Russian Hybrid Threats Report: Military camps close in on border as Kremlin accelerates false-flag narratives

As the crisis in Europe over Ukraine heats up, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, DFRLab’s global team presents the latest installment of the Russian Hybrid Threats Report

While the Kremlin announced today that units from its Western and Northern military districts have begun loading equipment onto trains to return to their bases, the DFRLab continues to observe other units positioning themselves closer to Ukraine’s northeast border with Russia.

Russian camps move closer to Ukrainian border

First footage of joint military drill surfaces as Russian build-up in Belarus continues

Russian Duma votes to ask Putin to recognize Donetsk and Luhansk independence

Russian media target UK foreign minister after meeting with Lavrov 

Kremlin-controlled media react to US, UK, and Canadian forces leaving Ukraine

Donetsk People’s Republic leader makes unfounded claim of mass grave discovery 

Pro-Kremlin Ukrainian MP claims Zelenskyy plans to “massacre Russians” 

Pro-Kremlin media outlet amplifies unsubstantiated claims about Ukraine shelling Donetsk 

Kremlin media rehash old narrative that the US is giving up on Ukraine

Airspace hysteria as Ukraine-bound flight lands in Moldova

Phantom explosion reports in Donetsk

Russian camps move closer to Ukrainian border

Over the past few weeks, previous build-up sites at Yelnya and Voronezh have steadily emptied, with military equipment now coalescing in areas near Ukraine’s northeastern border in the Russian oblasts of Bryansk, Kursk, and Belgorod in particular. New camps closer to the border appear to be forming, and camps at Valuyki and Postoyalye Dvory have swollen in size, the former just five kilometers from the border. In Belgorod Oblast, large amounts of helicopters have appeared, along with surveillance radars and S-300V air defense and anti-ballistic missile systems. In Kursk, new units arrived near the border and throughout the oblast, and a 64N6 acquisition radar for the S-300 air defense system was spotted moving through Kursk city. Activity continued in other areas of Russia bordering Ukraine, as well as in Crimea and Belarus.

Michael J. Sheldon, Research Associate, Washington DC

Russian ground forces’ posture as of February 15, 2022, based on geolocation efforts by open-source researchers at the DFRLab and elsewhere. (Sources: @michael1sheldon/@The_Lookout_N/@CITeam_en via OpenStreetMap)

First footage of joint military drill surfaces as Russian build-up in Belarus continues

Footage has surfaced from the joint Russia-Belarus military drill Allied Resolve, filmed primarily by Russian and Belarusian state media outlets. A number of videos from the joint exercises showed drills with various rocket launchers, including the BM-27 Uragan, TOS-1A, and BM-30 Smerch. Additional footage captured armored vehicle maneuvers, including tanks and infantry fighting vehicles. These maneuvers are likely happening at the military training grounds in Brest Oblast. Exercises commenced on February 10 and are scheduled to run for ten days.

On February 12, a video surfaced of a Russian fuel convoy, showing at least seventeen Russian fuel trucks moving through the Rahachouski district in Gomel, Belarus. On the same day, a military convoy spotted in Naroulya, also in Gomel, included KamAZ and Ural military trucks, as well as BM-21 Grad multiple rocket launchers. This convoy was spotted roughly twenty kilometers from the Ukrainian border. A similar convoy was seen on February 13, close to Kalinkavichy district, Gomel.

Between February 10-12, reports and video footage emerged of Russian military helicopters arriving in Belarus. These helicopters were spotted in the Machulishchi and Cherven regions, south and east, respectively, of the city of Minsk. In the event of an invasion of Ukraine, attack helicopters could be used to provide air support for ground troops, while transport helicopters could be used to move units inside Ukrainian territory. The New York Times estimates that at least fifty attack and transport helicopters are currently in Machulishchi, Belarus and Valuiki, Russia.

On February 10, the Baltic states initiated a formal transparency request under the Vienna Document of the Organization for Security and Co-operation in Europe (OSCE), of which Belarus is a member. The Vienna Document is a mechanism for states to exchange information and ensure military transparency, and this request aims to “encourage Belarus to disclose key data” about the Allied Resolve exercise.  

