As the crisis in Europe over Ukraine heats up, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union (EU), DFRLab’s global team presents the latest installment of the Russian Hybrid Threats Report.
S-400 missile systems spotted in Belarus as the national guard mobilizes in Chechnya
False claims by Belarusian media as small rallies support Lukashenka in Minsk
Putin speaks out against Ukraine joining NATO
Ukrainian police arrest group allegedly planning mass riots in Kyiv
Head of Luhansk separatist region warns Congress against sanctions
Russian-language Twitter accounts mock Latvian military capabilities
New Ukraine-Poland-UK initiative criticized by Kremlin media
Russian foreign ministry claims electricity outage, but videos show otherwise
S-400 missile systems spotted in Belarus as the national guard mobilizes in Chechnya
Over the past week, the Russian military buildup near Ukraine and in Crimea has continued at a steady pace.
In Belarus, the DFRLab noted the arrival of the 69th Covering Brigade and the 101st Logistics Brigade in Gomel Oblast from the Eastern Military District. On February 3, the DFRLab confirmed the arrival of the 2nd S-400 Triumph Missile Battalion in Belarus at Luninets station, fifty kilometers from the Ukrainian border. Additional footage of S-400 Triumph anti-aircraft missile systems had first surfaced on February 2. This is the first time the DFRLab has observed S-400s inside Belarusian territory.
Pantsir short-range air defense systems were previously observed arriving at Luninets station. Meanwhile, assets from the Russian Airborne Forces continued to arrive in Brest and Gomel oblasts.
Additionally, river-crossing equipment including pontoon bridges and amphibious transport vehicles arrived in Gomel Oblast and were spotted heading from Gomel in the direction of Rechitsa, approximately sixty kilometers from the Ukrainian border and three hundred kilometers due north of Kyiv. This is a cause for concern since Russia might use this equipment in offensive operations in the river-dense areas north of Kyiv, notably including the Dnipro River, which forms a natural border between Ukraine and Belarus.
Also spotted in the Gomel region was a Krasukha-4 electronic warfare (EW) system, accompanied by R-934UMV and Leer-3 EW systems. The Krasukha-4 is an advanced system which may be used to interfere with early-warning and reconnaissance aircraft, including NATO aircraft that currently operate within Ukraine collecting information on the build-up. The R-934UMV and Leer-3 offer additional options to interfere with radio and cellular signals. Notably, Russia has used the Leer-3 in the past to send demoralizing text messages to Ukrainian soldiers in the field. Throughout the past several weeks, several trains carrying armored vehicles were also spotted carrying Borisoglebsk-2 EW systems that are capable of monitoring and interfering with enemy signals. In addition to these systems spotted in Belarus, Infauna and Leer-2 EW systems have also been spotted on trains moving from the Russian far east to Belarus.
Meanwhile, the 200th Motor-Rifle Brigade of the Russian Northern Fleet has begun moving equipment south from the Murmansk Oblast towards a currently unknown destination. This equipment includes weapons such as rocket artillery, self-propelled artillery, short-range air defense, armored personnel carriers, and tanks.
Movement of military equipment continued in Bryansk, Rostov, and Voronezh oblasts, and Krasnodar Krai, as well as Crimea. Air-defense and radar systems are still moving throughout Russia. In Rostov Oblast, the DFRLab geolocated the movement of S-300V missiles, meant to counter aircraft and ballistic missiles. A Nebo-M early-warning radar complex was spotted moving through Voronezh Oblast, where an S-400 battalion was reportedly seen moving at night.
This week also saw the mobilization of Rosgvardiya units all throughout Russia, including the Kadyrov regiment from Chechnya, in the general direction of Ukraine. Rosgvardiya, the Russian national guard, could serve to hold territory in the event of an invasion.
Ambassador Linda Thomas-Greenfield, head of the US Mission to the United Nations, claimed during a UN Security Council meeting on February 1 that Russia had amassed five thousand troops in Belarus, in addition to “short-range ballistic missiles, special forces, and anti-aircraft batteries.” According to Thomas-Greenfield, this number is expected to grow to thirty thousand in early February.
—Michael Sheldon, DFRLab Research Associate, Washington DC
—Lukas Andriukaitis, DFRLab Associate Director, Brussels
False claims by Belarusian media as small rallies support Lukashenka in Minsk
On February 1, CNN reported that the US State Department had ordered family members of employees at the US embassy in Belarus to leave the country. Belarusian media outlet NEXTA falsely claimed that the US embassy plans to halt work on February 21 and that all employees except security guards would be fired.
Meanwhile, videos on social media this week showed small rallies in Minsk in support of Belarusian President Alyaksandr Lukashenka. The demonstrations were likely a response to anti-Lukashenka and anti-Putin protests and flash mobs that were reported in Belarus throughout January.
—Lukas Andriukaitis, DFRLab Associate Director, Brussels
Putin speaks out against Ukraine joining NATO
On February 1, Russian President Vladimir Putin commented on allegedly leaked documents, published by the Spanish newspaper El Pais, that claim to reveal the United States’ and NATO’s written response to security demands made by Russia on December 17. While the source of the leak is unclear, US officials had previously speculated that the Kremlin would leak them at some point.
