As Russia expands its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, DFRLab’s global team presents the latest installment of the Russian Hybrid War Report.
Exploitation of social platforms
Social media companies crack down on Kremlin media outlets amidst government demands for compliance
Russian parliament proposes fifteen years in prison for sharing “fakes” about Russian troops
Documenting dissent
Kremlin blocks independent outlets Ekho Moskvy and TV Rain, threatens Wikipedia
Kremlin ramps up pressure on independent media outlets
In Belarus, protests and calls for soldiers to renounce the war in Ukraine
Cyber activists disrupt Russian and Belarusian state-controlled media and public services
Georgians protest against their government, expressing solidarity with Ukraine
Tracking narratives
Russian TikTok users allegedly compensated to produce near-identical videos
Georgian far left push message that Ukraine war is a battle between US and Russian empires
South Ossetia supports Russian invasion, blaming rise of neo-Nazis
Security
Belarusian paratroopers expected in Ukraine as Lukashenka confirms missile fire
Regional reactions
Ugandan general tweets support for Russia
Sudan Foreign Ministry says Russian media reported military leader’s comments out of context
Social media companies crack down on Kremlin media outlets amidst government demands for compliance
Google, Meta, and Twitter are taking action against Russian state-owned media accounts to limit the spread of harmful information online. At the request of the European Union, Meta will restrict access to Kremlin-owned outlets RT and Sputnik across the EU. Earlier, Meta announced it would also restrict access to several Russian state media accounts in Ukraine at the government’s request. In addition, the company has demonetized the accounts of Russian state-owned media organizations and prohibited them from posting ads on Facebook and Instagram.
In a similar move, Google has blocked RT and Sputnik’s YouTube channels across Europe. It will also prevent RT and other relevant outlets from receiving funding from ads on their websites and apps.
Meanwhile, Twitter announced actions to reduce the spread of articles from Russian state-affiliated media. Links to Kremlin media will now include a “stay informed” label. Since the start of the invasion, there has been an uptick in the sharing of Kremlin media articles on Twitter, with more than 45,000 tweets a day directing users to state-affiliated outlets.
Twitter also said that advertisements in Ukraine and Russia are on pause to ensure that critical public safety information is “elevated.” To this end, users in the two countries will no longer see tweet recommendations from accounts they don’t follow.
Responding to social media companies’ increased moderation efforts, the Russian government ordered companies to comply with a new law that mandates social media platforms operating in Russia must set up local offices and register with Russia’s media watchdog, Roskomnadzor. Under this legislation, local representatives could be held liable if Russia feels platforms are not abiding by local laws. These actions have been widely condemned by digital rights experts, as the law could be used as justification to intimidate employees with the threat of arrest and pressure companies to engage in censorship.
Both Russian independent news outlets and Tik Tok have already fielded requests from the government to take down content related to the war in Ukraine. In response to what Russia claims is “censorship” by social media companies, Roskomnadzor announced restrictions on access to Facebook, and access to Twitter appears to be limited as of February 26.
Over the weekend, Facebook and Twitter removed two covert influence operations targeting Ukrainians. One operation was tied to Russia, and another had connections to Belarus. Facebook also said the pro-Belarus hacking group Ghostwriter was targeting Ukrainians, including the military.
—Jacqueline Malaret, Assistant Director, Washington, DC
—Ingrid Dickinson, Young Global Professional, Washington, DC
—Lukas Andriukaitis, Associate Director, Brussels, Belgium
Russian parliament proposes fifteen years in prison for sharing “fakes” about Russian troops
Vyacheslav Volodin, chairman of the Russian State Duma, approved a proposal by the Security and Anti-Corruption Committee to draft a law introducing criminal liability for sharing “fake” content related to Russia’s armed forces. Members of the ruling United Russia party previously proposed introducing such a bill, citing “a lot of disinformation” on social media. The bill passed its first reading on March 2 and is expected to be presented for its second reading in several days.
The draft law states that the punishment for sharing fake content about Russian troops would be fifteen years in prison. The move could be a reaction to the increasing amount of footage showing Russia targeting civilian areas in Ukraine, which Russia denies. The law might intimidate Russian internet users and discourage them from sharing or saving such footage, particularly anything documenting war crimes. Meanwhile, Karim Khan, a prosecutor with the International Criminal Court, announced that he would investigate Russia for possible war crimes or crimes against humanity in Ukraine.
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
Kremlin blocks independent outlets Ekho Moskvy and TV Rain, threatens Wikipedia
On March 1, Wikipedia shared a notice they received from Russia’s Roskomnadzor information agency threatening to block the crowdsourced platform due to its Russian-language article on Russia’s invasion of Ukraine. The notice cited the inclusion of information about Russian military personnel casualties and Ukrainian civilian victims. In response, Wikipedia shared workarounds for users if Wikipedia does become blocked in Russia.
