As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report.
Security
Russia and Ukraine warn Zaporizhzhia nuclear plant facing imminent threat
Tracking narratives
Forged Kuleba letter asks Poland to name street after Stepan Bandera
Media Policy
Russia announces plans to build online system to detect prohibited content
War crimes and human rights abuses
Russian occupation administration conducts campaign of arrests in Kherson
International response
Russia and Turkey spar over alleged weapons contract
Ukrainians crowdfund Finnish satellite for armed forces
Russia and Ukraine warn Zaporizhzhia nuclear plant facing imminent threat
The Russian occupation of Ukraine’s Zaporizhzhia nuclear power plant continues to provoke fear among the international community in light of renewed shelling around the plant. Russian command in the area employs the facility for housing troops and military equipment, effectively using the plant as a shield against any possible Ukrainian attempt to retake the area. Ukraine and Russia have exchanged accusations about who is behind the shelling, both issuing warnings that the opposing side might attack the plant.
Earlier this month, independent Russia-focused publication The Insider published a video in which Russian military trucks enter the territory of the nuclear power plant and unload cargo. The column of trucks reportedly arrived on August 2. According to the video, Russian forces are mining the territory around the nuclear power plant. The Insider also reported that about 500 Russian soldiers are stationed at the Zaporizhzhia plant, alongside military equipment, including armored vehicles, anti-aircraft installations, and equipment for radiochemical detection. New footage also emerged on August 18 showing military trucks inside the plant.
Russia has accused Ukraine of preparing a “provocation at the Zaporizhzhia nuclear power plant” during UN Secretary-General Antonio Guterres’s visit to Ukraine this week. The Russian Ministry of Defense also claimed that the Ukrainian 44th Artillery Brigade from Nikopol would strike the Zaporizhzhia plant on August 19. No evidence was provided to support either accusation. Ukraine’s Energoatom, which oversees the country’s nuclear plants, has established a crisis headquarters to handle any possible incidents at the Zaporizhzhia nuclear power plant. Meanwhile, Ukrainian military intelligence issued a statement on Facebook on August 18 warning against a false-flag operation by Russia on August 19.
Located in the city of Enerhodar, Zaporizhzhia is the largest nuclear power plant in Europe. Since March 2022, it has been under the control of Russian troops. The UN has urged Russia to withdraw troops from the nuclear power plant and to establish a safe perimeter. The pro-Russian administration of the Zaporizhzhia region has been silent on the subject.
Meanwhile, the Ukrainian army continues to attack Russian forces along frontlines and occupied territories. A Russian base was reportedly destroyed in Amvrosiivka, Donetsk region, on August 17. On the same day, a Russian base in Lysychansk was also attacked. The Ukrainian government also admitted that it was behind recent explosions in Crimea. On August 16, reports arose of thick smoke and multiple explosions at Gvardeyskoe airbase in Crimea. On the evening of August 18, Russian air defenses stopped a Ukrainian drone attack in the Kerch area.
In Kherson, the occupying Russian administration the telecommunication company Norma-4, which could signal an attempt to cut off residents of the region from the outside world. After Russian forces took control of Kherson’s internet in May, several service providers went dark as Russia rerouted internet traffic from Kherson through Russian networks.
—Ruslan Trad, Resident Fellow for Security Research, Sofia, Bulgaria
Forged Kuleba letter asks Poland to name street after Stepan Bandera
On August 16, the Russian Telegram channel Джокер ДНР (“Joker DNR”) published a forged letter falsely attributed to Ukrainian Foreign Minister Dmytro Kuleba. In the letter, Kuleba is portrayed as asking Polish authorities to rename Belwederska Street in Warsaw, where the Russian Embassy is located, to Stepan Bandera Street, after the controversial far-right leader of the Ukrainian Insurgent Army in World War II. The forged letter claims that changing the street name to Stepan Bandera street would be seen as a gesture of support for Ukrainians. The letter highlights that Russia changed the names of the streets in Moscow where the embassies of the United States and the United Kingdom are located. The letter is not dated, and Dmytro Kuleba’s signature appears to be copied from a publicly available letter signed by him in 2021.
On August 17, the Telegram channel published another forged document, allegedly signed by Marcin Przydacz, Poland’s Deputy Minister of Foreign Affairs. The document contains several orders allegedly issued by Przydacz, including an order for the president of the Polish Institute of National Remembrance to provide a written expert opinion on the possibility of changing the name of the street in Warsaw “to honor the national hero of Ukraine Stepan Bandera.” It also proposes a campaign to increase the popularity of Stepan Bandera among Polish citizens.
Marcin Przydac confirmed on Twitter that the document was a forgery. “The linguistic errors clearly point to the potential authors of this provocation,” he said.
The Joker DNR Telegram channel also published a post that contained screenshots of Facebook posts from the accounts of Polish nationals Piotr Górka, an expert in the history of the Polish Air Force, and Dariusz Walusiak, a Polish historian and documentarian. Górka has previously written a book that was published by the Institute of National Remembrance, the organization mentioned in Przydacz’s forged document. Górka’s Facebook post claims that he fully supports the Polish government’s decision to change the name of Belwederska Street to Stepan Bandera Street. At the time of writing, Górka’s Facebook account was no longer available.