During a joint press briefing with Hungarian Prime Minister Viktor Orbán, Putin complained that “the principal security concerns of Russia were ignored” by NATO and the United States. Toward the end of the press conference, he repeated the falsehood that NATO previously promised not to expand eastwards: “Said one thing, did the other thing,” Putin said. “Now people are saying—they threw us under the bus (кинули), just tricked us (просто обманули).” This quote appeared in multiple headlines from pro-Kremlin media, including Komsomolyskaya Pravda, iReactor, Gazeta.ru, MK.RU, Lenta, Rambler, and REN TV, among others.
Putin also explained his logic regarding the perceived threat of Ukraine joining NATO. “Ukraine’s doctrine documents say that they want to return Crimea, including by military means,” he said. “Let’s imagine that Ukraine is a NATO member state and starts these military operations. Should we fight with NATO?” This statement was covered by many neutral news outlets in Russia, including BBC Russia, Radio Svoboda, Forbes Russia, Novaya Gazeta, and Meduza. Outside of Russia, Belarusian outlet Charter97 and the Russian branch of Delfi Latvia also wrote about the statement. Some pro-Kremlin outlets, like Sputnik Radio and Regnum, also picked up on this comment. And as part of its coverage of Putin’s remarks, pro-Kremlin outlet Tsargrad complained that the Ukrainian Armed Forces had fired live rounds “not far from Crimea” during a military exercise on February 2.
During the press briefing, Putin also stated that the United States does not care about Ukraine’s security and that its “main task is to prevent Russia’s development.” Putin also falsely denied that NATO has any “open-door policy” written in its founding act.
—Nika Aleksejeva, DFRLab Lead Researcher, Riga, Latvia
False narratives regarding Ukrainian conscription, the forced departure of US and UK citizens, and the use of NATO mortars
Kremlin-owned media continue to amplify messaging from Ukrainian separatist regions. One narrative circulated on February 3 claimed that Ukraine would limit men of conscription age from leaving the country. While such a decision would violate Ukrainian law, this narrative likely emerged to create panic among the civilian population. The Ukrainian government’s Centre for Strategic Communication debunked the claim, calling it a “provocation.”
That same day, multiple Russian outlets reported that Ukraine asked diplomats to urge foreigners to leave the breakaway Donbas region, citing the so-called People’s Police of the separatist Donetsk People’s Republic (abbreviated DNR in Russian). The articles indicated that a few diplomatic missions had already announced the departure of staff. This is likely referencing the decision from the British embassy in Ukraine to withdraw dependents and some embassy staff, and the US embassy’s authorization for the voluntary departure of staff and dependents, both announced on January 24. While both the United Kingdom and the United States advise against non-essential travel to Ukraine, they have not made statements advising their citizens to depart the country.
Another narrative claimed that arms deliveries to Ukraine “inspire” aggression toward Russia. Natalia Nikonorova, DNR Minister of Foreign Affairs, claimed that Ukraine fired 60-millimeter mortars in the eastern Ukrainian town of Olenivka. She alleged that this ammunition is a standard NATO round and that Ukraine has never used this weaponry before, despite previous reporting documenting the use of domestically manufactured 60-millimeter mortars in the country. The narrative emerged during Nikonorova’s interview with Kremlin-owned outlet RIA and was later amplified by other outlets. This aligns with previous attempts by pro-Kremlin outlets to allege that Ukraine is preparing for an attack.
—Roman Osadchuk, Research Associate, Kyiv, Ukraine
Ukrainian police arrest group allegedly planning mass riots in Kyiv
On January 31, Ukraine Internal Affairs Minister Denys Monastyrskiy announced that police had arrested a group allegedly planning mass riots in the center of Kyiv to destabilize Ukraine. According to Monastyrskiy, organizers planned to involve up to five thousand people, with about 1,500 people who would fight the police and use fake blood to appear as victims. Police also indicated that people would receive a modest payment for participating in the riots. Similar riots were reportedly planned in other cities, including Sumy, Chernihiv, Poltava, and Cherkasy.
—Roman Osadchuk, Research Associate, Kyiv, Ukraine
Head of Luhansk separatist region warns Congress against sanctions
Numerous Kremlin-owned and pro-Kremlin online outlets promoted a statement from Leonid Pasechnik, the head of the separatist Luhansk People’s Republic (LNR in Russian). Pasechnik threatened the United States over possible sanctions against Russia, warning US members of Congress that they would “break their teeth” trying to crush Donbas. He was referencing legislation introduced by Congressional Republicans that would designate Russia as a state sponsor of terror in the event of a Ukrainian invasion. Pasechnik compared the breakaway regions to Cuba, stating that Washington has been trying to “crush Cuba” using sanctions for sixty years with no success. Pasechnik’s remarks were also spread on Russian social media network Vkontakte by accounts identifying themselves as news sources covering Donetsk People’s Republic, Luhansk People’s Republic, and Novorossiya.