Ukraine also invoked the Vienna Document on February 11 to formally request information from Russia about the military build-up at the Ukraine border. On February 14, Ukrainian Foreign Minister Dmytro Kuleba said Russia had failed to respond and announced that he would take the next step, to request a formal meeting be held with Russia within forty-eight hours.

Lukas Andriukaitis, Associate Director, Brussels Belgium

Russian Duma votes to ask Putin to recognize Donetsk and Luhansk independence

The Russian Duma voted on February 15 to formally ask Russian President Vladimir Putin to recognize eastern Ukraine’s breakaway regions—the so-called Donetsk People’s Republic (DNR) and Luhansk People’s Republic (LNR)—as independent states. The ruling United Russia party had earlier submitted a draft resolution to Russia’s parliament regarding their recognition. The resolution will now be sent to Putin for approval. A decision to recognize the independence of Ukraine’s eastern regions could further escalate the ongoing conflict, as it would nullify aspects of the Minsk agreements pursuing reintegration into Ukraine, and potentially serve as a pretext for invasion.

Eto Buziashvili, Research Associate, Tbilisi, Georgia

Russian media target UK foreign minister after meeting with Lavrov 

A deluge of negative reporting from Russian media emerged following British Foreign Secretary Liz Truss’s February 10 meeting with her Russian counterpart, Sergei Lavrov. Most media outlets in Russia, and several in the United Kingdom, picked up on Lavrov’s characterization of the meeting as a conversation between “the mute and the deaf.” 

Another popular narrative that emerged from the Truss-Lavrov meeting amplified by proKremlin and Kremlinowned media insinuated that Truss was geographically illiterate because she didn’t know the regions of Rostov and Voronezh were in Russia. The narrative emerged when Russian media outlet Kommersant reported on the closed-door meeting, citing two diplomatic sources saying Lavrov had asked Truss whether she questioned Russia’s sovereignty over the two regions. Truss reportedly replied, “Great Britain will never recognize the sovereignty of these regions,” even though they are within Russian territory. Later, the UK embassy in Russia tweeted a quote from an interview Truss did with RBK, an independent Russian media outlet, in which she said, “During the meeting, I thought that Minister Lavrov was talking about a part of Ukraine. I made it clear that these regions [Rostov and Voronezh] are part of sovereign Russia.” Later, Dmitry Peskov, the spokesman for the Russian president, reportedly said he “hopes” that Truss’s mistake was a “slip of the tongue.”

Additionally, pro-Kremlin media outlets Lenta and Izvestiya cited a tweet by RT journalist Bryan McDonald. In the tweet, McDonald mocked Truss for wearing a fur hat and a coat while it was 2 degrees Celsius, just above freezing. “Warmer than London will be tonight, according to the forecast,” he added.

Nika Aleksejeva, DFRLab Lead Researcher, Riga, Latvia

Kremlin-controlled media react to US, UK, and Canadian forces leaving Ukraine

Over the weekend, the United States, United Kingdom, and Canada ordered military personnel to leave Ukraine amid reports that Russia could invade “at any time.” Pro-Kremlin media, such as Polit Rossiya, RIA FAN, and Vzglyad, reported on the situation by citing Russian Foreign Ministry spokesperson Maria Zakharova, who told the TV show Solovev LIVE, “Their mission is done there; they did something there already.” Voennoe Obozrenie, a pro-Kremlin media outlet, twisted the story to suggest the withdrawal could be an “informational cover-up for an operation against Donbas.” Additionally, Regnum, another pro-Kremlin outlet, compiled a series of quotes they claimed came from social-media users in Ukraine. The headline of the article includes the phrase “done fighting” (навоевались), suggesting to readers that military instructors from the United States, United Kingdom, and Canada were not serious about helping Ukraine in case of a military confrontation.  

