BANNER: Marigo News Telegram channel displaying the pro-Russian Z symbol, followed by “Join us!” in Russian. (Source: Telegram/archive)

A man running an alleged NGO in Abidjan, Côte d’Ivoire created sockpuppets and duplicate profiles used to operate pro-Russian Facebook pages and at least one private group with over 62,000 followers. These assets were used to complement and promote a pro-Russian Telegram channel launched in April 2022, which has now grown to nearly 12,000 members.

While the Facebook network itself was not overly sophisticated — the fake accounts used the same profile pictures or were left almost completely empty — it had significant reach within Côte d’Ivoire. Its Telegram channel, which launched on April 18, continues to post pro-Kremlin content about the invasion of Ukraine in French. At the time of publication, the channel had 11,615 followers. Content from the Telegram channel appeared to be copied directly from a pro-Kremlin Telegram channel with links to the Kremlin propaganda website RusVesna. The posts, which look to be directly translated from Russian into French with only minor edits, support Russia’s invasion of Ukraine and provide updates on Russian military advances.

The network coincides with increased influence efforts by Russia focused on justifying and winning support — or at least neutralizing public opinion — in the Global South for its war of aggression against Ukraine. While the DFRLab has not linked the network directly to the Kremlin, the tactics and narratives correlate with previous efforts by Russia and its supporters.

A Meta representative confirmed that the operation was comprised of “a small network of fake accounts ran by a single authentic individual with pro-Russian sentiment.” Given the operation appears to be the work of one person, the decision to de-platform the network fell under Meta’s policies regarding inauthentic behavior. They also noted that the primary page used by the network was de-platformed in June 2022 after its systems automatically detected it. Counter to previous engagements with the DFRLab, Meta inadvertently removed the network during the investigation, preventing DFRLab from fully archiving and analyzing it.

Increasing Islamist attacks near Côte d’Ivoire’s borders with Mali and Burkina Faso and against Ivorian forces directly have resulted in local militias patrolling northern parts of the country and French forces training the Ivorian military. Although Côte d’Ivoire voted in support of suspending Russia from the United Nations Human Rights Council in April, anti-French and pro-Russian narratives are on the rise in West Africa. Neighboring Mali and Burkina Faso have already called for Russian assistance in fighting Islamist insurgents.

The first page relating to Ukraine was created by the network on March 30. Called “Opération Dénazification et Démilitarisation — Marigo New,” the page posted content about Russia’s invasion of Ukraine. The content itself was pro-Russian, and supported Russia’s narratives about the invasion. The content was regularly shared to a parallel Facebook group called “Ukraine. Breaking News” in an almost taunting way, with comments such as “Vive la Russie” (“long live Russia”). Posts were also shared to a group called “RT Afrique,” which does not appear to be affiliated with the Kremlin-controlled channel RT and was instead created by a profile located in Abidjan, Côte d’Ivoire.

“Opération Dénazification et Démilitarisation — Marigo New,” was removed by Facebook’s automated systems in June 2022. Prior to its removal, the DFRLab noted an email address listed in the about section containing the surname Kadyrov, the family name of Ramzan Kadyrov, the despotic head of the Chechen Republic. Chechnya has assisted Russian forces in the invasion of Ukraine. There is no indication the email address was associated with an authentic member of the Kadyrov family, and was likely an homage to them.

The name Kadyrov was also used by a sockpuppet Facebook account. The “Igor Kadyrov” profile had no identifiable information, and used an image of General Magomed Tushayev, a notorious advisor to Ramzan Kadyrov reportedly killed earlier this year in Ukraine, as its profile picture. According to Illia Ponomarenko, a defense reporter for The Kyiv Independent, Tushayev was killed in action in during fighting in Hostomel in late February 2022. His death has not been confirmed. The Igor Kadyrov profile had just 77 Facebook friends, including similarly empty accounts, some of which used stolen images of adult entertainment actors as their profile pictures.

It appeared the primary use of the Igor Kadyrov profile was to act as an administrator for a private Facebook group with over 62,000 members. Previously launched in October 2020 as a working-singles dating group, the group changed its name to “Opération Dénazification et Démilitarisation de l’Ukraine” on April 7, 2022. The banner image was also updated to include the “Z” symbol that has come to represent support for Russia in the country’s invasion of Ukraine. It is unclear how many of its 62,000 members joined prior to the name change, potentially subjected to a bait-and-switch operation by the page owner.

The two other administrators of the “Opération Dénazification et Démilitarisation de l’Ukraine” group were duplicate accounts with inverted names: Tapé Elvis and Elvis Tapé.

According to Facebook, the network of fake accounts was run by a single, authentic individual. The DFRLab identified the Tapé Elvis account as the operator behind the network, as the account itself appeared the most authentic. The profile joined Facebook in 2013, contained personal information, and regularly posted content, including personal opinions. Much of the more recent content was pro-Russia and anti-West, and included posts that had been labeled misleading by independent fact-checkers, as well as content from Sputnik and RT. The Elvis Tapé profile, on the other hand, contained very little personal information. The profile’s banner image was stolen, and, unlike Tapé Elvis, it did not post any of its own content.

Although it was named Tapé Elvis, the profile was originally created under the name Ethan Marigo, according to the profile URL. It also stated that Ethan Marigo was a nickname, and included the name in the profile’s “intro” section.

A search for Ethan Marigo returned both a Facebook page and a profile under the same name. The profile had just eight friends and contained very little personal information but used the same profile picture as Tapé Elvis. Importantly, the profile also listed Abidjan as its current location, just like the Elvis Tapé profile.

According to page transparency data, the Ethan Marigo Facebook page was administered by two accounts located in Côte d’Ivoire.

