Inside the Covert Industry Selling Russia's War as a Civilian Job: Investigation by Code for Africa

A forensic investigation published by Code for Africa's iLAB, working with the African Digital Democracy Observatory, concludes that recruiting foreigners into Russia's war "is no longer a state campaign. It is a covert industry." The report, "Death Benefits: the industry selling Russia's war as a job," co-written by CfA editor-in-chief Justin Arenstein and senior investigative analyst Eliud Akwei, with support from investigative manager Jacktone Momanyi, maps 289 digital assets across 33 competing recruitment operations, accurate as of September 21, 2026. The network breaks down into 197 web assets (75 apex domains, 104 subdomains, 18 platform-hosted pages), 19 social-media accounts or pages, and 73 messaging accounts or channels spread across WhatsApp, Telegram, VK and Russia's state-backed MAX app. Seventeen of the 33 groups are verified by name; the rest remain under investigation. Parts of the network were still actively expanding as of September 22, even as individual sites and accounts went dark.

How the Pitch Works

The offer is designed for speed and disposability. Operators use pre-translated WhatsApp opening messages in recruits' own languages, funneling applicants from Facebook ads through fake corporate landing pages before a human recruiter takes over the conversation on WhatsApp or Telegram. One Facebook advertiser page, "Birch Meadow," ran four ads launched the same day, September 16, localized by flag, language and model: one version aimed at Côte d'Ivoire openly read "rejoignez les forces armées de la Fédération de Russie" ("join the armed forces of the Russian Federation") with a salary of $2,000-plus, housing, medical cover and family support; the identical offer, re-dressed for Sierra Leone, was marketed as "Work in Russia" with a legal contract and professional training - the military was never mentioned. Elsewhere, a Facebook page called "Bremen GAME STORE" ran fake film-casting-call ads as a recruitment front.

Pages are AI-generated and treated as burn-and-replace: cheap to build, so operators don't fight takedowns, they just rebuild. The report found Russian-language revision notes left behind in the code of several supposedly foreign-facing sites, including a Wolof-language page built for Senegal by Work Crew Agency (WCA), one of the network's recruitment brands - evidence the builders were Russian speakers.

Who's Being Targeted, Country by Country

The report's most consequential finding, in its own words, isn't about Russia at all - it's about who the operation is selling to. The flagship brand, IRC Russian Bear, runs content in six languages - Russian, Arabic, English, French, Portuguese and Spanish - through four named regional desks (support-africa@, support-asia@, support-latam@, support-me@) under the strapline "Africa, the East, Asia, and Latin America." The language choices aren't random - they follow whichever colonial-era language still works as the common language in each target region today: French for West and Central Africa, Portuguese for Angola and Mozambique, Spanish for Latin America, Arabic for North Africa and the Middle East.

The oldest domain in the network, workinrussia2025.ru, advertises army contracts to "citizens of Africa, Zimbabwe, Iraq, Indonesia, Panama, Colombia, the Philippines, Myanmar, Europe and the CIS." The Central HQ / Estado Mayor Central operation runs military-contract recruitment in ten languages with country-specific builds for Zimbabwe, Colombia, Mexico, Panama and Peru. Other confirmed targeting includes Kyrgyz and Kazakh recruitment (via an Instagram and Telegram presence called kg.zaprlata) and Uzbek, Tajik and CIS applicants (via a self-described agency called Kadrovoe agentstvo ShchIT). A Belarus-facing brand, защитник ("Defender"), runs a Russian-domain arm and a separate Belarusian arm with its own pricing and eligibility rules restricted to Belarusian citizens.

As of early September, the network was actively expanding its target list. After Meta took down hundreds of Africa-focused ad campaigns in August, operators pivoted to targeting Syrian recruits in early September, launched a new West African campaign on September 20, and opened new sites aimed at Colombians and Mexicans - alongside a parallel push to lure men with specific technical skills, including drone pilots, doctors and engineers.

