On March 12th, 2020 CNN Chief International Correspondent Clarissa Ward and a team of investigative reporters broke open a big story about a new Russian troll farm operating out of the west African country of Ghana and a second site in Nigeria (ref: https://www.cnn.com/2020/03/12/world/russia-ghana-troll-farms-2020-ward/index.html). Her investigation led to the conclusion that this social media troll farm was very likely linked to the same Russian troll farm called the Internet Research Agency (IRA) that was located in St Petersburg Russia and was shown to be involved in the  targeting of the 2016 US elections.  The IRA was funded by Russian oligarch Yevgeny Prigozhin, who is closely aligned with the Kremlin and nicknamed “Putin’s chef”. Their incredible investigative work led to the identification of and face-to-face confrontation of the man running the Ghanian troll farm in the city of Accra.

The investigation done by CNN, with the help of two Clemson University professors Darren Linvell and Patrick Warren, and another separate independent investigation done by Graphika Inc resulted in Facebook and Twitter taking action and reporting on and removing and/or suspending numerous pages and accounts. In a press release statement Facebook said that it had “removed 49 Facebook accounts, 69 Pages and 85 Instagram accounts for engaging in foreign interference.” For its part Twitter told CNN that it had removed 71 accounts that had a total of 68,000 followers.

Two of the Twitter accounts that CNN highlighted and identified as being operated out of this Russian backed Ghanian troll farm were @africamustwake and @africathen.  It turns out we had identified and classified both accounts  back in November of 2019 as Kremlin-aligned alt-left Twitter troll accounts and had started archiving them using the open source python script Birdwatcher. During my weekly archiving of the newly accumulated tweets from all our different sets of troll accounts we noticed in early March of 2020 that a number of these “Africa” named accounts had been suspended by Twitter. We did some further analysis on the related accounts using the prior data collected in the Birdwatcher archive and analysis of archived historical tweets at Archive.org. This analysis revealed about seven accounts that were all now suspended and that we felt were likely related based on their interactions and apparent thematic focus. At the time we did not have enough information to make any precise attribution or even determine a geographic location that could be assigned to these accounts.

Given that these accounts were now suspended by Twitter, we reported on four of these accounts (@africamustwake, @africathen, @s_racism_, @_Pawa_2_da_ppl_) along  with a couple of other accounts that we thought might somehow be linked together in a Twitter thread on March 6th, 2020 (ref: https://twitter.com/SlickRockWeb/status/1236000942664884229).

Screen capture of the Twitter account @AfricaMustWake

Screen capture of the Twitter account @AfricaThen as it was archived in Archiv.org on Jan 12th, 2020

Screen capture of the Twitter account @S_Racism_

Screen capture of the Twitter account @_Pawa_2_da_ppl_ as it was archived in Archiv.org on Feb. 7th, 2020

The initial four accounts all represented women of color (a critical voting bloc in the upcoming 2020 elections), used similar hashtags like #BLM or #BlackLivesMatter, #PoliceBrutality and #BlackExcellence, were all less than a year old, and used profile pictures that were distinctively African. The @s_racism_ account used a header image with a watermark containing a reference to a know disinformation website called “thefreethoughtproject.com”. This site ranked #620 is usage by the Russian IRA accounts from Twitter archive data and ranked #243 in usage from our own Kremlin-aligned Hamilton68 troll data which is ongoing. Many of the accounts had US city locations in their profile and attempted to comment and tweet about issues and news items happening in the United States. For example @africamustwake tweeted about the Gayle Knight controversy that occurred days after Kobe Bryant’s death here in the United States.

Screen capture of the Twitter account @AfricaMustWake tweeting about the Gayle Knight Kobe Bryant controversy

Through cross-analysis we identified additional accounts that appeared to all be related both through their profiles and tweet content and are displayed below. We posted about these later in a Twitter thread on March 12th 2020 (ref: https://twitter.com/SlickRockWeb/status/1238247386088189954)

• @AfricaMustWake
• @AfricaThen
• @TheNewAfrica_
• @_Pawa_2_da_ppl_
• @s_Racism_
• @TonCarthur
• @WomensRights___

Minutes later during the publishing of my Twitter thread on March 12^th, Twitter posted the newly suspended accounts, 71 in total, that they attributed to the Ghana and Nigeria troll farms (ref: https://twitter.com/TwitterSafety/status/1238208545721638912). Also one of the researchers involved in the CNN news story by Clarissa Ward found my thread and commented that all seven accounts were in fact related and present in this new set of state-sponsored troll farm accounts.

Tweet by Clemson University Professor Darren Linvill acknowledging that the accounts we posted were in fact related to this Ghanian troll farm.

We later confirmed this by downloading the hashed Twitter data for these 71 suspended accounts and matched up the text present in the bio profiles of the accounts and the creation dates. Many of the accounts were still in the process of being built out and building up their followers. The @TonCArthur account was one of the few male profiles we was able to independently identify prior to the reporting and this account had less than 500 tweets before it was suspended.

Screen capture of the Twitter account @TonCArthur

The threat intelligence & online network visualization company Graphika Inc (@Graphika_NYC) was also simultaneously researching this Ghana Troll farm and published a very thorough report later in the same day after CNN, “IRA in Ghana: Double Deceit” (ref: https://d1qmdf3vop2l07.cloudfront.net/uplifting-lion.cloudvent.net/compressed/_min_/9e0cf8e16c036e3099709f677cef202f.pdf)

Using the hashed Twitter data on these 71 accounts attributed to either the Russian state sponsored Ghanian or Nigerian troll accounts we pulled out additional accounts by searching the Google cache of indexed web results using an exact search match for significant snippets of the bio profile text. An additional eight accounts of note were fully identified from this new set of 71 and we highlight two here, @end_differences and @black_mind_incc. Interestingly the @black_mind_incc account shows up in a prior archive and analysis of  the #RacistDebraMessing hashtag in September 2019 used to attack the actress and political activist Debra Messing (@DebraMessing).