One day prior to publishing, the DFRLab reached out to email addresses affiliated with Tapé Elvis and Ethan Marigo requesting comment on their alleged involvement. None of the email accounts responded.

Included in the “intro” and “about” sections of the Tapé Elvis profile were links to a Wixsite. Although the website was not fully completed, it included information on an entity called the Marigo Group. Allegedly created in 2013, the same year Tapé Elvis joined Facebook, the group claimed to work to reduce youth unemployment in Africa. Notably, the Wixsite states it was created by Mr Tapé K. Elvis.

The DFRLab was able to identify three other Facebook pages that included links to the Wixsite: Marigo TV, Marigo Services and Le Marigot d’Afrique. These pages also all included a cellphone number with a Côte d’Ivoire dialing code. According to a search using TrueCaller, the number belongs to a person named Tape Kaloua.

The cellphone number was also listed in the Ethan Marigo page, as well as a page entitled Marigo Jeune Afrique. The page was created in 2016, posted very rarely, and listed itself as a non-governmental organization. The DFRLab could not find any evidence of an NGO in Côte d’Ivoire named Marigo Jeune Afrique.

In fact, a Google search for the alleged NGO returned very little information other than a YouTube channel, a profile for Kaloua Elvis Tapé on Xing.com, a German-speaking job search platform, and a LinkedIn page for Ethan Marigo. Although the names and profile pictures were different, Xing.com, and LinkedIn showed the same individual from Abidjan who allegedly operated the Tapé Elvis, Elvis Tapé, and Ethan Marigo pages.

The logo for Marige Juene Afrique — a map of Africa with Côte d’Ivoire highlighted in red — was included in the profile picture of Ethan Marigo and Tapé Elvis. It was also found on the Wixsite.

On May 2, the Marigo Jeune Afrique Facebook page created a post saying it supported Russia and called on its followers to join a Telegram channel called “Opération de Dénazification et de Démilitarisation de l’Ukraine.” The Telegram channel used the same name and banner image as the Facebook group administrated by Igor Kadryov, Elvis Tapé and Tapé Elvis.

The same day the Marigo Jeune Afrique Facebook page advertised the Telegram channel, the channel posted a message saying that the organization named Marigo Jeune Afrique supports “the Russian Federation in its drive to put an end to imperialism in the world.” The channel also updated its banner image to include the Marigo Jeune Afrique logo and the words “Marigo News,” and changed its name to “Opération spéciale de Dénazification et de Démilitarisation (MARIGONEWS).”

On June 26, the channel was renamed “Marigo News,” the day after the “Marigo News” Facebook page was created. An hour later, the channel again changed its name to “Marigo News — Opération ZOV.” The letters “Z”, “O” and “V” have been used since February on Russian military vehicles, and has served as jingoistic branding to in support for Russia. For example, since the start of the invasion, many pro-Kremlin Telegram channels have included the letter “Z” in their name or banner image.

In many of the posts containing media in the “Marigo News — Opération ZOV” channel there is a picture of the Telegram logo as well as the words “RVvoenkory” included in the top right corner. On Telegram, @RVvoenkory corresponds to a group called “Операция Z: военкоры русской весны — резерв,” which translates to “Operation Z: War Reporters of the Russian Spring — Reservists.” The channel’s last post states that it has been shadow-banned by Telegram, and encourages its followers to instead use the channel @RVvoenkor.

“Marigo News — Opération ZOV” appears to be copying content from @RVvoenkor, a Telegram channel called “Операция Z: Военкоры Русской Весны” (“Operation Z: War Reporters of the Russian Spring”). It is a pro-Kremlin channel with approximately 885,000 followers. In its description it says the channel is comprised of volunteers and war correspondents of the “Russian Spring,” in reference to RusVesna, a Kremlin propaganda website of the same name. Much of the media posted to the channel contains the RusVesna logo. The official RusVesna Telegram channel, which has approximately 177,000 followers, also shares content from the @RVvoenkor channel and includes media with the “RVvoenkory” logo in news articles and posts to the official RusVesna YouTube channel.

On July 3, both “Marigo News — Opération ZOV” and “Операция Z: Военкоры Русской Весны” posted a three-part series summarizing a RusVesna article on statements from the Russian Ministry of Defense. The article itself contained links to YouTube clips with the RusVesna and the RVvoenkory logos.

The official Telegram channel for RusVesna posted part three of the series at 12:12pm Moscow/Kyiv time without any media. At 12:48pm, “Операция Z: Военкоры Русской Весны” posted the exact same text with a link to the RusVesna post and a short video not included in the original rusvesna.su article. Seven minutes later, “Marigo News — Opération ZOV” posted a translated version of the text, excluding the link to RusVesna’s channel.

A comparison of the two Telegram channels shows that “Marigo News — Opération ZOV” seems to randomly copy pro-Russian content from “Операция Z: Военкоры Русской Весны” and posts French translations to the channel’s 11,600+ followers. The French content has been shared on West African Facebook pages, as well as Twitter accounts that have subsequently been suspended for violating Twitter’s guidelines.

Although the international spotlight currently rests on Ukraine, Russia’s expansion into West Africa has not slowed down. Rather, a rise in anti-French sentiment has seen West African countries turning away from the West and calling on Russia for additional support. The growth and reach of a Telegram channel that is, at its core, a translated version of Kremlin narratives operated by an Ivorian citizen appear to align with Russia’s goals of African expansion and influence.

Tessa Knight, “Pro-Kremlin Telegram channel linked to inauthentic Facebook assets from Côte d’Ivoire,” Digital Forensic Research Lab (DFRLab), July 8, 2022, https://medium.com/dfrlab/pro-kremlin-telegram-channel-linked-to-inauthentic-facebook-assets-from-c%C3%B4te-divoire-ad2541f6849f.