How Big Tech Platforms Fuel Russia’s Recruitment of Africans for its War

NAIROBI, September 23 – The Facebook advertisement presented itself as a chance to break into the film industry. A “Global Casting Call” sought African male actors for a new film project, accompanied by an AI-generated image of Black men in military fatigues and the words “Shooting in 2025”. The Facebook page claimed to belong to a game shop in Bremen, Germany.

A click to the page took applicants to a polished recruitment website promising a signing bonus of up to US$40,000, a monthly salary of US$3,200 and a “special dispensation” for Zimbabwean nationals.

There was no film project. Only after the visa was issued and the flight booked did the reality emerge: the promised job was a route into Russia’s war in Ukraine.

The case is part of a wider recruitment network uncovered by a new forensic investigation from Code for Africa’s iLAB, published today, which mapped 289 digital assets across 33 operations using Western software, servers, advertising platforms and tracking tools. The investigation found services from companies including Meta, Google, TikTok, Vercel, Lovable and Cloudflare embedded at different points in the recruitment chain, leaving digital traces that could potentially help investigators identify the people behind the networks.

That finding brings the technology companies into a difficult accountability focus. The investigation does not allege that they deliberately helped Russia recruit soldiers. Rather, it documents how their systems have been used to advertise deceptive jobs, collect applicants’ information, track their activity and connect them with recruiters. The same systems may also hold records that could help investigators trace those recruiters, and it raises questions about whether such evidence is being preserved and, where legally appropriate, made available before accounts and websites are abandoned and replaced.

“The pitch almost never mentions war,” the forensic report states. “A man sees a job advert in his Facebook feed, usually placed by a page that presents itself as an ordinary staffing agency. The advert offers construction work, a security contract, a film role, or help with a Russian visa. It sends him to a landing page that looks like a corporate recruitment site, sometimes carrying the logos of prominent Western news organisations that the operators claim have endorsed the service.”

The investigation traced the infrastructure behind these apparently ordinary job offers through advertising accounts, tracking codes, website builders and hosting services. Much of it is provided by Western technology companies, creating digital links that may connect apparently separate recruitment operations to the people running them.

According to iLAB, that infrastructure has helped the networks operate across borders while repeatedly abandoning websites and social media accounts and resurfacing under new identities.

Some of the clearest evidence lies not in the advertisements themselves but in the digital fingerprints, they leave behind.

The iLAB investigation identified 16 Meta advertising pixels concentrated in a single file and deployed across eight apparently connected recruitment websites. A Meta Pixel is a piece of tracking code used to measure activity generated by advertising, and investigators found the unusual concentration of identifiers significant because it suggested that different advertising identities were being operated through a common template.

“It means one operator was feeding 16 separate advertising identities from one template,” the report states. “The parent site of the cluster carries three pixels – two drawn from the 16, and one unique to itself – which is exactly what a hierarchy looks like.”

Those identifiers potentially matter far beyond advertising analytics. They may help establish relationships between apparently separate websites and advertising accounts, although the report is careful not to suggest that the technical evidence alone proves who controlled every account.

The same pattern appears in Google’s ecosystem. The investigators found Google Ads conversion tags on Work Crew Agency pages that recorded clicks on WhatsApp links, while four Bratsky Syndicate domains published Google Search Console verification tokens in their page code. A separate Belarus-facing recruitment website loaded a TikTok Pixel.

“The platforms hold the records that would answer those questions,” the report says, after noting that the tokens alone do not establish whether different accounts or a single account controlled the sites.

That is precisely where the accountability question becomes more substantial than simply asking whether a platform removed a page.

For investigators, the valuable information may be sitting behind the page: the advertising account, administrator details, campaign history, spending records and billing information.

For Code for Africa editor-in-chief Justin Arenstein, those records are more important than the websites themselves. “Removing web pages is a week’s inconvenience,” he said. “Closing the ad accounts, payment channels and hosting behind them is what makes recruitment by deception unprofitable.”

Meta claims has already removed more than 300 advertising campaigns linked to the recruiters, according to Arenstein. Yet iLAB found that after Meta removed an estimated 300 Africa-focused campaigns in August, the recruitment network shifted within days to targeting people in Syria, Colombia and Mexico.

The pattern suggests that the removal of individual advertisements can disrupt the visible operation without necessarily disabling the underlying infrastructure.

Built in the West, deployed in Africa

The websites used to present these recruitment schemes are themselves evidence of how accessible sophisticated digital tools have become.

According to iLAB, recruitment pages in the network were generated using AI website-building tools from the United States and Sweden. Vercel’s v0 and Lovable were among the services identified, and the investigators found artefacts carrying the platforms’ names.

One Vercel subdomain contained a public URL recording an operator instruction to “update IP and pixel”.

In another case, a recruitment site’s social-media preview image continued to be served from Lovable’s own storage under the platform’s service account. Forms created using an Austrian software product collected applicants’ personal information and sent it to Russia.

None of this, by itself, establishes that the companies knew what their services were being used for when the pages were created. The evidence instead shows how the operators were able to assemble a convincing recruitment front using ordinary commercial tools whose intended uses have little to do with military recruitment.

“The network’s disposable outer layer is built almost entirely out of Western consumer software, sold by companies headquartered in NATO and EU member states, and used to recruit for a war those states are sanctioning,” the report states.

