Influence, Subcontracted: How OSINT Cracked Nigeria’s Pro-Kremlin YouTube Network

“We don’t know who’s who anymore…” – An anonymous Malian journalist, specializing in the fight against Russian disinformation. [Source: Forbidden Stories]

In March 2020, CNN journalists were led inside an unremarkable house in Accra, Ghana. Inside, a small team of young Ghanaians spent their days posing as Americans online. 

The year before, Central African journalist Ephrem Yalike had become a “little telegraph operator”. He was paid $50 per-article, three articles a week, to spread pro-Russian narratives about the Wagner Group and anti-U.N. protests. The death threats from his employers came daily, but $50 was a lot of money.

Most Western countries have gotten wise to the kinds of tactics Russian influence networks used to influence our media, democratic processes and  the 2016 US presidential election, or the UK Brexit Referendum. Russian money doesn’t go as far in Europe as it used to. For this reason, Russian actors looking to cause trouble - whether oligarchs, mercenaries or the Kremlin itself - have switched frontiers.

Africa itself is suffering under Russian influence. Russia’s growing footprint in Africa is very deliberately framed as an opportunistic partnership: a partner with more clout than most target countries, lending its soft power - and rubles - to develop the undeveloped and strengthen the weak. On the ground, the truth is more obvious. Across the Sahel and Central Africa, Moscow’s model of ‘irregular’ tools looks nothing like “investment”; unless economies are really grown by deploying the Wagner Group to oil fields, coercing foreign citizens into your army, or making opaque deals for resources mined by children. 

Still, Russia’s $18 billion in trade with African countries lags far behind the United States’ $64 billion and China’s $254 billion. Moscow is losing a wider, self-serving geopolitical contest to exploit the world’s richest continent. Time for dirty tactics. 

“The Kremlin and the Chinese Communist Party (CCP) are hard at work expanding their kleptocratic networks in Africa… This malign networked influence undermines African governments and… is a top contributor to conflict and human rights violations on the African continent.” – Christopher Walker, Vice President for Studies and Analysis, National Endowment for Democracy. [Source: NED]

To maintain such relationships of power asymmetry, states like Russia need to position themselves as anti-colonial partners - even if that’s a lie. Even if that means financing schemes to exacerbate local wounds and co-opt the media in the Kremlin’s favor. Even if it means co-opting journalists, funding media outlets, training influencers in phony ‘journalism schools’, and saturating public discourse with untruths. Recent analysis conducted by journalism collective Forbidden Stories followed Russian front ‘The Company’ as it spent $300,000 per month on media placements, ranging from $600 per article in Benin to $10,000 in Libya. These deliberate, locally-targeted disinformation campaigns feed political instability; instability creates openings for further financial and strategic penetration by Russia. And because much of this activity is outsourced - handled by local actors, paid obliquely, and masked as grassroots engagement - it’s both scalable and plausibly deniable. 

In nascent global economies like Ghana’s or Nigeria’s, financial oversight struggles to keep pace with seismic levels of growth - allowing poisonous financial inflows to contaminate the national economic bloodstream. Distorting markets, incentivising corruption, and embedding foreign influence into the fabric of African public life are both means and end of economic pollution by dirty Moscow money.

But don’t think the Kremlin has forgotten about the West.

In that Accra house, or in Ephram Yalike’s testimony, we get a glimpse into the way Russia has enmeshed its interests in both Africa and the West. A two-for-one deal sees Russia circumvent the countermeasures most Western countries have built against state-sponsored influence, while making use of their African disinformation infrastructure to project malign influence back West too. 

Now, an OSINT investigation has discovered a pro-Russian Youtube network operating out of Nigeria is publishing videos that have received millions of views. Their content denigrates Ukraine, the United States, the European Union, and Israel; they typify the Kremlin anti-West narratives spread by Russian influence operations through African proxies.

