As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, the DFRLab’s global team presents the latest installment of the Russian War Report.
Tracking Narratives
Questions arise over Russian media footage posted immediately after Kherson strikes
Ukraine discusses retaliatory strikes as multiple fires hit Russian border regions
Security
Pro-Kremlin Telegram channels falsely accuse Ukraine of selling weapons, again
Geolocating attacks in Moldovan breakaway region Transnistria
Russia intensifies attacks on Azovstal steel plant as Zelenskyy says evacuations are coming
Occupation
Russia planning “staged referendum” in Kherson
Questions arise over Russian media footage posted immediately after Kherson strikes
On April 27, residents of Russian-occupied Kherson held a pro-Ukraine rally that ended with protesters being dispersed by tear gas and stun grenades. At least four people were injured. Later that night, starting around 11:00 p.m. local time (8:00 p.m. UTC), the first reports of explosions in the city began to appear on Telegram. Ukrainian outlet Pravda reported that an antenna was struck, resulting in residents losing the signal to Russian TV channels that began broadcasting one week ago. However, the TV channels resumed broadcasting almost immediately.
A journalist with Izvestia, a Russian outlet previously identified as spreading disinformation, released footage showing the aftermath of the explosions. In the footage, the journalist claims that Russian anti-air defenses shot down a Ukrainian Tochka U missile that, he speculates, was aiming at the TV antennas. The claims were yet another example of pro-Kremlin media alleging that Ukraine was firing on its own citizens in occupied portions of the country as a means of inculcating pro-Russian and anti-Ukrainian sentiment.
Ukrainian Telegram channels conducted a metadata analysis of the video, but they did not disclose how they retrieved and analyzed the metadata. Based off of their reading of the metadata, however, the channels concluded that the video had been created two hours before the explosions started. The DFRLab independently analyzed the metadata and found that the Telegram channels likely failed to consider the timezone in their readout.
The DFRLab verified the metadata on the clip re-uploaded to Ukrainian Telegram channels using Metadata2go and received the same timestamp, 9:15 p.m. However, the time provided in the metadata was in the UTC timezone, which is three hours behind Ukrainian time, meaning that the local time would have been 12:15 a.m., which would indicate that the footage was likely filmed around an hour after the first posts appeared on Telegram.
Possibly complicating matters, the DFRLab found that the Izvestia Telegram channel had actually swapped out the video at one point, which would also mean that the metadata would have changed at the time of the swap. The original publication on the Izvestia Telegram channel was published at 12:10 a.m. local time, but the post was edited one hour later, as shown below. A new video with better resolution and the Izvestia logo in the top right corner was uploaded. The archived version of the original Izvestia post showed the video to be of lower resolution and without a logo. The older video’s metadata suggested it was created at 11:45 p.m. local time (8:45 p.m. UTC). The timestamp in the new video’s metadata was erased.
Ukraine discusses retaliatory strikes as multiple fires hit Russian border regions
On April 27, fires and explosions occurred in the Russian regions of Belgorod, Voronezh, and Kursk, all near the Ukrainian border. Pro-Kremlin outlet Lenta.ru reported that an ammunition depot had caught fire in Belgorod. On the same day, Russian media reported two pro-Ukrainian Russian saboteurs, captured by Russia’s security service in Belgorod, planned to target railways with explosives to stop Russian military equipment from reaching Ukraine.
In Voronezh, Russian air defense systems took down a Ukrainian drone, according to local Governor Aleksandr Gusev. In Kursk, Governor Roman Starovoyt also reported that Russian air defenses had intercepted a Ukrainian drone.
Ukrainian presidential advisor Mykhailo Podolyak said on April 27 that “Belgorod, Voronezh, Kursk regions are now also beginning to learn the notion of ‘demilitarization.’” He added that fires in ammunition depots are “absolutely natural processes of nature. Karma is a cruel thing.” Podolyak did not confirm or deny Ukraine’s responsibility for the fires in Russia.
On April 28, citing US Secretary of State Antony Blinken, Podolyak tweeted, “Ukraine must decide for itself whether to strike at [Russian] military facilities, @SecBlinken said. Russia has attacked [Ukraine] and killed civilians. Ukraine will defend itself in any way, including strikes on the warehouses and bases of [Russian] assassins. The world recognizes this right.”
