How Putin's Russian goon squad used Mexican gig workers to troll an American election

The freelancer — I'll call him Carlos — thought the whole thing seemed sketchy. But he was a recent college graduate navigating the job market during the first weeks of the COVID-19 pandemic. He needed the money. Posting to social media sounded like an easy work-from-home gig, so he applied.

After a short interview over video chat with a woman named Vera, Carlos got the job. The company called itself "Social CMS." Vera, a Venezuelan national working in Mexico, sent him a contract with a physical address connected to a coworking space in Germany. She also put him in touch with one of her managers — a man called Tom, who never revealed his last name, and claimed to be based in Poland. Tom communicated with Carlos exclusively through WhatsApp. (Vera did not respond to repeated requests for comment.)

Carlos had some questions about Social CMS. He didn't understand why the company didn't have a web page, despite claiming to have a presence in three different countries. Nor did Carlos understand how the company intended to monetize the string of seemingly random messages about current events that he was being asked to post to Instagram.

"The goal is to make accounts growing," Tom told him via WhatsApp. "Searching for content, posting, and improving it — that's basically what this job is about."

But Vera and Tom were just middle management. The real boss of Social CMS was a notorious Russian warlord, Yevgeny Prigozhin — the man who founded the Internet Research Agency, the troll farm in St. Petersburg, Russia, that propagated pro-Trump and anti-Clinton memes in an attempt to influence the US presidential election in 2016. Over the years, Prigozhin, a close ally of Russian leader Vladimir Putin, had used his personal military operation to prop up Putin-aligned leaders across Africa. Now, with Trump once again running for president, the Russian warlord had set up shop in Mexico, in the months leading up to another US election, in an attempt to spread divisive messages and build a horde of devoted online followers.

The fact that the clandestine Social CMS campaign in Mexico was backed by Prigozhin has come to light as part of a massive leak of more than 2,000 documents from inside the Wagner Group, the Kremlin-backed mercenary company run by Prigozhin. For weeks, Insider has combed through the records along with a consortium of media outlets including Paris Match, Arte, the Dossier Center, and Die Welt, a German newspaper that originally received the documents and shared them with others. The documents came to the consortium through anonymous hackers who call themselves Bogatyri, or "knights." Insider spoke with Carlos after finding his name buried in the documents and locating him online. He verified his account by providing chat transcripts, screenshots, contracts, and internal company documents. While the fact that Prigozhin's Internet Research Agency had operated in Mexico was briefly mentioned in a March 2021 government report, the story and documents provided by Carlos are the first public glimpse of that operation from the inside.

Sen. Mark Warner, who chairs the Senate Intelligence Committee, told Insider that Prigozhin might have chosen Mexico for language reasons and to further the deception. "One thing we saw in 2020 was a fair bit of foreign misinformation efforts targeting Spanish-language speakers," he said. "So it makes sense from that perspective to operate out of Mexico, which would also make it harder to identify activity as a Russian operation." The ability of the FBI and social-media platforms to combat election interference has "improved dramatically" since 2016, Warner added, but "we definitely still have more work to do."

The troll-from-home side hustle

Carlos' work for Social CMS was completely remote. It paid roughly 10,000 pesos, or $500, a month. Sometimes Carlos could manage to do it in two or three hours and have the rest of the day to himself. When Carlos was posting, he didn't use his own phone. Social CMS shipped him one to use exclusively for his work.

At first, Vera had him post Spanish-language messages about current events to Instagram. But within a few weeks, she shifted his team over to posts that sought to inflame America's deepest political and social fault lines. The team had accounts dedicated to posting divisive messages about feminism, religion, LGBTQ rights, immigration, environmentalism, and the Black Lives Matter protests. Among their Instagram handles were @femfemglobe, @pray_tojesus, and @powerful.black.voices. Sometimes they would write their own material. But in many cases, especially with the more political accounts, they would simply click on hashtags to surface material that was already online and then repackage it with new captions.

Occasionally Carlos and others would post about the race between Donald Trump and Joe Biden, with an occasional mention of Kanye West's novelty candidacy. But unlike Internet Research Agency's efforts in 2016, there didn't seem to be an agenda to support any particular candidate. The initial goal appeared to be that of many aspiring content providers and social-media influencers: to push people's buttons, drive engagement, and rack up as many followers as possible. Social CMS was building clout.