Disinformation is how documents suggest actors like ‘The Company’ intended to create “the largest anti-Western coalition in Africa”. This is how OSINT Industries helped uncover a new threat: Russian influence, subcontracted. 

Meet Max Lesser, Senior Analyst on Emerging Threats (and his intern, Meera).

“If I can’t use OSINT Industries, it probably isn’t worth it…” – Max Lesser, Senior Analyst on Emerging Threats. [Source: OSINT Industries]

‍Max Lesser works as a Senior Analyst on Emerging Threats at a major international relations non-profit. This unit focuses on how technology innovation can advance US cybersecurity through academic research on adversary strategy, scientific experimentation and interdisciplinary study by talented analysts like Max. Their aim: to balance the risks of tech in the wrong hands, with the power of tech in the right ones. 

In his previous life, Max served as head of U.S. policy analysis and engagement at Darktrace Federal, a cybersecurity company that specializes in AI’s potential to combat attacks (including nation-state attacks) on US federal clients. Max’s research and insight into foreign malign influence on US politics has also been referenced by OpenAI itself, and made its way into The New York Times, Wall Street Journal, and NBC News.

This also isn’t Max’s first case study with OSINT Industries. Our previous collaboration followed how Max and his team traced a network attempting to crowdfund a fatwa against U.S. President Donald Trump. Using OSINT Industries and other open-source techniques, Max surfaced an Ayatollah-backed operation that threatened an assassination. 

Now, Max (and his former intern Meera) have reached out to us once again to show how OSINT can uncover state-aligned influence operations in near real-time - and thwart the disinformation campaigns of hostile regimes. 

Five Channels, One Voice: Doomscrolling the Network 

As in Max’s last groundbreaking OSINT investigation, this story begins with an intern doomscrolling. This time, Max’s intern Meera was browsing content on her phone when she came across not a single website, but a deeply suspect pattern in supposedly grassroots accounts. 

‍“NO SURVIVORS!”, the video thumbnails read. “UKRAINE 100% SURRENDERED: IT’S OVER!!!”

Viewing one would encourage YouTube’s algorithm to feed her another, a drip-feed of disinformation that might have worked on a less critical thinker. This didn’t look like misinformation; it was outright, deliberate fake news.

Meera’s YouTube was soon overrun by identical videos, from channels all spreading pro-Russia narratives on the invasion of Ukraine.

It didn’t take long for her to identify the network of accounts spreading this material. The videos came from a recurring set of five usernames: @Peace-Crusader, @conflictcompas, @GloryinCombat, @freshinfoinsight, and an unexpectedly casual outlier, @DaddyMaxwell77. As of August 30 2025, this network has amassed ~37.4K subscribers, and 5.8M+ total views.

Meera catalogued the ways in which these accounts were similar or the same. 

• All five denigrated Ukraine, the United States, the European Union, and Israel.
• All five aligned with known Russian influence narratives, such as the ‘decline of the West’, ‘imminent collapse’, or whataboutism regarding Ukraine. 
• All five have near-identical biographies.
• All five mostly post edits of disgraced American media personality Scott Ritter and known misinformation-spreader Douglas Macgregor, both of which appear on Russian state media pushing pro-Kremlin narratives.
• All five have identical video descriptions, and overlapping hashtags like ‘#militarystrategy’ and ‘#douglasmacgregorinterview’.
• All five use AI voiceovers, and three use AI news anchors in their videos to suggest Macgregor and Ritter are talking live.
• Most videos have identical and histrionic thumbnails and titles (i.e. “Douglas Macgregor: SURRENDERED!!!”) with long posting gaps suggesting a preset list.

‍“We sampled titles from 200 videos, finding 65 titles were identical across 2 to 3 channels and 15 were identical across 4 to 5 channels.” – Max Lesser, Senior Analyst on Emerging Threats. [Source: Memetic Warfare]

To Meera, the chances of these channels being organic seemed slim to none. She spread the word to her boss.

