Online Insurgents
Mapping the Digital Network of the National Liberation Army
Overview
The National Liberation Army (Ejército de Liberación Nacional – ELN) is Colombia's last remaining major insurgent group, and is designated as a terrorist organization by the U.S. and the European Union. Beyond armed activity, the ELN exercises territorial governance and drug-trafficking influence that is a fixture within Colombia's security landscape.
The guerrilla group maintains an operational presence across Colombia and Venezuela. Its members are divided among several groups, known as “War Fronts.” The administration of outgoing president Gustavo Petro has approached the ELN with a "Total Peace" framework, engaging in a dialogue with the country’s armed groups.
ELN’s central role in Colombia faces near-term disruption. President-elect Abelardo de la Espriella, who takes office on Aug. 7, 2026, has campaigned on ending negotiations and launching a military campaign against the ELN and other armed groups.
A June 2025 investigation by the Atlantic Council’s DFRLab found that the ELN employs a cross-platform digital strategy to amplify anti-U.S. and pro-Kremlin narratives. This report builds on that finding, mapping the group’s digital communications network as of June 5, 2026, and identifying its entities and technical infrastructure. Based on observed patterns of platform use, branding, and infrastructure design, we analyzed the ELN’s organizational logic and cross-platform strategy.
Key Findings
The ELN-linked communications network comprises at least 200 accounts across 19 online platforms and 12 web domains.
We identified ELN assets on Telegram, X, Instagram, Threads, TikTok, Facebook, YouTube, Mastodon, VKontakte (VK), Vimeo, Twitch, WhatsApp, Medium, Beacons, SoundCloud, Ivoox, Amazon Music, PodcastApp, and Online Radio. We assess that this platform diversification likely functions as a strategy to increase the organization’s online resilience and broaden its audience.
The network can be sorted into three levels
A Central Level, consisting of organizational and leadership-linked entities (each operating multiple accounts) across the broader ELN network; a Front Level, consisting of entities associated with individual ELN War Fronts; and a Supporter Level, consisting of decentralized accounts operated by supporters, sympathizers, and followers.
Telegram channels are present across the Central and Front levels.
These are used to distribute organizational messaging, amplify Front-level communications, and circulate leadership-linked content.
Front-level communications operate through two parallel architectures.
These include a direct model, in which War Fronts communicate under their own designation, and a proxy model, in which culturally branded, persona-based entities serve as the primary dissemination interface. We assess that this dual structure reinforces organizational legitimacy while extending reach through more accessible, audience-tailored channels.
Technical and behavioral indicators suggest coordinated management across core organizational and Front-level entities.
Several ELN-linked domains resolve to shared hosting infrastructure distributed across two distinct IP clusters. Behaviorally, consistent cross-linking, audience routing, and cross-platform promotion indicate coordinated dissemination practices.
The ELN Delegation, the entity responsible for the organization's peace-process communications, has technical and behavioral links to the group's armed communications apparatus.
Its website resolves to the same hosting cluster as ELN Voces — the organization's primary messaging hub — and several Front-level domains. Its Telegram channel redistributes content originating from Front-level channels.
Multiple open-source indicators support attribution of core organizational and Front-level entities.
The large majority are assessed at high confidence based on explicit self-identification, corroborated by converging technical and behavioral evidence. Explicit self-identification, repeated cross-promotion between entities, shared branding, cross-platform continuity, and shared technical infrastructure collectively support our assessment of an integrated ELN communications network. We identified supporter-linked accounts with low confidence.
The communications network demonstrates consistent narrative and symbolic alignment across organizational, Front-level, persona-based, and supporter-linked entities.
Recurring themes include anti-state framing, anti-imperialist messaging, anti-U.S. framing, revolutionary legitimacy, resistance narratives, and militant symbolism. Some Front-level entities disseminate operational messaging that emphasizes coercive and intimidation capabilities. This includes references to explosive devices, drone attacks, military casualties, and armed confrontation.
Graphika is the most trusted provider of actionable open-source intelligence to help organizations stay ahead of emerging online events and make decisions on how to navigate them. Led by prominent innovators and technologists in the field of online discourse analysis, Graphika supports global enterprises and public sector customers across trust & safety, cyber threat intelligence, and strategic communications, spanning industries including intelligence, technology, media and entertainment, and global banking.
Download the complete PDF
The full report includes the complete network graph maps, raw attribution indicators, cross-platform topology analysis, and the full takedown timeline with platform-level data.
- Full network graph visualizations
- Attribution indicators with confidence scores
- Raw behavioral modeling data
- Takedown coordination timeline
Related Reports
True Crime to True Cringe
Examining How the #TrueCringeCommunity Promotes Violence and Evades Social Media Moderation
Read the Report
Falsos Amigos
Network of Domains and Social Media Accounts Uses AI Tools to Launder Reports From Chinese State Media Outlet CGTN in Multiple Languages
Read the Report
Chinese State Influence: Tariffs to Tension
Selected Insights from Graphika’s Intelligence Reporting on Chinese State Influence Actors and Adjacent Communities
Read the ReportSee How Graphika Can Help Your Team Act on This Intelligence
This report is one of 600+ investigations Graphika’s team has published. Our platform gives your analysts continuous access to the same intelligence — plus the tools to apply it to your specific threat environment.