South African influencers-for-hire target Ukraine’s president in influence campaign, researchers say

Avatar

South African influencers have reportedly been involved in an online influence campaign targeting Ukrainian President Volodymyr Zelensky, researchers have found.

The campaign, which criticized Zelensky’s rejection of a proposed ceasefire by Russia, appears to be part of a larger, coordinated effort linked to an African influence-for-hire network.

A new analysis from the Atlantic Council’s Digital Forensic Research Lab (DFRLab) identified over 40 accounts involved in the traffic manipulation campaign, which garnered 290,000 views. Among these accounts, 29 identified as influencers in their bios on X (formerly Twitter), with four directly linked to Lit, a South African influencer marketplace known for facilitating paid promotions.

The influencers targeted Zelensky over his refusal to accept a three-day ceasefire proposed by Russian President Vladimir Putin late last month. The ceasefire was set to coincide with Russia’s Victory Day celebrations but was ultimately dismissed by Zelensky, who called for a longer, 30-day ceasefire format in line with U.S. suggestions.

Following Zelensky’s rejection, pro-Russia voices, including bloggers on Telegram and X, launched a wave of criticism. This online attack was amplified by South African influencers who promoted anti-Zelensky hashtags on X.

According to DFRLab, this campaign was not the first of its kind. The influencers had previously engaged in similar efforts, including a March 2025 campaign aimed at disrupting Zelensky’s planned meeting with South African President Cyril Ramaphosa. Hashtags such as #ZelenScam and #StopZelenScammingUS trended in South Africa during this period, portraying Zelensky as corrupt.

The rise of Russian influence across Africa, including South Africa, has been accompanied by an increase in disinformation campaigns. According to the Africa Center for Strategic Studies, disinformation efforts on the continent have surged nearly fourfold since 2022, with Russia being the primary sponsor behind nearly 40 percent of all such campaigns in Africa.

South Africa has been one of the most popular targets for Russian disinformation. In addition to pushing narratives intended to polarize communities, fan distrust, and bolster the African National Congress, Russia has used influential South Africans to promote pro-Russian narratives within South Africa and abroad, researchers said.

It is common for Russia to use social media to spread disinformation abroad. DFRLab last year identified a network of malicious accounts targeting American users on social media platform X to discredit protests in Georgia sparked by an unpopular Russian-style law that threatens the independence of local media. This campaign was likely orchestrated by the Russia-linked malign network Doppelgänger, known for spreading disinformation in the U.S. and Europe.

CybercrimeGovernmentNewsPeople
Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

ASUS Patches DriverHub RCE Flaws Exploitable via HTTP and Crafted .ini Files

Next Post

Türkiye Hackers Exploited Output Messenger Zero-Day to Drop Golang Backdoors on Kurdish Servers

Related Posts

NSO Group Fined $168M for Targeting 1,400 WhatsApp Users With Pegasus Spyware

A federal jury on Tuesday decided that NSO Group must pay Meta-owned WhatsApp WhatsApp approximately $168 million in monetary damages, more than four months after a federal judge ruled that the Israeli company violated U.S. laws by exploiting WhatsApp servers to deploy Pegasus spyware, targeting over 1,400 individuals globally. WhatsApp originally filed the lawsuit against NSO Group in 2019,
Avatar
Read More

Storm-1977 Hits Education Clouds with AzureChecker, Deploys 200+ Crypto Mining Containers

Microsoft has revealed that a threat actor it tracks as Storm-1977 has conducted password spraying attacks against cloud tenants in the education sector over the past year. "The attack involves the use of AzureChecker.exe, a Command Line Interface (CLI) tool that is being used by a wide range of threat actors," the Microsoft Threat Intelligence team said in an analysis. The tech giant noted that
Avatar
Read More