That same day, Russian users found themselves unable to access the websites for the liberal radio station Ekho Moskvy and the independent broadcaster TV Rain. Around the same time, the Russian Prosecutor General’s office released a statement on Telegram saying they had submitted demands to Roskomnadzor to restrict access to both channels. The statement accused the outlets of calling for extremism and violence, spreading “false information” regarding Russia’s special operation in Ukraine, and calling for “mass public events.”
The Prosecutor General’s office stated that the restrictions could legally be put in place due to Article 15.3 Federal Law No. 149-FZ Paragraph 1, “On Information, Information Technologies and Data Protection,” which covers the restriction of access to information inciting mass riots, extremist activities, and participation in mass public events. According to Article 15.3, the Russian government must first notify the online publication hosting the problematic content and request that it be removed; if the content is not immediately removed, they may then proceed with restricting access to the online publication.
TV Rain posted on Telegram that the Prosecutor General’s office did not identify specific materials on their website that violated Russian laws. It also said it strictly followed legal standards and used trusted sources when covering events in Ukraine.
Both Ekho Moskvy and TV Rain began trending on Twitter in Russia as these events unfolded.
—Ingrid Dickinson, Young Global Professional, Washington DC
Kremlin ramps up pressure on independent media outlets
On February 24, Russian federal censor Roskomnadzor stated that Russian media outlets were “obliged” to rely on information received from Russian official sources while covering Russia’s “special operation” in Ukraine. The statement also argued that Roskomnadzor would block all attempts of disseminating “knowingly false information” on the internet. Considering the fact that Russia has generally avoided disclosing information about the exact number of casualties and military loss in Ukraine, Roskomnadzor’s announcement might be an attempt to prevent independent media from reporting casualty statistics. Having said that, Kremlin outlet RBK reported on March 2 that Russia had experienced a total of 498 deaths and 1,597 injuries since the invasion, according to the Ministry of Defense.
On February 28, Roskomnadzor claimed that it found instances of Google Ads being used to spread “unreliable socially significant information” about Russian and Ukrainian casualties. Consequently, Roskomnadzor demanded that Google restrict access to such materials, and warned Russian Internet sites against distributing such ads to avoid administrative fines or website bans. Roskomnadzor did not specify what false information it had found, but its statement suggests it wishes to prevent the distribution of any kind of information about Russian casualties to prevent public outrage.
Russian authorities have already taken actions against multiple independent media outlets. On February 28, Roskomnadzor blocked to access to Current Time and Krym.Realii, both projects of Radio Free Europe/Radio Liberty, as well as the New Times. Following the ban, Current Times wrote that they were accused of “spreading unreliable socially significant information about the Russian military allegedly killed and captured within the territory of Ukraine.” RFE/RL President Jamie Fly assessed the Kremlin’s move as “an attempt to hide the terrible truth about the human price of Putin’s criminal war against Ukraine.”
On top of blocking internet resources, journalists at independent media outlets also face physical threats. On February 24, Interfax journalist Dmitry Gavrilov was arrested during an anti-war rally in Saint Petersburg while he was taking a photograph of an anti-war banner. Gavrilov showed his press credentials to police but was nonetheless detained. The following day, Russian police arrested three RFE/RL journalists covering anti-war protests in Moscow, even though they too had all the necessary credentials to work during mass protests.
—Givi Gigitashvili, Research Associate, Warsaw, Poland
In Belarus, protests and calls for soldiers to renounce the war in Ukraine
Videos of a February 27 protest in Belarus have surfaced on social media. The protests were in response to several recent developments in the country, including Belarus joining the war against Ukraine, serving as a transit point for Russian weapons, and Belarus revoking its non-nuclear status after a February 27 constitutional referendum. Crowds gathered near the defense ministry chanting “Glory to Ukraine!” and “Long live Belarus.” The Belarusian government responded aggressively, sending in riot police to detain protesters.
Meanwhile, Belarusians living in Vilnius, Lithuania climbed over the fence of the Belarusian embassy and replaced the official state flag hanging outside the building’s entrance with the opposition nationalist flag and a Ukrainian flag.
Lastly, a video of Belarusian lieutenant colonel Sakhashchik Valery Stepanovich discouraging soldiers from joining the war in Ukraine went viral online. “This is not our war,” he said. “Find a way not to follow criminal orders. Sometimes saying ‘no’ takes the most courage.”
—Lukas Andriukaitis, Associate Director, Brussels, Belgium
Cyber activists disrupt Russian and Belarusian state-controlled media and public services
When Russia invaded Ukraine on February 24, the cyber activist collective Anonymous announced their “war against the Kremlin.” Over the next several days they took credit for successful attacks on public services and state-controlled media in Russia and Belarus. As there is no official Anonymous account on Twitter, the collective used hashtags #OpRussia and #OpKremlin to share news and updates about the cyber-attack campaign.
