As the crisis in Europe over Ukraine heats up, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, DFRLab’s global team presents the latest installment of the Russian Hybrid Threats Report.
More Russian equipment arrives along Ukraine’s northern border
Russian narratives of “junk” weapons supplied by the West
Russian outlets claim Ukraine is preparing military offensive
Russian Duma member claims Ukrainian is a Russian dialect spoken in a artificially created nation
Old biolab conspiracy resurfaces
The military inspection that never happened
Baltic states targeted by inauthentic Twitter accounts
Russian media spotlight anti-NATO politicians
Facebook ads push Kremlin narratives in Georgia
More Russian equipment arrives along Ukraine’s northern border
The DFRLab has tracked military equipment arriving in Gomel and Brest oblasts, in southeastern and southwestern Belarus, respectively, as well as a resumption of equipment arriving near Russia’s border with northern Ukraine. While Russia claims that the equipment is in Belarus for upcoming joint exercises, the units spotted in Gomel Oblast are nowhere near known training areas. Instead, they appear to be congregating in temporary camps in open fields not far from Ukraine’s northern border.
In addition, the 217th Airborne Regiment has arrived in Belarus, alongside Russian aviation assets. On January 27, Kremlin-owned media outlets announced that Russian SU-35S fighter jets were successfully deployed to Belarus. They claimed the fighter jets will be part of the Allied Resolve joint military exercise between Belarus and Russia. Footage of these jets in Belarus appeared online as early as January 22. The fighter jets appear to be deployed at Baranovichy air base in southern Belarus.
While the flow of military equipment into Belarus from the Russian Eastern Military District continues, there has also been a resurgence in activity in Russia’s Smolensk and Voronezh oblasts, and to some extent Bryansk Oblast, northeast of Ukraine. Notably, the 4th Tank Division appears to have resumed its movement from Moscow to the Pogonovo training grounds south of Voronezh city after a lull in December and early January.
Other developments include the emergence of pontoon bridges in areas where troops are positioned near the Dnieper River.
Meanwhile, Belarusian President Alyaksandr Lukashenka announced on January 24 that he would send the “whole contingent of the Belarusian army” to the Ukrainian border. According to Lukashenka, Ukrainians have already started pulling their troops together on the southern border of Belarus, which, he said, he must keep safe.
—Lukas Andriukaitis, DFRLab Associate Director, Brussels
—Michael Sheldon, DFRLab Research Associate, Washington, DC
Additional reading from the DFRLab:
Russian equipment flows into Belarus
Russian narratives of “junk” weapons supplied by the West
Between January 17-19, the United Kingdom sent two thousand Next Generation Light Anti-tank Weapons to Ukraine. The United States also shipped additional Javelin anti-tank missiles to Ukraine, alongside other types of military assistance, including small arms and ammunition, secure radios, and medical equipment.
Russian officials were quick to condemn the shipments.
The DFRLab observed state-controlled outlets publishing unsubstantiated claims about how the weapons would be used. The Russian Embassy in the United States wrote on Facebook that the United States was aware that weapons shipped to Ukraine would eventually “end up in the hands of terrorists and militants in Ukraine.” Along similar lines, a Sputnik article claimed the likelihood of US and British weapons being transferred to neo-Nazis was higher than ever and could lead to the death of many residents in the Donbas region of occupied eastern Ukraine.
Kremlin-controlled outlets also pushed false claims about the quality of the weapons. Media outlet Vesti claimed that the US Javelins “could not even hit the old Soviet tank.” The article also purports that UK anti-tank missiles are becoming obsolete, and the British government found a profitable way to get rid of them. An article published by Gazeta.ru claimed that the Baltic countries sent their old anti-tank and surface-to-air missiles to Ukraine, and in exchange hoped to receive newer supplies from the United States. An article published by RIA FAN alleged that the United Kingdom had no intention of supplying Ukraine with modern weapons and was forcing the country to accept decommissioned anti-tank systems. A Tsargrad article also asserted that British anti-tank missiles were outdated, and using them could harm Ukrainian soldiers.
Kremlin-controlled media also amplified Ukrainian voices critical of the weapons shipments to Ukraine. Valeriy Hnatenko, a pro-Russia Ukrainian parliament member, was cited in Ria Novosti, Lenta, Ukraina.ru, and other outlets after claiming that Washington sent outdated weapons to Kyiv and that Ukraine already possessed weapons that are more powerful than the American Javelin missiles. Vladimir Mulik, a pro-Russian commentator and former employee of the Ukrainian Security Services, was cited by Sputnik, Ria Novosti, Rambler, and Lenta after alleging that British anti-tank systems would expire in 2022.
Meanwhile, Russian Foreign Minister Sergei Lavrov said that by supplying weapons to Ukraine, the United States was pushing Ukraine towards a provocation against Russia.
