As the crisis in Europe over Ukraine heats up, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, DFRLab’s global team presents the latest installment of the Russian Hybrid War Report.
Belarus enters the conflict after crossing Ukraine’s northern border
Ukraine government and civil society websites targeted by cyberattacks prior to invasion
Ukraine reports OSCE cars used as shields for Russian tanks
Twitter says ‘human error’ caused researcher accounts to be suspended
Georgian breakaway region South Ossetia announces combat alert
Russia and Azerbaijan sign declaration on allied cooperation, consider military support
Ukrainian Defense Minister calls on all Ukrainians to mobilize
Baltic countries and Poland invoke NATO’s Article 4
OSINT researchers debate when Putin recorded his war declaration
Facebook restricts Russian state-owned TV channel for 90 days
Sudanese paramilitary leader arrives in Moscow
Russia’s communications regulator warns Russian media to cite only “official Russian sources”
Venezuela aligns with Russian narrative in Telegram and Twitter broadcasting
Belarus enters the conflict after crossing Ukraine’s northern border
Not long after dawn on February 24, tanks were recorded moving into Ukrainian territory from southwestern Belarus, crossing over at the Senkivka checkpoint. Tanks, infantry fighting vehicles, and Russian heavy flamethrower systems can be identified in the videos. Videos showing missiles being launched from the Mogilev area towards Ukraine have also surfaced, yet have not been specifically geolocated as of now. CNN and Newsweek reported that Belarusian troops are also taking part in the attack against Ukraine, despite previous insistence from Belarusian leader Alyaksandr Lukashenka that Belarus would not participate in any military action against the country.
In an urgent meeting with Russian President Vladimir Putin, Lukashenka announced that they had agreed to keep Russian troops stationed in Belarus. Lukashenka previously denied that Belarusian troops would take part in the Ukrainian invasion. He also proclaimed that Ukraine is losing the war and offered to host talks in Minsk.
New Maxar satellite imagery released the day before the attack showed Russian military deployment changes on February 21 and 22. The new images revealed Russia had deployed more than one hundred vehicles and dozens of troop shelters at Bolshoi Bokov airfield in southern Belarus, near the city of Mazyr. This new deployment is less than twenty kilometers from the Ukrainian border. The same set of new images also documented ground being cleared southwest of Belgorod, Russia, in the general vicinity of where Russia later began its attack on Kharkiv.
That same day, the Ukrainian State Border Guard Service announced the implementation of a number of security measures along its borders with Russia and Belarus. The new measures included limiting vehicle traffic; using radio stations, drones, and filming and taking pictures; as well as keeping non-residents away from the border zone. Meanwhile, Belarusian opposition leader Sviatlana Tsikhanouskaya urged Western countries to impose tougher sanctions on both Russia and Belarus to deter them from further aggression. According to her, the current sanctions packages are not enough, as Russia and Belarus are not showing any responsiveness to them.
Viktor Gulevich, head of the Belarusian army, previously stated on February 21 that the withdrawal of Russian troops from Belarus would depend on regional NATO troop withdrawals. According to Reuters reporting, Gulevich said Minsk believed it was within its rights to demand that US and NATO member forces withdraw from near Belarusian borders, including from near borders with neighboring countries Poland, Latvia, and Lithuania.
Lastly, new footage has surfaced of Russian Ka-52 Alligator and Mi-24P combat helicopters in the Gomel region of Southeastern Belarus, potentially near the R-35 highway; however, this video has not yet been geolocated. Additional as-yet-unverified videos suggest that the southern Belarusian border where Russian troops are stationed is becoming more muddy, which might impact the tactical capabilities of Russian ground troops in the region.
—Lukas Andriukaitis, Associate Director, Brussels, Belgium
Ukraine government and civil society websites targeted by cyberattacks prior to invasion
A pair of cyberattacks targeted Ukrainian banks and government websites during the twenty-four hours leading up to the Russian invasion. Targets included the web pages for the Ukrainian parliament, Ministry of Foreign Affairs (MFA), and Cabinet of Ministers.
According to the internet monitoring website IsItDownRightNow.com, the websites for the MFA and Cabinet of Ministers were temporarily taken offline on Wednesday. Over several hours, the DFRLab also observed that Ukraine’s security services website would only partially load.
Mykhailo Fedorov, Ukraine’s Minister of Digital Transformation, confirmed a large-scale distributed denial-of-service (DDoS) attack had occurred. He claimed that unknown actors attacked Ukrainian banks, state servicer provider Diia, and the websites for the Ukrainian parliament, the MFA, and the Cabinet of Ministers. Fortunately, many of the services continued working despite the ongoing attack.