Three Brothers: Triangulating the Operators

“None of this could have happened without OSINT Industries…” – Max Lesser, Senior Analyst on Emerging Threats. [Source: OSINT Industries]

Max and Meera had discovered a disinformation network. What now?

Four of five users had publicly listed their email addresses in the ‘More Info’ section of their channels. @Peace-Crusader displayed the email address [redactedemail1]@gmail[.]com; both @conflictcompas and @freshinfoinsight displayed [redactedemail2]@gmail[.]com; and @GloryinCombat displayed [redactedemail3]@gmail[.]com.

Running searches for each email address on OSINT Industries would reveal who was behind these videos. 

Max’s OSINT Industries searches revealed names, usernames, and accounts associated with each email, making it clear who was responsible for which. As multiple accounts were attached to some, he gave each unique ‘Operator’ an identifying letter:

• ‍Operator A is the owner of [redactedemail1]@gmail[.]com
• Operator B is the owner of [redactedemail2]@gmail[.]com
• Operator C is the owner of [redactedemail3]@gmail[.]com

One channel – the uniquely-named @DaddyMaxwell77 – did not display an email address. However, he had something in common with the others that suggested both a connection, and a key identifying clue.

@DaddyMaxwell77, like the other 3 Operators, listed his location as Nigeria.

Who Are They?... And Who is DJ Fresh?

“‘Sammy Sachs’ would never have been visibly affiliated with ‘Samuel Shokoya’*… Getting names mattered.” – Max Lesser, Senior Analyst on Emerging Threats. [Source: OSINT Industries]

Our two intrepid investigators now knew these Operators were located in Nigeria. Thanks to OSINT Industries, they could triangulate this key piece of open-source information with the identifying OSINT brought up in-search.

‍OSINT Industries brought up usernames associated with the emails. From their searches, Max and Meera found Facebook accounts too. Specifically, a profile associated with Operator A - which listed Operator C as his brother. Operator C’s profile listed Operator A and Operator B as brothers too.

Triangulating this finding with account data from further OSINT Industries searches made the picture even clearer. 

Operator B and Operator C’s profiles used aliases that matched their emails and a linked account, but also referenced another: ‘DJ Fresh’. This alias presented Max and Meera with a profile picture, and alias DJ Fresh was soon unmasked. Reverse image searching led to ‘Isaac Shakoya’*. 

Isaac and the two other Operators shared this distinctive last name. As Facebook results suggested, they were brothers.

Three Motives: They Can’t All Be Brothers, Can They?

“These aren’t experienced operators, they’re cheap proxies… They’re just dudes who got paid to do this”. – Max Lesser, Senior Analyst on Emerging Threats. [Source: OSINT Industries]

Max and Meera knew this network was exhibiting “clear indicators of coordinated inauthentic behavior”. They knew the identities of the apparent operators - three Nigerian brothers - and their relationship. What remained “less clear” was the operator's motivation. 

Several options arose.

Motive One: Chasing Clicks or Kremlin Kash?

One explanation is that the operators are “primarily financially motivated, but not funded by the Kremlin”. That is, the network and its brother-Operators are not directly receiving Russian money. Instead, they hope to get high enough engagement to monetize their content, and even attract paid members.

Three of the five channels offer paid membership, so this motive makes some sense to Max and Meera. These channels have reached the engagement threshold to monetize their channels through YouTube, and are receiving additional payment via their however many red-pilled Russia fans (or addicted boomers) they have managed to ensnare. 

Yet our investigators judge that profit isn’t enough to explain the “exclusive focus on amplifying Kremlin-aligned narratives, nor does it rule out the possibility of third-party funding.” There’s no explicit financial motive to emphasizing pro-Russia narratives; in fact, were they looking for pure profit, they would have more luck with Youtube Kids AI slop.

Motive Two: KWorkers of the World, Unite!

