Over the New Year holiday at the start of 2023, the Secretary-General of the ANC, Fikile Mbalula, was snapped wearing a white suit criss-crossed with images of rail-tracks and sleepers. With corruption investigations into the Republic’s Public Rail Agency, Prasa, ongoing, it was no surprise that the picture of the politician was soon dubbed ‘The Devil wears Prasa’.
Three years later the clownish politician found himself at the centre of another storm. This time he was alleged to have sought assistance from a Russian agent for the 2026 Local Government Elections, while thanking Moscow for its support in the May 2024 event.
The Russian agent, code name 9477, and his translator reportedly met with Mbalula in the lounge of an upmarket Johannesburg hotel. ‘I briefly reported on the results of the 2024 mission,’ reported the agent. He does on to detail how Mbalula thanked the Russians for their assistance before the elections in May 2024 and asked the mission to continue to help the party, particularly in the run-up to the 2026 local government elections. Agent 9477 describes Mbalula’s request for ‘support for the shooting of a film to coincide with the party’s anniversary … and $300,000 to finance the organisation of the party congress.’
These dealings are part of a series of recent revelations about Russian media manipulation across Africa and, in South Africa, in the run-up to the May 2024 election specifically targeting the Democratic Alliance. The DA had taken a strong stance against Russia’s war in Ukraine, which included a visit by its party leader to Kyiv in April 2022, launching a May 2023 court action compelling the SA government to arrest Vladimir Putin if he attended the local BRICS summit, and speaking out against the planned appearance of Russian Tupolev Tu-160 ‘Blackjack’ bombers at a SA airshow in October 2024.
Fake news is one of the tactics in what is termed ‘hybrid war’, actions just below the threshold of inter-state violence, but nonetheless designed to achieve the same ends: chaos, capitulation and capture.
More exactly, this is a form of political warfare in which the Russian Federation is prominent but not alone in causing mischief in international relations.
A recently leaked dossier of Russian documents to The Continent and published by several outlets, including Forbidden Secrets, details the control that Russia’s Foreign Intelligence Service, or SVR, Sluzhba Vneshney Razvedki, the successor to the KGB’s First Chief Directorate, has assumed over Wagner influence operations and networks in Latin America and Africa.
Both regions have renewed global importance, given the race to secure critical minerals. Between them, they hold between 60-70% of global copper reserves and more than 60% of lithium, both key to the green energy and data revolutions.
It’s not only the race for critical minerals that has had an impact, however. The fight for support for Russia’s war in Ukraine has widened the audience for its narrative. As a consequence of its diplomatic and economic isolation, Moscow has aggressively pursued an information operation worldwide, aimed at winning allies and dividing opponents. The DA’s opposition to Russia’s war and to Moscow’s longstanding relationship with the ANC has catalysed an increase in Russian involvement in SA’s domestic politics.
The Institute for Security Studies (ISS), utilising software from Murmur Intelligence, has analysed the vast scale of the influence campaign around South Africa’s May 2024 national election. The analysis drew on more than 1.2 million social media documents and field interviews with influencers.
Among its central findings was the identification of the so-called ‘Dumb Alliance’ influence campaign: a coordinated network of predominantly paid social media influencer accounts that systematically targeted the DA using a cluster of 11 anti-DA hashtags (#dumballiance, #notwhiteenough, #rescuedumballiance, #stopdaracism, #byebyeda, #danotayoba, #dontstealourvotes, #stoptheda, #doomsdayforda, #boycottelections). ISS identified a network of influencer accounts that generated nearly 80,000 posts linked to these hashtags.
ISS also identified at least 375 accounts that amplified links to the dedicated anti-DA website, dumballiance.com, and a core cluster of 24-26 accounts that had amplified at least seven unique anti-DA hashtags. During field interviews, one influencer told ISS researchers that a Russian client had contacted him via direct message on X and paid him between R40 and R50 per interaction to amplify pre-supplied content targeting the DA.
In February 2026, the ‘All Eyes on Wagner’ project released an analysis of leaked Russian intelligence material that shed new light on the anti-DA activity observed during the May 2024 election. The SVR reportedly identified South Africa as a priority environment for social media mis/disinformation campaigns.
According to the documents, SA was to be targeted by uniting ‘allies of the progressive factions to expand its membership’ by launching ‘a counter-campaign against the DA party’; by conducting ‘anti-Ukrainian and anti-UAZA [Ukrainian-South Africa Association] campaigns’; and through promoting ‘South African alignment with BRICS’.
