his brother Abdulrahim Dagalo. Their commercial flagship, Al Junaid Company for Multi Activities, long served as the RSF’s economic engine — handling gold extraction, livestock exports, and construction. As sanctions tightened after Sudan’s 2023 civil conflict, a constellation of firms appeared in the United Arab Emirates, mirroring Al Junaid’s business lines while distancing the Dagalos from direct ownership.
Among the companies cited in the report are Tradive General Trading LLC, GSK Advanced Business LLC, Capital Tap Holding LLC, Al Jil Alqadem General Trading, Horizon Advanced Solutions, and Natwest Logistics LLC. These firms, formally registered in Dubai, declared activities ranging from gold and vehicle trade to consultancy and project management.
Behind them stood a small circle of recurring individuals:
- Mazin Fadlalla, a Sudanese national linked to multiple RSF-associated entities, serving as director or shareholder across Tradive, GSK, and Horizon.
- Abozer Habib, appearing in GSK and Natwest Logistics, is reportedly responsible for coordinating procurement and transport.
- Emirati partners such as Naser Alhammadi and Essa Almarri, who provided local registration and commercial cover.
Corporate filings reveal overlaps in addresses, contact numbers, and even website domains. Several company websites were hosted on the same IP range as Al Junaid’s Sudanese operations, a digital clue suggesting continuity despite formal separation.
Adaptive behaviour as a risk signal
Examined over time, the network displays distinct adaptive behaviour — an intelligence asset in itself. Between 2023 and 2025, as Western sanctions targeted RSF-linked entities, shareholdings in some companies shifted to new proxies days before or after designations. Capital Tap Holding and Horizon Advanced Solutions, for instance, altered their ownership structures immediately before U.S. and EU measures were implemented.
Three recurring tactics emerge:
- Ownership cycling – Fadlalla or Habib transferring shares to lesser-known associates as scrutiny increased.
- Purpose shifting – entities registered for consultancy or IT later adding gold trading or logistics to their activity list.
- Temporal clustering – new firms established within weeks of sanctions on previous ones, replicating functions almost identically.
Such manoeuvres create measurable temporal signatures of risk: bursts of incorporation, rapid turnover of directors, and thematic repetition in trade categories. For analysts, these are indicators of organised continuity rather than isolated coincidence.
Concentration and replication of control
Although dozens of companies were involved, functional control rested with a few intermediaries bridging the RSF and UAE commercial ecosystem. Fadlalla and Habib acted as bridging nodes, connecting military financing in Sudan to corporate legitimacy in Dubai. Their repeated presence across unrelated firms underscores how small personal networks can sustain large-scale economic operations.
From a systems perspective, this produces both concentration and redundancy. The network depends on a handful of operators — yet those operators can re-create legal vehicles at will. Enforcement, therefore, requires monitoring recurrence rather than individual company names.
Data signatures of coordination
Beyond ownership, the report highlights quantifiable data correlations typical of proxy commerce:
- Multiple firms shared the same registered office in Dubai’s Business Bay district.
- Websites for GSK Advanced Business, Tradive, and Natwest Logistics used identical design templates and were hosted on related servers.
- Customs data pointed to overlapping trade in gold, tyres, and vehicle parts, commodities directly relevant to RSF logistics.
Each indicator, trivial in isolation, becomes meaningful when aggregated. The overlap of domain metadata, commodity codes, and corporate addresses forms a composite risk signature — a reproducible model for identifying successor networks elsewhere.
Systemic vulnerabilities
The RSF’s commercial ecosystem thrived not because of extraordinary secrecy but because of regulatory asymmetry. Until recently, the UAE’s beneficial-ownership regime left wide discretion over disclosure; enforcement relied on company self-reporting. This environment allowed sanctioned actors to operate through nominally independent local partners without immediate detection.
The case illustrates how armed groups exploit the very mechanisms of globalisation — open trade, light corporate registration, and fragmented data governance — to launder resources into legitimacy. The weakness lies less in intelligence capacity than in data interoperability: ownership, trade, and sanctions datasets rarely intersect in real time.
Understanding networks rather than entities
The RSF’s financial infrastructure demonstrates a broader analytical point: risk is relational. Each company may appear compliant, but collectively they constitute a functional system linking resource extraction, capital movement, and political violence. Mapping that system requires connecting discrete datapoints — director histories, registry timestamps, trade patterns — into a coherent temporal network.
When analysed this way, illicit finance looks less like a set of secret accounts and more like an adaptive graph: nodes representing legal entities, edges representing shared identifiers, and time as the axis of mutation. Such mapping transforms qualitative allegations into structural evidence — revealing not only who benefits, but how the mechanism endures.
