Meta disrupted a Russia-based Coordinated Inauthentic Behavior (CIB) network targeting Sub-Saharan Africa. This file contains Indicators of Compromise (IOCs) from Meta’s Adversarial Threat Report H2 2025.
Influence operation threat actors continue to adapt in response to our detection and enforcement efforts. In recent months, we’ve observed increasing use of freelance social media managers to execute influence operations in Africa on behalf of nation-state actors. Unlike commercial firms offering “IO-for-hire” services that we reported on in the past, these freelancers are often social media managers based in the same locale as the target audience. They use their authentic accounts to run social media for brands and promote content, and we believe they are unwitting of the true nature and sponsorship of the campaigns they are running.
Over the last six months, we have uncovered two campaigns targeting Africa in which local, for-hire individuals conduct influence activities on our platforms, likely on behalf of Russia-based actors. While we have previously documented Russia’s use of local cutouts in Africa as early as 2019, recent investigations reflect a proliferation of this tactic and a decreasing reliance by Russian networks to use strictly fake accounts. This evolution is a departure from typical influence operation models, where campaigns are run directly by commercial firms or nation-state actors through networks of inauthentic personas.
In most cases, we have no evidence to suggest that the for-hire individuals involved in these operations were aware of the ultimate Russian backing. Despite this, their activities - particularly their attempts to circumvent political ad detection and use of fake accounts to continue operating their campaign after initial enforcements - violate Meta’s Coordinated Inauthentic Behavior policy and resulted in their removal from our platforms.
Beyond perceived anonymity, leveraging local, for-hire individuals enables threat actors to minimize their online footprint and outsource phases of the online operations kill chain that are most vulnerable to platform detection, such as acquiring and disguising assets. By hiring locals that specialize in digital media management, influence actors effectively obtain local infrastructure, mature and authentic social media accounts, and target-specific knowledge, all of which facilitate the operation’s ability to integrate smoothly into the local information environment. This tactic also facilitates longevity - another phase in the online operations kill chain - as we’ve observed threat actors quickly replace social media managers when previous ones are removed, allowing campaigns to continue with minimal downtime.
As platforms continue to improve detection of inauthentic behavior, we assess that influence actors could increase their use of paid intermediaries for influence operations. This report aims to increase awareness of this issue, enabling digital freelancers to critically evaluate who they’re working for and thereby help them avoid disruptions to their legitimate income streams. The following sections provide details on two recent investigations that use this tactic.
We removed 67 Facebook accounts, 70 Pages, and 2 Groups for violating our policy against Coordinated Inauthentic Behavior. About 621,400 accounts followed one or more of these Pages, and about 4,200 accounts followed one or more of these Groups. The network engaged in around $107,300 in spending for ads on Facebook and Instagram, paid for mostly in US dollars, South African Rands, and Nigerian Nairas. This network targeted multiple countries throughout sub-Saharan Africa and leveraged local freelancers, likely working on behalf of individuals in Russia. The operation created Pages purporting to be local and original media outlets and ran ads that denigrated African partnerships with France and the United States and promoted Russian geopolitical interests.
A decentralized network of individuals, claiming to be social media managers, drove this operation across primarily Mali, Burkina Faso, Gabon, Nigeria, South Africa, Senegal, Angola, and Benin. These individuals, some of which maintained active profiles on freelance platforms like Upwork, stated they were social media managers or search engine optimization specialists, for example.
On our platform, these individuals created Facebook Pages that masqueraded as local media or news outlets and ran undeclared political ads that typically targeted multiple African countries. The individuals behind these Pages repeatedly returned to our platform after we removed them, often using fake accounts to recreate similar brands. This network of individuals operated independently, though they likely received centralized tasking through channels outside of Meta’s platform. This assessment is supported by our observations of these individuals running the same or slightly adjusted ad content - often within a two day window - and utilizing the same text obfuscation methods, such as “4ng0la, “uk_ra_ine”, and “fr@nce”.
To a lesser extent, the operation leveraged established, authentic media outlets on Facebook that offered paid advertisements, typically including “DM for ads” or similar language in their Page descriptions. These advertisements featured similar political themes, text obfuscation methods, and coordination indicators as the broader network.
We found this network as a result of our internal investigation into suspected coordinated inauthentic behavior in the region. Our analysis benefited from reporting produced by France’s Vigilance and Protection Service against Foreign Digital Interference (VIGINUM).
We removed 10 Facebook accounts, 2 Pages, and 9 Instagram accounts for violating our policy against Coordinated Inauthentic Behavior. About 20,800 accounts followed one or more of these Pages, and about 3,100 accounts followed one or more of these Instagram accounts. This network targeted numerous sub-Saharan African countries and leveraged a Cameroon-based freelancer, likely working on behalf of employees of RT, a Russian state-controlled media entity.
The individuals behind this activity attempted to create two seemingly independent, grassroots media outlets, establishing a presence across multiple internet platforms including Telegram, TikTok, Facebook, Instagram, and X. On our platform, the brands - Allô Afrique and Derniere Minute - posted in French and targeted audiences with international news, seeding narratives on Russia’s stance on Ukraine and the West, and at times, shared RT-branded content. These brands also posted videos periodically featuring RT employees without acknowledging their affiliation to the Russian-controlled media outlet.
For the majority of time this campaign ran, a Cameroon-based individual operated the Facebook and Instagram accounts associated with these brands. This individual was associated with a Page advertising the individual’s own digital communications agency. We assess it is possible the operator had knowledge of the ultimate sponsor of this operation.
We found this activity as a result of an internal investigation into suspected coordinated inauthentic behavior in the region and identified links to a past influence operation we removed and reported in November 2023.
Note: URLs have been defanged for safety. Replace [.] with . to resolve.
| Indicator Type | Indicator Value |
|---|---|
| Social Media Account | hxxps://x[.]com/Allo_Afrique |
| Social Media Account | hxxps://x[.]com/dernierminute24 |
| Social Media Account | hxxps://t[.]me/AlloAfrique |
| Social Media Account | hxxps://t[.]me/derniere_minute |
| Social Media Account | hxxps://www[.]youtube[.]com/@All%C3%B4Afrique |