On February 26, Anonymous claimed they had hacked Kremlin-owned TV channels, which suddenly started showing footage from Ukraine that contradicted the official Kremlin narrative. Many anonymous Twitter accounts reported on the hack.
The following day, Anonymous took credit for taking down a long list of Russian government websites, including the Russian pension fund, the State Service, the presidential administration, customs, the national government site, Moscow’s mayor, and the Chechnya Republic. As of March 2, many of these sites – Mos.ru, government.ru, customs.gov.ru, kremlin.ru, gosuslugi.ru, and pfr.gov.ru – remained offline. Chechnya.gov.ru had been restored, but now required users to demonstrate they were not automated bots using “captcha” tests before being allowed to proceed to the site.
On February 28, Anonymous claimed they had downed Russian propaganda websites, three Belarusian banks, and multiple Belarusian government sites, including the Information Ministry, Military Industry Authority, and Defense Ministry. While one Belarusian bank, Belinvestbank.by, has been restored, belarusbank.by and priorbank.by remained compromised at the time of writing, alongside the government sites mil.by, vpk.gov.by, and mpt.gov.by.
In additional to shutting down websites, Anonymous also took credit for leaking information from Russia’s Ministry of Defense and the Russian Nuclear Institute.
Anonymous is not the only cyber activist collective attacking Russian and Belarusian infrastructure. The DFRLab previously reporting about the Belarusian Cyber Partisans hacking the Belarus Railway company, while the IT Army of Ukraine is also engaging in cyber activism.
—Nika Aleksejeva, Lead Researcher, Riga, Latvia
Georgians protest against their government, expressing solidarity with Ukraine
On March 1, a large rally in Tbilisi demanded the Georgian government’s resignation and snap elections. The latest protest took place in solidarity with Ukrainian President Volodymyr Zelensky after he announced that Ukraine was recalling its ambassador to Georgia due to the government’s “immoral position” on sanctions and barring Georgian volunteers from flying to Ukraine.
Georgia has seen four consecutive days of protests, as thousands take to the street to express their solidarity with Ukraine and condemn the Georgian government’s position on Ukraine. Volodymyr Zelensky expressed support for the protesters when he tweeted on February 26, “Incredible Georgian people who understand that friends must be supported! Grateful to everyone in Tbilisi and other cities who came out in support of Ukraine and against the war. Indeed, there are times when citizens are not the government, but better than the government.”
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Russian TikTok users allegedly compensated to produce near-identical videos
Multiple Russian TikTok users published now-deleted videos with the hashtag #давайзамир (#letsgoforpeace), in which they included near-identical phrases such as “All are blaming Russia, but close their eyes that Donbas has been under fire for eight years,” and “Please check all the news, we’re fighting for peace.” Notably, the text in many of these videos was also extremely similar, and on some occasions identical, strongly suggesting either coordination or the distribution of talking points for Russian video creators. Indeed, some Russian TikTok users pushed back publishing messages claiming they were offered payment to post peace symbols and express the message that Russia is stopping the war rather than starting it, and that the world has ignored the Donbas for eight years.
The scope of the narrative operation caught the eye of other TikTok users, who compiled videos of TikTokers voicing similar statements, then shamed them for being corrupt. Some of these TikTokers muted comments to avoid criticism, while others ultimately deleted their videos.
Not long after this first wave of similar narratives, a second wave appeared, when multiple users published videos featuring the lines, “In 2015, a new memorial named Alley of Angels was built in Donetsk” and “Russia wants to bring peace.” These videos were available at the time of publishing but may soon be deleted as well.
—Roman Osadchuk, Research Associate
Georgian far left push message that Ukraine war is a battle between US and Russian empires
Georgian far-left groups are promoting the narrative that the war in Ukraine is a battle between two empires over Ukrainian resources. The narrative portrays the US and Russia as equal threats to Ukraine. On February 24, Politicano, a Facebook page known for Soviet Union nostalgia and affiliated with the Kremlin-linked News Front Georgia, posted that Ukraine has become a battleground for Western and Russian empires. Another Facebook page, “ნაპერწკალი“ (“Spark”), which describes itself as an “independent Marxist collective initiative,” posted that the war in Ukraine is a conflict between Russian and Western imperialists, fighting over spheres of influence and resources.
The narrative that Ukraine is stuck between the imperial interests of the West and Russia aligns with messaging coming from far-right Russian philosopher Aleksandr Dugin. On February 27, Dugin posted, “This is not a war with Ukraine. This is a confrontation with globalization…on all levels, including geopolitical and ideological.” According to him, Russia is creating a global resistance zone. “When we win, everybody benefits from it,” he said.
