As Russia expands its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, DFRLab’s global team presents the latest installment of the Russian Hybrid War Report.
TASS website apparently hacked to display casualty statistics
Pro-Kremlin disinformation aims to diminish trust in Ukrainian army’s capabilities
Retaliations spread against Russian celebrities who urged an end to the war
Belarus Cyber Partisans disrupt Belarus railway network
“War” isn’t mentioned on pro-Kremlin and Kremlin-owned media outlets
Pro-Kremlin newspaper publishes commentary comparing Ukraine to Gaza
Mexican YouTube channels claim the US will invade Mexico in response to the Russian invasion
Georgian PM says Ukraine failed to avoid war, Georgia not joining sanctions against Russia
Georgia’s breakaway region of Abkhazia recognized DNR and LNR
Social media war: Meta establishes monitoring center, Patreon bans military fundraising, Russian accounts under new scrutiny
Meta announced the creation of a “Special Operations Center” to monitor Ukraine war content on Facebook and Instagram. This model was previously deployed during the Taliban’s takeover of Afghanistan in August 2021, as well as in select elections beginning in 2018. Meta further activated a one-click privacy tool that it developed after the fall of Afghanistan to shield Afghans from Taliban surveillance and reprisals. The tool renders all user data, including profile pictures, inaccessible to any account that has not been directly added by that user.
Patreon removed a fundraising campaign for Come Back Alive, a Ukrainian charity organization that collects donations for the Ukrainian military and which was founded in 2014. The fundraiser had gone viral on February 23 when Twitter users discovered that different donation tiers were tied to different pieces of military equipment (e.g. $4 for a bullet, $299 for a tank). While Come Back Alive claimed that the $250,000 raised since the invasion had disappeared, Patreon stated that the funds would be given to the charity. Patreon has a longstanding ban on the financing of violent activities, although this policy has been inconsistently enforced in the past.
Lastly, social-media companies are being pressured to remove Russian diplomatic and media accounts from their platforms. Following the initial bombardment by Russian forces, the official Twitter account of Ukraine (@Ukraine) appealed directly to Twitter users and Twitter policy staff to remove the @Russia handle. Russian media also reported that Facebook had imposed restrictions on the social media accounts of RIA Novosti, the state-owned media conglomerate whose properties include RT and Radio Sputnik. At the time of this reporting, however, the pages were still accessible.
—Emerson T. Brooking, Resident Senior Fellow, Washington, DC
—Ingrid Dickinson, Young Global Professional, Washington, DC
Additional reading: Silicon Valley Must Pull the Plug on the Kremlin (Tech Policy Press)
TASS website apparently hacked to display casualty statistics
On February 27, Twitter user @PutinIsAVirus noticed an article published by Russian state news service TASS that listed Russian losses and acknowledged Vladimir Putin’s “disappointment” in how the war was proceeding. The DFRLab confirmed that the page was displaying this information before it was removed from the article.
@PutinIsAVirus presumed that someone at TASS had intentionally leaked the figures, but another user, @kamerknc, raised the possibility that TASS had been hacked, noting that the page had also briefly displayed pro-Ukrainian information on how readers could contact Ukraine’s hotline for Russians to learn about missing soldiers.
While there have been numerous instances of hackers shutting down websites in Ukraine and Russia, this incident would be one of the first examples of hackers successfully altering content on a state media website to demoralize audiences. Russia has largely avoided discussing its own casualties.
—Andy Carvin, DFRLab Managing Editor, Washington DC
Pro-Kremlin disinformation aims to diminish trust in Ukrainian army’s capabilities
Debunks published by Ukrainian fact-checkers reveal that pro-Kremlin media have pivoted from spreading disinformation that paints Ukraine as the aggressor to disinformation that implies the Ukrainian army is demoralized.
Since Russia’s full-scale military assault began on February 24, Ukrainian fact-checkers have seen an increase in stories that focus on the demoralization of Ukraine’s armed forces. One narrative claimed that servicemen with the 57th Separate Motorized Infantry Brigade gave up their arms and defected to the so-called Luhansk People’s Republic; a second said that Ukrainian forces were abandoning their positions en masse; and a third claimed that the Ukrainian army was not resisting Russia. All these stories were debunked by StopFake.org, the Ukrainian fact-checking collective.
Additionally, Kremlin-controlled television channel Russia-24 accused Ukraine of sharing disinformation about its victories. The Facebook page for Ukraine’s ground forces announced the capture of two Russian prisoners of war (POW), sharing a photo of the men, potentially in violation of the Geneva Convention. Russia-24 said this claim was false because snow was visible in the photo and “there is no snow in the streets.” In the image, the POWs are standing in a wooded area, where snow typically remains on the ground longer than in streets.
In addition, Russia-24 suggested that a report from Ukraine’s State Emergency Service about a fire in an apartment building in Chuguiiv, which killed a young boy, was false. Russia-24 claimed that “journalists contacted the mother and it turned out that everyone is safe and sound.” The story did not include any evidence of them contacting the mother.