Nika Aleksejeva, DFRLab Lead Researcher, Riga, Latvia

Donetsk People’s Republic leader makes unfounded claim of mass grave discovery 

On February 11, Denis Pushilin, the head of the separatist Donetsk People’s Republic (DNR), claimed that more than 130 civilians had been found in a mass grave discovered on DNR territory. The separatist leader asserted that the civilians died due to Ukrainian aggression, citing gunshots, mines, and blunt-force trauma as the causes of death. According to Pushilin, most of the dead were between thirty and sixty years old, though they included women, children, and the elderly, all of whom were buried in civilian clothes. The DNR announced that a criminal case had been opened over what Pushilin called “ethnic cleansing” committed by Ukraine. In addition, the TV channel Perviy Sevastopol asserted that throughout the course of Ukraine’s aggression against the self-proclaimed republic, more than three hundred children had been injured, many of whom now suffer from disabilities.   

The separatist leader has not presented any evidence to support his mass grave claim. Instead, this narrative is more likely part of Russia’s broader attempt to create possible justifications for a military incursion into Ukraine. As US National Security Adviser Jake Sullivan previously argued, Russia could create a false-flag operation to trigger military action. 

Givi Gigitashvili, Research Associate, Kyiv, Ukraine 

Pro-Kremlin Ukrainian MP claims Zelenskyy plans to “massacre Russians” 

Ilya Kiva, a member of Ukraine’s Parliament from the pro-Kremlin political party Opposition Platform—For Life, made a similarly provocative claim without any evidence that Ukrainian President Volodymyr Zelenskyy is preparing a “massacre of Russians” at the hands of Ukrainian “Nazi groups.” 

According to the Telegram post:

Zelenskyy’s government is closing TV channels, blocking YouTube channels, internet sites and Telegram channels to prepare the country for an information vacuum and informational isolation of the population. They will create legal lawlessness and prepare a “massacre” of unwanted, the Russian population. They will be called the enemies of Ukraine. All this will be done at the hands of Nazis. The Nazis themselves have long made no secret of their plans to start a massacre of Russians inside the country. In the near future, the internet and communications may be disconnected. 

Kiva’s post garnered more than thirteen thousand views on Telegram. Kremlin-owned and pro-Kremlin online outlets amplified the post. Some outlets used the word “genocide” to describe Kiva’s claim.  

Eto Buziashvili, Research Associate, Tbilisi, Georgia

Pro-Kremlin media outlet amplifies unsubstantiated claims about Ukraine shelling Donetsk 

On February 5, the Telegram channel Novorossiya Militia Reports (Сводки ополчения Новороссии) posted, “The Armed Forces of Ukraine opened artillery fire in the north of Donetsk, the area of the airport and Yakovlevka… Something is burning in the Yakovlevka area.” In addition, the Novorossiya website claimed that residents of the city woke up to the sounds of Ukrainian artillery.   

This claim was picked up by the Russian pro-Kremlin media outlet Moskovskij Komsomolets, which reported that Ukrainian forces had started an offensive in Donetsk, using mortars, small arms, grenade launchers, and large-caliber artillery. 

The Novorossiya Telegram post included a photo of what appears to be plumes of smoke on the horizon. However, it is not clear what caused the smoke in the image. The OSCE sent a special monitoring mission to Ukraine, which recorded thirty-eight explosions in the Donetsk region between February 4-6, but no claim of responsibility was made for the explosions. A fact-check from Polygraph.info says the claims of a Ukrainian attack on Donetsk are “unsubstantiated.”

The DFRLab also found a recently created Telegram channel that constantly spreads false information about alleged military clashes between Ukrainian and Russian forces. The channel АГРЕГАТОР (“Aggregator”) was launched on January 4; its first post appeared on February 13, falsely claiming that military clashes between Ukraine and Russia had started, leaving six Ukrainians and one Russian dead. On the same day, the Telegram channel South Caucasus Production falsely claimed that Russia had managed to gain control of 37 percent of Ukrainian territory.

