As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, the DFRLab’s global team presents the latest installment of the Russian War Report.
Security
New fires and alleged sabotage operations across Russian territory
Tracking Narratives
Russian media presents civilian evacuation from Mariupol as Putin’s success and Zelenskyy’s failure
Pro-Kremlin Telegram exploits Ukrainian reporting error
Russian Telegram channel undermines Ukraine-Poland relations with an apparently forged letter
Kremlin increases video content as a source for spreading disinformation and propaganda
New fires and alleged sabotage operations across Russian territory
Over the past several days, numerous strategic facilities on Russian territory have caught fire. The reason of the fires in most cases were not officially confirmed, though many of them are suspected to be sabotage operations. At the same time, Siberia is experiencing massive seasonal wildfires, which Russia has lacked enough manpower to keep under control.
On May 3, videos surfaced showing a massive warehouse caught fire in Bogorodskoye, northeast of Moscow. Russia’s Ministry of Emergency Situations also provided photos showing the scale of the fire, which reportedly spanned an area of more than three hectares. The warehouse was reportedly leased by the Prosveshchenie publishing house, which manufactures most of Russia’s school textbooks. That same day, another video showed a polyethylene waste storage area burning in the region of Krasnoyarsk. The fire, which reportedly spanned around 500 square meters, was also covered by Kremlin media.
On May 2, videos captured a fire at a munitions factory facility in Perm, near the Ural Mountains, roughly 1,500km east of Moscow. The factory reportedly manufactured Grad and Smerch rocket munitions, which have played a significant role in destroying cities in Ukraine. And on May 1, videos documented fuel-oil tanks burning in Mytishchi. The location of the fuel depot is reportedly only thirty minutes from the Kremlin.
On April 30, a GRES-2 120-megawatt coal-fired power plant was reportedly sabotaged and caught fire in the Sakhalin region of the Russian far east. A video captured the massive destruction at the plant.
Meanwhile, photos surfaced on May 1 suggesting that a railway bridge in Russia’s Kursk region was destroyed due to sabotage. The bridge reportedly was used to transport Russian troops and military equipment to Ukraine. Kremlin media outlet RIA Novosti reported on the incident without providing the cause of the “partial collapse.”
At the same time, Siberia is currently experiencing massive seasonal wildfires. Videos that surfaced on May 2 captured the enormous scale of the wildfires. Ukrainian journalist Denis Kazansky reported that the fires continue to burn as there is no one to put them out, because the military unit responsible for extinguishing fires in the region is currently fighting in Ukraine. But Russian officials insist they had extinguished more than six hundred fires encompassing 37,000 hectares nationwide as of last week.
—Lukas Andriukaitis, Associate Director, Brussels, Belgium
Russian media presents civilian evacuation from Mariupol as Putin’s success and Zelenskyy’s failure
Ukrainian and Russian officials reported that around one hundred civilians evacuated from the Azovstal steel works in Mariupol over the weekend of April 30. The evacuation was carried out in collaboration with the United Nations and the International Committee of Red Cross after UN Secretary-General Antonio Guterres visited Moscow and Kyiv the previous week.
On May 1, the Russian Ministry of Defense wrote that eighty civilians had been evacuated from Azovstal “thanks to the initiative of Russian President Vladimir Putin.” The statement claimed that evacuated civilians who “express a wish to go to regions under Kyiv regime control will be passed over to the UN and the International Committee of the Red Cross.”
This came less than an hour after Ukrainian President Volodymir Zelenskyy tweeted on Twitter that an initial group of one hundred civilians had been evacuated. “Tomorrow we’ll meet them in Zaporizhzhia,” Zelenskyy wrote. “Grateful to our team! Now they, together with #UN, are working on the evacuation of other civilians from the plant.” The UN separately noted that one hundred civilians had been allowed to leave during the first phase of the operation.
According to Reuters, the first batch of civilians arrived in Bezimenne village in the separatist-controlled Donetsk People’s Republic. On May 2, Russia’s MoD wrote that “eleven liberated citizens” decided to stay in the breakaway territory “voluntarily,” while the remaining civilians were passed to the UN and ICRC and were heading to Zaporizhzhia. Ukrainian Military Police posted photos of “over a hundred” civilians arriving in Zaporizhzhia.