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
Russian-language Twitter accounts mock Latvian military capabilities
The Latvian government decided on February 1 to send Ukraine military instructors who will work alongside their Canadian counterparts to help the Ukrainian Armed Forces. This announcement caught the attention of the Latvian pro-Kremlin media outlet BB.lv and Kremlin-controlled media outlets TASS and Lenta.
The announcement was also noted by Russian-language Twitter accounts, which mocked Latvian military capabilities and accused Latvia and Ukraine of being “Nazis.” For example, the account @RadioStydoba wrote: “Latvia will send its military instructors to Ukraine. Descendants from the Latvian SS Legion will be able to cry on the shoulder of the Ukrainian SS Legion. And vice versa. They will share the mutual experience of digging hiding places. And in their behavior when totally surrounded.” The tweet garnered 390 likes and sixty-two retweets, a considerable amount for tweets about a Baltic state written in Russian. This tweet was copied verbatim by @d5SayyUAL0rLSBL, and in part by user @klyvatel, though neither tweet garnered many engagements.
Meanwhile, the account @helensmail559 framed the announcement as a joke that simultaneously mocked the Canadian military: “Want a joke? Prime Minister Karinsh: ‘Latvia will send military instructors to Ukraine. They will work with Canadians.’” Another user, @tarantinot19682, tweeted the announcement with an image of two soldiers running with mini military jets around their waists. This portrayal implies that Latvian military instructors are a mockery and cannot teach Ukrainians anything.
—Nika Aleksejeva, DFRLab Lead Researcher, Riga, Latvia
New Ukraine-Poland-UK initiative criticized by Kremlin media
On February 1, Ukraine, Poland, and the United Kingdom announced a joint plan to create a trilateral “format of political cooperation.” The initiative’s goal is to strengthen security and develop trade between the countries.
After the announcement, pro-Kremlin media outlets and commentators in Russia started to belittle the initiative and advised others not to take it seriously. Andrei Kelin, Russian ambassador to the United Kingdom, predicted that the countries would discuss establishing a new alliance without actually creating it. Russian outlet TASS quoted Andrey Bystritsky, chairman of the Valdai Discussion Club’s development council, who claimed that the new coalition was nothing more than a vague political PR stunt with no substance.
Russian media outlets reporting on the initiative also cited pro-Kremlin commentators in Ukraine and Poland. Ria Novosti quoted Ukrainian political scientist Andrei Golovachev, who dubbed the trilateral agreement as a union of outsiders, saying that the United Kingdom has already left the EU, Poland remains in the EU in name only, and Ukraine has no chance to join the EU because of deeply rooted disagreements with Germany and other members. He asserted that the United Kingdom wanted to create this union to unleash a pan-European war. Elsewhere, Politnavigator quoted pro-Kremlin commentator Mateusz Piskorsky in Poland, who claimed that creating a new trade alliance would threaten the security of Poland and negatively affect relations between Poland and its partners in Europe, primarily Germany. He also accused the United Kingdom of reviving the geopolitical games of nineteenth-century Europe in its quest for international status after leaving the EU.
Russian military expert Viktor Baranets, meanwhile, predicted that the new alliance would trigger disagreements within NATO, leading to its final collapse. Politnavigator asserted that in the event of Russian aggression against Ukraine, this alliance would not be able to defend Ukraine because Poland and the United Kingdom are NATO members and that is their priority obligation. Russian newspaper Vzglyad accused Poland of trying to become the political, economic, and spiritual center of Eastern Europe.
Meanwhile, Kremlin-linked News Front asserted that the United States is pushing Western Europe down a “suicidal path” by encouraging countries to end trade and economic ties with Russia. The article also claimed the new trade alliance intends to put pressure on Germany, which insists on moving forward with the Nord Stream 2 gas pipeline.
—Givi Gigitashvili, DFRLab Research Associate, Warsaw
Russian foreign ministry claims electricity outage, but videos show otherwise
Russia’s foreign ministry issued a statement on January 28 complaining that a protest organized by European Georgia, a pro-Western opposition party, somehow caused a power outage at the Russian Interests Section of the Swiss embassy in Tbilisi the previous day. The statement added that Russia sent a diplomatic note to Georgia’s Ministry of Foreign Affairs expressing its hope that “Georgian authorities will take all possible measures to prevent such incidents.”
Rallygoers projected the phrase “Слава Україні!” (Glory to Ukraine!) and the NATO flag on the outer façade of the building, which previously served as the Russian embassy in Tbilisi.
It remains unclear when, if at any point, the power when out. Footage from the time of the rally shows lights on within the interior of the building.
—Sopo Gelava, DFRLab Research Associate, Tbilisi, Georgia
Image: Russian TV footage of the 2nd S-400 Missile Battalion arriving in Belarus. The DFRLab confirmed the location as Luninets Station, fifty kilometers from the Ukrainian border. (Source: TV Zvezda)