The Companies Behind the Offers

Most of the 33 operations are small and short-lived, but a handful dominate. IRC Russian Bear is the largest verified foreign-recruitment storefront. Central HQ / Estado Mayor Central (contract-rf.com) runs the ten-language, five-country build. Rus-Visit-Free / JoinRussia redirects visitors by browser language, with French pages aimed at Francophone Africa and Spanish pages at Latin America; its linked site jon-us-russ.ru advertises a $1,000 referral fee. KONTRAKT.RUS runs Telegram and MAX channels, accepts foreign and CIS applicants, and openly invites recruiters and agencies to supply candidates for a commission. Sluzhba-SVO is the single largest asset cluster in the census - 67 assets built around city-specific regional subdomains.

A separate EEAS-reported framework groups four brands - Military Staff Agency, Work in Russia, IRC Russian Bear and Work Crew Agency - as a loose, parallel "playbook" rather than one syndicate; iLAB's evidence found only one technical link between any of them, a shared Google Tag Manager container connecting MSA and WCA. On September 18, six MSA websites (militarystaffagency.ru, join-army.com, russian-army-join.com, russianarmywork.online, workrussianarmy.com, work-russian-army.com) all moved from Russian hosting to a single Amsterdam-registered address operated by VDSINA SERVERS TECH FZCO, a UAE-registered hosting brand - the same namespace used by IRC Russian Bear.

The report also names individuals tied to specific operations under its evidence-tier rules: Nikita Bushin, who operates защитник.рф through a registered Moscow organization, AHO «ЗАЩИТНИК»; Daniil Olegovich Rodionov, registered as a sole trader behind the Belarusian arm, защитник.бел, out of Irkutsk oblast; and Roman Saponkov, also named in the report's final named-individuals review.

Built on Western Infrastructure

The network runs almost entirely on Western commercial platforms. The flagship brand served its recruitment pitch from a server in Amsterdam. Pages across the network were generated with AI website builders from Vercel (v0, United States) and Lovable (Sweden) - in one case, a recruitment site's social-media preview image was still being served from Lovable's own platform storage. Recruitment forms ran on a product built by an Austrian company, stereosense GmbH, routing applicants' personal data - names, phone numbers, passport details - to Russia before a human recruiter took over. The domain infrastructure runs through Identity Digital (which operates the .army registry used by IRC Russian Bear), Cloudflare, GoDaddy, NameCheap, Taplink and Tilda, a Russian-registered site builder with a UK corporate office. Advertising and measurement ran through Meta and Google: one shared code file alone carried 16 identical Meta Pixel IDs, deployed across different sites without a single edit - evidence, the report concludes, of one operator running 16 separate advertising identities from a single template.

What Recruits Are Actually Offered

Pricing varies sharply by brand, which the report reads as evidence of several competing operators rather than one organization working from a shared pay scale. IRC Russian Bear's own site states a signing payment of roughly $15,000, monthly pay around $3,000, injury compensation of $8,000 to $32,000, and a death benefit of $60,000 "paid to relatives via the RF embassy." Rus-Visit-Free advertises signing payments up to $40,000. The Belarusian защитник.бел arm quotes a death benefit "from 12,400,000 rubles" - but its own Facebook ads promised payouts up to 74% higher than what its own landing page actually offered, a gap the report flags as provable, deceptive advertising independent of any mercenary-law question. A specialist drone-operator recruitment page advertises the richest package in the file: up to 17,500,000 rubles in the first year, plus up to 10,000,000 rubles of a recruit's existing debt written off. Recruits are told to open Russian bank accounts via MIR cards through VTB, Sberbank, Promsvyazbank or Gazprombank - all four under significant international sanctions. Against roughly one documented death for every five identified African recruits, the report's own framing is blunt: this isn't a benefit schedule. It's a price list.

Get Out Safely

Anyone who encounters one of these offers - a staffing agency, a "casting call," help securing a Russian visa, or a job as a translator or coordinator - should treat it as a red flag rather than an opportunity. Foreign nationals already recruited into Russia's armed forces have a safe option to leave through Ukraine's "I Want to Live" project.