Another explanation is that the operators are “ideologically motivated to spread this content”. However, “the operators’ personal, public social media channels show no clear sign of ideological alignment with Kremlin positions.” 

One thing the Operators did express on socials was a need for employment. Operator A publicly expressed on X he was searching for a much-needed job. OSINT Industries also showed Operator A and Operator C have accounts on Kwork: Russia’s most popular freelancing site.

 A third party with a motive to spread this content would have both means, and opportunity. 

Max and Meera found, considering the Kremlin’s “historical use of Nigerian proxies”, the network’s “consistent amplification of Kremlin-aligned narratives”, and “the observed content and structure” of the channels, what they saw was “consistent with patterns seen in past Russian influence operations”.

‍“Considering the above, the most plausible explanation is that the network forms part of a Russian influence operation…”  

Motive Three: Network in the Mirror May Be Bigger Than It Appears

“…This raises the possibility that the network is broader than initially identified, potentially involving multiple operators across several countries.”  – Max Lesser, Senior Analyst on Emerging Threats. [Source: Memetic Warfare]

In their investigation of the five-channel cluster, Max and Meera found a collection of other channels too. More Scott Ritter and Douglas Macgregor content; more histrionic titles and thumbnails; more pro-Russia talking points; more obvious patterns in their titles, descriptions and channel bios.

The “extended network” includes:

• @WORLD_INFOC
• @beginyourjourneyyy
• @STORYFlixx
• @theunfilteredminds
• @WarZoneEcho
• @CAPTAINWORLD713
• And the ironically-named @truepropaganda.

These other channels “appear related”, but have no visible connection to Operators A, B, or C - or to Nigeria. 

Some of these channels are demonstrably based elsewhere. For example, using an associated email, Max and Meera could place @beginyourjourneyyy’s operator in Pakistan. 

That username is appropriate for what this extended network’s creators or funders intend viewers to do - fall down the rabbit hole of Kremlin-backed disinformation. That this network stretches worldwide suggests that the Nigerian brother-Operators are not the only cogs in this machine. A more diffuse, transnational network takes a great deal of strategic synchronisation to appear organic. When attempting to stretch their reach to such a breadth, failure in this respect suggests only loose coordination on the part of whoever’s in charge. Perhaps, by contracting “cheap proxies”, the creators maintain plausible deniability.

Supposedly ‘independent’, semi-affiliated actors are reproducing and scaling pro-Kremlin messaging on YouTube. Max and Meera had discovered just one cluster in a broader disinformation architecture. 

Therefore, the real question isn’t the motives of Operators A, B, and C. They’re small fry. It’s the motives of this international network’s handlers; people they might never meet. 

People who sound suspiciously like ‘The Company’.

The Real Architects: How OSINT Uncovers Disinformation Networks

“OSINT Industries played a critical role in the attribution of the network, that was where it really came in… Moving from email to real people and determining their relationships.” – Max Lesser, Senior Analyst on Emerging Threats. [Source: OSINT Industries]

‍OSINT Industries played a key part in this investigation’s biggest breakthrough. Max was keen to stress that the module for KWork is available only on OSINT Industries. No other OSINT tool would have untangled these brothers’ motive - or their potential connection to Russian money. By connecting the Shakoyas* to Russia’s Fiverr, our tool “gave [Max and Meera] an understanding of how they were recruited.” 

What’s more, OSINT Industries searches quickly revealed that this potential state-sponsored influence campaign was “a somewhat crude operation”. The “really not good OPSEC” on show highlighted to Max the utility of OSINT when it comes to unlocking these networks. Preying on desperate people, Russia’s bad actors can’t target computer scientists or intelligence professionals to do their dirty work.

For journalists, the intelligence is there for the taking. 

‍“We invite other researchers to reach out to us with information about this network and its operators.”  – Max Lesser, Senior Analyst on Emerging Threats. [Source: Memetic Warfare]