Russia’s Ministry of Defense has only reported about its success in Ukraine and has not mentioned any casualties among its forces, while Ukraine’s Ministry of Defense claimed eight hundred Russian soldiers have been killed as of Friday, which cannot be verified.
—Nika Aleksejeva, DFRLab Lead Researcher, Riga, Latvia
Retaliations spread against Russian celebrities who urged an end to the war
Many Russian and foreign celebrities popular in Russia made public statements condemning Russia’s invasion of Ukraine, and some of them have already experienced consequences for their public condemnation of the Kremlin regime.
Ivan Urgant, host of the popular comedy show “Vecherny Urgant,” posted a black square on his Instagram channel with the phrase “Fear and pain. NO TO WAR.” The show, which aired on the Kremlin-controlled Pervijchannel, then disappeared from its programming. Channel spokesperson Larisa Krimova was evasive, later telling journalists, “The current program layout is connected with important social and political events. Ivan Urgant, of course, continues to work on the channel.”
Similarly, the TV channels TNT and Pyatnica!, both owned by Gazprom Media, a part of the state-owned gas enterprise Gazprom, ended their contracts with Armen Oganyan, a producer at Comedy Club Production, and Marina Grankina, producer at Ukrainian TeenSpirit, after both condemned the war in Ukraine. Meanwhile, ticket sales were suspended for a Minsk concert by Valery Milardze, a popular Russian singer who condemned the war on Instagram.
Other Russian anti-war celebrities such as actress Chulpan Hamatova were labeled as “politically illiterate” by Kremlin-controlled media outlet RIA FAN. Additionally, Russian pop singer Sergei Lazarev, actress Maria Mironova, and other Russian celebrities received online threats after making anti-war statements on social media.
—Nika Aleksejeva, DFRLab Lead Researcher, Riga, Latvia
Belarus Cyber Partisans disrupt Belarus railway network
On February 27, Belarus Cyber Partisans announced the “collapse” of Belarus Railway’s computer systems “to slow down the deployment of occupying troops and give Ukrainians more time to repel the attack.” This was their second attempt to disrupt the train network in recent weeks. Cyber Partisans also claimed that they had disrupted Belarus Railway websites. The DFRLab confirmed that the websites pass.rw.by, portal.rw.by, and rw.by were no longer functioning that evening.
Later, a Telegram channel named Belarus Railway Worker’s Community claimed that Belarus Railway operations were now in “manual mode” and that trains in Neman, Minsk, and Orsha were “paralyzed.” On Twitter, an anonymous user named @liksio reported from a train that ticket validation had been disrupted.
The railway company announced on Telegram that ticket sales had been disrupted but made no comment about the status of other railway operations.
—Nika Aleksejeva, DFRLab Lead Researcher, Riga, Latvia
“War” isn’t mentioned on pro-Kremlin and Kremlin-owned media outlets
As the international community condemns Russia’s war in Ukraine, pro-Kremlin and Kremlin-owned media outlets are refusing to use the term “war,” instead referring to the situation in Ukraine as a “special military operation.”
The DFRLab analyzed the headlines of four major outlets known for pushing the Kremlin’s agenda: Sputnik Georgia, Zvezda, Ria Novosti, and RT. The findings revealed that the outlets commonly used variants of “special military operation” like “special operation” and “military operation” instead of “war” or “invasion,” the terms widely used by independent media to describe the situation in Ukraine. For example, the Russian-language edition of state-owned RT placed a banner on its website reading “special operation.”
However, RT seems to have no issue using the term “war” when describing Ukraine’s actions. On February 22, two days before Russia’s invasion, RT’s English-language platform published an article titled “How Ukraine’s ‘Revolution of Dignity’ led to war, poverty and the rise of the far-right.” The article also uses the term “Nazi” twenty-three times while pushing the narrative of a “Nazi Ukraine”—one of the justifications used by Putin when announcing the invasion into Ukraine on February 24.
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Pro-Kremlin newspaper publishes commentary comparing Ukraine to Gaza
Komsomolskaya Pravda, a Russian daily newspaper, published a commentary comparing the war in Ukraine with the recent conflicts in Gaza. A letter authored by a former Donetsk resident with Israeli citizenship claimed that Ukraine has been bombing the so-called Donetsk People’s Republic for eight years, not unlike how Israel has been targeted by rockets from Gaza. The author asked, “If Israel is allowed to respond to shelling from Gaza and capture the Golan Heights, then why is Russia not allowed to do the same?”
The letter then went on to claim that 100 percent of residents in Donetsk are Russians rather than Ukrainians, yet there was not a single Russian-language school there in 2014. “Why do we suddenly believe that there will be no war considering this situation?” the author concluded.
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Mexican YouTube channels claim the US will invade Mexico in response to the Russian invasion
Videos posted in Spanish by Tu COSMOPOLIS, a Mexican channel that describes itself as a platform spreading “verified information,” and Campechaneando, a YouTuber close to Mexico’s President Andrés Manuel López Obrador (AMLO), amassed hundreds of thousands of views by misleadingly claiming that the United States will invade Mexico in the wake of Russia’s invasion of Ukraine.