Dariusz Walusiak shared Górka’s Facebook post on the timeline of more than twenty Facebook users, including Adam Kalita, who works at the Krakow branch of the Institute of National Remembrance; Jan Kasprzyk, head of the Office for War Veterans and Victims of Oppression; and Alicja Kondraciuk, a Polish public figure living in Krakow. He also shared the post on Facebook groups. At the time of writing, Walusiak’s Facebook account was no longer available, but the DFRLab was able to archive Facebook posts before they disappeared.
The Joker DNR Telegram channel frequently publishes documents that it alleges are “leaked.” Some of these documents contain personal information about Ukrainian soldiers. According to cybersecurity firm Mandiant, the Telegram account is a Russia-aligned hacktivist group with connections to another threat actor, Ghostwriter. The tactic of taking over social media accounts to push false or leaked documents is quite similar to Ghostwriter’s tactics. The DFRLab has previously reported on an information operation attributed to Ghostwriter in which social media accounts of Polish nationals were hacked to plant false information.
The possibility exists that the owners of the Joker DNR Telegram account hacked the accounts of Górka and Walusiak, but the DFRLab is unable to confirm this. The selection of people the Walusiak account shared Górka’s post with indicates there may have been an effort to alert people who would have strongly opposed the “plan” to change the street name.
—Givi Gigitashvili, Research Associate, Warsaw, Poland
Russia announces plans to build online system to detect prohibited content
Russian censor Roskomnadzor has allocated 57.7 million rubles (nearly USD $1 million) to launch the Oculus internet surveillance system for detecting “prohibited data” by mid-December, Russian outlet Kommersant.ru reported.
According to the report, the surveillance system will be built on neural networks and will “analyze photos, videos and texts on websites, social networks and messengers for prohibited information, including homosexual propaganda and the manufacture of drugs and weapons,” Kommersant stated.
The system is expected to have a capacity of analyzing 200,000 images per day, meaning that Oculus could be able to analyze two frames per second, Russian outlet RBC reported. Prohibited content that would be a subject to Oculus monitoring includes extremism and terrorism materials, calls for “illegal” mass gatherings, expressions of “clear disrespect” for the state and official symbols, and the “promotion of non-traditional sexual relations.”
An unnamed source from “a large IT company” told Kommersant that the implementation of such a project under the suggested budget and timeline is “almost impossible.”
The development of the Oculus system appears to the next step in Russia’s domestic internet surveillance and censorship toolbox.
—Eto Buziashvili, Research Associate, Washington DC
Russian occupation administration conducts campaign of arrests in Kherson
Reports of abuse and arrests are increasing in southern Ukraine territory occupied by Russia. Recently published reports and witness testimonies from the city of Kherson document Russian troops going door-to-door to search belongings, mobile phones, and documents. The Russian occupation administration arrests anyone it suspects of assisting Ukraine against the Russian forces in the region.
Witness testimonies also show that the Russian administration holds civilians and members of the Ukrainian administration in basements, including the mayor of Kherson.
—Ruslan Trad, Resident Fellow for Security Research, Sofia, Bulgaria
Russia and Turkey spar over alleged weapons contract
Dmitry Shugaev, head of Russia’s federal service for military-technical cooperation, announced on August 16 that Turkey had signed a new contract to purchase a “second batch” of Russian S-400 anti-aircraft missile systems. Ismail Demir, president of Turkey’s Defense Industry Agency, which is responsible for procurement, was quick to deny the allegation. “There is no new development. According to the agreement made on the first day, the process continues, ” Demir said. The initial deal between Russia and Turkey was struck in 2017.
An unnamed Turkish defense official also told Reuters that there were no new agreements. “The original contract that was signed with Russia for the purchase of S-400s already included two batches. The purchase of a second batch was included in the original plan and the related contract.”
Kremlin-controlled media outlets such as RIA Novosti, RBC, and Izvestiya reported on August 18 that Russia had started fulfilling the contract with Turkey by delivering the second batch of S-400 anti-aircraft missile systems.
One day before Shugaev’s announcement, the Russian Minister of Industry and Trade, Denis Manturov, told Kremlin-controlled news agency Interfax that negotiations about the delivery of a “new batch” of S-400 anti-aircraft missile systems were “continuing.”
Turkey, a NATO member state, purchased Russian S-400 anti-aircraft missile systems in December 2017. In response, the US prohibited the transfer of F-35 fighter aircraft to Turkey in 2019. Most recently, the US approved the sale of F-16 fighter jets to Turkey, after Turkey dropped objections to Sweden and Finland joining NATO. Kremlin’s media campaign about the “new” S-400 deal with Turkey may be an attempt to sow divisions among NATO member states.
—Nika Aleksejeva, Lead Researcher, Riga, Latvia
Ukrainians crowdfund Finnish satellite for armed forces
A Ukrainian foundation launched by popular TV host Serhiy Prytula announced on Thursday that it had signed a deal with Finnish satellite company ICEYE to purchase a radar satellite for the Ukrainian Armed Forces.
A crowdfunding effort launched by the Serhiy Prytula Charity Foundation raised USD $20 million in June to buy Bayraktar drones for the Ukrainian military. However, Turkish defense firm Baykar refused to accept the money and donated three military drones to Ukraine instead. Prytula said that after consulting with Ukraine’s Ministry of Defense, the charity foundation purchased a satellite with the money that had been raised for the Bayraktar drones.
—Eto Buziashvili, Research Associate, Washington DC