As the crisis in Europe over Ukraine heats up, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, DFRLab’s global team presents the latest installment of the Russian Hybrid Threats Report.
More footage of growing Russian troop presence in Belarus
Significant expansions around Kursk, Belgorod, and Bryansk oblasts
Lukashenka says Belarusian and Russian armies will act together
Belarusian authorities push claim about Ukrainian drone
Retired Russian Colonel-General says there is no “critical threat” to Russia
Kremlin media slam Bloomberg after erroneous headline claims Russia had invaded Ukraine
YouTube blocks channels belonging to Ukrainian separatists and Pro-Kremlin politician
Telegram channels spread false claims about Kyiv mayor and US withdrawal
Ukrainian pro-Kremlin MPs amplified by Russian media
Hungary suspected of blocking Ukraine’s accession to NATO cyber defense center
More footage of growing Russian troop presence in Belarus
On February 5, Russian state media TASS reported that Russia had relocated a Su-25SM attack aircraft from the Eastern Military District to Belarus for joint exercises. According to the report, the aircraft was stationed in the Brest region. Videos from the Russian military media outlet TV Zvezda confirmed the relocation.
That same day, videos of a Russian military deployment in Rechitsa surfaced online in which large formations of Russian military vehicles can be seen. Satellite images released on the same day appear to show the newly established Russian military camp south of Rechitsa in great detail. Tents, trucks, tanks, infantry fighting vehicles, and artillery can be clearly identified.
On February 6, CNN reported that the Russian military had conducted advanced deployments to several locations in Belarus. Newly released satellite images show that some Russian field camps are now within twenty miles of the Ukrainian border. Satellite images also provide a detailed look at Luninets airfield, where the newly arrived Russian S-400 air defense systems and Su-25SM attack aircraft are visible. In total, these satellite images confirm a Russian build-up in Yelsk, Rechitsa, and Luninets airfield.
Meanwhile, videos from February 6 showed Russian and Belarusian soldiers hosting an equipment exhibition for residents in Yampol, Gomel region. Civilians were invited to observe the military equipment and listen to soldiers performing songs. On the same day, the Gomel media outlet Flagshtok published an article about an army base being built near the village of Ziabrouka. Belarusian authorities immediately blocked the website, as the military base was not officially part of the joint exercises.
—Lukas Andriukaitis, Associate Director, Brussels
Significant expansions around Kursk, Belgorod, and Bryansk oblasts
In addition to the Russian build-up in Belarus, the surge of military equipment moving into Russian border areas with Ukraine continues to accelerate.
In Kursk Oblast, the known training area Postoyalye Dvory saw a significant expansion over the past week, as evidenced by satellite imagery. The DFRLab identified a new military camp established near the village of Zorino after several convoys with armored vehicles and logistical equipment were seen traveling in the direction of the village through the nearby town of Oboyan over the weekend. On February 6, the DFRLab geolocated large amounts of equipment which arrived by rail at Korenevo station, also in Kursk Oblast, just twenty kilometers from the Ukrainian border. The equipment included Buk anti-air missile systems, pontoon bridges, and other military vehicles.
In Belgorod Oblast, near Ukraine’s northeastern border, the military garrison at Soloti saw increased occupancy, visible from low-resolution satellite imagery. Radio relay stations have begun appearing in this area, suggesting that a communications network is being established in the Russian border region with Ukraine. Iskander short-range ballistic missiles were spotted once again in Bryansk Oblast, moving in the direction of several military camps in the vicinity of Klintsy. Also in Bryansk Oblast, units from the 41st combined arms army are arriving from their previous encampment in Yelnya, Smolensk Oblast, as reported by CIT. Military rail and road traffic continued throughout the Russian border area with Ukraine, as well as in Crimea. Russian National Guard deployments made up a large portion of road traffic.
—Michael Sheldon, Research Associate, Washington DC
Lukashenka says Belarusian and Russian armies will act together
On February 4, Belarusian President Alyaksandr Lukashenka was interviewed by TV host Vladimir Solovyov. Speaking about the possibility of war against Ukraine, Lukashenka stated that Washington is pushing Kyiv to war. He would not rule out a missile attack on Ukraine or the use of other weapons “in response to the military actions of the armed forces of Ukraine.”
Lukashenka said that if Ukraine started a war against Russia or Belarus, “We will go to war defending ourselves.” When asked about Belarus’s actions in the case of a Ukrainian offensive against the breakaway regions of eastern Ukraine, Lukashenka underlined that the Belarusian army would act “exactly the same way” as Russia, highlighting that the two countries would conduct a joint response.
