Contents
In 2022, we took a look back at the start of the World Health Organization’s GSMS program to combat counterfeit drugs through utilizing global intelligence. At that time, the organization was heavily focused on setting up safe ground for reporting counterfeit drug production and finalising an effective form of dissemination and action. Today, knowing what we know about underground digital markets on the deep and dark web, we thought it would be an interesting exercise to look back and see where this program is at now, and the strides, if any, that have been made since we last wrote about.
What is the GSMS Program
The Global Surveillance and Monitoring System (GSMS) is an initiative launched by the World Health Organization (WHO) in 2013 to combat the global threat of substandard and falsified (SF) medical products. The GSMS works by collecting, aggregating, and analyzing reports of SF medicines from national regulatory authorities, inspectorates, enforcement units, pharmacovigilance centers, and quality control laboratories across participating countries. This data is relayed to WHO through secure electronic alerts, allowing for real-time sharing of threats across borders and supporting emergency responses, targeted investigations, and global policy coordination.
At its core, the GSMS enables regulators around the world to cross-reference and validate reports with those from other regions, drawing on WHO’s centralized database and photo libraries of known counterfeit products. This system both enhances the accuracy and speed of incident response and builds a growing evidence base to inform prevention strategies and strengthen supply chain integrity on a global level.
The 2025 State of Counterfeit Drugs
Counterfeit medicine incidents have sharply increased in 2025, with multiple high-profile factory raids and seizures reported in the U.S. ($3.5 million worth of counterfeit GLP-1 weight loss injections were seized in one week alone), as well as in Nigeria, Vietnam, and India. The counterfeit drug sector is now a $75 billion-a-year criminal enterprise, driven by sophisticated global supply chains and exploited via the weaknesses of online and cross-border logistics. Leading sources of counterfeit drugs remain India, China, and Southeast Asia, but destination markets span the globe.
In the United States, the influx of counterfeit medicines has reached historic levels. As of early 2025, U.S. Customs and Border Protection (CBP) reported intercepting nearly 1.3 billion “de minimis” parcels annually, with many flagged for containing fake or unauthorized pharmaceuticals. In Canada, border agencies routinely seize illicit shipments, and reports estimate that at least 10% of packages from overseas internet pharmacies contain counterfeit drugs, with both U.S. and Canadian authorities highlighting ongoing threats to public health from these international sources.
The Deep, Dark Web and Its Role in Counterfeit Drug Sales
The deep and dark web now power much of the global trade in illicit pharmaceuticals. Online pharmacies and covert marketplaces use encryption, cryptocurrencies, and AI to evade detection, advertising everything from high-demand injectables to synthetic opioids. AI is increasingly wielded by both criminals (to create fake packaging, clones of legitimate pharma websites, and mislead search engines) and defenders (to scan the web and supply chain, flag anomalies, and trigger takedowns). Law enforcement and threat intelligence teams increasingly rely on dark web analytics and digital forensics to monitor illicit trade, disrupt major sellers, and safeguard patient health.
One of the largest examples of intelligence teams relying on automation and investigation of the deep and dark web to combat counterfeit pharmaceuticals is Operation RapTor (2025), a major international crackdown led by the U.S. Joint Criminal Opioid and Darknet Enforcement (JCODE) team, Europol, and other global partners. Using digital forensics, blockchain analytics, and undercover operations on dark web marketplaces, investigators seized over $200 million in digital assets and narcotics, arrested 270 individuals, and dismantled marketplace infrastructures like Incognito Market, Tor2Door, and Kingdom Market. These sites trafficked everything from fake prescription drugs to counterfeit pills marketed as legitimate pharmaceuticals.
The Role of Threat Intelligence in WHO’s GSMS
Threat intelligence is now the linchpin in the fight against counterfeit drugs. The ability to scan the surface web and deep, dark web for new threats, analyze global shipping trends, and integrate AI-driven predictive insights allows both government agencies and private sector leaders to detect counterfeiting patterns in near real-time. Advanced analytics and cross-organization information sharing, like what we are seeing with the WHO’s GSMS, are making it possible to dismantle illicit networks, restore trust in legitimate supply chains, and prevent patient harm.
Deep and Dark Web Counterfeit Pharmaceuticals Monitoring Best Practices
The Wrap Up
While the WHO’s GSMS program has led to significant improvements in global detection and early warning capabilities, challenges persist around comprehensive enforcement and timely intervention. Since its launch, the system has enabled regulators from over 190 countries to share actionable threat data and rapidly identify trends in substandard and falsified medicines, resulting in faster recalls and the shutdown of several major counterfeit supply routes. However, limitations in resources, inconsistent reporting, and gaps in regulatory capacity, especially in low- and middle-income regions, mean that a substantial portion of counterfeit products still reach consumers before being intercepted.
The deepest changes, however, come from the web’s shadowy corners. The deep and dark web connects buyers to sellers, anonymizing transactions through encrypted channels, anonymous cryptocurrencies, and sophisticated escrow systems.
As such, the GSMS remains seen as a critical foundation for international cooperation, but its long-term effectiveness depends on continued investment, expanded analytics, and deeper integration with threat intelligence practices worldwide.