The Ghost on the Byline - Decipon Insights

The Ledger

The documents don’t look like espionage.

They look like a content marketing agency’s accounting records. Expense reports. Staff biographies. Campaign summaries. A spreadsheet tracking how many articles were published in Mali versus Niger, and what each one cost. Operational reports describing which journalists had accepted payment and which had not. A line item for stadium banners in Argentina.

In February 2026, the pan-African outlet The Continent received 76 internal documents totaling 1,431 pages — leaked anonymously, written in Russian, covering January through November 2024. Forbidden Stories and a consortium of international journalists analyzed and published them.

The documents belong to a Russian influence network that its members call “the Company.” You may have heard of its previous owner: Yevgeny Prigozhin, the oligarch whose Wagner Group mercenaries occupied half the African continent’s military coups before he died in a suspicious plane crash in August 2023. The Company ran the influence operations side — the media manipulation, the narrative construction, the journalist payments, the anti-Western campaigns that preceded and followed Wagner’s guns.

Prigozhin died. The Company did not.

The Inheritance

After August 2023, Russia faced an administrative problem: it had a functioning, battle-tested influence infrastructure operating across 30 countries, with agents in place, relationships built, and narratives running. The question was not whether to keep it. The question was who would run it.

By the end of 2023, documents show, the answer was clear. Russia’s Foreign Intelligence Service — the SVR — had moved from a supporting role to direct supervision. The transition was orderly. Prigozhin’s deputies stayed in their positions. Sergei Mashkevich continued running strategic operations with a focus on Latin America. Sergei Klyukin oversaw 34-person analysis units monitoring 15 countries. The institutional knowledge survived its founder’s removal.

The SVR’s inheritance added something Wagner’s informal network had lacked: the explicit imprimatur of a state intelligence service. The Company was no longer an oligarch’s project with state tolerance. It was a state project with plausible deniability. The distinction has operational significance. State intelligence services have procurement protocols, budget cycles, personnel standards, and escalation chains. They are harder to disrupt because there is no single owner to eliminate.

The documents confirm a budget of approximately €7.3 million over ten months in 2024 — roughly $750,000 per month — for operations spanning Africa, Latin America, and the Middle East. Monthly spending on article placement alone often exceeded $300,000.

This is not a covert operation hiding in the dark. It is a line in a budget.

The Global South as Terrain

The geographic focus is deliberate and worth examining.

Storm-1516 targets France and Germany. The Iran information war targets American and Israeli credibility. The Company’s primary operational terrain is the Global South — countries in West and Central Africa, Southern Africa, Latin America. The choice is not incidental. It reflects a specific strategic logic.

The post-colonial resentment of Western powers is genuine, deep, and widely shared across these regions. France’s military presence in the Sahel — which for decades came with French-backed governments and periodic intervention — created a reservoir of legitimate grievance. The Russian narrative does not need to fabricate this resentment. It only needs to attach itself to something real and redirect it.

The Company’s August 2023 strategic document, titled “Confederation of Independence,” outlined the goal explicitly: “undermine the image of Western countries” and create “a belt of regimes friendly to the Russian Federation” by exploiting anti-colonial sentiment.

This is the manipulation mechanic: find an emotion the audience already has, validate it, amplify it, and attach it to conclusions that serve your interests rather than theirs. The grievance is real. The solution being offered — closer alignment with Russia — is the fabrication. The narrative works because the emotional foundation is genuine. That is why it is harder to debunk than fabricated war footage. You cannot fact-check a feeling.

The campaigns ran accordingly. “Ukraine supports African terrorists.” “French troops are occupying your country.” “Sanctions are a form of economic colonialism.” Each claim exists on a spectrum from true to fabricated, but all are attached to a real emotional substrate. The Sahel has experienced French military presence. The economic effects of Western sanctions are real. Ukraine’s conflict is, from many African governments’ perspectives, a European problem they were not asked about.

The Company threads its fabrications into that fabric, pulls the threads that were already loose.

The Ghost Journalists

The operational core of the Company’s media influence is a network of paid journalists — some real, some fabricated.

The real journalists received payments to publish Company-scripted narratives under their own names. In West African outlets, internal accounting documents tracked over 700 articles published between June and October 2024, priced between €250 and €700 each. Journalists in Chad received 50,000 to 200,000 CFA francs — roughly €75 to €300 — per article. That is approximately one month’s salary for a Chadian journalist for a single article. The incentive structure is not subtle.

The fabricated journalists are a different architecture.

In Argentina, the Company deployed at least four invented personas to author 19, 9, 12, and multiple articles respectively — a total of over 250 articles placed across 20-plus Argentinian outlets between June and October 2024, at a cost of approximately $280,000. The personas had names, photographs, claimed degrees, and institutional affiliations:

Gabriel di Taranto — AI-generated profile picture. Claimed a Master’s degree in Political Communication from Universidad Nacional de Avellaneda. The university confirmed no such program exists. Nineteen articles. Total cost: $29,900.

Juan Carlos López — Profile image sourced from stock photo repositories. Nine articles. $9,900.

Marcelo Lopreiatto — Profile picture from an AI-generated headshot distribution service. Twelve articles. $16,400.

These are not personas built to deceive at scale. They are built to meet the minimum threshold of credibility required by editors who do not investigate their contributors. A professional photograph, a plausible credential, a coherent writing style. The fake degree needs only to survive a glance, not a verification call.

The logic is that most editorial operations — especially at mid-tier regional outlets under financial pressure — do not have the bandwidth to verify contributor credentials for every submission. They require a plausible surface. The Company provided one.