Earlier, on April 26, British Minister of Armed Forces James Heappey confirmed that Ukraine has the right to use British weapons to destroy military objects on Russian territory. Seemingly in response, on April 28, RT editor-in-chief Margarita Simonyan tweeted, “Explosions and air defense sirens in Belgorod. The Anglo-Saxons publicly offer Ukraine to transfer offense to the territory of Russia. And they supply it with the means to implement this plan. What choice are you giving us, idiots? Complete destruction of the remaining Ukraine? Nuclear strike?”
Kremlin-controlled media have not reported on Podolyak’s statement and did not blame Ukraine for the ammunition depot fire in Belgorod. Simonyan’s tweet is the only public response to recent developments from a Kremlin-affiliated official that the DFRLab has found.
Additionally, on April 28, Russian regional media outlet NN.ru wrote about the first official death of a Russian serviceman in Belgorod, Russia, who died due to Ukrainian shelling on April 19. Multiple independent media outlets also reported on the story, which went unreported in Kremlin-controlled media.
—Nika Aleksejeva, Lead Researcher, Riga, Latvia
Pro-Kremlin Telegram channels falsely accuse Ukraine of selling weapons, again
Kremlin-tied Telegram channel Легитимный (“Legitimate”) published a post on April 28 accusing Ukraine of smuggling Western weapons to other countries. This is the latest iteration of the narrative, which surfaced last week when Ukraine was accused of selling weapons to African countries.
The “Legitimate” channel leveled unsupported claims that foreign mercenaries had been serving as liaisons between the Ukrainian government and private buyers. The channel falsely stated that more than 90 percent of the foreigners who came to Ukraine to fight against Russia were actually in the country to steal weapons and make money.
In spreading these claims, many pro-Kremlin Telegram channels often quote other channels, each adding their own spin on the narrative. In this same way, Legitimate had quoted another channel, Cartel, which had claimed that weapons were being sent to the front line on paper only and then being marked as destroyed as a means of obscuring their sale. In its post, Cartel had quoted another channel, Сплетница (Gossip Girl).
Gossip Girl’s post accused the Ukrainian government of sending weapons to “illegal markets, including the Middle East.” The channel claimed without evidence that photos of weaponry donated to Ukraine had appeared in Lebanon, where “Hamas and other groups’ fighters” buy weapons to fight Israel and the United States.
These narratives could be an attempt to undermine Western countries’ trust in Ukraine as a means of discouraging the further provision of weapons to Ukraine.
—Roman Osadchuk, Research Associate
Geolocating attacks in Moldovan breakaway region Transnistria
On April 25 and 26, several explosions took place in the Moldovan breakaway region of Transnistria, which borders Ukraine and hosts around 1,500 Russian soldiers.
On April 25, three men fired RPG-27 anti-tank grenade launchers at Transnistria’s Ministry of State Security. The next day, the Ministry of Internal Affairs of Transnistria reported two explosions targeting the Mayak radio and television center. The blasts disabled the center’s two most powerful antennas, which had been used to rebroadcast Russian radio. In addition, Transnistria separatist leaders claimed that they had found ten explosive devices at the site of the “terrorist attack” in Mayak. The third explosion reportedly took place on April 26 and targeted a Transnistrian military unit near the village of Parkany. No casualties were reported in any of the attacks.
Transnistrian separatist leaders and the Russian Ministry of Foreign Affairs described these attacks as acts of terrorism.
The DFRLab geolocated a video released by Transnistrian media, showing the attack on the region’s Ministry of State Security. In the video, three men fire grenade launchers from the street toward the building; they stand next to a long green residential building with 90-degree corners. The ministry building has a pedestrian crossing in front of it, and a yellow building is visible on the opposite side of the street. Satellite imagery confirmed that the video was filmed in front of the Transnistria Ministry of State Security building.
Vadim Krasnoselsky, head of the breakaway region, claimed that the attacks “can be traced to Ukraine.” He said the main objective of the attacks was to drag Transnistria into the Russia-Ukraine war. He also asked Ukrainian authorities to investigate the activities of the militant groups who had committed acts of terrorism in the breakaway region.
Transnistrian TV station First Pridnestrovian Channel reported that “terrorists” illegally had crossed into the region via the Moldova-Ukraine border, entering in a SsangYong car with a Polish license plate. The DFRLab checked the license plate number given by the channel against Poland’s insurance database but could not find any information on the number or its owner. Stanislaw Zaryn, Spokesman for Poland’s Minister-Special Services Coordinator, told the DFRLab that the Polish license plate visible in the First Pridnestrovian Channel video belonged to a different car than the one displayed in a video, indicating that the plate had possibly been stolen or repurposed. Elsewhere, Zaryn also told Wirtualna Polska, a Polish media outlet, that the car owner had not reported their license plates as having been stolen.