Pro-Kremlin commentators and media outlets also tried to downgrade the importance of the newly supplied weapons. For example, an RT article asserted that the size of the supplies and the quality of the weapons would not provide any significant advantage to Ukraine, and that the United States was creating a dangerous illusion of support for the country. The article also said that Ukraine was not receiving the weapons for free and that Western countries had economic incentives to provide support.
—Givi Gigitashvili, DFRLab Research Associate, Warsaw
Russian outlets claim Ukraine is preparing military offensive
Russian-controlled sources amplified a narrative claiming that Ukraine is actively preparing a military offensive. On January 26, the so-called People’s Police of the separatist Donetsk People’s Republic reported on Telegram that Ukrainian-controlled parts of Donetsk and Luhansk received an order to create an evacuation plan for those living near the front lines of possible conflict areas. The DFRLab could not find any credible reports confirming that such an order had been issued. Pro-Kremlin sources Eurasia Daily, RIA, Tsargrad, and Radio Vesti amplified variants of this report.
This story fits the broader Kremlin narrative that Ukraine is preparing to launch an offensive attack or provocation against Donetsk, Luhansk, or Crimea. Recently, Kremlin Press Secretary Dmitry Peskov claimed that the threat of Ukrainian provocations in Donbas was relatively high. The narrative was also parroted by the head of Crimea’s parliament and by a representative of the People’s Police in separatist-occupied Luhansk. Meanwhile, Kremlin-owned RIA quoted former Ukrainian Prime Minister Mykola Azarov claiming that an evacuation from Donbas is likely if an offensive is launched.
In another article, Grigory Karasin, the head of Russia’s Federation Council Committee on International Affairs, claimed that while Ukraine might not wish for further escalation, Washington had to “whip up hysteria around a hypothetical invasion” to continue to put pressure on Russia. This is a continuation of the false narrative that the current crisis the result of Western aggression against Russia.
—Roman Osadchuk, DFRLab Research Associate, Kyiv
Russian Duma member claims Ukrainian is a Russian dialect spoken in a artificially created nation
On January 25, at a plenary session of the Russian Duma, Fair Russia party member Anatoly Wasserman made a number of controversial statements. He claimed that the Ukrainian language is a dialect of Russian rather than a language in its own right and compared Ukrainian to slang used by criminals. He said that the widespread adoption of Ukrainian does not mean that it should be recognized as a language.
Wasserman also called Ukraine an artificially created nation, saying it was only independent on paper and not in reality. He referred to the current Ukrainian government as “terrorists” who are protected by the United States, which he claimed would postpone an attack on either Donbas or Transnistria until August 2022 to raise the Democratic Party’s chances of winning midterm elections in November.
Wasserman is a former Ukrainian citizen who promotes the myth that Ukraine and Russia are one nation. Some Russian media criticized his statements.
—Roman Osadchuk,, DFRLab Research Associate, Kyiv
Old biolab conspiracy resurfaces
Ukrainian pro-Kremlin media published an “investigation” suggesting that the Pentagon conducted biological experiments on 4,400 Ukrainian and 1,000 Georgian soldiers. According to the story, the experiment measured antibodies against Crimean-Congo hemorrhagic fever and the hantavirus. This narrative is a continuation of a widely disproven conspiracy theory dating back many years, while the article itself is based on a debunked 2018 story published by a Bulgarian journalist with Russian ties.
—Roman Osadchuk,, DFRLab Research Associate, Kyiv
The military inspection that never happened
This week, representatives of Latvia’s armed forces were scheduled to inspect Russian military districts in Bryansk and Smolensk, as part of the Organization for Security and Cooperation in Europe (OSCE) treaty to monitor the scope of military activities, particularly those that must be announced in advance within the framework of the Vienna Document. However, Russia’s Defense Ministry declined the January 21 visit. Despite this decision, pro-Kremlin media including RIA Novosti, Baltnews Latvia, and Regnum incorrectly reported that the visit took place between January 24-29, citing Sergei Ryzhkov, the head of Russia’s National Center for Nuclear Risk Reduction. Such a move suggests that Russia wants to project the appearance of transparency while simultaneously avoiding it.
—Nika Aleksejeva, DFRLab Lead Researcher, Riga, Latvia
Baltic states targeted by inauthentic Twitter accounts
A network of inauthentic Twitter accounts spread a narrative claiming Russia will evacuate personnel from its embassies in Lithuania, Latvia, and Estonia, according to disinformation researcher Markian Kuzmowycz.
The tweets from the network claimed that the evacuation order was prompted by “continued United States efforts to destabilize” the Baltic states and undermine the security of Baltic-state residents. The accounts amplified several versions of the tweets, with the only other difference being which country—Lithuania, Latvia, or Estonia—was targeted.
The profile photos used by the inauthentic Twitter accounts were created using StyleGAN, a machine-learning framework that generates synthetic faces. Kuzmowycz identified thirty-six accounts spreading the same four messages, totaling 2,030 tweets. All the accounts were created this month.