The Stories They Bought

The content placed through this infrastructure tells you what the Company wanted.

In Argentina, the focus was threefold: discourage military assistance to Ukraine (“Milei, We Don’t Need Someone Else’s War”), discredit President Milei amid his economic reforms, and manufacture a regional conflict. One article — explicitly marked “fake story” in the Company’s internal accounting documents — claimed that Milei had dispatched a “sabotage team” against Chile’s Trans-Andean gas pipeline.

That last detail is worth pausing on. The Company maintained internal documents that labeled specific operations as fake. The accounting record for the pipeline article notes its fictional status. The operation is organized enough to track its own fabrications. The people running it know exactly what is real and what is not. The confusion is not in the source. It is manufactured and exported.

In the Sahel, the campaigns supported military juntas, opposed French and Western military presence, and promoted the Alliance of Sahel States — the bloc of coup governments that expelled French forces and pivoted toward Russian military partnerships. The content did not need to persuade audiences that Russia was benevolent. It only needed to persuade them that the alternatives were worse.

In Chad, when journalist Olivier Monodji was approached by operatives posing as Belarusian journalists offering to help him launch a “media house,” he participated long enough to understand what was being asked. When he pushed back, he was imprisoned for four months. Charges were eventually dismissed. The Company’s documents marked him as a problem. His name appears in the operational reports.

In the Central African Republic, journalist Ephrem Yalike accepted €45 per article for a period before exposing the operation publicly. He risked his life doing it.

What the Failures Show

The Argentina operations did not achieve their goals. Argentina joined the Rammstein Format supporting Ukraine. Milei’s party strengthened electorally. No Argentina-Chile tensions materialized from the fabricated pipeline story.

This follows the pattern that has appeared elsewhere in the Company’s documented operations: the infrastructure functions; the outcomes are mixed. The mechanism for placing content works. The content itself does not reliably determine political outcomes.

The Armenia election result, the Argentina results, and the documented limitations of Storm-1516 in achieving policy changes in France and Germany all point to the same structural constraint: influence operations can flood an information environment, but they cannot substitute for the emotional and political realities audiences bring with them. When those realities run against the narrative, the content is placed and ignored.

What the operations can do — reliably, at scale, for $750,000 a month — is generate friction. Make the information environment noisier. Make verification harder. Make skepticism more exhausting. Make it expensive, in time and energy, to know what is true. That is a lower bar than winning the argument. It is a bar that paid content farms can clear.

The Company is not trying to convert audiences to pro-Russian positions. It is trying to degrade the quality of the information environment enough that pro-Western positions become harder to hold with confidence.

Influence Tactics Breakdown

Anti-Colonial Narrative Laundering. Attaching fabricated pro-Russian narratives to genuine post-colonial resentment, so that the emotional substrate of the message is real even when its conclusions are manufactured. Audiences who feel the grievance do not experience the narrative as foreign propaganda; they experience it as validation of something they already believe. The Russian conclusion is cargo on a ship built from local lumber.

Ghost Journalist Infrastructure. Creating fabricated author personas — AI-generated photographs, false credentials, invented institutional affiliations — to place content in editorial systems that perform cursory rather than rigorous contributor verification. The fabrication is not designed to survive investigation; it is designed to survive inattention. Most content does not get investigated.

The Paid Correspondent Network. Recruiting real journalists in target regions with payment structures calibrated to local economic conditions. A €300 payment for a single article, when a journalist earns €250 per month, creates an incentive that is difficult to decline in contexts of economic precarity. The network buys not just individual articles but ongoing relationships — and the threat of exposure as a paid Russian agent becomes a tool to enforce continued compliance.

Internal Truthfulness, External Fabrication. Maintaining internal accounting records that explicitly label fabricated operations as fake while distributing those fabrications through public channels. The operation is not confused about what is true; it is organized around the systematic creation of confusion in others. The clear-eyed cynicism visible in the Company’s own documents is the clearest evidence of deliberate manipulation.

State Absorption of Private Infrastructure. Converting a mercenary influence network into a state intelligence apparatus without disrupting its operations, personnel, or relationships. The transition from Prigozhin to SVR control preserved institutional knowledge, existing agents, and established media relationships while adding the legitimacy, stability, and resources of state backing. The private sector built the capability. The state inherited it.

What the Documents Actually Prove

The Forbidden Stories leak is unusual in what it reveals.

Most influence operations are reconstructed from the outside: researchers identify patterns, trace accounts, map coordination networks, and infer intent from behavior. The Company’s documents invert the usual epistemic position. The internal records describe intent directly, in the operators’ own words, with line-item budget entries attached.

This is not an inference that Russia is running a global influence operation in the Global South. It is a document showing what it cost, who ran it, which journalists were paid, which stories were labeled fake in the internal records, and which strategic documents described the goal as building a belt of Russia-friendly regimes.

The banality of it — the expense reports, the staff bios, the article count spreadsheets — is the most important detail. Influence operations at industrial scale are not primarily dramatic. They are administrative. Someone schedules the content. Someone approves the payment. Someone files the accounting record. The document that labeled the pipeline fabrication a “fake story” was written by a person who goes home after work.

This is what a disinformation franchise looks like from the inside. Not a shadow conspiracy. A content agency with a propaganda vertical and a government client.

The documents are out. The Company is still operating.

This article is part of Decipon’s Manipulation Breakdowns series, examining specific influence operations through the Influence Tactics Protocol.

Sources: