As Russia expands its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, the DFRLab’s global team presents the latest installment of the Russian War Report.
Tracking narratives
Russia makes false claims while blaming Ukraine for Kramatorsk railway station attack
Ukraine accuses Russia of using mobile crematoria in Mariupol
Media policy
Inconsistent messages from Russia on the use of VPNs
Security
Tracking Russian mercenaries in Ukraine
War crimes and human rights abuses
Amid reports of looting, Russian soldiers may be stealing civilian cars
Russia makes false claims while blaming Ukraine for Kramatorsk railway station attack
On April 8, missiles landed near Kramatorsk railway station, killing dozens of people and injuring more than 100. The exact scale of casualties is still being investigated. According to local authorities, at least four children died. One of the missiles found on the scene had the phrase “За детей” (“for the children”) scrawled on it. While the phrase is open to interpretation, some have speculated that it was intended to mean “for the children of Russia,” and thus part of Russia’s attempt to paint Ukraine as the aggressor.
Ukrainian authorities had urged residents of Donetsk and Luhansk oblasts, including the city of Kramatorsk, to evacuate while it was still possible. Ukraine brought in multiple trains to bring residents away from the conflict, but the evacuation faced problems. On April 7, for example, three evacuation trains got stuck after Russia bombed railways near Barvinkove, the primary route westward from Sloviansk and Kramatorsk. The trains eventually departed after a delay of several hours. Meanwhile, buses from Vuhledar came under fire during an evacuation.
At least six trains were scheduled to depart Kramatorsk on April 8, each leaving the station as soon as they reached capacity.
Russia tried to blame Ukraine for attacking its own citizens. Russian Telegram channel Siloviki prematurely published information that Russians are “working on a cluster of armed forces of Ukraine at Kramatorsk railway station” and celebrated casualties among Ukrainian combatants. A few minutes after the initial post, they edited it, presumably after reports of civilian casualties proliferated. In the edited post, they said that when the Kramatorsk railway station was hit, “It was possibly a Tochka-U [missile] that the Armed Forces of Ukraine use.” Both posts were subsequently deleted, but the original post and the edited message were archived as a forwarded message on another pro-Kremlin channel. Another pro-Kremlin Telegram channel, Veteran Notes, published an ominous message on the evening of April 7, suggesting people who evacuate from Kramatorsk and Sloviansk not use railway transport.
Kremlin-owned mainstream media picked up the narrative and continued claiming Ukraine had attacked its own civilians, insisting that Russia does not use the Tochka-U missile system. While it might not be on official lists of Russian equipment, researchers previously spotted footage of Tochka-U systems being deployed in Belarus over the course of March, disproving Russia’s claims of not using them.
—Roman Osadchuk, Research Associate
Ukraine accuses Russia of using mobile crematoria in Mariupol
On April 6, the Mariupol City Council released a statement on Telegram accusing Russian forces of using mobile crematoria to cover up war crimes. According to the council’s statement, Russian leadership ordered troops to destroy evidence of crimes in Mariupol following the public backlash against the Bucha massacre. They alleged that Konstantin Ivashchenko, the self-appointed separatist mayor of Mariupol, coordinates the mobile crematoria with the help of local special brigades recruited by Russians. The council speculated that Mariupol’s death toll could be in the tens of thousands, though the scale of civilian casualties remains unknown. Turkey has offered to help evacuate the wounded and dead from Mariupol by sea, but the initiative requires Moscow’s approval. The council suggested that the Kremlin has yet to sign off on the plan because of the high number of civilian casualties. Ukrainian authorities have not provided evidence of Russian forces using mobile crematoria in Mariupol.
Before the invasion, Ukraine and other countries noted the presence of Russian mobile crematoria near the Ukrainian border. On February 23, British Defense Secretary Ben Wallace announced that Russia would deploy mobile crematoria in Ukraine to hide evidence of casualties. On March 3, Ukrainian President Volodymyr Zelenskyy said that the Russians had brought mobile crematoria into Ukraine to burn the bodies of their dead service members. Zelenskyy argued that the Kremlin would not want Russian families to know that their children died fighting in Ukraine.
In 2015, after the annexation of Crimea and the occupation of the Donbas region, Ukrainian authorities raised the issue of Russian mobile crematoria. On January 29 of that year, the head of the Ukraine Security Service stated that Russia brought several mobile crematoria into militant-held areas of Ukraine. At the time, US Reps. Mac Thornberry (R-TX) and Seth Moulton (D-MA) also noted that they had seen evidence of Russian mobile crematoria in Ukraine.
—Givi Gigitashvili, Research Associate, Warsaw, Poland
Kremlin-linked accounts promote Telegram channel spreading disinformation under the guise of fact-checking
The War on Fakes Telegram channel continues to amplify Russian disinformation under the guise of fact-checking, according to DFRLab monitoring. First reported on by the DFRLab in early March, War on Fakes now has over 720,000 subscribers, despite losing about 30,000 from March 19 to April 2. On April 3, the Russian Ministry of Defense amplified a post by War on Fakes to discredit information about the Bucha massacre.
The DFRLab has seen increased promotion of War on Fakes’ English-language content through new Telegram channels and Russian government Facebook accounts. Using the Meta-owned analysis tool CrowdTangle, the DFRLab examined accounts sharing links to War on Fakes’ English-language website. Throughout March and into April, Russian embassies and other government-affiliated accounts shared links to the website hundreds of times on Facebook. The combined reach of these accounts includes millions of users.
Although War on Fakes also has websites in Chinese, Arabic, French, and Spanish, none of these URLs were shared as widely; however, there were at least a few shares by Russian embassy accounts for each of these other language options.
The War on Fakes Telegram channel has also begun promoting a similar channel called “For the Truth,” which describes itself as “created to refute fakes and bring the truth to the West in their language.” The channel posts in Russian and English, and appears to be writing longer-form articles, which it shares via the web publishing tool Telegra.ph. One of War on Fakes’ secondary channels also publishes long-form articles via Telegra.ph in Russian. For the Truth admits that they coordinate with War on Fakes in some of their posts.
The DFRLab also identified what appears to be state-organized promotion of War on Fakes through Russia’s social media platform VKontakte. Hundreds of accounts and pages shared identical copy-and-pasted versions of a post promoting War on Fakes to Russian parents; most of the posts were published on March 9 and 10. The post’s text includes an emotional appeal to parents about the safety of their children and the need to protect them from false information about the war.
A significant portion of the pages sharing this post are government-funded schools or clubs, including the Young Guard program of Murmansk and numerous secondary schools, kindergartens, and preschools. The DFRLab has previously witnessed municipal VK accounts being used to justify the invasion of Ukraine. Other groups sharing the text include a step aerobics group, the Karate Federation of Murmansk, and a youth soccer organization. The DFRLab also identified another grouping of local government and news accounts sharing a different copied-and-pasted text promoting War on Fakes. This data set includes thirty separate accounts that all shared posts on February 27 within an hour of each other. Included in the posts was a video—which appears to have been taken down—refuting the claim that a Russian rocket hit an apartment building in Ukraine.
There appears to be some level of coordinated behavior behind these posts. When considering that the accounts have a connection to the Russian government, this provides evidence that the Kremlin is connected, or at the very least promoting, the War on Fakes operation.
—Ingrid Dickinson, Young Global Professional, Washington DC
Inconsistent messages from Russia on the use of VPNs
Over the last several weeks, virtual private networks (VPNs) have become a popular tool to help Russian internet users connect to Western online platforms blocked by the Kremlin. In mid-March, several outlets began reporting on the increased demand for VPNs in Russia. According to WIRED, “Almost a million people from Russia had signed up since the war started, 20 times the usual rate.” Pro-Kremlin outlet RBC.ru also noted that the sudden proliferation of VPNs likely explained why Russian use of western social media platforms had not dropped off entirely.
The Kremlin has not been supportive of the recent surge in VPN use, but messaging and enforcement has been inconsistent, as can be seen in this timeline put together by the DFRLab:
March 15: Alexander Khinshtein, Chairman of the State Duma Committee on Information Politics, stated that twenty VPN services had been blocked in Russia, and federal censor Roskomnadzor would continue blocking others.
March 17: TASS published a report by the cybersecurity firm Group-IB, which stated that blocking VPNs is “a very abstract task” and represents a technological challenge.
March 18: The Russian Fund for the Development of Digital Economy misleadingly “warned” Russian internet users that VPN services are a threat to their data security.
March 21: Russian outlets reported that many blocked VPN services continue to work in Russia, but at a slower speed.
March 22: Alexander Khinshtein stated that a legislative ban on VPNs was not being considered in Russia.
March 22: Andrei Klishas, head of the Federation Council Committee on Constitutional Legislation and State Building, stated there would be no punishment for using VPNs, even if the services are officially are banned.
—Eto Buziashvili, Research Associate, Washington DC
Tracking Russian mercenaries in Ukraine
Kremlin-backed Wagner Group mercenaries have been documented for the first time in Ukraine, after reports stating that over 1,000 fighters had being deployed in the war. Germany’s foreign intelligence service, the Bundesnachrichtendienst, intercepted Russian communications, which according to Der Spiegel suggested that “members of the Russian mercenary unit called the Wagner Group played a leading role in the atrocities in Ukraine.” The group became infamous for its atrocities in Syria and other conflict zones.
One of the individuals seen in the photos appears to be Yan Petrovskiy a.k.a. Velikyi Slavyan, serving in Wagner’s Rusich unit. In 2020, the DFRLab consulted with Norwegian journalists from NRK.no to identify him in Syria. Despite his efforts to conceal himself with a blurred face, Petrovskiy can be identified through distinctive features such as tattoos on his wrists, as well as his black watch, the side arm on his leg, and a “Valknut” patch on his chest made of three interlocking triangles. The Valknut, also known as the “knot of the slain,” represents the afterlife and is commonly used by the far right.
Meanwhile, according to the additional reporting, Rusich unit commander Aleksey “Fritz” Milchakov was recently wounded, and Yan Petrovsky is reportedly now in charge.
—Lukas Andriukaitis, Associate Director, Brussels, Belgium
Amid reports of looting, Russian soldiers may be stealing civilian cars
The monitoring group Belaruski Gayun published a new investigation on April 8 alleging that Russian soldiers are driving stolen Ukrainian vehicles. After receiving multiple requests from Ukrainian residents seeking help to find their stolen cars, Belaruski Gayun investigated civilian cars marked with a “V,” a symbol used by Russian troops to identify friendly forces. They discovered multiple cars in Belarus with this symbol and concluded that at least some of the vehicles were likely stolen from Ukrainian residents.
Belaruski Gayun spotted civilian cars without registration plates that were part of a large convoy of Russian military equipment. One of the cars in the convoy featured the logo of Havrylivski Kurchata (“Havryliv Chickens”), a domestic Ukrainian brand sold by the agriculture holding company Agromars.
Meanwhile, Russian Mediazona published a story about Dmytro Mayboroda, a Ukrainian mobile app developer, who lived under Russian occupation in Bervitsa, Kyiv Oblast. To ensure Russian soldiers would not steal his personal phone, he gave them phones he uses for app testing. After the withdrawal of Russian troops, Dmytro checked the phones locations and found out that more than one of them was now in Russia, including one he geolocated to a Russian military hospital in Dolgoprudny, Moscow Oblast.
—Roman Osadchuk, Research Associate
Image: This video footage and these images show the aftermath of a Russian missile attack on Kramatorsk railway station in the Donetsk Oblast in the East of the country, where thousands of peaceful Ukrainians were waiting to be evacuated on Friday morning (08April2022). Credit: Office of the President of Ukraine/Cover Images ]