Roman Osadchuk, Research Associate, Kyiv, Ukraine 

Kremlin media rehash old narrative that the US is giving up on Ukraine

During a live broadcast of pro-Russian TV channel NASH, Ukrainian political commenter Aleksandr Lazarev claimed, “Americans are doing concessions for Russia to prevent Russia’s merge with China. They are ready to give Ukraine away.” NASH was recently sanctioned by Ukraine for its connection to pro-Russian politician Yevhen Murayev. Recently, the United Kingdom named Murayev as a possible candidate to lead a pro-Kremlin government in Ukraine in the event of an invasion and coup.

Lazarev’s remarks received significant amplification from pro-Kremlin media. One headline read, “In Kyiv, announcement that Biden is ready to ‘give up’ Ukraine to Russia.” This is not a new narrative, as claims that the United States surrendered Ukraine to Russia have appeared in pro-Kremlin sources as far back as five years ago.

 —Roman Osadchuk, Research Associate, Kyiv, Ukraine 

Airspace hysteria as Ukraine-bound flight lands in Moldova

On February 13, Ukrainian media reported that oligarchs and business owners are leaving Ukraine, citing FlightRadar data tracking chartered flights and private jet departures. Notably, the report claimed that Igor Abramovich, a parliament member from a pro-Russian political party, ordered a private jet for fifty passengers. Although multiple sources claimed the departures were for short pre-planned trips or scheduled maintenance, the Ukrainian outlet Pravda said it represents the largest number of chartered flights in six years of observation. The story was circulated in pro-Kremlin media. Ten hours before Pravda published its article, a Kremlin-tied Telegram channel in Ukraine published a rumor that oligarchs were leaving Ukraine.

On February 12, the sanctioned pro-Kremlin Ukrainian media outlet Strana UA published a story that international insurance companies plan to stop covering incidents in the skies above Ukraine, which could prevent airlines from flying to Ukraine. Strana UA’s article was published within an hour of Dutch airline KLM’s announcement that the company will stop flying to Ukraine. The next day, flight PQ0902, operated by Ukrainian airline SkyUP, landed in Chisinau, Moldova, instead of Kyiv. The airline said the plane’s owner, a resident of Ireland, “informed the airline of an immediate ban on the entry of the UR-SQO aircraft into Ukrainian airspace.” Despite efforts involving government agencies to persuade the owner to allow the plane into Ukraine, they “flatly refused.”

Kremlin-owned RIA picked up the Strana UA article with the headline, “The West is closing airspace over Ukraine,” and multiple other media outlets followed suit. The Ukrainian government refuted speculation that its airspace was closed but acknowledged that due to the fluctuations in the insurance markets, the Ukrainian government should subsidize air carriers. 

 —Roman Osadchuk, Research Associate, Kyiv, Ukraine

Phantom explosion reports in Donetsk

On February 12, RT reported another explosion in Donetsk, citing unnamed local media. Two minutes after reporting the explosion, the pro-Russian Strana UA Telegram channel published a screenshot of a user’s comments discussing an explosion near Donetsk airport. Within twenty minutes, RT’s editor-in-chief Margarita Simonian wrote, “Is it started?” insinuating that Ukraine had started a war. She later posted “confirmation” that the explosion had taken place on Ukraine’s side of the line of control, but then added that RT correspondents in Donetsk did not hear any explosions. RT also published comments from Eduard Basurin, a representative of the so-called people’s police of the DNR, who claimed that he did not hear anything. Sometime later, Simonian chimed in again and forwarded a message that said the explosion was “Ukrainian disinformation.” 

Ukraine’s Joint Forces Operation published a statement that Ukrainian troops have followed the ceasefire and did not conduct any shelling. In the evening, DNR leader Denis Pushilin claimed that the situation was under control and that the explosion on Ukrainian-controlled territory might have been “a filming of provocation,” which would align with previous claims from separatist leaders.

Roman Osadchuk, Research Associate, Kyiv, Ukraine 

Image: Image grab from footage released on February 15, 2022, by Russia shows tanks from the units of the Western Military District are returning to their points of permanent deployment (bases) from undisclosed location near Ukraine. Photo by EYEPRESS via Reuters Connect