Fedorov confirmed that cyberattacks continued throughout the night and were ongoing. He claimed that all information sources in Ukraine were under attack, but assured citizens that the situation was under control. As of Thursday morning, the websites were accessible from Ukraine.
Meanwhile, open-source research collective InformNapalm also reported a DDoS attack on their webpage. A similar attack was directed at Censor.net, a popular Ukrainian online media outlet. The organizations successfully defended against the attacks and webpage performance was not impacted.
Lastly, cybersecurity firms Symantec and ESET said they had discovered a new destructive malware wiping data from Ukrainian machines.
—Roman Osadchuk, Research Associate
Ukraine reports OSCE cars used as shields for Russian tanks
On February 24, the State Border Guard Service of Ukraine reported that columns of Russian tanks entered the Luhansk region of Eastern Ukraine through Krasna Talivka, Milove, and Horodyshche. According to the Border Guard, the columns were led by white cars bearing the logo for the Organization for Security and Co-operation in Europe (OSCE), which has monitored the conflict on a daily basis for years.
The OSCE previously announced on February 13 that it was pulling out its staff from eastern Ukraine. At the time, Kremlin outlet RT reported that OSCE had evacuated their car fleet but left behind armored vehicles.
At the time of writing, the OSCE had not commented on the matter and the DFRLab cannot independently confirm whether the OSCE vehicles allegedly being used by Russia are authentic or were Russian vehicles with OSCE logos affixed to them.
—Roman Osadchuk, Research Associate
Twitter says ‘human error’ caused researcher accounts to be suspended
Twitter cited “human error” after suspending the accounts of several open-source researchers on Wednesday. The social media company dismissed rumors that the removals were the result of a mass reporting campaign. “A small number of human errors as part of our work to proactively address manipulated media resulted in these incorrect enforcements,” said Yoel Roth, head of site integrity at Twitter. “We’re fixing the issue and reaching out directly to the affected folks.”
Bellingcat analyst Nick Waters published a thread listing more than a dozen legitimate accounts that Twitter had suspended. Those with suspended accounts included Roman Burko, the founder of the open-source research collective InformNapalm; Kyle Glen, OSINT researcher and cofounder of Conflict News; Serhii Sternenko, a Ukrainian right-leaning activist from Odesa; and Maria Avdeeva, research director at the European Expert Association. By Thursday, all of the accounts cited by Waters except @ukrwarreport had been restored.
—Nika Aleksejeva, DFRLab Lead Researcher, Riga, Latvia
Putin’s United Russia party suspected of initiating online flash mob to support separatist independence
Shortly after Putin recognized the independence of the Donetsk and Luhansk peoples republics on February 21, a pro-Russia online flash mob began tweeting using the hashtags #СвоихНеБросаем (#WeDoNotAbandonOurPeople) and #МыВместе (#WeAreTogether). The campaign expressed support for people living in Donetsk and Luhansk, alleging that they are suffering under Ukrainian Armed Forces. The Twitter campaign created the impression that there is public support for Putin’s decision.
Open-source evidence suggests Putin’s United Russia party could have initiated the flash mob. United Russia started using the #СвоихНеБросаем hashtag on February 20, the day before the Putin’s announcement, calling on its audience to give humanitarian assistance to people evacuated from Donbas to Rostov Oblast. Later, United Russia continued to use the hashtag for other purposes.
The DFRLab analyzed the hashtags on Twitter and found 59 percent of the mentions were original tweets (1005 out of 1709). Each tweet received an average of 26.4 engagements, suggesting the campaign failed to go viral. The most popular tweet had 223 engagements.
Analyzing the hashtags on Facebook using the monitoring tool CrowdTangle, the DFRLab found that the most engaged–with content came from United Russia accounts or the accounts of their prominent members. The highest number of engagements a post received was 1,300 reactions, 140 comments and 124 shares, which is not considered particularly high. A CrowdTangle query identified 202 posts on Facebook pages, public groups, and verified profiles that received an average of 39 engagements. Meanwhile, a CrowdTangle analysis of Instagram found that 509 posts have used the hashtag since February 20, receiving an average of 720 engagements.
The DFRLab found the hashtag was also used on other social media platforms, such as VKontakte, Odnoklassniki, and Telegram, but has yet to determine their levels of engagement.
—Nika Aleksejeva, DFRLab Lead Researcher, Riga, Latvia
Georgian breakaway region South Ossetia announces combat alert
Anatoly Bibilov, president of the Georgian breakaway region of South Ossetia, announced a “combat alert” after an emergency security council meeting on Thursday. According to Bibilov, all units of the Ministry of Defense “must be ready to advance to concentration points.” Bibilov also ordered full cooperation with the Russian military base in the region. He cited the Treaty of Alliance and Integration between South Ossetia and Russia, signed in 2015, when reiterating South Ossetia’s “full support” for Russia’s actions.
