As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union (EU)—the DFRLab’s global team presents the latest installment of the Russian War Report.
Security
Russian MoD seeks to boost recruitment efforts across Russia
Tracking narratives
Russian disinformation campaign to encourage split in Ukrainian leadership
Investigations
Media investigation finds Ukrainian colonel coordinated Nord Stream pipeline attack
Media policy
Russia gets gradually closer to blocking VPNs in 2024
Russian armed forces face difficulties in replenishing military and paramilitary supplies amid failed offensive in Avdiivka
In a November 8 article, the Wall Street Journal reported that Russian officials in an April visit to Egypt had asked President Abdel Fattah al-Sisi “to give back more than a hundred engines from Russian helicopters that Moscow needed for Ukraine.” Another source quoted by the Wall Street Journal also said that Russian officials were seeking to “[go] back in secret to their customers trying to buy back what they sold them.” The Washington Post, in an October 16 investigation, quoted US intelligence reporting that satellite imagery helped identify a North Korean container ship that could have provided munitions for Russia. The investigation found that three hundred containers had been shipped from North Korea’s Rajin Harbor to the Russian harbor of Dunai and were subsequently located at an ammunition depot next to the Azov Sea.
The DFRLab additionally found evidence that the Russian armed forces are turning to civilians to help with purchasing additional paramilitary equipment, including drones, thermal sights, vehicles, and medicine. The Russian charity fund “All for Victory” hosted fundraisers organized by Russian propagandist Vladimir Solovyov, including an additional “emergency fundraiser” to support soldiers on the front line during the battle of Avdiivka in October 2023. According to an October 13 Telegram post, the fundraiser aimed to collect money to purchase “drones, thermal sights, [. . .] anti-electronic warfare devices to protect themselves against [the enemy], tactical medicine, bulletproof vests and helmets, warm clothes and boots.”
The DFRLab also found that several military bloggers reposted the original post to their channels, reaching an audience of nearly eight hundred thousand people, according to data from a query using Telegram monitoring tool TGStat. Pro-Russian news outlet DNR News reported that the initiative had raised around eighty-two million rubles (approximately nine hundred thousand dollars) in seven days.
Additionally, Solovyov held a separate fundraiser during a livestream dedicated to the purchase of 1,440 units of Chinese-made DJI Mavic and FPV drones, earning a total of nearly 470 million rubles (approximately 5.175 million dollars) over the course of three days.
“The People’s Front,” a Russian organization that President Vladimir Putin directly headed from 2013 until 2018, established the “Everything for Victory” charity fund. The charity fund and the government-sponsored organization are intertwined, as the People’s Front was renamed in May 2022, as “The People’s Front, All for the victory,” only a few months after Russia invaded Ukraine. In 2022, the organization focused on providing humanitarian aid, which it advertises on its VKontakte page; it later shifted to providing paramilitary goods, initially as means to support the self-proclaimed separatist armed forces of the Donbas region. Still later, it shifted to providing the same goods but to the battalions of the Russian army, with additional promotional support on social media from military bloggers.
Upon investigating the phone number on display on the charity fund’s website, the DFRLab found that the number had been promoted as a general helpline across Russia, in which the Russian Red Cross also participates. Regional information portals, including Russia’s public service platform (Gosuslugi) in the region of Saint Petersburg, pushed the phone number as the health ministry’s local helpline during the COVID-19 pandemic.
—Valentin Châtelet, Research Associate, Brussels, Belgium
Russian MoD seeks to boost recruitment efforts across Russia
The Russian Ministry of Defense (MoD) website dedicated to the recruitment of contract soldiers is engaging in a massive campaign to build an “elite division of contract soldiers” and has pledged a one-time down payment of one million rubles (approximately eleven thousand dollars) upon signing the contract. This special recruitment bonus will supposedly be available from November 1 to November 25. Russian military bloggers “Старше Эдды” (“Older than Edda”), “Пул N3” (“Bullet No. 3”), “Kotsnews,” and “Военкор Котенок” (“Military correspondent Kotyonok”) all amplified the MoD campaign on their Telegram channels.
A similar campaign took place in October, which another channel, “Reviewer of the war,” referred to as “the biggest one-time down payment for contract soldiers.” In that earlier campaign, the Russian MoD promised that new contractors would be paid six hundred thousand rubles (approximately 6,600 dollars) upon signing.
The Georgia-based “Get lost!” initiative, which aims to help Russians flee from mobilization, drafting, and summons to military commissariats reported on November 12 that Russian authorities had engaged in a widespread SMS campaign to entice men to enroll as soldiers. The initiative claimed that messages were sent to residents of the Bashkortotan and Tatarstan Republics, as well as Irkutsk Oblast. Although the DFRLab was unable to independently confirm the authenticity of most of the senders, it identified one phone number that users on callfilter.app, a website dedicated to report phone scams, identified as “military commissariat.” On November 14, the initiative reported that additional calls to enroll were identified online, as military commissariats sent out messages on messaging apps.
—Valentin Châtelet, Research Associate, Brussels, Belgium
Russian disinformation campaign to encourage split in Ukrainian leadership
Echoing an earlier situation featuring a poorly made deepfake of Ukrainian President Volodymyr Zelenskyy, three deepfake videos of General Valerii Zaluzhnyi, commander-in-chief of the Armed Forces of Ukraine, recently surfaced on Telegram. In the new fabricated videos, a clear facsimile of Zaluzhnyi claimed or alluded to Zelenskyy’s supposed intention to kill the general. These videos appeared against the backdrop of the death of Hennadii Chastiakov, Zaluzhnyi’s aide, from an explosion, the cause of which remains under investigation.
