A Ticket to Russia. How Recruitment for War Became a Business

Foreign nationals recruited into the Russian armed forces do not always know from the outset what they are actually being recruited for. Potential candidates have been drawn in with offers of construction and security work, film roles, visa assistance or the prospect of travelling to Russia. From there, they are directed to websites resembling employment agencies, before the conversation moves to WhatsApp or Telegram. The military nature of the offer may only become clear later in the process.

This is part of the system described in a report by Code for Africa (CfA), a member of the African Digital Democracy Observatory, with research led by its iLAB forensic investigation unit. The authors of Death Benefits: the industry selling Russia’s war as a job traced 167 digital assets used to recruit foreign nationals into the Russian armed forces. These included 105 websites and web pages, 10 social media accounts and 52 messaging accounts and channels across WhatsApp, Telegram, VK and MAX. Researchers attributed them to 22 separate operations. The number itself matters, but what becomes more revealing is what happens when the network is broken down. The report does not point to a single, neatly organised structure controlled from one place. It points to a market.

Suppliers of recruits

Four brands – Military Staff Agency, Work in Russia, IRC Russian Bear and Work Crew Agency – had already been identified by the EEAS as recruitment brands operating in parallel. CfA confirms some links between their infrastructure, while also finding clear boundaries between them. Individual operations use separate phone numbers, analytics accounts and hosting. In some cases they share infrastructure, but the evidence does not support treating them as one organisation.

The authors offer a different interpretation: the Russian military is the end customer, surrounded by a group of suppliers competing for recruits. Part of the market even resembles a franchise model. Bratsky Syndicate, the largest single operation in CfA’s dataset, presents its model as a business that can be replicated regionally. The next tier consists of larger brands focused on foreign candidates, followed by smaller agencies and individual recruiters. One Work in Russia website offered recruiters $1,000 for every candidate who paid for his own travel to Russia, and $150 if the operator covered the travel costs.

This is one of the report’s central conclusions. Focusing too heavily on where the “headquarters” of the operation might be can send the analysis in the wrong direction. The system does not depend on uniformity. Competition between operators and fragmented infrastructure may in fact make it more resilient.

War is not what is being sold

The mechanism relies first of all on the economic appeal of going to Russia. Promised salaries, help with travel and visas, and other benefits are presented in ways tailored to the circumstances of the intended audience.

Nor is this an operation aimed only at Africans. IRC Russian Bear communicated in six languages and maintained separate support channels for Africa, Asia, Latin America and the Middle East. Other websites were tailored to audiences in countries including Zimbabwe, Colombia, Mexico, Peru, Indonesia and Cambodia. After some Africa-focused campaigns were removed, a new offer targeting Syrians also appeared.

Africa nevertheless remains one of the markets clearly targeted by these operations, because the promise of $2,000–$3,000 a month carries very different weight in economies where such an income can represent a dramatic financial leap. In many cases, there is no attempt to persuade potential recruits to support Russian policy or the war itself. The appeal is economic: jobs, travel and the prospect of a better income. Disinformation serves a practical purpose here – not to change someone’s opinion, but to move them towards a concrete decision.

Websites built to disappear

CfA uses the term burn-and-replace to describe part of this infrastructure. Websites are cheap, easy to copy and do not need to stay online for long. Once one is detected or removed, an operator can launch another domain and reproduce an almost identical site. The network also made use of generative website-building tools, including Vercel v0 and Lovable. AI makes this model easier to sustain: new versions can be created faster and more cheaply, and once one site is removed, another can be launched relatively easily under a new address.

More valuable than the website itself is the infrastructure that allows operators to promote it and quickly replace it: advertising accounts, histories of advertising activity, administrator profiles, tracking identifiers and billing relationships. On eight identical websites, researchers found the same block of 16 Meta Pixel IDs. Losing a domain matters relatively little if the operator still has access to the infrastructure needed to redirect traffic to the next one.