Bibilov also said security forces were monitoring the situation along the Georgian border “to ensure readiness to respond to all provocations potentially originating from Georgia.”
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Russia and Azerbaijan sign declaration on allied cooperation, consider military support
On February 22 in Moscow, Azerbaijan President Ilham Aliev and Vladimir Putin signed a declaration regarding allied cooperation. Azerbaijan’s state information agency Azertag published a Russian version of the declaration, which reiterated cooperation between the two states in different fields, including the economy, energy, transportation, trade, health, and education.
Notably, three sections of the declaration mention military cooperation between Azerbaijan and Russia:
- Paragraph 11 of the declaration states that Russia and Azerbaijan will suppress activities of organizations and entities on their territory, targeting the sovereignty, independence, and territorial integrity of each party.
- According to paragraph 13, “The parties will deepen cooperation between the armed forces of the Russian Federation and the Republic of Azerbaijan, including holding joint operational and combat trainings, as well as developing other areas of bilateral military cooperation.”
- Lastly, in paragraph 16, they state, “In order to ensure security, maintain peace and stability, the Russian Federation and the Republic of Azerbaijan may consider the possibility of providing each other with military support on the basis of the UN Charter, different international agreements and considering the existing international-legal obligations of each party.”
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Ukrainian Defense Minister calls on all Ukrainians to mobilize
Ukraine’s Minister of Defense Oleksiy Reznikov called on all Ukrainians “who are ready and able to hold a weapon” to mobilize. According to a statement posted on Facebook early Thursday morning, Ukraine has entered “total defense mode.” Reznikov said all that is required to join the ranks of the armed forces is a passport. “The enemy is attacking, but our army is indestructible,” he added.
Following the defense minister’s statement, Ukrainian President Volodymyr Zelenskyy tweeted a similar statement: “We will give weapons to anyone who wants to defend the country. Be ready to support Ukraine in the squares of our cities.”
Also Thursday, Ukraine banned all male citizens between the ages of 18 and 60 from leaving the country. “This regulation will remain in effect for the period of the legal regime of martial law,” the State Border Guard Service said.
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
Baltic countries and Poland invoke NATO’s Article 4
Lithuania, Latvia, Estonia, and Poland invoked Article 4 of NATO’s founding treaty Thursday, triggering consultations with Alliance members. Article 4 states that “the Parties will consult together whenever, in the opinion of any of them, the territorial integrity, political independence or security of any of the Parties is threatened.”
Following initial consultations, NATO issued a statement saying “we have decided, in line with our defensive planning to protect all allies, to take additional steps to further strengthen deterrence and defense across the alliance.”
This comes as NATO held an emergency meeting to discuss Russia’s assault on Ukraine. NATO Secretary-General Jens Stoltenberg stated that Russia’s attack on Ukraine “is a grave breach of international law, and a serious threat to Euro-Atlantic security.”
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
OSINT researchers debate when Putin recorded his war declaration
On February 24, the official website of the Russian presidency published a video in which Vladimir Putin effectively declared war on Ukraine, announcing that he was ordering the Russian armed forces to conduct a special military operation in Ukraine in accordance with Article 51 of United Nations Charter and in pursuance of the treaties of friendship and mutual assistance with the self-proclaimed Donetsk People’s Republic and the Luhansk People’s Republic.
After the video’s release, Russian independent media outlet Novaya Gazeta wrote on Facebook and Twitter that the speech had been recorded on February 21, based on an analysis of the recording’s metadata. The story was quickly picked up by the Russian edition of Delfi Estonia media outlet on Facebook, by Ekho Moskvy on Twitter, and Turkish state-controlled media TRT’s Russian language Facebook page.
However, CNN journalist Gianluca Mezzo wrote that when he checked the metadata of Putin’s video, he concluded that it was recorded on February 24 at 03:35:44. He also published a screenshot of metadata info of a file from the website metadata2go.com.
The DFRLab team could not download a video from Kremlin’s website to independently verify its metadata; at the time of writing, Kremlin.ru was no longer functional.
—Givi Gigitashvili, DFRLab Research Associate, Warsaw, Poland
Facebook restricts Russian state-owned TV channel for 90 days
Facebook restricted the page of Zvezda TV, the Russian state-owned TV channel run by Russia’s Ministry of Defense. Zvezda published a screenshot of a restriction notice from Facebook on its website, saying that the page is restricted from the platform for ninety days for “repeatedly publishing false information.”
