As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report.
Security
Heavy fighting expected in Kherson, Prigozhin aims to boost Wagner operations
Tracking narratives
Russia again accuses Ukraine of plotting to use a “dirty bomb”
Facebook ads spread pro-Russian narratives
Polish Senate declares Russia a terrorist regime
Heavy fighting expected in Kherson, Prigozhin aims to boost Wagner operations
Ukraine’s Southern Operational Command stated on October 21 that Russian forces are actively transferring ammunition, military equipment, and units from the Dnipro River’s west bank to the east bank. Russian forces are likely not fully withdrawing from the upper Kherson region but preparing to defend the city. Humanitarian facilities in Kherson have also reportedly ceased operations.
Russia continues to use missiles and drones against critical infrastructure in Ukraine. The Ukrainian Armed Forces reported that on October 23 Russia conducted at least two missile strikes and twenty-five airstrikes. Ukrainian forces also said they shot down twelve Iranian-made Shahed-136 drones. Civilian infrastructure in Mykolaiv, Zaporizhzhia, and Novotavrycheske were among the targeted areas.
Meanwhile, Russian bloggers reported that Yevgeny Prigozhin, the main financier of the Wagner Group, is sponsoring the formation of a volunteer battalion, with recruitment led by former Russian officer Igor Girkin. Girkin is a critic of the Russian military command and a prominent figure among the Russian nationalists who participated in the annexation of Crimea in 2014. The Russian army is depending more heavily on Wagner fighters to gain territory in Bakhmut, which Russia has been trying to seize for months. Additionally, according to Russian sources, Wagner is recruiting crews for Pantsir-S1 and S-300 missile systems, Man-portable air-defense systems (MANPADS), electronic warfare, Su-25 aircraft, and other equipment. While Wagner fighters utilize the infrastructure of the Russian military, the group’s equipment and operations are funded separately. It appears that Wagner’s command wants to strengthen the unit’s independence on the battlefield.
There is also an increasing possibility of ethnic conflicts among soldiers as racial discrimination emerges among Russian military ranks. Footage released on October 24 showed a Russian officer beating a Muslim soldier allegedly for attempting to pray. Russian commentators have denied the authenticity of the clip. However, this is not an isolated case, as two Tajikistan nationals are suspected of being behind a deadly shooting at a training ground in Russia’s Belgorod region on October 15.
In addition, General Oleksiy Gromov, a senior Ukrainian military official, said on October 27 that Belarus is preparing for an escalation. As evidence, he said that Russian officers are now checking the degree of combat readiness of Belarusian military units and that “secret transfers of personnel, equipment and military maneuvers continue in the country.”
Gromov’s claims have not been independently verified.
—Ruslan Trad, Resident Fellow for Security Research, Sofia, Bulgaria
Russia again accuses Ukraine of plotting to use a “dirty bomb”
Russian President Vladimir Putin claimed on October 27 that Ukraine is plotting to use a “dirty bomb,” reigniting a narrative that has spread through pro-Kremlin sources since the early days of the war. Russian state media outlets amplified the latest iteration of the claim.
In remarks delivered to the Kremlin-associated Valdai Discussion Club, Putin acknowledged that Russian intelligence services intentionally published information about Ukraine’s “dirty bomb.” He said that Kyiv authorities “are doing everything to cover up the traces of the preparation.” Putin also stated that he “instructed [Russian Defense Minister] Shoigu to call all of his colleagues and inform them.” Shoigu indeed called his Western counterparts on October 23 to warn that Ukraine was planning to use a “dirty bomb.”
Along with Putin, Russian Foreign Ministry spokesperson Maria Zakharova claimed that Ukraine’s goal “is to blame Russia for using weapons of mass destruction,” while simultaneously planning to use WMDs against Russia.
