Russia’s global strategy for reasserting itself as a geopolitical superpower has led to an increased presence in Africa, where it has broadened efforts to shape the continent’s politics and pursue new economic opportunities to allay the effects of sanctions. While the presence of Russian military instructors and paramilitary groups in Libya and the Central African Republic is well documented, there is emerging evidence that Russian-linked companies are now active in the information space as well. Yevgeny Prigozhin, the oligarch perhaps best known for running the Internet Research Agency, is central to this expansion.

In this post we identify a Facebook operation attributed to entities tied to Prigozhin — including, it appears, the Wagner Group (Частная военная компания Вагнера), a Russian organization that has served as a private military contractor in several African countries. The first allusion to a social media influence operation tied to Prigozhin stemmed from Daily Beast reporting and a document shared with us by the Dossier Center that suggested the existence of a cluster of Facebook Pages tied to the Wagner Group. We identified an initial cluster of Pages which targeted Libya, and shared the find with the Facebook Threat Intel team. Facebook subsequently provided us with data on two related networks that they had been investigating previously. These networks have been targeting the Central African Republic, the Democratic Republic of the Congo, Madagascar, Mozambique, and Sudan, and included “news” Pages and websites, and Pages purporting to belong to political parties as well as individual politicians. The part of the operation we analyzed included seven Instagram accounts and 73 Facebook Pages. In total 1.72 million accounts liked the Facebook Pages, though we note that some of these likes are possibly from the same account across multiple Pages. The Page managers were quite active; in October 2019 alone there were 8,900 posts. 

Wagner Group document shared by the Dossier Center. The document included an example post from a Page called ليبيا القذافي (Libya Gaddafi). The post was a photo of former president Muammar Gaddafi, overlaid on an outline of Libya. The document described the post as a “Patriotic post about the best time for the Motherland.” (High Resolution)

From our analysis of the social media activity, there are several key takeaways:

• The operation, conducted by Russia-linked organizations likely operating at least in part at the behest of a state actor, appears to have further relied on subcontractors who are native speakers and/or local to the region. This variety of nested obfuscation increases hurdles to attribution of disinformation campaigns. 

• In addition to well-known social media platforms such as Twitter and Facebook, the actors leveraged public WhatsApp and Telegram groups. Whether more private chat channels were also used is an area for further research. 

• The operation used social media engagement tactics designed to develop a close relationship with the audience, including Facebook Live videos, Google Forms for feedback, and a contest.

• The operation shared tactical similarities to Internet Research Agency activities; the operatives created several associated news sites (in one case staffed by reporters who appear to have spent time in Russia) as well as Facebook Pages that produced social-first content (memes, live videos). The attribution of such activity to non-IRA entities that nonetheless share an affiliation with Prigozhin leads to a significant unresolved question of what relationship, if any, exists between the IRA, Wagner, and Prigozhin’s other companies, and to what extent Russia is distributing its active-measures capabilities across a myriad of organizations to hinder detection and attribution.

The activity and strategies varied by country:

• Libya: Russian actors are supporting two potential future presidential candidates: the rebel General Khalifa Haftar and Muammar Gaddafi’s son, Saif al-Islam Gaddafi. The Facebook operation began in December 2018, and the Pages were run by administrators in Egypt. Prior reporting has indicated that the Wagner Group has at least 100 mercenaries fighting with Haftar’s militias.

• Sudan: Facebook activity began in mid-2018, and has persisted since the April coup against Omar al-Bashir, transition to the Transitional Military Council, and transition to the Sovereign Council of Sudan. Content has been slightly supportive of whatever government is in power, and occasionally critical of protesters. Several of the Pages relate to two news websites, khartoumstar.com and sudandaily.org, the latter of which often re-posted Sputnik articles. There were additionally Facebook Pages purporting to be the official Pages of several political parties, along with “news” Pages for the Transitional Military Council and the Sovereign Council of Sudan. The former had the url facebook.com/transitionalmilitarycouncil, and at first glance appeared to be its official Page. Prigozhin-linked companies are known to have mining agreements in Sudan and have trained local military forces.

A Sudan Daily article, reposted from Sputnik, saying that Russian mercenaries in Sudan have no connection to the Russian government. (Link to full image) 

• Central African Republic: A network of Facebook Pages was created to publicize and praise the wide range of activities undertaken by the Russian government in the CAR, from military support to cultural events. These Pages, most of which had administrators in Madagascar, seem to have been intended to appear organic and give CAR audiences the impression of widespread domestic support for the administration of President Touadéra and its Russian partners.

• Madagascar: Russian actors created several Pages in 2018, but only began posting in February 2019, just after the new president was inaugurated. The Pages bolstered the government. One Page was created for a specific parliamentary candidate. 

• Mozambique: The Facebook operation began in September 2019, a few weeks before the country’s presidential and parliamentary elections. The Pages posted content to support the incumbent president, and damage the reputation of the opposition – in at least one instance, with a fake news story. 

A post from Onda da Frelimo (Wave of Frelimo) describing the results of a poll purportedly conducted by the International Anticrisis Center, a Russian organization. The publication of such polls is illegal in Mozambique. Frelimo is the ruling party in Mozambique. (High resolution)

• Democratic Republic of the Congo: Three Facebook Pages, created in 2019 after a contentious election, published content and memes mocking and criticizing key Congolese political figures, including the president. These Pages were not clearly aligned with the Russian government’s public strategy. 

The potential connection between the Libya operation and the Wagner Group is based on the leaked document obtained from the Dossier Center, which we cannot independently verify. We attribute these collective operations to actors tied to Yevgeny Prigozhin. Facebook’s attribution supports our conclusion. This investigation demonstrates a fundamental challenge of attributing information operations: disentangling activity by domestic interested parties, foreign actors working on behalf of domestic parties and foreign actors working in support of their own geopolitical or commercial interests. Our initial analysis of this content suggests a complex mix of motivations and our understanding of the African political disinformation ecosystem continues to evolve. Our full analysis of the materials, including images and figures, is in the linked whitepaper.