Separately, the DFRLab also geolocated footage showing the aftermath of the attack on the radio antennas and found that the antennas were located less than 1 kilometer away from the Ukraine-Moldova border, near the Transnistrian village of Mayak.
The Ukrainian Center for Countering Disinformation called the events in Transnistria Russian “provocations,” saying Russia seeks to open an additional front near Odesa. The Center said that Russia wants to force Ukraine to send armed forces toward Transnistria in order to weaken its positions in Mykolaiv city.
On April 27, Oleksiy Arestovich, an advisor to Zelenskyy, stated that Ukraine could help Moldova to capture Transnistria if the latter asked for the former’s help. Moldovan authorities declined, however, saying that there could only be a political and peaceful solution to the Transnistria conflict.
Maia Sandu, the president of Moldova, first linked the explosions to internal forces in Transnistria, but she later admitted that she could have been wrong in her initial assessment of the events.
—Givi Gigitashvili, Research Associate, Warsaw, Poland
Russia intensifies attacks on Azovstal steel plant as Zelenskyy says evacuations are coming
In recent days, Russian attacks on Mariupol’s Azovstal steel plant have intensified, according to newly published video footage. Many civilians are in hiding in the plant’s underground bunkers. On Friday, Ukrainian President Volodymyr Zelenskyy’s office said, “an operation is planned today to get civilians out of the plant.”
On April 27, aerial photos appeared on Telegram showing Russian forces shelling the Azovstal steel works.
Tweet featuring video footage of Russian forces firing on Azovstal steel works. (Source: @CanadianUkrain1/archive)
Also that day, Major Serhiy Volyna, a Ukrainian Marine commander, released a video pleading to the international community for help. He reported that around 600 wounded soldiers are stuck in the Azovstal plant alongside hundreds of civilians without required medical supplies and that they are running out of food and water.
Volyna’s claims are supported by graphic photos that surfaced on April 26, showing the wounded being treated in a field hospital.
On April 28, videos surfaced of Russian forces continuing the assault on the Azovstal plant, pushing in more equipment after heavy overnight airstrikes.
Also that day, the Kyiv Independent, citing Azov Battalion members defending the Azovstal plant, reported that Russian airstrikes had struck a military field hospital treating both wounded soldiers and civilians. Casualties were reported after the field hospital collapsed. According to the report, the hospital was attacked by naval artillery. A video of the aftermath of the attack on the hospital shows people digging through rubble and taking care of the wounded.
On April 29, Ukrainian media shared a graphic video allegedly showing Ukrainian forces striking a Russian soldier near the Azovstal plant.
—Lukas Andriukaitis, Associate Director, Brussels, Belgium
Russia planning “staged referendum” in Kherson
On April 25, the United Kingdom’s Ministry of Defense published its latest Defense Intelligence update in which it suggested that Russia is planning a “staged referendum” in Kherson. On the same day, Andrey Rudenko, Russia’s Deputy Minister of Foreign Affairs, told Kremlin-owned RIA Novosti that he “had not heard” about the plans to have a referendum in Kherson.
During the first weeks of the war in Ukraine, residents of Kherson took to the streets with Ukrainian flags and chanted anti-Russia slogans. Soon after, reports emerged of violent crackdowns on protesters and kidnappings. Eventually, Russian forces seized the city, and it remains under Russian occupation today.
On April 26, a local pro-Ukrainian Telegram channel reported that the Ukrainian flag and coat of arms were removed from the municipality building. On the same day, Kherson Mayor Igor Kolykhayev was replaced by Aleksander Kobts, a member of the Kherson city council who worked for the Soviet KGB prior to the end of the Cold War and later for the Ukrainian Security Service. On April 28, Kremlin-controlled RIA Novosti reported that the Russian Ruble would be introduced in Kherson on May 1 with a transition period of four months.
On April 27, independent Russian media outlet Meduza cited three anonymous sources “close to the Kremlin” who claimed that Russia is planning to schedule referendums designed for Kherson, Donetsk, and Luhansk to incorporate into the Russian state. The report said the referendums are expected to occur on May 15 and 16.
On April 28, ousted mayor Kolykhayev told the Ukrainian outlet NV that he suspects Russia’s true goal is for Kherson to join Crimea, suggesting Russia does not want several “quasi-republics.”
—Nika Aleksejeva, Lead Researcher, Riga, Latvia