At least one of Carlos' posts, a borrowed meme expressing outrage over police brutality, went viral, racking up tens of thousands of comments. He knew that the work itself was questionable, but the experience was still thrilling. "I've never been that famous anywhere in my life," he said. "It was a miracle. It wasn't material that I myself had created, but I was the one to put it in the right place."

Compared to Russia's social-media efforts in 2016, Social CMS was a low-budget operation, one tiny drop injected into the daily torrent of memes that flow organically — and authentically — from the political grievances of American voters. Its impact, though hard to measure, was likely rather small. One week before the election, after being tipped off by the FBI, Facebook shut down Social CMS's accounts.

But just because Social CMS didn't yield an immediate, large-scale impact doesn't mean it should be ignored. Even if low-rent troll farms can't actually swing an election, they can still undermine democracy by seeding moral panic and raising questions about the legitimacy of the winner. Indeed, while the ultimate objective of Social CMS remains murky, its very existence serves as a reminder of the shadowy financing behind untold numbers of online actors who actively seek to disrupt and poison the national discourse. In 2016, a report by Graphika, the social-media-analytics firm, and the University of Oxford found that more than 30 million users interacted with Prigozhin-funded posts. The difference between 2016 and 2020 is that troll farms like Social CMS can now take full advantage of an anonymized global network — proxy servers, bitcoin wallets, coworking spaces, gig labor — to further their objectives. They might not be able to elect a president, but they're fully capable of messing with our heads.

"In some cases, it was almost as though they wanted us to know what they were doing," said retired Gen. James Clapper, speaking about Russian efforts to probe voter rolls in 2016. In his former role as director of National Intelligence, Clapper oversaw the intelligence community's effort to assess Russian interference in the 2016 election.

Prigozhin has never acknowledged Social CMS, but he has made no secret of his ambition to interfere in US elections. "We have interfered, we are interfering, and we will continue to interfere," Prigozhin boasted in November, just before the US midterm elections. "Carefully, accurately, surgically and in our own way, as we know how to do."

Hacking 'Putin's chef'

It is unclear who leaked the internal documents from Prigozhin's corporate empire or what their motivations were. Bogatyri, which says it is opposed to Putin's aggression in Ukraine and is "against war and against all violence," claims to have obtained the documents by hacking into the servers of Concord, one of Prigozhin's companies.

What isn't in doubt, however, is the value of what the WagnerLeaks documents reveal. To ascertain their authenticity, the media consortium cross-referenced dozens of phone numbers and addresses of Prigozhin employees whose names appear in a detailed corporate directory. Many of those contacted by the consortium confirmed their participation in Social CMS and other Prigozhin-backed operations. While it was impossible to fully verify each individual document in the trove, outside experts who reviewed them consider the documents to be authentic, based in part on the astonishing level of detail they contain.

"They appear real to me, since there is so much administrative trivia," said Clapper.

The documents reveal Prigozhin's operation at its most granular. They include invoices, budgets, expense reports, and scanned passports. Items as small as stipends for pro-Russia journalists in Africa and diesel fuel to light the "Bangui La Coquette" sign that overlooks the capital of the Central African Republic — an impoverished nation where Wagner's mercenaries protect the company's mines with brute force — are carefully noted and accounted for.

Prigozhin did not respond to a detailed list of questions that Insider sent to his press email about Social CMS and individuals revealed in the leaked documents. "I didn't know who are you," wrote the person who is listed in the corporate directory as Prigozhin's media liaison. He did not respond to further messages. Prigozhin responded to inquiries from another member of the media consortium with profanities, saying, "It's embarrassing to even take a shit with you," and insisting that he had already answered the same questions many times.

Prigozhin, a convicted felon who runs a catering business, is often called "Putin's chef" for his long-standing alliance with the Russian president, dating back to the 1990s, when Prigozhin opened two fashionable restaurants in St. Petersburg. He has gained notoriety for his role as leader of the Wagner Group, which has sent thousands of Russian convicts to fight for Putin's ambition to conquer Ukraine. His rising prominence in the war effort has led to speculation that he's maneuvering to become Russia's next minister of defense.

His tentacles extend far beyond Ukraine, across Africa and the Middle East and into Mexico. The leaked documents make clear that Social CMS is one small piece of a global operation that involves bribing friendly journalists, paying fake activists to protest a United Nations mission in the Central African Republic, and deceiving Russia's people about the legitimacy of their own elections.

Fan mail for Bashar al-Assad

The armed wing of Prigozhin's operation, the Wagner Group, is often referred to as a "private military contractor" or "mercenary organization." But the leaked documents are proof Wagner is a private company in name only. It is best understood as an arm of the Russian state, one that can break international law and engage in covert operations with a deniability unavailable to operatives who work for the Kremlin on a more formal basis.