However, Lukashenka said he does not think there will be a large-scale war in Europe. According to his estimates, a military confrontation would only last three to four days. This aligns with a February 2 statement from Russian parliament member and pro-Kremlin journalist Anatoly Wasserman, who estimated a war with Ukraine would last four days.
In the same interview, Lukashenka asked Russian President Vladimir Putin to bestow upon him the rank of colonel of the Russian army. Asked how “the president of independent Belarus,” who once served in the Soviet army, might become a Russian army colonel, Lukashenka noted that the Soviet army belonged to both Russia and Belarus. He also reiterated Putin’s idea of restoring the Soviet Union.
The Atlantic Council has previously reported on how Putin is “quietly occupying Belarus” while the world has its attention on Ukraine. According to Brian Whitmore, nonresident senior fellow at the Eurasia Center, “The change in Belarus’s geopolitical status over the past eighteen months represents one of the most dramatic shifts in the security calculus in Eastern Europe since Russia’s illegal 2014 annexation of Crimea.”
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
Belarusian authorities push claim about Ukrainian drone
On February 3, Belarusian authorities announced that they had intercepted a Ukrainian unmanned aerial vehicle (UAV) flying over Belarusian territory to carry out reconnaissance on the Russian Armed Forces at the Brest military training ground. The event reportedly took place on January 24, with Russian state-controlled outlet RIA Novosti claiming that the UAV took more than two hundred photographs on Belarusian territory. The Belarusian foreign ministry summoned Ukrainian Ambassador Ihor Kyzym to deliver a “note of protest” to his government. Belarusian state-owned TV station Belarus 1 aired footage of the drone being brought down by Belarusian authorities, then ran a statement from the foreign ministry accusing Ukraine of triggering further escalation in the region.
Following his meeting with Belarusian officials, Kyzym wrote on Facebook that Ukraine did not use any UAV in that region on January 24. He also argued that the conversation was about a Russian-manufactured Orlan UAV, which Ukraine does not possess in its arsenal. The Belarusian military, however, claimed it was a Ukrainian Spectator-M1 UAV that flew forty kilometers into Belarusian territory.
The footage aired by Belarus 1 revealed that the drone in question did not resemble the Ukrainian Spectator UAV. Ukrainian blogger Alexander Kovalenko compared visual elements of the UAV shown on Belarus 1 with footage of a Ukrainian Spectator UAV and found at least three clear design differences. Specifically, the shape of the tail and wings of the drone displayed on Belarusian TV were different from the Spectator drone. In addition, the drone brought down by Belarus had one additional metal piece at the top, which the Spectator drone does not have. Similar to Kovalenko’s findings, the Russian investigative outlet the Insider also found that the wings and tail of the drone shown on Belarus 1 had a different design from the Spectator drone. The Insider also wrote that the UAV brought down in Belarus had similarities to a Russian-made Orlan drone.
Following the Insider’s report, RIA Novosti published an opinion from Russian military expert Denis Fedutinov, who acknowledged that the UAV in the Belarus 1 footage looks different from the Ukraine’s standard Spectator UAVs. However, he claimed that Ukraine used a unique Spectator prototype that is not yet fully in production. By using a prototype, he argued, the Ukrainian military wanted to make it harder for Belarus to identify the exact origin of a drone. While it is true that Ukraine is producing new Spectator prototypes, the Insider stated that pre-production models cannot fly long distances and would not be able to reach Brest.
—Givi Gigitashvili, Research Associate, Warsaw, Poland
Retired Russian Colonel-General says there is no “critical threat” to Russia
A retired Russian Colonel-General said there are no “critical threats that endanger Russia’s sovereignty and its vital interests.” Leonid Ivashov, who now serves as chairman of the All-Russian Officers’ Assembly, an independent organization known for its nationalist, anti-NATO and anti-Putin stance, issued a statement on January 31 addressed to Putin and “citizens of the Russian Federation.” In the statement, Ivashov said that “NATO forces are not building up, they are not showing threatening activity.” He noted that a war with Ukraine would “undermine Russian statehood,” and the number of casualties on both sides would “impact the future demographic situation” in Russia. Ivashov argued that Russia is dealing with an internal “systemic crisis” characterized by an unsustainable governance model, an ineffective administration, and a passive civil society. Ivashov then called on Putin to “abandon the criminal policy of provoking a war.”