This is where another uncomfortable aspect of the report emerges. Much of the system runs on ordinary Western services. Websites were built using software from US and Swedish companies, data was collected through a product made by an Austrian company, and advertising and traffic measurement relied in part on tools from Meta and Google. One of IRC Russian Bear’s websites served recruitment content from an IP address that CfA concluded was located in Amsterdam.

That does not mean these companies knowingly participated in recruitment. The report does not claim that they did. What it does show is that the operation relies on ordinary digital infrastructure and can therefore also be disrupted outside Russia.

$60,000 for death

The bleakest part of the report concerns the price lists. IRC Russian Bear advertised around $15,000 for signing a contract, roughly $3,000 in monthly pay, between $8,000 and $32,000 for injuries, and $60,000 in the event of death.

The authors compare the structure to an insurance product: different outcomes are assigned different prices. A candidate sees the amounts, but not the risk attached to them. The report cites several independent datasets on African recruits. They cover different populations and come from different types of sources, so they cannot be combined into a single overall count. Even so, all point to a similar mortality rate: roughly one in five identified recruits has been killed. In Ghana’s case, BBC findings cited by CfA referred to 272 people believed to have gone to Russia, 55 of whom were dead.

Another important part of the offer is the promise that death benefits will be paid to relatives “via the RF embassy”. CfA found no evidence that such a mechanism actually operates. The authors nevertheless describe it as one of the most testable claims made by the entire network. If embassies are involved in the payments, that would mean direct participation by a state institution in the mechanism. If they are not, recruiters are using the authority of Russian diplomacy to lend credibility to a false claim about how the benefit is paid.

Claims of Kremlin ties

Some websites claim to operate as official representatives of the Russian Ministry of Defence. IRC Russian Bear embedded such a statement directly in its website code, in all six language versions. At the same time, CfA found no public document confirming that mandate.

Recruiters also tried to bolster their credibility using fabricated material attributed to the BBC and the New York Post. Other websites warned users about scammers and middlemen while themselves operating within an ecosystem built on deception. Such tactics are designed to build trust by exploiting a real concern among potential candidates: if the market is full of scams, someone loudly warning against them may appear to be the safer option.

The report is careful about attribution. Every core claim is assigned a confidence level: confirmed, probable, possible or unsupported. British authorities identified Polina Azarnykh – whom they say manages a channel, website and bot linked to the Sadiq Rossia operation – as being backed by the Russian government in recruiting foreign nationals into the Russian military. But this is the only case described in the report in which a European government has made such a finding. The authors do not extend that attribution to the rest of the market.

A problem bigger than disinformation

This is where the Code for Africa report makes its most interesting move. The authors argue that describing the operation simply as disinformation is too narrow. A false employer, a fabricated ministry mandate, invented media coverage and the concealment of the real nature of the work are not merely tools for shaping a narrative. They are intended to get a specific person to act.

The report treats the operation primarily as fraud and argues that it also meets the elements of human trafficking. That shift in language has practical consequences. If the problem is reduced to false content, the responses are fact-checking, moderation and media literacy. If it is recruitment by deception into work a candidate did not knowingly agree to, the picture changes: prosecutors, anti-trafficking laws, data protection, consumer law and the responsibilities of service providers all come into play.

The same applies to the infrastructure. Removing another domain produces a visible but short-lived result. Losing advertising accounts, payment instruments or access to infrastructure that cannot be rebuilt in an afternoon is much more costly for an operator. CfA also recommends preserving evidence before websites are removed. Otherwise, a successful takedown may destroy material that a regulator or prosecutor later needs.

The most important finding in Death Benefits is therefore not that foreign nationals are ending up in the Russian military. The report shows something harder to capture: how a market has formed around their recruitment, with its own intermediaries, commissions, localised offers, advertising, analytics and infrastructure designed to survive takedowns.

It is this commercial character of the operation that should change the way responses are designed. As long as launching another website remains very cheap, the number of domains removed will have limited meaning. More important questions are who pays for the advertising, who is paid for each recruit, where candidates’ data ends up, and which parts of the chain are genuinely difficult to replace. Recruiters are selling work, money and the prospect of travel. War is what waits on the other side of the offer.