Indeed, the WagnerLeaks reveal Prigozhin behaving with an impunity akin to that of a shadow member of Putin's cabinet:

• An internal memo instructs Wagner employees to comply with an order given by the FSB, Russia's intelligence service, to communicate using virtual private networks because of concerns about surveillance. The memo threatens violators with treason under Article 275 of Russia's criminal code.
• A 2017 letter from Prigozhin to Syrian President Bashar al-Assad requests that Syrian combat medals be awarded to 46 Wagner fighters. "They all showed heroism and bravery liberating Syria from the enemies," Prigozhin writes.
• Another 2017 letter from Prigozhin to one of Assad's aides demands $120 million to cover expenses incurred by Euro Polis, one of Prigozhin's oil companies, on a joint oil venture situated on land that Wagner troops seized from Syrian rebels.
• A 2015 letter from Prigozhin to Sergei Shoigu, Russia's minister of defense, requests a customs rebate of 70 million rubles for four cargo ships that Prigozhin's companies imported and then turned over to the Russian military "as a gift."
• Over a nine-year period, Prigozhin's personal calendar lists more than 30 appointments noted as "Kremlin," more than 50 with the Kremlin's chief spokesperson, Dmitry Peskov, and six with Vladimir Putin himself.

The secret records, however, offer only clues about a central question that hovers over Prigozhin's shadow empire: to what extent does Putin order and oversee Wagner's operations?

In an interview about the leaks, a European official who asked to remain anonymous for fear of Russian reprisals said he was surprised by the extent to which Putin has allowed his administration's dependence on Prigozhin to become public. "Putin was a classical leader who relied on state bureaucracy," the official said. "The fact that he now recognizes crazy people — criminals, basically — is a change."

Prigozhin's worldwide influence network

Beyond Social CMS, the WagnerLeaks contain evidence of a broader influence operation. Globally, Prigozhin spends more than $1 million a month on influence operations worldwide, including pro-Russia action movies that he funds and promotes on YouTube.

Not all of Prigozhin's propaganda activities are kept secret. One document specifies the salary of Mira Terada, the St. Petersburg-based head the Foundation to Battle Injustice, a Russian nonprofit that claims to work with a number of US citizens and nonprofit organizations. In 2021, according to the documents, Terada was receiving 100,000 rubles a month for her foundation work and another 100,000 rubles for filming a "special project," amounting to roughly $2,700 a month. Terada has interviewed Tara Reade, the former Senate aide who accused President Joe Biden of sexually assaulting her in the 1990s. Terada's foundation openly boasts of its connection to Prigozhin online, describing him as a "Russian entrepreneur." Like Social CMS, the foundation weighs in on a potpourri of divisive issues — police brutality, animal abuse, transgender rights, and alleged abuses by Ukrainian forces.

Terada, a Russian national who once lived in the United States, was convicted in a US federal court of money laundering in 2020. She has since used her experience with the US criminal-justice system as a kind of foundational story for her current mission to expose what she says are the abuses committed by the US government. In an interview with Insider, Terada presented herself as a Russian ally of aggrieved Americans.

"I talk to many American people," she said. "Not only human-rights defenders and journalists, but regular Americans who have all types of issues, whose rights are violated."

But Terada does not seem concerned that the man who pays her salary is viewed by many as one of the world's most notorious violators of human rights. When asked about reports of Wagner soldiers who had committed war crimes, including gruesome videos of Wagner deserters who were executed with a sledgehammer, Terada dismissed the account as unfounded. "This is something I don't know about," she said. "Before evidence is provided, it's just words." She didn't seem as interested in digging into the wrongdoing of her own government.

The WagnerLeaks also contain documents regarding an internal investigation into an 2017 execution in Syria by the company's mercenaries that helped cement its reputation for extreme violence. Wagner Group fighters wrote up reports that investigate who made a video of the killing public; they seem less concerned with who actually carried it out. That killing is now the subject of a lawsuit in a Moscow court.

Russians trolling Russians: 'No doubts about the legitimacy'

The targets of Prigozhin's influence operations are not exclusively overseas. According to the WagnerLeaks, Prigozhin has also trained his St. Petersburg propaganda apparatus on the Russian people. His main vehicle is a small network of Russian-language media operations called the Patriot Media Group. At its head is RIA FAN, short for Federal News Agency. While the Patriot Media Group doesn't have the reach of state-run outlets like RT or TASS, its stories travel far on social media and news aggregators, making it one of Russia's 20-most-influential news sources.