The DFRLab examined some of the accounts in the network prior to their suspension and found that they all had Russian names, with their Twitter handles following the same pattern consisting of the first letter of a first name followed by a surname and a two-digit number, such as @mkorolev89 or @afokin92. The accounts had zero followers and did not tweet original content but frequently retweeted other content, all common indicators of inauthentic activity.
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
Russian media spotlight anti-NATO politicians
During a January 25 press conference, Croatian President Zoran Milanović said that Ukraine should not be accepted into NATO and that “Croatia will not send any troops” in the case of a military conflict between Ukraine and Russia. Milanović stated he would recall all troops “to the last Croatian soldier,” adding that any deal should consider “the security interests of Russia.”
Milanović’s statements quickly made headlines on pro-Kremlin media, including Tsargrad, Gazeta.ru, MK.RU, Izvestiya, Russkaya Vesna, and Komsomolyskaya Pravda. For example, RIA FAN, an outlet associated with Russia’s Internet Research Agency, published an article titled “Telegram users agreed with the words of the President of Croatia on the withdrawal of troops from NATO.”
Gordan Grlić Radman, Croatia’s minister of foreign affairs, rejected Milanović’s statements and offered assurances that Croatia “will remain a loyal member of NATO,” adding: “Everything we do, we do in consultation with our partners.”
Andrej Plenković, the prime minister of Croatia, apologized to Ukrainians via Twitter, saying: “Given the fact that none of our soldiers are in Ukraine and the contingent in Poland has already returned, I don’t know which military the president intends to withdraw. His statement on corruption in Ukraine is not our position, and on behalf of the government, I apologize to Ukrainians for such insinuations.” Several pro-Kremlin outlets, including Gazeta.ru, Izvestiya, and MK.RU, reported Plenković’s apology.
More broadly, pro-Kremlin media are intentionally giving a platform to NATO-skeptic politicians. A January 25 opinion piece published by Sputnik Moldova argued that NATO would not protect Ukraine if Russia were to invade. The article, written by Aleksandr Hrolenko, a columnist at the Kremlin-owned outlet Rossiya Segodnya, draws on politicians’ statements and previous actions from NATO member states to make its point.
Meanwhile, RT interviewed Manuel Pineda, a Spanish member of European Parliament. “We are not interested in any wars,” he said. “This is all a provocation by the US and NATO, who want to change the world order as they are losing influence when it comes to developing countries.” RT also reported on Michel Larive, a member of the French National Assembly, saying that France should leave NATO and that the Alliance should have ended after the Cold War. Similarly, RIA Novosti reported on an interview in French media outlet Atlantico with Éric Denécé, founder and director of the French Intelligence Research Center. He expressed that France “should definitely” leave NATO.
—Nika Aleksejeva, DFRLab Lead Researcher, Riga, Latvia
Facebook ads push Kremlin narratives in Georgia
Last week, the ruling Georgian Dream political party was criticized for its silence around the situation in Ukraine. This week, a multi-party effort to draft a resolution in support of Ukraine was met with harsh criticism because the resolution did not mention Russian military aggression. Opposition parties refused to sign the document and the resolution failed.
Georgian pro-Kremlin Facebook page Politicano, affiliated with the Yevgeny Primakov Public Center and Kremlin-affiliated media organization News Front Georgia, sponsored several posts on Facebook targeting Ukraine and NATO. According to the Media Development Foundation, a Georgian counter-disinformation research organization, Politicano sponsored at least eight posts between December 1 and January 22. The ads pushed longstanding Kremlin narratives about Ukraine being a failed state and a supporter of Nazis while also highlighting Russia’s military strength advantages compared to Ukraine. The sponsored posts also targeted Ukrainian President Volodymyr Zelenskyy, calling him a clown.
Meanwhile, the pro-Kremlin political party Conservative Movement and its affiliated media outlet, Alt-Info, continue pushing anti-NATO, anti-Ukrainian, and pro-Kremlin narratives. Conservative Movement leader Giorgi Kardava said that Ukraine made a geopolitical mistake aligning with the West and forced Russia to resort to aggression. On January 25, a guest on an Alt-Info Facebook video program said that NATO needlessly supplies weapons to Ukraine despite Russia only carrying out military operations in its own territory. The guest blamed the United States and the European Union for spreading the idea that Russia is preparing for war.
Lastly, Sputnik Abkhazia, a branch of the Kremlin-controlled Sputnik news outlet that covers the breakaway region of Abkhazia, raised the specter of nuclear war, saying that Russia reserves the right to use nuclear weapons in response to a nuclear threat or a severe case of aggression against Russia.
—Sopo Gelava, DFRLab Research Associate, Tbilisi, Georgia
Image: A live broadcast of Russian President Vladimir Putin's annual end-of-year news conference in a control room of the Public Television of Russia (OTR) TV Channel. Photo by Anton Novoderezhkin/TASS.