Within these documents are details of a plan to discredit the DA and its leader, John Steenhuisen, with the distribution of racist mugs as part of his birthday celebrations in 2025. The Russians were apparently behind a number of other ‘interferences’ against the DA in the run-up to the 2024 election, including the fabrication of a letter signed in the name of Helen Zille as chairman of the party, alleging a scheme to remove the ANC from power once a coalition had been formed. There were other, earlier deceptions, including a bill for a reservation for at a Singaporean hotel for Zille and her younger chief of staff Tim Harris, the intention to frame them as lovers.
Given its history of racial division, South Africa offers relatively easy pickings in Russia’s political warfare in Africa, where sowing division and discord is the aim, and where character assassination by fake news is part of the means. Across Africa, there is now clear evidence that foreign influence campaigns, especially those linked to Russia, are actively attempting to shape public opinion through disinformation networks, proxy media outlets, and coordinated online messaging. These campaigns are not random. They are carefully strategic. They are deliberate. And their ultimate target is public trust in democracy itself.
It is not surprising, therefore, given the BRICS interests and South Africa’s relative sophistication, along with legacy ANC links, proven levels of government corruption, and its relatively open media environment, that much Russian action focuses on South Africa. Unlike much of the rest of Africa, South Africa does not offer Russia a real opportunity through military support or financial and economic assistance.
The pattern of election interference is not unusual in global elections. Cyber warfare has become a major feature of campaigns.
Such cyber activities have to be divided between Advanced Persistent Threat (APT), essentially against malware and hacking to carry out financial crimes or to launch strategic destabilising actions. An APT does not comprise a ‘smash-and-grab’ one-time hack. Rather, it’s a long-term, sophisticated campaign in which an intruder gains access to a network, potentially staying there for an extended period, using tools that standard antivirus software can’t catch. APTs can involve state-sponsored groups endeavouring to steal secrets or, to take another example, to turn off (or on) infrastructure software. Russian-linked operations often pair intrusions with influence releases (‘hack and leak’) and coordinated personal political attacks.
The other, even more insidious form of cyber threat is known as the Advanced Persistent Manipulator (APM). This is the cognitive/information equivalent of an APT.
APM refers to the strategic use of psychological techniques to influence a target’s perceptions, emotions, or behaviour, mostly without them realising it.
It’s easy to get lost in the ‘Alphabet Soup’ of cybersecurity and psychological operations. While APT and APM may sound similar, they operate in completely different realms—one targets your hard drive, and the other targets your head. The goal is for the target to believe the conclusion they reached was their own original thought, rather than a narrative planted by an outside actor.
APTs have become far more sophisticated – and powerful – with the introduction of AI, which is exponentially increasing the volume of messaging. Already, it is estimated that Russian sources are generating two million information messages per day across a large number of languages. ‘By 2028,’ says Alto, a leading Spanish cyber and counter-intelligence capability, half of APT state actors will be AI.’ Alto already sifts more than 700 billion information signals annually.
‘Big Data’ and algorithms work out what makes you angry, scared, or compliant, harvest this digital dust, and then feeding you specific content to trigger those feelings.
Amplifying public messaging is the stock in trade of Russian attempts, which includes the likes of ‘Toy Soldiers’ – usually retired Western military colonels promoting a counter-narrative favourable to Russian interests. For this payment comes in a variety of forms, but notably through large-scale purchases of their writings, which satisfy their egos as much as their pockets. Another form is through so-called ‘Pink Slime’ journalism, where news outlets, often fake partisan operations, publish manufactured news reports to suit a particular point of view from sites of titles that are little more than shells for advocacy. The ZambiaNews.net or SANews.net sites are given as two examples.
The ready availability of sources of dissemination and information, such as the Russian state-controlled RT and Sputnik make this process easier.
Already by the end of 2024, fake news sites outnumbered real newspaper sites in the US, some 1,265 to the 1,213 daily newspapers. The effects are startling. Even before AI gained the traction it now enjoys, in May 2024, the Alliance for Security Democracy (ASD) published a report documenting some 400 domains that had published identical or nearly identical copies of articles originally featured on RT.com, Russia’s most influential, English-language propaganda outlet. ASD notes that the most observed domain was the bignewsnetwork.com, a website affiliated with a content distribution network of the same name, which operated more than 500 other websites that present themselves as local, regional, or national news outlets. It had surfaced as a primary dissemination point for both Russian and Chinese state media content.