Kremlin-owned Sputnik Kyrgyzstan portrayed the evacuation as solely a Russian rescue effort. Another Kremlin outlet, Vesti.ru, misleadingly wrote that Zelenskyy acknowledged the civilian evacuation from Azovstal “three hours later,” even though Zelenskyy’s tweet that came out an hour prior to the Russian MoD report about the mission. RIA Novosti, meanwhile, published comments by Azovstal employee Natalya Usmanova, who said that the Ukrainian military were not allowing civilians to leave the steel works factory after the corridor was announced. Usmanova was also cited by the BBC in Russian, which gave the additional context that that she came to hide in the factory bunker voluntarily but was not allowed to exit, as “the shelling was so intense that there was no oxygen by the exit of the bunker.” People “were afraid to go and get a fresh air,” she added.
On April 29, pro-Kremlin outlet Voennoe Obozrenie claimed the evacuation is being used by the Ukrainian military to escape the siege and that Zelenskyy was not in control of the situation. The article falsely stated that Zelenskyy is unpopular in Ukraine and would lose support if the military surrendered Avostal. Recent independent polling in Ukraine suggested that Zelenskyy would receive 82.5 percent of votes if a presidential election were held again.
The following day, Russian Duma member Viktor Vodolacky told media without evidence that evacuation corridors “may be used by the West to rescue foreign mercenaries” fighting in Ukraine against Russia.
—Nika Aleksejeva, Lead Researcher, Riga, Latvia
Pro-Kremlin Telegram exploits Ukrainian reporting error
On the afternoon of April 30, Ukrainian Telegram channel News Odesa and information agency UNIAN published a video of a ship presumably hitting a floating mine, with audio commentary remarking, “A Russian ship goes to hell.” Both channels, which published within a minute of each other, wrote, “Reportedly it is a Russian ship near Odesa. Waiting for official messages.” But their reports were incorrect. Twelve minutes later, News Odesa acknowledged the footage was actually six years old, depicting the deliberate sinking of a decommissioned US ship. UNIAN updated their reporting twenty-one minutes later, also clarifying that the original video was six years old, and the audio had been added recently.
Multiple Ukrainian channels forwarded or copied the message from both channels, then later updated or deleted their initial posts within a short period after realizing the reporting was in error. Several channels provided corrections within minutes of their original publication.
However, pro-Kremlin channels used the reporting error to “prove” that Ukrainian sources intentionally fabricate information. Kremlin-tied Telegram channel Legitimniy published a debunk of the story after News Odesa’s correction. Legitimniy claimed that some “media department” made up “victories” for Ukraine because there are no real ones that Ukraine’s presidential office could provide to these outlets.
A few hours after the original outlets’ corrections, additional Russian Telegram channels entered the debate, blaming the Ukrainian side for intentional fabrications and claiming that it was Ukrainian propaganda. The Russian outlet Izvestia also covered the story. Meanwhile, the War on Fakes Telegram channel, which has become notorious for publishing pro-Russian disinformation framed as fact-checking, released an “investigation” into the incident the following day.
As reporting mistakes are inevitable in the fog of war, it is vital that outlets acknowledge them in a timely fashion and provide corrections. Nonetheless, pro-Kremlin channels took advantage of this particular mistake to spin the narrative that Ukrainian sources should not be trusted in any context.
—Roman Osadchuk, Research Associate
Russian Telegram channel undermines Ukraine-Poland relations with an apparently forged letter
On May 2, Kremlin-tied Telegram channel Gossip Girl published what appears to be a forged document ordering Polish armed forces to prepare airborne units to enter the Ukrainian territories of Lviv and Volyn oblasts and take critical infrastructure objects under their control. The document featured a Ukrainian Intelligence logo, presumably to allege that the agency intercepted it. The document was amplified by a pro-Kremlin propagandist, an open-source research account, and other Twitter accounts. Several accounts doubted its authenticity but shared it anyway.
The document featured multiple elements suggesting its inauthenticity. First, the signature of Polish General Jarosław Mika is wrong and does not correspond with his actual signature. Second, the letter is addressed to Brigadier General Grzegorz Grodzki. According to the document, dated April 27, he is responsible for executing the orders contained within it, even though he has not been the commander of the airborne units in question since April 6. Third, the seals were most likely copy-pasted from another document, as Polish internet sleuths found signs of editing where text overlapped the seals on the second document. The signature of another general was stolen from this source document as well. Notably, Russian foreign intelligence chief Sergei Naryshkin claimed on April 28 that Poland intended to divide Ukraine.