Screen capture of the Twitter account @end_differences

Screen capture of the Twitter account @black_mind_incc

Using the Google cache technique we were also able to identify the primary troll account (@EBLA_NETWORK) representing the NGO linked to this campaign. According to the Graphika report the NGO cover, “Eliminating Barriers to the Liberation of Africa” or EBLA, claimed to have been founded in June 2019. It turns out that the EBLA NGO, that was setup as the cover for this Russian backed troll farm operation, was one of the key pieces of sigint that allowed CNN to track this operation to Ghana. As they noted in their report a number of the other troll accounts displayed videos that had the EBLA logo as a watermark on them. Graphika reported that the NGO had an observable start date of around June/July 2019. All but 10 of the 71 Twitter accounts linked to this campaign had creation dates after the date of June 2019.

Screen capture of the Twitter account @EBLA_NETWORK

The NGO’s corresponding website, eblango[.]org, was registered a few months later in October of 2019 and was only partially functional. It was developed initially using the WordPress CMS v5.1.3 and appeared to still be in development. Here is a screen capture of the homepage.

Screen capture of the EBLA NGO website as it looked around December 3rd, 2019 as archived by Archive.org

The OSINT for the eblango[.]org site was surprisingly clean. The domain eblango[.]org was first registered on October 8th,  2019.  The WHOIS information also revealed that NameCheap Inc was used as the registrar and that the private registration service Whois Guard Inc. out of Panama was used. This combination has been used in other Russian run operations, however it is an exceedingly common combination and thus not any kind of useful signal by itself. The site used the shared IP address of 192.64.118[.]106 hosted at Namecheap[.]com. We did find additional subdomains that were created such as bank.eblango[.]org that seemed to pull up web content created for the Danquah Institute also located in Accra Ghana. We do not currently know the significance of this finding.

Screen capture of the WHOIS record and domain name creation date for eblango.org

Screen capture of the DNS records and IP address for eblango.org

We attempted further OSINT research on the eblango[.]org domain using the tools at RiskIQ and was not able to find any additional data pivots of value or significance. When we did a cursory analysis using search engine optimization techniques we discovered that the eblango[.]org site was currently hacked and displaying Japanese SEO spam. Further analysis has not yet been done on the type of and extent of the hack or when it happened and it is not unreasonable to think there may now be malware inserted into this WordPress based site. It should be noted that there were a number of security vulnerabilities discovered in the WordPress core v5.1.3 and below and those were addressed with the v5.1.4 release.

Screen capture showing evidence that the eblango.org website is currently hacked and displaying Japanese SEO spam

Back in November 2019 when we first identified some of these troll accounts based on their interactions with other accounts we were monitoring and specific tweets that they were liking, we categorized these accounts into our Kremlin-aligned alt-left set of Hamilton68 accounts. We also analyzed some characteristics like top hashtags, client usage and tweet schedule.

From the Clarissa Ward CNN report some of the Ghana troll farm employees made adjustments in their activity to better mimic American time-zones. It is important to note that other foreign troll operators have started making similar adjustments and that analysis of the hourly tweet schedule is becoming less reliable as an indicator of foreign activity. Here is the hourly tweet schedule profile for the previous 2722 and 615 tweets respectively for  @AfricaMustWake and @TheNewAfrica_. The analysis was performed on November 5th, 2019.

Hourly tweet schedule for the Twitter account @AfricaMustWake over the period between 2019-06-28 and 2019-11-05

Hourly tweet schedule for the Twitter account @TheNewAfrica_ over the period between 2019-07-16 and 2019-11-05

Displayed are the top 30 hashtags analyzed back on November 5^th, 2019 for @AfricaMustWake (2722 tweets) and @TheNewAfrica_  (615 tweets) Twitter accounts respectively.

Top 30 hashtags for the Twitter account @AfricaMustWake over the period between 2019-06-28 and 2019-11-05

Top 30 hashtags for the Twitter account @TheNewAfrica_ over the period between 2019-07-16 and 2019-11-05

Based on the tweet content and hashtag usage these accounts, while still in their early stages of development, were not being overtly political but were rather exploiting the tried and true methods used by many of the IRA accounts in 2016 to exploit racial difference and incite racial conflict among other Americans on Twitter. It is not clear what these account would have ultimately been used for in the run up to the 2020 Presidential elections in the United States, but many of them stated US locations in their profiles even though they were actually being operated from Ghana or Nigeria. Thankfully, at least for this troll farm, we will not have to worry about what their ultimate goals and intentions would have been.

It is important to note that the Russian IRA troll site outsourced to Accra, Ghana is but one small 24 employee run troll farm. There are likely dozens more like this one around the world being operated by numerous nation states with malicious and/or propagandistic intent. There are at least 12 troll farms likely still in operation in Russia  and there are most definitely more in Africa along with Venezuela, Macedonia, Albania, Georgia and Ukraine. It is also clear the troll farms have learned from 2016 and are making adjustments to become more difficult to spot. Clarissa Ward & her team at CNN did a fantastic job of investigative journalism but unfortunately most troll farms will not likely be sourced back to their precise address of operation like this one. Hopefully our immunity as a nation continues to strengthen from what we experienced in 2016 and we continue to stay vigilant to nation state run disinformation and propaganda campaigns online.

Eric Digital Investigations, untitled