—Sopo Gelava, Research Associate, Tbilisi, Georgia
South Ossetia supports Russian invasion, blaming rise of neo-Nazis
On February 28, the KGB of South Ossetia issued a statement claiming that there is raise of neo-Nazi and nationalistic sentiments in Georgia. The claim refers to Georgians willing to join Ukraine’s international legion of territorial defence, that allows foreign volunteers to support Ukraine’s defense efforts. The South Ossetia KGB described Georgian volunteers as “aggressive Georgian volunteers from the ranks of [former President] Mikheil Saakashvili’s radical followers.” It continued, “Instead of recognising its responsibility for crimes committed against humanity from 1920s till 2008, the Tbilisi regime expresses support for Ukrainian Banderovtsi [followers of the 20th century Ukrainian nationalist Stepan Bandera] who in turn are nurturing their own revanchist goals.”
That same day, South Ossetia’s information agency published a story with the headline, “South Ossetia and Russia unite against Nazism.” The article claimed that citizens of South Ossetia launched a flash mob on social networks with the hashtag #Мирбезнацизма (“World without Nazism”). As of March 2, the DFRLab could not find a single public post on either Facebook or Twitter featuring the hashtag during the alleged time span of the flash mob.
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Belarusian paratroopers expected in Ukraine as Lukashenka confirms missile fire
On the morning of February 28, the Kyiv Independent reported that the first Ilyushin Il-76 transport aircraft was expected to deploy Belarusian paratroopers into Ukraine. Meanwhile, reports of ballistic missiles launched from Belarus into Ukraine continue to surface, with some reports suggesting the use of Iskander missiles. Belarusian President Alyaksandr Lukashenka later confirmed missiles were launched from Belarus on February 27.
—Lukas Andriukaitis, Associate Director, Brussels, Belgium
Ugandan General tweets support for Russia
Ugandan Lieutenant General Mahoozi Kainerugaba, son of President Yoweri Museveni and leader of the country’s land forces, tweeted on February 28, “The majority of mankind (that are non-white) support Russia’s stand in Ukraine.” The DFRLab previously identified a network of inauthentic Facebook assets working to prime Lt. Gen. Kainerugaba as the next president of Uganda.
The Ugandan Embassy in Moscow called on nationals living in Ukraine to remain cautious and follow instructions issued by the Ukrainian government. The embassy said, “It is our prayer that the situation will be short lived, and that normality will soon be restored.” The presidency has yet to issue any further comment on the war.
On February 24, Vladlen Semivolos, Russia’s ambassador to Uganda, spoke to Uganda’s permanent secretary of the Ministry of Foreign Affairs, Vincent Waiswa Bagiire, about developing bilateral cooperation in the United Nations.
—Tessa Knight, Research Associate, Cape Town, South Africa
Sudan Foreign Ministry says Russian media reported military leader’s comments out of context
The deputy head of Sudan’s military council, Mohamed Hamdan Daglo, was quoted by Russian media outlet FAN as having recognized the independence of the Donetsk and Luhansk People’s Republics. Daglo, who visited Moscow last week, was quoted saying, “The whole world must realize that it is [Russia’s] right to defend herself.” However, the Sudan Tribune reported a statement from Sudan’s Foreign Ministry claiming Daglo’s quote was taken out of context and used as a “cheap attempt to fish in troubled waters.”
On February 27, Sudan’s state news agency reported that the meeting between Sudanese and Russian officials had been scheduled prior to the war in Ukraine, and that Sudan called for de-escalation “on both sides.”
—Tessa Knight, Research Associate, Cape Town, South Africa
Further reading
Mon, Feb 28, 2022
Russian Hybrid War Report: Russia retaliates against anti-war celebrities as social platforms crack down on Russian media
New Atlanticist By
Meta, Patreon, and Twitter are taking action against Russian accounts, while Russian celebrities are facing pushback for their views, according to the Council's open-source researchers.
Wed, Mar 2, 2022
Mapped: Russia’s shelling of civilians in Kharkiv
New Atlanticist By Michael J. Sheldon
The DFRLab analyzed and geolocated available imagery of the attack, identifying three main neighborhoods affected by shelling.
Tue, Mar 1, 2022
Four ways the war in Ukraine might end
New Atlanticist By Barry Pavel, Peter Engelke, Jeffrey Cimmino
The United States, its transatlantic allies and partners, and the entire world face a difficult period of sustained contestation with Russia.
Image: Facebook logo displayed on a phone screen and Russian flag displayed on a screen in the background are seen in this illustration photo taken in Krakow, Poland on March 1, 2022. (Photo Illustration by Jakub Porzycki/NurPhoto)NO USE FRANCE