The Telegram channel Legitimate forwarded Gossip Girl’s post and claimed without evidence that Ukraine had already agreed with Poland that the latter would move its forces to the Western part of Ukraine to move Ukrainian troops to the frontline in the Eastern part of Ukraine. Legitimate also provided spurious “insider” information that Western countries prevented Ukraine from signing a peace agreement with Russia that would result in the loss of territory. The logic behind Legitimate’s claim is that Warsaw would benefit from the partition of Ukraine, annexing the western parts of the country. The Russian narrative that Western neighbors intend to partition Ukraine for their individual gain has been debunked multiple times.
This would not be the first attempt by Russia to attack Polish-Ukrainian relations, as Russia consistently tries to undermine them.
—Roman Osadchuk, Research Associate
Kremlin increases video content as a source for spreading disinformation and propaganda
Amid YouTube’s blockage of Russian state-affiliated channels and Russia’s threats to ban the platform in the country, Kremlin media is expanding its video output through alternate means.
On its website, the Kremlin-owned RT has launched a section titled “Join the Information Home Guard.” The section leads to the Telegram channel Videos in Different Languages, which currently has more than 35,000 subscribers. The channel was created on April 21 and became operational on the same day. In its about section, the channel states, “With your help, we will break through the information blockade around the events in Ukraine. The whole truth in the most important videos from Ukraine in 17 foreign languages. Share these videos with your friends abroad. Join the Information Home Guard!”
Videos with short descriptions are posted in numerous European languages, as well as in Chinese, Turkish, Vietnamese, Persian, and Japanese.
Separately, in an attempt to justify Russia’s war crimes in Ukraine, RT released a “documentary” called “Maidan: Turn to War” (“Майдан: поворот на войну”), based on anti-Ukraine disinformation narratives long spread by the Kremlin. First released on March 5, it was promoted by RT Editor-In-Chief Margarita Simonyan on her Telegram channel nearly two months later. “On May 2, 2014, supporters of Euromaidan [the Ukrainian pro-democracy revolution] drowned pro-Russian protests in blood in Odesa,” she wrote. “Dozens of people died.” She added that “the terrible footage of the massacre” should be sent to “everyone who does not believe in [existence of] nationalism in Ukraine.”
The RT video, available in Russian and English, is based on commentaries given by pro-Kremlin actors, including journalists and former officials. It spreads multiple Kremlin narratives, including that Ukrainian ultranationalists had been planning a revolution long before the 2014 Euromaidan protests, and that they were trained and equipped in military camps to suppress pro-Russian sentiments in Eastern Ukraine by killing and robbing Russian-speaking civilians.
The video was uploaded by at least five YouTube channels on May 2. RT also promoted the movie that same day using more than fifteen different VK communities to amplify the content.
—Eto Buziashvili, Research Associate, Washington DC
Ukraine accuses Georgia, Armenia, and Azerbaijan of negotiating with Russia to re-export Russian products
On May 1, the Ukrainian MoD’s Chief Directorate of Intelligence said that Moscow is negotiating with Georgia, Armenia, and Azerbaijan to re-export Russian products to international markets. According to the statement, the supply is planned to be made under the guise of Georgian, Armenian, and Azerbaijani products to avoid international sanctions. It also claimed that two hundred companies have already been registered for this purpose in the three countries.
The Ukrainian MoD statement also said that Moscow plans to organize the production of component parts for the military and dual-use purposes in Collective Security Treaty Organization (CSTO) member states. The CSTO is currently comprised of Armenia, Belarus, Kazakhstan, Kyrgyzstan, Tajikistan, and Russia. According to the MoD statement, Armenia has created favorable conditions for Russian companies to do business there, especially in the IT sector.
Irakli Kobakhidze, chairman of the ruling Georgian Dream party, commented that the MoD statement lacked evidence. “This is another sad case when such a statement is spread by the Ukrainian authorities without facts,” he said. “It also has a very simple reason – people who are in the radical opposition here [in Georgia], are in power there [in Ukraine].”
Previously on April 4, the Ukrainian MoD accused Georgia of allowing Russia to smuggle illegal goods through its territory. Georgian authorities promptly denied the allegations.
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Image: File photo of Russian firefighter. (Source: EMERCOM)