On October 26, the Kremlin-owned outlet RIA published an article, based on an anonymous source, that claimed Kyiv had “already completed the technical preparations for the dirty bomb provocation.” The article stated that Ukraine’s state-owned rocket manufacturer “prepared a mockup of a rocket, which is planned to be filled with radioactive material, then supposedly to shoot it down over the exclusion zone of the Chernobyl nuclear power plant and announce the launch of a nuclear charge by the Russian armed forces.”
On October 24, Igor Kirillov, chief of the radiation, chemical and biological defense forces of the Russian army, claimed that “Kyiv possesses the scientific base for creating a dirty bomb.” According to Kirillov’s comments, the “dirty bomb” can be prepared at the research base research base of the Kharkiv Institute of Physics and Technology. He added that this institute participated in the nuclear program of the Soviet Union.
Along with these statements from Russian officials, Kremlin-owned and pro-Kremlin media outlets have amplified the accusation. While some outlets explained the mechanics and usage of dirty bombs, others claimed that the United Nations Security Council has already stopped Ukraine from deploying a “dirty bomb.”
The DFRLab has previously reported on Russia’s attempts to propagate the narrative that Ukraine plans to utilize “dirty bombs.”
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
Facebook ads spread pro-Russian narratives
This week, the DFRLab observed multiple Facebook ads spreading pro-Russian narratives that criticized Ukrainian anti-air defense systems, claimed that Ukraine is under external control, called for the removal of Ukrainian President Volodymyr Zelenskyy, and discredited the Ukrainian government. User comments responding the ads expressed anger towards their content, with some accounts saying they were reporting the ads. The narratives are another example of how ad platforms can be exploited in influence operations. The DFRLab has previously reported on how Facebook ads are used to spread disinformation.
The DFRLab identified at least four different pages that amplified disinformation through Facebook ads. The pages have abstract names and profile pictures. They published and advertised a single post in Russian featuring poorly made caricatures, usually stolen from Russian or Belarusian sources. The pages have only a few followers but are not newly created, with some dating prior to the Russian invasion of Ukraine on February 24.
As all of the ads and pages were removed at the time of publication. As all of the ads and pages had been removed at the time of writing, the DFRLab could not establish its precise reach, but one ad in the library received between 200,000 and 250,000 impressions. Other ads received between 800 and 1,000 engagements.
The Facebook ads and pages appear to be linked to a network based in Russia identified by the DFRLab and other outlets earlier this fall. According to a spokesperson for Facebook’s parent company, Meta: “We detected and removed these ads and the associated Pages. We’ve also blocked hundreds of domains as part of our ongoing work to prevent the networks we took down from reconstituting on our platform. As we said last month, this operation is persistent in trying to set up new domains spoofing news organizations and drive people across social media to these websites. The majority of this operation’s accounts, Pages and ads on our platforms were detected and removed by our automated systems. We keep updating our threat report, including the list of spoofed domains, to help inform open-source research by security researchers and our industry peers.”
—Roman Osadchuk, Research Associate
Polish Senate declares Russia a terrorist regime
On October 26, the Polish Senate passed a resolution declaring Russia a terrorist regime. Eighty-five senators voted in favor of the resolution while fifteen others abstained. The resolution states that Russian armed forces “unleashed a brutal war with Ukraine” and that the purpose of the conflict is to “wipe out a sovereign country from the map and destroy the Ukrainian nation.” The Senate condemned Russian aggression and called “all countries in favor of peace, democracy and human rights to recognize the authorities of the Russian Federation as a terrorist regime.” The Senate also praised all institutions and organizations that undertake research and document war crimes committed against Ukraine.
On October 27, Senate Marshal Tomasz Grodzki announced that a “strong” cyberattack on Senate servers was underway and added that he did not know if the attack was related with the adoption of the resolution on Russia or whether it was a coincidence.
On October 18, the Parliament of Estonia also adopted a resolution declaring Russia a terrorist state, following Lithuania and Latvia, who have also designated Russia as a terrorist state. On October 13, the parliamentary assembly of the Council of Europe also passed a resolution declaring Russia a terrorist regime.
—Givi Gigitashvili, Research Associate, Warsaw, Poland