As the crisis in Europe over Ukraine heats up, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, the DFRLab’s global team presents the latest installment of the Russian Hybrid Threats Report.
Russian build-up in Belarus continues within the Chernobyl exclusion zone
Kindergarten damaged in Luhansk
Ukraine’s ambassador to the UK suggests Ukraine “might” give up NATO ambitions
Russian investigators claim to find mass graves of civilians killed by Ukrainian armed groups
Zakharova ridicules Ukraine and the West about possible military incursion dates
Telegram channels proliferate narrative claiming the West has given up on Ukraine
Telegram channels accuses the West of escalating hostilities for profit
Cyberattack takes down Ukrainian government and bank websites
Leaders of breakaway regions announce evacuation of civilians after unverified reports of sabotage at a chemical facility
On February 18, the leaders of the breakaway regions of Donetsk and Luhansk announced that civilians would evacuate to Russian territory. “Today their guns are aimed at civilians, at us and our children,” Donetsk leader Dennis Pushilin said in his remarks, wearing an army pullover rather than his usual suit and tie. He later continued, “Therefore, from today, February 18, a mass centralized departure of the population to the Russian Federation has been organized.”
Soon afterwards, Luhansk leader Leonid Pasechnik followed suit. “In order to prevent casualties among the civilian population, I call on residents of the Republics who do not have mobilization orders, as well as are not involved in the life support of social and civilian infrastructure, to leave… the Republic for the Russian Federation as soon as possible,” he said in a statement.
The announcement came within hours of Russian-aligned media claiming Ukraine had staged assaults on the breakaway regions and was poised for further action. The official Telegram channel of TASS claimed that Donetsk authorities had killed two saboteurs who were allegedly trying to detonate chlorine cylinders in Horlivka, while other pro-Kremlin social media channels promoted a video they alleged depicted a firefight with saboteurs.
Following the announcements, residents reportedly began receiving SMS messages with instructions on how to prepare for evacuation. Soon, crowds in Donetsk could be seen lining up for convoys of buses and queuing at ATM machines.
Margarita Simonyan, head of RT, added to the speculation, claiming that Pushilin had told her that Ukraine was preparing for an attack. “Their units are lined up in battle formations,” she tweeted. “If they haven’t received the order yet, they will as soon as possible. We can no longer wait and risk civilians.” She then followed this with another tweet, alleging, “And now it looks like it has started.”
Ukrainian Foreign Minister Dmytro Kuleba pushed back hard on these claims. “We categorically refute Russian disinformation reports on Ukraine’s alleged offensive operations or acts of sabotage in chemical production facilities,” he tweeted. “Ukraine does not conduct or plan any such actions in the Donbas. We are fully committed to diplomatic conflict resolution only.”
At the time of publishing, there were also unverified reports of an explosion in Donetsk.
—Andy Carvin, DFRLab Managing Editor, Washington DC
Russian build-up in Belarus continues within the Chernobyl exclusion zone
On February 17, newly released satellite imagery suggested a new Russian field hospital was under construction in Asipovichy, Belarus. Satellite photos also indicated that a field hospital in Pribytki airbase was dismantled between February 12 and 14. February 16 imagery from the satellite data company Sentinel Hub also showed a decreasing amount of military equipment and tents at Zyabrovka airfield in Belarus and Yelnya base in Russia, but it is unclear where this equipment was re-deployed.
On February 16, satellite images surfaced showing a pontoon bridge over the Pripyat River in Belarus. The bridge appears to have been erected on February 15 in the Chernobyl exclusion zone, roughly six kilometers from the Ukrainian border. The troops behind the bridge construction are likely the same units from the far east of Russia that were reported as arriving to Belarus in late January. On the same day, exercise videos taken on the ground also surfaced, showing the progress of the pontoon bridge construction.
That same day, Belarusian Minister of Foreign Affairs Uladzimir Makey declared that the Russian military would fully leave Belarus after the Allied Resolve drills end. According to Makey, “Not a single soldier, not a single piece of military equipment will remain after these exercises. This is stated at the level of the Ministry of Defense, and President Lukashenka said so as well.” Belarusian state-owned media outlets also published the statement.