StopFake, the Ukrainian fact-checking organization, had previously flagged two publications from Zvezda on Facebook as false information. The first article claimed that Russia had already suppressed the air-defense forces of Ukraine, while the second reported that Ukrainian military border guard units did not resist Russian forces.
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Sudanese paramilitary leader arrives in Moscow
The commander of Sudan’s Rapid Support Forces (RSF), General Mohamed Hamdan Dagalo, commonly known as “Hemedti,” arrived in Moscow for bilateral talks with senior Russian government officials on February 23. According to the RSF Twitter account, Dagalo will act in his capacity as deputy head of the military-led ruling council, leading a delegation of ministers. Dagalo and the RSF led a military coup in Sudan last October, which has seen sustained violent protests over the last four months.
According to VOA News, Sudanese Foreign Ministry spokesperson Khalid Farah said, “This visit was scheduled ahead and has nothing whatsoever to do with what is happening in Ukraine.” Similarly, Dagalo tweeted in Arabic that he hopes the trip will “advance relations between Sudan and Russia to broader horizons and strengthen the existing cooperation” between the two countries.
The DFRLab previously uncovered a network of inauthentic accounts with links to the Internet Research Agency that worked to amplify pro-Russian content in Sudan, promoting Russia as a friend to the Sudanese people.
—Tessa Knight, DFRLab Research Associate, Cape Town, South Africa
Russia’s communications regulator warns Russian media to cite only “official Russian sources”
Roskomnadzor, Russia’s communications regulator, issued a statement warning the media and online outlets against spreading “unverified information.” Roskomnadzor referred to Article 49 of Russia’s Mass Media Law, which obliges editors to verify the authenticity of their reporting prior to publishing it.
According to Roskomnadzor, “When preparing their materials and publications related to the conduct of a special operation in connection with the situation in the Lugansk People’s Republic and the Donetsk People’s Republic, they are obliged to use information and data obtained from official Russian sources.”
Roskomnadzor also noted, “The dissemination of knowingly false information entails liability under Article 13.15 of the Code of Administrative Offenses of the Russian Federation in the form of an administrative fine in the amount of up to 5 million rubles.” The statement warned that failure to follow this law would result in “immediate blocking of such materials by Roskomnadzor in accordance with Article 15.3 of Federal Law No. 149-FZ, ‘On Information, Information Technologies, and Information Protection.’”
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
Venezuela aligns with Russian narrative in Telegram and Twitter broadcasting
The official Telegram channel of Venezuela’s government-owned TV network posted a news update about Russia’s invasion of Ukraine, written in alignment with Kremlin messaging. The post stated, “Russia launches special operation to demilitarize and denazify Ukraine. Last Monday, after recognizing the independence of Donetsk and Luhansk, President Vladimir Putin announced the dispatch of Russian troops with the aim of demilitarizing and denazifying the regions.”
The post by the Venezuelan government TV network also aligned with President Nicolas Maduro’s February 22 Twitter broadcast, in which he stated, “The Bolivarian Revolution is with Russia…. We know that Putin is defending the right to peace and dignity of the Russian people and the peoples of the world and the world balance.” He continued, “Imperialism and NATO have tried to bury diplomatic agreements based on international law to disrespect Russia. Patiently, President Putin has raised the breach of these agreements and the danger that NATO deploys its weapons offensive, including its atomic weapons aimed at Russia.”
—Iria Puyosa, DFRLab Visiting Fellow, Ann Arbor, Michigan
Further reading
Thu, Feb 24, 2022
Experts React: Russia has launched a war against Ukraine. How can the West fight back?
New Atlanticist By
Our experts are weighing in with their thoughts about where this conflict is going and how the West can fight back.
Thu, Feb 24, 2022
LIVE: Russia-Ukraine peace talks, Putin’s nuclear threat, and Germany’s big military bet
New Atlanticist By
As Russia further escalates its military intervention in Ukraine, check back here for the latest insights, analysis, and reporting from the Atlantic Council's experts as events unfold.
Thu, Feb 17, 2022
Twenty questions (and expert answers) about what’s happening with Ukraine and Russia
New Atlanticist By
As the crisis in Eastern Europe continues to unfold, we tapped our expert network to answer the burning questions about the implications for Russia, Ukraine, and the wider world.
Image: A helicopter flies over troops during the joint military drills of the armed forces of Russia and Belarus at a firing range in the Brest Region, Belarus February 19, 2022. (Photo by Vadim Yakubyonok/Belta/Handout via REUTERS.)