Russia exploitation of these developments in the US has surfaced in the ‘Doppelganger’ case. Established by Russian firms (Social Design Agency and Structura National Technology) in May 2022, the campaign was directed at undermining support for Ukraine, weakening Western alliances, and disrupting elections in Europe and the US. The campaign cloned the websites of legitimate news organisations (including Der Spiegel, Le Monde, Fox News, and The Washington Post) to publish pro-Russian, anti-Ukrainian, or divisive content. The use of so-called ‘Recent Reliable News’ (RRN) would mimic the layout and branding of established media outlets, differing only slightly in the URL, and used bulk-created accounts on platforms like X and Facebook to spread this content. It also used AI to generate articles, images, and videos, including some featuring celebrities with false quotes.
The US Department of Justice (DOJ) disrupted this network in September 2024 by seizing 32 internet domains and sanctioning individuals involved, including employees of RT. However, it seems that Doppelganger continues to operate despite this disruption.
The increased use of Russian assets to spread disinformation in a domestic political context suggests there may be substance to rumours of Russian funding for the MK Party in South Africa. If true, this might also help explain why MK activists were recruited to fight in Ukraine. There is also evidence that influencers are being used to peddle anti-DA messaging, especially in the City of Cape Town.
Today the digital/cognitive domain can act as a hinge between the physical and the cyber domains. Cyber is has an obvious connection but the physical aspect involves the co-ordination of social unrest, sabotage, and radicalisation, all within the scope of the weaponisation of information operations by Russia.
The waving of the Russian flags in African protests across the Sahel region and in Nigeria from 2024, and the recruitment (and payment) of disaffected youths to mount arson attacks in the UK the same year against allegedly Ukraine-linked sites, are cases in point. Ken McCallum, the head of MI5, Britain’s domestic intelligence service, warned that Russia is on a ‘mission to generate mayhem on British and European streets,’ while his then counterpart at MI6, the British foreign intelligence agency, said bluntly that ‘Russian intelligence services have gone a bit feral.’ Or as Gabrielius Landsbergis, Lithuania’s former foreign minister, put it: ‘During the Cold War, you had to cultivate an agent, then the agent would cultivate a network. Now you offer €50, €100, and you have a bunch of people that join in and do stuff for you… This is the way it works in the 21st century.’
The Soviets were masters of AGITPROP, Agitation and Propaganda, the central thesis of which was repetition of messages, no matter how fake and fact-free. Vladimir Vladimirovich Putin, as a former KGB agent and head of its successor, the FSB (Federal’naya sluzhba bezopasnosti), knows these techniques well, as do those schooled in this system by the former liberation movements.
Countering fake news is difficult. Debunking after the fact doesn’t work; the rumour is already on the mill. Pre-bunking is very difficult since one cannot predict the future, at least with any accuracy. But there are tools that permit one to detect Russian state‑media content laundering, which are capable of flagging duplicate content and amplification across the web to warn audiences before propaganda gains wider reach.
One of the problems in dealing with this form of interference is that, given that they work through existing political power structures, it’s hard to do more than call them out unless they do something egregious.
For its part, the DA – and other liberal-minded African oppositions – will have to monitor these campaigns, recognise them before they take root, and react in real time. Collaboration on this threat to democracy between oppositions across sub-Saharan Africa could not only create a measure of solidarity but also enable economies of scale. Oppositions clearly cannot rely on state ‘protection’, not least since the professional capabilities of African intelligence agencies are limited, and their political interests lie elsewhere. There is the unknown factor of the degree to which Russian intelligence has penetrated and compromised key personnel in those agencies.
African opposition parties will need to ‘go it alone’ in both protecting itself against Russian penetration and disinformation, as well as identifying and countering the amorphous and international spiderwebs of the Russian agencies.
Dr Mills is with the Platform for African Democrats. This is part of a longer study published by the Centrum Balticum and available here.
[Image: https://www.flickr.com/photos/governmentza/48951521182/in/photolist-2hzFkNw-2hzEjkH-2hzEjk2-2hzFkGV-2hzEjcM-2hzfh5f-2hzi4xy-2hzi4vj-2hzfh2e-28rqQwW-28rqQum-29sDJqW-29sDJn9-289XEUv-28q7JPW-29vpuYV-28q7JBw-29vpuRv-28q7JkQ-288DeSD-28q7J7U-288DeK4-288Demi-MjMvU4-MQmeku-MjMvyK-N7iHku-N7iH9N-N7iH3A-LLSBKT-LTTZt2-LLSBvV-AbPAiN-B7DRBC-B7DRoG-AuT5V7-vMWcjz-vGSMsB-vHfkLP-vEzaAy-uKSoou-vEzaaJ-vHfjPD-sDVHg7-spMYXk-sGf3KV-sGg16t-rKf9rh-sFKD4B-rJJG7G]
The views of the writer are not necessarily the views of the Daily Friend or the IRR.
If you like what you have just read, support the Daily Friend