Tu COSMOPOLIS and Campechaneando posted the videos on February 23 and February 24 respectively. Both videos distorted an interview with former US President Donald Trump and misleadingly claimed that he suggested that the United States will invade Mexico’s northern states in response to the Russian invasion of Ukraine. Campechaneando also suggested that US President Joe Biden will follow up on the false statement attributed to Trump. Tu COSMOPOLIS and Campechaneando videos garnered 458,000 and 385,000 views, respectively, as of Friday evening.
Although Trump mentioned Mexico three times, he did not suggest an invasion of the country. Instead, Trump proposed to increase the presence of security forces on the southern border—on US territory—to prevent “millions of people [who] are bum-rushing our country” from “127 countries,” not just Mexico.
In another video posted on February 22, Campechaneando also claimed that Russia’s Vladimir Putin told AMLO that the United States will defeat Mexico and invade the country. Campechaneando did not show Putin’s statement or quote him. However, Putin’s claims about the United States stealing Mexican territories first appeared in 2014, prior to AMLO becoming president, when Putin used the 1848 Guadalupe-Hidalgo agreement between the US and Mexico as an argument to defend the 2014 Russia-Ukraine armed conflict. The video garnered 450,000 views.
The DFRLab could not find a connection or coordination between the Tu COSMOPOLIS and Campechaneando channels.
—Daniel Suárez Pérez, Research Assistant in Latin America, Colombia
Georgian PM says Ukraine failed to avoid war, Georgia not joining sanctions against Russia
On February 25, Georgian Prime Minister Irakli Gharibashvili said that Ukraine failed to avoid war and that it would harm its territorial integrity and citizens. While commenting on Ukraine at a memorial for Georgians killed during the 1921 Soviet invasion of Georgia, Gharibashvili recalled the 2008 Russian-Georgian war and blamed the Georgian government that was in power at the time for “stupidly, foolishly… succumbing to provocation.”
Gharibashvili also announced that Georgia will not join international economic sanctions on Russia, claiming that to do so would damage “the country, the populace, and more.” In a response to opposition criticism for not calling a National Security Council meeting about Russia’s invasion of Ukraine, Gharibashvili commented that “there is no need.”
Kremlin media hailed Gharibashvili’s decision not to join sanctions against Russia. RT editor in chief Margarita Simonyan tweeted in Russian, “Ребята, Грузия выздоровела!” (“Guys, Georgia has recovered!”) Russian First anchor Artyom Sheynin considered Gharibashvili’s statement as support for “precise military operations to force to peace,” adding that Russian military operations “clean people’s minds historically,” referring to Russia’s war in Georgia in 2008.
Domestically, Gharibashvili is under fire for his remarks. Thousands of Georgian citizens went into the streets to condemn Gharibashvili and express support to Ukraine.
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Georgia’s breakaway region of Abkhazia recognized DNR and LNR
On February 25, the president of Georgia’s breakaway region of Abkhazia signed decrees recognizing the Donetsk and Luhansk people’s republics. In a Russian-language statement published by Apsnypress, President Aslan Bzhania stressed that Abkhazia has experienced the same fate as Donetsk and Luhansk, insisting that “more than four million Russian-speaking citizens of Ukraine were effectively subject to genocide.” Bzhania’s statement went on to accuse Ukraine of aggression incited by the West, adding that “Georgia tried to destroy the Abkhaz people” thirty years ago.
Bzhania claimed that “militant nationalism” and radical political forces deprived Ukraine of the ability to negotiate, so instead Ukraine had resorted to the persecution of Russian speakers residing in the Donbas. He added that the West provided Ukraine with lethal weapons, thus helping Ukraine prepare for its “final annihilation” of Russian speakers. Bzhania assessed Russia’s recognition of Ukraine’s breakaway republics as “fair,” adding that a military operation is “absolutely justified.”
Bzhania also called on the government of Abkhazia to start preparation for establishing diplomatic relations between Abkhazia and the two Ukrainian breakaway republics.
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Further reading
Thu, Feb 24, 2022
Russian Hybrid War Report: Belarus joins conflict against Ukraine
New Atlanticist By
The Council's open-source researchers break down the Kremlin's latest moves online and on the battlefield in its war in Ukraine.
Fri, Feb 25, 2022
Not just Ukraine: Putin wants to remake the world
New Atlanticist By
We would be mistaken to hope that Putin's ambition is limited to Europe. Ultimately, it is the international liberal order and its norms that he is after.
Thu, Feb 24, 2022
LIVE: Russia-Ukraine peace talks, Putin’s nuclear threat, and Germany’s big military bet
New Atlanticist By
As Russia further escalates its military intervention in Ukraine, check back here for the latest insights, analysis, and reporting from the Atlantic Council's experts as events unfold.
Image: Participants of the rally in the center of St. Petersburg, Russia, against military actions in Ukraine, February 27, 2022 (Photo by Valya Egorshin/NurPhoto via Reuters)