Between February 14 and 16, additional videos surfaced showing increased Russian helicopter activity in Belarus. Around twenty-five Russian Ka-52 “Alligator” helicopters were spotted near Mstislavl in eastern Belarus. Helicopter activity was also spotted over Gomel, Mogilev, and other unidentified locations. Additional satellite images have also surfaced revealing a Russian Mi-26 helicopter present at Machulishchy airfield, south of Minsk.
—Lukas Andriukaitis, Associate Director, Brussels
Kindergarten damaged in Luhansk
A kindergarten in a village in the Luhansk region of Ukraine was heavily damaged after being attacked, leaving two civilians injured. The Ukrainian army stated that Russian occupying forces were behind the incident and attacked the kindergarten “with special cynicism.” Dmitry Peskov, spokesperson for Russian President Vladimir Putin, blamed Ukraine for the escalation. Moscow-based correspondent Oliver Carroll tweeted a video of the ruined schoolhouse, noting that the kindergarten is located in territory controlled by the government of Ukraine. Citing a diplomatic source from the Organization for Security and Cooperation in Europe (OSCE), Reuters reported that the OSCE “had recorded multiple shelling incidents along the line of contact in the early hours of Thursday.”
The kindergarten in question, Дитячий садок-ясла №21 “Казка,” is located in Stanytsia Luhanska, just north of the city of Luhansk. The damage is on the building’s south/southwest side, suggesting that the attack most likely came from the separatist-controlled area, though the munition involved and its origins are still unknown.
—Eto Buziashvili, Research Associate, Tbilisi, Georgia; and Lukas Andriukaitis, Associate Director, Brussels
Geolocation of the attack damage (pictures 1 and 2) revealed that the kindergarten in question is located in Ukrainian government-controlled Stanytsia Luhanska (images 3 and 4). (Source: 1. @mrsorokaa/archive; 2. @maria_avdv/archive; 3. Google Maps; 4. LiveUAMap)
Ukraine’s ambassador to the UK suggests Ukraine “might” give up NATO ambitions
Ukraine “might” consider dropping its ambitions of joining NATO if it averts a war, said Vadym Prystaiko, the country’s ambassador to the United Kingdom. In an interview with BBC Radio 5, Prystaiko said the goal of joining NATO is written into Ukraine’s constitution, but added, “We are flexible trying to find the best way out [of a possible war]. If we have to go through some serious concessions that’s something we might do. That’s for sure.”
Prystaiko’s statement was widely covered in Western media, independent Russian media, and Kremlin-controlled media. For comments on the statement, media outlets turned to the UK Defense Ministry, Ukraine’s Ministry of Foreign Affairs (MFA), Ukraine’s Office of the President, and Prystaiko himself.
Ukrainian MFA spokesperson Oleg Nikolenko said that Prystaiko’s words “were pulled out of context.” Sergey Nikiforov, spokesperson for the Office of the President, said Ukraine’s NATO membership remains a priority for the country, regardless of what Prystaiko really meant. Prystaiko later clarified that the concessions he mentioned did not include Ukraine’s NATO ambitions. UK Armed Forces Minister James Heappey said that the United Kingdom would respect any decision Ukraine makes regarding NATO membership.
Kremlin-controlled and pro-Kremlin media did provide fact–based reporting about Prystaiko’s interview and its aftermath, adding commentary from Kremlin officials and pro-Kremlin experts. Kremlin officials were reserved in assessing whether Prystaiko’s statement impacted Russia’s perception of NATO as a threat. Putin Press Secretary Dmitry Peskov stated that Ukraine giving up its NATO ambitions “would significantly contribute to formulating a more meaningful response to Russian concerns.” Sergei Tsekov, a member of Russia’s Federal Council Committee on Foreign Affairs, added that Russia is comfortable with Ukraine not joining NATO, though the country’s primary goal is to reach security guarantees with NATO and the United States.