Though the statement appeared on the All-Russian Officers’ Assembly’s website on January 31, it did not catch media attention until February 6, primarily from independent and pro-western Russian media such as Dozdy TV, Meduza, DW (in Russian), Radio Svoboda, and Eho Moskvy.
Ivashov previously served as the head of the main international cooperation directorate in Russia’s Ministry of Defense. He attempted to run for president in 2011, but the Central Election Commission denied his candidacy. Nevertheless, his opinions are often published in the pro-Kremlin news outlet Gazeta and the weekly Russian army publication Zvezda.
—Nika Aleksejeva, DFRLab Lead Researcher, Riga, Latvia
Kremlin media slam Bloomberg after erroneous headline claims Russia had invaded Ukraine
Bloomberg News issued an apology on February 4 for accidentally publishing an article titled: “Russia Invades Ukraine.” The news agency explained it was a publishing error and that it “prepare[s] headlines for many scenarios.”
The event was covered by many media outlets globally, including Kremlin-controlled media. RIA Novosti cited Putin spokesman Dmitry Peskov, who suggested that “Bloomberg News” be renamed “fake news.” Kremlin-owned news agency TASS interviewed Vladimir Solovev, the head of the Russian Union of Journalists, who said it was a mistake and “not a provocation,” though “such an oversight in the current, very tense international situation, of course, could provoke military action.” Pro-Kremlin outlet Tsargrad cited TV host Tina Kandelaki, who described Bloomberg as “fantasy writers,” and political commentator Maksim Zharov, who wrote on his Telegram channel that “Bloomberg’s false start may have been intentional.”
—Nika Aleksejeva, Lead Researcher, Riga, Latvia
YouTube blocks channels belonging to Ukrainian separatists and Pro-Kremlin politician
On February 4, the de facto authorities of the so-called Donetsk People’s Republic (DNR) and Luhansk People’s Republic (LNR) stated that YouTube had banned several of their channels. According to their statements, the channels blocked by the platforms included “DNR Ministry of Information,” “DNR National Police,” “LNR National TV-Radio company,” and “Lugansk Information Center.” The channels now lead to a page stating they were “terminated for violating YouTube’s Community Guidelines.” Representatives of the LNR stated that YouTube also blocked the account for the so-called People’s Police. Based on the statement from the LNR authorities, Russian media reported the People’s Police account was also banned, along with its Facebook page. The People’s Police announced it has prepared “alternative platforms for posting video materials on Russian video hosting and international video hosting based on an independent blockchain model.” At the time of publication, however, another LNR police channel, “МВД ЛНР” (“LNR Police”), remained accessible.
In Ukraine, YouTube banned UkrLive and First Independent, channels associated with pro-Kremlin Ukrainian magnate Viktor Medvedchuk and his political allies. Medvedchuk is a Ukrainian member of parliament with close ties to Putin. In December 2021, Ukrainian President Volodymyr Zelenskyy imposed similar sanctions against UkrLive and First Independent, which might have led to the YouTube ban. Both outlets, however, continue to broadcast on YouTube using backup channels, claiming that their suspension and sanctions are acts of censorship.
Zelenskyy previously banned of a number of other TV channels associated with Medvedchuk in February 2021.
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
—Roman Osadchuk, Research Associate, Kyiv, Ukraine
Telegram channels spread false claims about Kyiv mayor and US withdrawal
Kremlin–aligned Telegram channel Cartel wrote that Kyiv Mayor Vitali Klitschko is preparing a military operation dubbed “Double Strike” to liberate Donetsk and Luhansk. They also alleged that Klitschko had already made a deal with US Secretary of State Antony Blinken for a supply of M1 Abrams tanks and AeroVironment RQ-11 Raven UAVs. The channel claimed that the supposed operation would draft people from the municipal guard, which they said was “actively drafting” people with military experience, and the city’s budget would finance the operation. However, the channel added a disclaimer that “it might be a joke, but everything is possible.” The claim originated with Kyiv political commenter Kirilo Sazonov, who wrote a post about the supposed operation on Facebook. While the Cartel channel acknowledged that it might be a hoax, another pro-Russian Telegram channel, First, posted that it had confirmed its colleague’s claim and forwarded the post from Cartel. First currently has more than 429,000 subscribers on Telegram.
