Nigerian social media accounts targeted in influence campaign centered on Ukraine invasion


Olalekan Owonikoko’s Twitter account was used to post his support for the Russian attack on Ukraine on February 27, just days after the invasion:

“NATO destroyed Afghanistan, Iraq, Syria, Yugoslavia and Libya. All oppressed countries must stand with Russia. This is not a war against the Ukrainian people but against the evil of NATO. Putin has the right to keep his borders (love emoji)



Owonikoko, a Nigerian web designer and development artist, appears to have been one of many Southern bystanders caught up in the online battle to control how people view Russia’s invasion of Ukraine. In response to these content moderation challenges, social media companies have stepped up monitoring of bots and misinformation and global media are investigating the extent of the problem.

Owonikoko also began his own personal investigation after a friend alerted him to the scam tweet.

“I checked my account and saw tweets and yet my password, email, phone number were intact. I had to change them immediately,” Owonikoko said, while speaking at The Record.

“I still don’t know if it was from Buffer, or where it came from. I know my account is linked to Buffer,” Owonikoko explained, referring to a social media management tool used to plan, post and monitor content on social media accounts.

In February, threat actors accessed Buffer’s accounts to “support Russia’s invasion of Ukraine”, as confirmed by an official statement from Buffer on February 26. According to Buffer, 1,552 accounts were accessed, of which 618 accounts were used to post 766 unauthorized messages on Twitter (505), Facebook (233) and LinkedIn (28).

This attack is part of a wave of digital supply chain attacks that threatens the entire ecosystem by targeting less secure services and platforms.

The Twitter account of Tech Cabal, a leading tech publication in Africa whose account was connected to Buffer, was also used to post a tweet similar to Owonikoko’s. Both accounts had two-factor authentication enabled on their Twitter accounts, but likely not on their Buffer accounts, which were then used to access their social media accounts.

“Our records do not show any accounts (compromised Buffers) with two-factor authentication enabled at the time of the incident, but we saw accounts enabling two-factor authentication immediately upon noticing the unauthorized posts,” said said a Buffer spokesperson. says The Record.

“After this investigation, we can safely say that our systems were not compromised, it was the result of a credential stuffing attack,” they said. A credential stuffing attack occurs when hackers log into a targeted website with many usernames and passwords over a short period of time.

According to Buffer, the crash is likely due to reused passwords.

Content similar to what was posted on Owonikoko’s account is scattered across Twitter. The social media company said it was monitoring such activity.

“We continue to proactively assess inauthentic behavior and other violations of our rules. Since the start of the war in Ukraine, we have removed over 75,000 accounts for violating our platform manipulation and spamming policy,” a spokesperson told The Record.

It’s unclear exactly how or by whom Owonikoko’s account was compromised, but the published content and strategy appear to follow Russia’s playbook.

“We know what Russian disinformation campaigns in Africa have looked like in the past, so while we can’t say it’s Russian actors pushing these narratives at this time, we can say it fits that established pattern of what inauthentic coordinated campaigns have done. in the past – and Russia currently has strong incentives to do something similar,” Mark Duerksen, associate fellow at the Africa Center for Strategic Studies, told The Record.

There have also been apparent attempts to leverage concerns over the ongoing conflict to target users with phishing attempts.

On March 3, Ope Adetayo, a Nigerian journalist who has covered issues involving Ukraine, received an email that appeared to warn him of a login attempt linked to his Twitter account. The message said he was from Moscova, Russia.

But Adetayo said the post looked weird – and came from a “” email address, indicating it was a “phishing” or scam attempt. trick him into sharing his login credentials with an attacker.

Although he thought it might be official at first, he also suspected it might be dangerous.

“I didn’t click on that link (in the email), because who knows who designed the email?” Adetayo told The Record.

When he went to recheck the message a few weeks later, Gmail had marked it as potentially dangerous.

“Similar messages have been used to steal people’s personal information,” Gmail warned.

The apparent phishing attempt against Ope Adetayo. (via Ope Adetayo)

Twitter says it is working to combat media manipulation campaigns on its platform.

“We are actively monitoring high profile vulnerable accounts, including journalists, activists, government officials and agencies to mitigate any takeover or targeted manipulation attempts. Protecting people on Twitter, especially during high-risk times, is important to us,” the Twitter spokesperson said.

But even as social media companies moved to crack down on misinformation and media manipulation during the Russian invasion, the experiences of Adetayo and Owonikoko show how the online fallout from the conflict is disrupting communications in many places. other parts of the world.

“It’s really destabilized the news ecosystem in these places, leaving people confused about which stories are true, which is part of the strategy of disinformation campaigns – to sow distrust,” Duerksen said.

Since the recent invasion of Ukraine on February 24, the Russian government’s propaganda machine has been working at full throttle to influence media narratives about the war at home and abroad, including efforts targeting populations in Africa. and Latin America.

Russia has a huge presence and influence in African countries, creating strong incentives for it to control narratives about the invasion in these places – especially now.

“Russia is currently isolated internationally because of the invasion of Ukraine, so Putin really needs African support, he needs commitment – backed at the UN, he needs African resources, he needs African gold because it (Russia) lacks money,” Duerksen said.

He also has a history of covert online influence campaigns in the region. In 2019, a report by Stanford researchers revealed a network of Russian-coordinated campaigns to influence narratives and further their interests in Libya, Sudan, Central African Republic, Madagascar, Mozambique, and the Democratic Republic of Congo.

Russia’s disinformation regarding Ukraine in recent months has also targeted Spanish-speaking Latin Americans already inclined to mistrust the United States due to the country’s long history of military intervention in the region, according to a report by the Associated Press.

Since the start of the invasion, Russia’s media manipulation efforts have included extensive use of botnets, account hacking, questionable fact-checking, stifling independent media, increased use of TikTok to spread misinformation and the use of local influencers to spread misinformation – all seemingly intended to share a false narrative about the invasion.

Olatunji Olaigbe is a freelance journalist based in Nigeria. His work has been published by VICE, Al-Jazeera and The Record. His reporting often examines the underlying factors of societal issues and he was the winner of the 2021 Migration Journalism Awards in West and Central Africa from the International Organization for Migration.


Comments are closed.