Pro-Kremlin experts were more critical in their assessments. Military analyst Viktor Baranets claimed that Prystaiko’s statement is “a disguise of peacefulness” and a “clever diplomatic ploy” before “Ukraine’s armed forces will attack Donbas.” Political scientist Maxim Zharov suggested Prystaiko’s statement was probing the “Ukrainian elite” who are “dissatisfied and afraid of the pressure from the United States, who are promoting the myth of ‘Russian aggression.’” Another military expert, Yevgeny Linin, declared that Ukrainian President Volodymyr Zelenskyy is “very limited in his abilities” to go around Ukraine’s constitutional goal of joining NATO.
—Nika Aleksejeva, DFRLab Lead Researcher, Riga, Latvia
Russian investigators claim to find mass graves of civilians killed by Ukrainian armed groups
The Investigative Committee of Russia has opened a criminal case, according to Russian online outlets, several days after the head of the so-called Donetsk People’s Republic claimed that civilian mass graves had been found in the Donbas region. The committee stated that between August and October 2021, Russian investigators found five mass graves with the remains of at least 295 civilians who died “as a result of indiscriminate shelling by Ukrainian armed groups in 2014.” The Investigative Committee added that the “representatives of the Ukrainian security forces are constantly shelling the settlements of Donbas,” a claim that could be used as a pretext for a Russian invasion.
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
Georgian Kremlin supporter says the country must reconsider its foreign-policy agenda, compares Ukraine to Yugoslavia
After German Chancellor Olaf Scholz visited Moscow on February 15, pro-Kremlin Georgians said it was time for their country to reconsider its foreign-policy orientation. Scholz stated that Ukraine’s potential NATO membership was not on the agenda during his Russia visit. Dimitry Lortkipanidze, head of the Yevgeny Primakov Georgian-Russian Center, praised Scholz’s statement while speaking to pro-Kremlin far-right media outlet Alt-Info, claiming that Germany had brought dissonance to “Anglo-Saxon geopolitical plans.” According to Lortkipanidze, Georgia should participate in the so-called 3+3 format, a regional cooperation platform proposed by Turkey and Russia after the 2021 Nagorno-Karabakh war.
Lortkipanidze also compared the situation in eastern Ukraine with Yugoslavia. He said that if NATO had a legitimate right to bomb Yugoslavia to prevent genocide in the Balkans, then it should also consider that eastern Ukraine has been bombed for eight years. According to Lortkipanidze, the West does not have the political will to resolve this conflict and is engaged in “provocative actions.” He added that eastern Ukrainian territory is historically Russian, so the Russian constitution allows the Kremlin to defend ethnic Russians in Ukrainian territory.
Lortkipanidze said that a war with Ukraine was not on Russia’s political agenda, but the Kremlin would be obliged to resort to “military expansion” due to “a series of provocations.” Lortkipanidze said that the West had created the increased tensions of the Ukrainian crisis and could instigate a war, citing shipments of military equipment to Ukraine.
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Zakharova ridicules Ukraine and the West about possible military incursion dates
On February 15, the Russian Ministry of Defense claimed that Russia had started to partially pull troops back from the Ukraine border. On the same day, Maria Zakharova, spokesperson for the Russian Ministry of Foreign Affairs, wrote on Facebook that February 15 would go down in history as the day Western propaganda failed. Her post referred to the West’s predictions about the possible date of Russia’s incursion into Ukraine, while insisting that the Kremlin still has no plans to invade Ukraine. The following day, Zakharova wrote a Telegram post stating, “This is a request to the US and British disinformation media Bloomberg, The New York Times, The Sun, etc. to announce the schedule of our ‘invasions’ for the coming year. I would like to plan a vacation.”
Despite Moscow’s claims to have begun a withdrawal, NATO Secretary General Jens Stoltenberg argued that NATO had not seen any sign of de-escalation on the ground, but rather a continued increase in the number of Russian troops near Ukraine. Zelenskyy also stated on February 16 that Ukraine did not see any changes on the ground. The Associated Press reported on February 17 that US government officials believed Russia had sent an additional seven thousand troops to Ukraine’s borders.