The WagnerLeaks contain a two-part document entitled "Action Plan," which offers a striking window into how Prigozhin's media operation, like his mercenaries, effectively operate as another arm of the Russian state. The action plan gives explicit marching orders for how Prigozhin-controlled news outlets should cover the 2018 presidential election in Russia. Even before the first vote had been cast, editors were instructed to present the outcome of the race as preordained — "Vladimir Putin's victory." The factors behind Putin's victory were also carefully specified in advance of the actual election:

The editors of Prigozhin-controlled outlets were also instructed to vouch for the legitimacy of an election that hadn't even started yet:

Among six stories that were to be written in advance was a piece titled "Why Putin Won," a "text in which we clearly and intelligently explain why people voted for Putin and why other candidates couldn't even get close to him."

An analysis by Recorded Future, a cybersecurity company, found that the instructions in the Action Plan were in fact carried out by Prigozhin-controlled media outlets covering the 2018 election.

The documents are similar to manuals for new journalists that have circulated among the Moscow media since the early years of Putin's rule, according to Vasily Gatov, who researches Russia media at the University of Southern California.

"From a professional view — forgetting about the politics and the manipulation — this is a professional document," Gatov said. "It shows that Prigozhin's business was young. They hired the cheapest people available. The only thing these people have to be able to do is read and write. So they borrow from these old instructions about how to do things professionally."

One of the largest media conglomerates in Russia, known as VGTRK, is owned by the state. A separate trove of emails hacked from VGTRK last year reveal close coordination between its TV networks, the FSB, and the Russian military.

The WagnerLeaks supplement that picture by exposing Prigozhin's core obsession when it comes to elections — the public perception of legitimacy. "No statements from foreign media on legitimacy," reads the action plan. "These were the most legitimate elections in the last five years in the whole world." Gatov also noted that the 2018 election was "very much troubled by legitimate criticism about the validity of the elections themselves. There was a lot of fraud, and false ballots." One Russian election-monitoring organization reported more than 1,500 violations, including ballot-box stuffing.

By some estimates, Putin's personal wealth is as much as $200 billion. The country's foremost opposition leader, Alexei Navalny, rose to prominence by arguing Russia's elections are rigged; he's been poisoned, attacked in the street, and is now being held in a penal colony.

The freeze-out

One day, Carlos settled into his work for Social CMS and found that he couldn't log into one of his work accounts. At first, he thought it was an error. He sent Instagram a picture of his ID to try and unlock the account. It didn't work. Soon, his other work accounts were frozen. He looped in Vera. She didn't know what to do either. Then, the problem spread to Carlos's personal accounts. Twitter locked him out. LinkedIn demanded that he self-verify with his ID. Facebook allowed him to log in, but only after flashing this warning:

Carlos clicked on "learn more." That led him to an article by Facebook's security team. The article included pictures of memes that he and his colleagues had posted. It said that Social CMS "doesn't appear to exist" and that it "used fake accounts to create fictitious persona," and was under scrutiny by the FBI. The accounts were removed, Facebook said for "violating our policy against foreign interference which is coordinated inauthentic behavior on behalf of a foreign entity."

Carlos freaked out. "To see pictures of my work in that article, with the FBI — I was like, 'Holy shit, my first job, and this is what I do?' I was really worried. My first thought was whether I should be more worried about the FBI coming to my house to track me and kill me, or the KGB or something like that."

He started to worry that he'd never be able to visit the US, go to Disneyland, or get a job with a US company. "I was really worried about my future," he said. Carlos sounded the alarm with his colleagues. Vera claimed to be on their side. Some of the workers at Social CMS believed her. Carlos did not. He sent her his letter of resignation that day. "Something isn't right regarding the monitoring and perception Instagram and Twitter have of my activities online," he wrote. "I'm worried about this and I would not want my reputation to be affected by the accounts owned and managed by the company … I have decided not to continue with the project from today."

Vera tried to persuade him to accept one month's severance. She claimed she was paying it out of her own pocket.

Carlos declined. "I don't want a dime out of that dirty money," he said.

Anastasiia Carrier contributed translations and reporting.

Mattathias Schwartz is a senior correspondent at Insider and a contributing writer at the New York Times Magazine. He can be reached at mschwartz@insider.com and schwartz79@protonmail.com.