Another Telegram channel, Skeptic, wrote that the United States would abandon Ukraine, but it would try not to lose face like it did in Afghanistan. According to the channel, the information came from anonymous sources who viewed classified documents allegedly exchanged between the US State Department and Russia. The channel argued that the United States has accepted Ukraine’s integration into the Russian sphere of influence but wanted to draw out the process for years, leaving behind many obstacles. Therefore, they claimed, the United States will “pump up” Ukraine with weapons, believing that Ukrainians will fight Russia as a means to annoy Russia. The previously mentioned channel First also forwarded the message, before it was amplified and expanded by Kremlin-connected channel Rezident. Rezident argued that White House Press Secretary Jen Psaki’s statement that the United States would no longer use the word “imminent” to describe the Russian threat to Ukraine indicated that the United States had stopped being “100% Ukraine’s ally.”
—Roman Osadchuk, Research Associate, Kyiv, Ukraine
Ukrainian pro-Kremlin MPs amplified by Russian media
Renat Kuzmin, a pro-Russian Ukrainian member of parliament and close ally of Putin’s friend Viktor Medvedchuk, claimed on his personal Facebook page that people are moving their families either abroad or to Western Ukraine in fear of an invasion. The politician hypothesized that people are afraid of paratroopers and local rioters. According to him, Ukrainian authorities have not commented because they had quietly moved their own families out of the country. The message was amplified by several Kremlin-tied media outlets, including RIA, RT, and others. Similarly, Kuzmin’s fellow party member Illia Kyva wrote on his Telegram channel that Americans had seized power in Ukraine and staged a genocide. This fringe message also received amplification in pro-Kremlin media. Both narratives have served as a productive tool for spreading panic and despair, readily amplified by pro-Kremlin outlets.
—Roman Osadchuk, Research Associate, Kyiv, Ukraine
Hungary suspected of blocking Ukraine’s accession to NATO cyber defense center
On February 4, Oleksiy Danilov, secretary of Ukraine’s National Security and Defense Council, argued that Hungary had vetoed Ukraine’s accession to the NATO Cooperative Cyber Defense Center of Excellence in Tallinn, Estonia. Ukraine submitted a formal request to join the center last August and was expected to join in January.
While Hungarian authorities have not confirmed that they blocked Ukraine’s accession, Hungarian media outlet Azonnali reported that on January 5, Hungarian Ambassador Kristóf Forrai was invited to the Estonian Ministry of Foreign Affairs to discuss Hungary’s objection to Ukraine’s accession.
This decision comes after a massive cyberattack, attributed to Russia, targeted Ukrainian government websites on January 14. The cyber defense center is not formally part of NATO, but it supports member states with expertise in cyber defense research, training, and exercises.
Hungary has blocked Ukraine’s integration into Western institutions before. Following Ukraine’s adoption of a controversial education law in 2017, Hungary declared it would block “every issue important to Ukraine” in international organizations. One of Hungary’s requirements for Ukraine was that Hungarian must be the language of instruction for Hungarian speakers in Ukrainian schools, instead of the Ukrainian language. In 2019, Hungary vetoed a joint NATO statement on Ukraine, as it did not mention the “deprivation of rights” of the Hungarian minority in Ukraine’s Transcarpathia region. In January, Hungarian Foreign Minister Péter Szijjártó told Russian state-owned media outlet TASS that Hungary was still dissatisfied with the lack of rights of ethnic Hungarians in Ukraine and that Kyiv would need to fix these problems if it wanted to join the European Union and NATO.
—Givi Gigitashvili, Research Associate, Warsaw, Poland
Further reading
Fri, Jan 28, 2022
Russian Hybrid Threats Report: Kremlin pushes claims about Ukrainian offensive, ‘junk’ weapons from West
New Atlanticist By
The Council's Digital Forensic Research Lab is tracking the latest from Russian troop movements to social media conspiracy theories to Duma debates.
Tue, Feb 1, 2022
Russian Hybrid Threats Report: Will Moscow provide weapons and passports to breakaway Ukrainian regions?
New Atlanticist By
The Council’s Digital Forensic Research Lab is tracking the latest on Russia moving blood and food supplies to the front, narratives in Kremlin-tied media, and more.
Fri, Feb 4, 2022
Russian Hybrid Threats Report: Missile battalion confirmed in Belarus
New Atlanticist By
The Council’s Digital Forensic Research Lab tracks the latest Russian military movements and other developments in the Kremlin's hybrid war against Ukraine.
Image: The Russian military conducts exercises in the Moscow region, Russia, on Feb 7, 2022. Photo via REUTERS