The geographic location of the infrastructure adds another complication. The flagship recruitment brand, IRC Russian Bear, served its recruitment pages from a server in Amsterdam, while six Military Staff Agency sites moved to an Amsterdam-registered address last week on September 18.

The server is therefore sitting in an EU member state whose criminal code makes recruiting for a foreign army an offence, according to the investigation.

For Kenya, this is not simply a question of how technology is being misused. There are already families dealing with the consequences.

A classified National Intelligence Service report presented to Parliament in February found that more than 1,000 Kenyans had been recruited into Russia’s war effort, with 89 on the front lines, 39 hospitalised, 28 missing in action and at least one confirmed dead.

The recruitment pipeline was documented in a February 2026 dossier by Code for Africa’s African Digital Democracy Observatory, which named Global Face Human Resources Ltd and Ecopillars Manpower Ltd as central players in what authorities described as a “well-coordinated recruitment scam”.

The dossier described recruits being “locked in rooms, have their phones seized, are forced to sign contracts in Russian without interpreters or lawyers present, are driven at night to military bases, receive basic combat training in less than two weeks, and are deployed to infantry positions where they serve as what survivors describe as ‘cannon fodder.’”

Five months earlier, prosecutors had charged Global Face employee Edward Gituku, alleging that he arranged the recruitment of former Kenyan soldiers into Russian military units. Prosecutors later charged the company’s head, Festus Arasa Omwamba, with trafficking 22 Kenyans “for the purpose of exploitation by means of deception”.

Both men have denied the charges and the cases remain before the courts.

The prosecutions demonstrate the part of the recruitment business that can be seen on the ground: the agency office, the rented premises, and the recruiter dealing directly with prospective recruits.

The digital trail is harder to see, but potentially more revealing. “The part of the trade our census cannot see: a licensed-looking agency, a rented flat, a face-to-face closer, and no website left to take down,” the iLAB report says. Global Face’s own domain no longer resolves and its registration has lapsed.

For investigators, however, the disappearance of a domain does not necessarily mean the disappearance of the evidence. The advertising platforms and technology companies may still retain records linking the digital operation to the people who created, paid for and administered it.

The women in the factories

The recruitment extends beyond those sent towards the battlefield. A separate Associated Press investigation in 2024 found that young Kenyan women were among more than 200 recruits from East and West African countries enlisted to assemble weapons in wartime Russia, including Shahed-136 exploding drone warheads at the Alabuga Special Economic Zone in Tatarstan, about 1,000 kilometres east of Moscow.

The women, aged between 16 and 22, were recruited through social media advertisements promising free plane tickets, cash, accommodation and “the thrill of a European adventure”. Entry requirements included completing a computer game or passing a brief Russian vocabulary test.

Once in Russia, they found themselves isolated from the outside world, under strict surveillance and with restricted freedom.

A source who previously worked for the Alabuga Start recruitment syndicate told Journalist Hub East Africa in October 2024 that the programme had targeted young women from Ethiopia, Kenya, Uganda and South Africa with promises of education and well-paid employment.

“In my previous role, I was involved in promoting the Alabuga Start program, which preys upon Ethiopian, Kenyan, Ugandan and South African girls,” the source said. “It lures them to Russia all the way to Tatarstan with the promise of a well-paying job and education. Instead, these girls are forced into making weapons, harassed and worked to exhaustion.”

Approximately 90 per cent of the women recruited through the Alabuga Start programme are engaged in assembling drone components, according to the investigation, with at least 24 Kenyans believed to have been recruited at that time.

The use of social media in that recruitment has previously drawn scrutiny. TikTok said in 2024 that it had become aware of the Alabuga Start recruitment drive and outlined its policies concerning human exploitation.

The price of a man

The recruitment networks do not merely promise jobs. They put a price on the risk.

IRC Russian Bear advertises about US$15,000 to sign, US$3,000 a month in wages, US$8,000 to US$32,000 for injury and US$60,000 in the event of death.

The death benefit, the site states, is “paid to relatives via the RF embassy”, although the claim has not been substantiated.

“iLAB found no evidence that any family has ever been paid,” the report states. “The claim answers a recruit’s last and most serious objection, and it borrows the credibility of a diplomatic mission to do it. It is also the most testable claim in the entire network, because it names a payer, a route and a beneficiary.”

Kenya’s Foreign Affairs Ministry has not resolved the question. In a confidential February briefing, Prime Cabinet Secretary Musalia Mudavadi wrote that “the Ministry has not confirmed whether any Kenyan national has received the full compensation provided for in the contract”.

The Russian embassy in Nairobi has denied encouraging Kenyans to fight or issuing visas to those seeking to participate in what Moscow calls the “Special Military Operation”.

iLAB argues that the operation is better examined through fraud and potential human trafficking than simply as “disinformation”, pointing to existing legal mechanisms including fraud and anti-trafficking laws, the UN Palermo Protocol, Dutch and Austrian laws on recruitment for foreign armies and the EU Digital Services Act.

But prosecution depends on identifying those behind the networks, and much of the evidence may sit with the technology companies whose systems they use.

“What the operators cannot easily replace are their advertising accounts, billing records and platform administrator accounts,” the report states. “The platforms hold the account, administrator and billing records that could connect an advertising budget to the recruitment businesses. Many of those accounts are probably fraudulent, but following the money is an important avenue to explore.”

Meta did not respond to questions about preserving records or the scale of its enforcement. Google said it is “actively investigating” the report, while disputing some claims, including that most of the sites identified used Google Ads. TikTok did not respond.