Russia has a history of playing shell games regarding troop positions. Just eight days before its military incursion into Georgia in 2008, Russia announced that it had pulled out the last of its four hundred soldiers from Georgia’s breakaway region of Abkhazia.
—Givi Gigitashvili, DFRLab Research Associate, Warsaw
Telegram channels proliferate narrative claiming the West has given up on Ukraine
Pro-Kremlin Ukrainian Telegram channels continue to promote the idea that the West has given up on Ukraine and has handed it over to Russia. The ZeRada channel wrote about the gradual pressure for Ukraine to implement the Minsk agreements, presumably following the Russian interpretation of the agreements. The channel tried to explain the actions of Ukrainian elites and Western leaders, saying the latter likely tried to push Ukraine diplomatically toward the “destructive” agreements. ZeRada claimed the “measures” used to force Ukraine to implement the Minsk agreements included an “informational storm” to force investors to take money out of Ukraine and a ban on air travel above Ukraine. It also warned that “coffins” would ultimately be used to force Ukraine into concessions.
In another message, the same Telegram channel wrote that Russia recognizing the separatist Donetsk and Luhansk people’s republics could lead to both Russian and Russia-led forces in the Donbas attacking the Armed Forces of Ukraine. The post also stated that the West could still impose light sanctions, even if the incursion is minimal.
ZeRada and the Rezident Telegram channel promoted the claim that Scholz had pressed Zelenskyy to provide draft laws regarding the special status of the Donbas. In exchange, Germany allegedly promised to provide financial assistance to Ukraine. While both financial assistance and draft laws were a part of their conversations, there is no indication that those drafts will force Ukraine to make concessions.
—Roman Osadchuk, Research Associate, Kyiv, Ukraine
Telegram channels accuses the West of escalating hostilities for profit
The Rezident Telegram channel claimed that “the West continues to escalate the situation” around a probable Russian invasion to “sell energy resources to Europe at inflated prices.” In another message, the channel stated that foreign economies are making money off the crisis. It added that the United States and the United Kingdom are using Ukraine as a “ram” against Russia to solve their own problems. The channel cited UK Foreign Secretary Liz Truss, who said that the tensions might continue for a few months, to claim that the Ukrainian economy could not survive a drawn-out war.
Another Telegram channel, MediaKiller, quoted what it claimed was an article in Der Spiegel to argue that the United States “deliberately stirs up the situation” to earn money on resources while bankrupting Ukraine. It claimed that “America wants to hook up Europe to LNG [liquefied natural gas].”
Such messages are a part of a broader campaign to undermine trust in the Ukrainian government and its allies. The new wave of messages adds an “anti-Ukrainian” spin to Kremlin messaging that claims the West is overreacting and behaving hysterically.
—Roman Osadchuk, Research Associate, Kyiv, Ukraine
Cyberattack takes down Ukrainian government and bank websites
On February 15, state-owned banks and government websites in Ukraine were taken offline in a massive cyberattack. That afternoon, multiple people reported receiving a text message with false information stating ATMs were not working correctly. Later on, a large-scale DDoS attack was initiated, aimed at state banks PrivatBank and Oschadbank. Both their websites and mobile banking applications were affected. Bank representatives and Ukraine’s Centre of Strategic Communications reported there had been no threat to customers’ financial savings.
A Ukrainian website hosting service also reported a massive DDoS attack aimed at websites on the Ukrainian government domain gov.ua, citing a traffic volume of 150 gigabytes per second, which continued for five hours. Specialists claimed that it was the biggest attack of its kind in Ukrainian history.
The Armed Forces of Ukraine and Ministry of Defense websites were among the hardest hit government pages. In a statement, the Ministry of Defense reported that hackers exploited a vulnerability in the system used to protect the sites from DDoS attacks.
A similar attack happened on January 14 against multiple government websites that were defaced with a threatening message. The exact source of these attacks has not been established.
—Roman Osadchuk, Research Associate, Kyiv, Ukraine
Image: An interior view shows a kindergarten, which according to Ukraine's military officials was damaged by shelling, in Stanytsia Luhanska, Luhansk region, on February 17, 2022. Photo by Carlos Barria/REUTERS