Like Cinderella, the Malaysian opposition has seemingly transformed itself overnight from a downtrodden victim into the belle of the ball. In a stunning upset at the polls in early May, the Alliance of Hope, led by former Prime Minister Mahathir Mohamed, toppled corrupt incumbent Najib Razak, handing his party its first defeat since the country’s founding in 1957. Now facing charges that he directed $600 million from the country’s sovereign wealth fund, 1MDB, into his personal bank account, Najib is well-suited to the role of fairy-tale villain. While Malaysians certainly deserve to live happily ever after, their Cinderella story may have a dark side.

For decades, Kuala Lumpur has been a confederate of Iran, Hamas, and North Korea. And it’s not yet clear whether the 92-year-old and notoriously anti-Semitic Mahathir, who has his own well-documented history of cronyism and corruption, has either the will or the ability to sever the government’s ties to rogue states and extremists.

Since the 1990s, North Korea has used Malaysia as a base to operate front companies that fund the regime. For example, a North Korean intelligence operative established Malaysia Korea Partners (MKP) in 1996. The firm operates in 20 countries and has signed $350 million worth of contracts through construction projects in Angola, Zambia, and elsewhere.

Malaysian banks have also knowingly allowed North Korean officials to open accounts for their front companies. Most notably, North Korean national Kim Chang Hyok, who operates multiple front companies for the RGB, including the defense firm Glocom, opened several Malaysian bank accounts without even trying to conceal his links to North Korea, according to the UN Panel of Experts. The same body also reported in March that the Reconnaissance General Bureau (RGB)—North Korea’s main intelligence agency—exerts effective control over Glocom.

North Korea’s sanctions evasion persists even though Kuala Lumpur’s relations with Pyongyang deteriorated after the assassination of Kim Jong-un’s eldest brother, Kim Jong-nam, in Malaysia in February 2017. Moreover, Mahathir’s decision in June to reopen the Malaysian embassy in North Korea raises concerns that the Prime Minister has little interest in shutting Pyongyang’s illicit schemes, which also flourished during his original tenure in office.

Malaysia also has a record of serving as a conduit for Iranian sanctions evasion. Just one week after taking office, Mahathir stated that “sanctions by big powers” will not influence Malaysia’s economic policies, suggesting that Malaysia may buck U.S. sanctions when they return in early November. Malaysia imported $293 million of goods and services from Iran last year, up sharply from $45 million in 2015.

In July, the U.S. Treasury designated Malaysia-based Mahan Travel and Tourism Sdn Bhd for working on behalf of Iranian carrier Mahan Air—the “airline of choice” for Iran’s Islamic Revolutionary Guard Corps Qods Force, which Treasury designated in 2011 for its deliveries of weapons and manpower to the Assad regime. Mahan Travel and Tourism Sdn Bhd had been operating for at least eight years in Kuala Lumpur, conducting sales, marketing, and financial services for the carrier.

Hamas is yet another sanctioned entity benefitting from Malaysia’s friendship. Malaysia’s largest Islamist party has had ties to Hamas since at least 2002. Najib, the former premier, even defied the Israeli blockade of Gaza to visit the enclave in 2013. And most recently, the Mossad assassinated Fadi al-Batsh, a high-level Hamas operative, in Malaysia. Al-Batsh, a professor and lecturer at the British Malaysian Institute, conducted research on weapons systems and drones on behalf of Hamas. In a memorial Hamas held for al-Batsh in Gaza, ten masked fighters guarded his mourning tent, a significant honor.

This support for Hamas dovetails with Malaysian leaders’ courtship of Islamists at home. The Najib government pushed attempts to amend Malaysia’s Criminal Jurisdiction Act to allow sharia courts to issue harsher punishments.  During the recent campaign, Najib said that Malaysia should be ruled by Muslim ethnic Malays.

While the change in administration offered hope that Malaysia would reject this path, Mahathir recently met with Indian Muslim hate preacher Zakir Naik after rejecting New Delhi’s request to extradite the well-known televangelist, who is wanted for money laundering and terrorism.  Naik has justified Osama bin Laden’s atrocities, and helped to incite a July 2016 terror attack in Bangladesh that killed 29 people.

Malaysia’s democratic overturning of the corrupt Najib government is indeed an achievement worth celebrating. But that progress should not blind us to the country’s unresolved past demons, the ongoing corruption of its ruling class, and its longstanding identity as an enabler of rogue regimes and terrorist non-state actors. If we are to see a “happy ending” for this Cinderella story, and a vindication of the faith placed in Mahathir’s new administration, Malaysia will need to do much more to turn its back on the villains it counts among its friends.