On the evening of November 6, the day the aide was killed, Russian Telegram channel Radio Truha published the first of the deepfake videos. The channel is connected to another channel, Truha Barselona. Both channels claim to provide “satire” regarding Anatolii Sharij, a pro-Russian Ukrainian blogger charged with high treason. The video copied graphics of the Armed Forces of Ukraine and supposedly depicted Zaluzhnyi saying that his birthday had already passed and asked viewers not to give him gifts, implying any such gift would be explosives such as those that killed his aide.
The awkward movement, unnatural facial expressions, and changed voice of the general, as well as the absence of a statement on his official channels, suggested that the video was not real. That did not stop, however, multiple Russian pro-Kremlin Telegram channels from amplifying the video. As of November 16, the video had received 233,000 views and been shared 1,500 times, according to TGStat, a Telegram analytics tool. While the original video had a disclaimer with the channel’s handle “@RadioTruha,” some of the pro-Kremlin channels cut the ending, thus obscuring its satiric origin.
The second fabricated video appeared on November 7, posted by Radio Truha but without the handle watermark at the end of the video. In this video, a fake Zaluzhnyi calls for mutiny, asking soldiers to march on Kyiv and stop listening to the “criminal orders of Zelenskyy.” The Center Countering Disinformation debunked the video and highlighted that it was widely shared on TikTok, X, and Telegram. Here again, Zaluzhnyi’s appearance, voice, and movement seen in the video appeared clearly unnatural.
Radio Truha’s compatriot channel, Truha Barselona, published a third fake video; in this third fabricated video, Zaluzhnyi is seen claiming that, because Zelenskyy owns all Ukrainian media, they “wrongfully claimed that it is a deepfake.” This poorly made video supposedly featuring the commander-in-chief had received almost three hundred thousand views and been shared 7,500 times as of November 16.
While even some pro-Kremlin users acknowledged the clearly fake nature of the video, some shared it without additional comment. Meanwhile, Ukrainians mocked the forgeries with a deepfake of their own, in which a Zaluzhnyi facsimile declares that he and Zelenskyy had argued over which target in occupied territory to hit, implying that they are plentiful.
On November 13, Truha Barselona published a deepfake of Zelenskyy, in which he appears to order Ukrainian troops to leave the Donbas town of Avdiivka and which includes footage of a supposed cemetery of Ukrainian soldiers that had “not evacuated from Bakhmut.” The video features the same telltale signs of inauthenticity as the three fake Zaluzhnyi videos.
It is not the first time that Russian sources have tried to portray a conflict between Ukrainian military and political leadership. In late April, they launched an advertising campaign suggesting Zaluzhnyi had political ambitions. Since then, occasional ads and articles on forged websites have appeared sporadically, making similar claims. In one such instance, ads appeared in early November claiming that Zaluzhnyi would take Zelenskyy’s seat after the former penned a column for the Economist.
—Roman Osadchuk, Research Associate
Media investigation finds Ukrainian colonel coordinated Nord Stream pipeline attack
On November 11, the Washington Post and Der Spiegel published a joint investigation arguing that, according to anonymous sources in Ukraine and Europe, the explosion of three lines of the Nord Stream gas pipeline on September 26, 2022, were coordinated by Roman Chervinsky, a former commander of the Ukrainian Special Operations Forces. According to the Washington Post and Der Spiegel interlocutors, Chervinsky managed a team of six people who rented the vessel and, using deep-sea diving equipment, installed explosive devices on the pipelines.
The two media outlets also reported that, according to their sources, Chervinsky had not acted alone and that he was obeying orders from high-ranking Ukrainian officials, including Major General of the Armed Forces of Ukraine Viktor Hanushchak, who reports to Commander-in-Chief of the Armed Forces of Ukraine Valerii Zaluzhnyi. However, Ukrainian authorities denied the involvement of the Ukrainian Armed Forces in the pipeline explosion, and Chervinsky himself also denied having any role in the attack. The Washington Post and Der Spiegel also clarified that there was no evidence that Zelenskyy had approved this attack and that Chervinsky’s involvement in this case revealed internal tensions within the Ukrainian government, specifically between the country’s intelligence and military establishment and the political leadership.
Chervinsky has been in custody since April 2023 in Ukraine, where he is accused of abusing his power in a failed special operation aimed at recruiting a Russian pilot in 2022. According to Ukrainian Security Services, Chervinsky acted without permission and, in doing so, gave away coordinates of a Ukrainian airbase in Kanatove, which then became a target of Russian missile attacks in July 2022, killing the commander of the base’s military unit and wounding seventeen others. According to the Washington Post and Der Spiegel, Chervinsky also coordinated a complex operation in 2020, which attempted to trick Wagner mercenary group fighters into entering Ukraine from Belarus in order to bring them to justice. While Chervinsky failed in this operation as well, Belarusian authorities instead arrested thirty-three Wagner fighters near the country’s capital, Minsk, charging them with trying to overthrow the government around the 2020 presidential elections. Minsk subsequently handed them over to Russia in August 2020.
—Givi Gigitashvili, Research Associate, Warsaw, Poland
Russia gets gradually closer to blocking VPNs in 2024
Content that is unfavorable or problematic in the Kremlin’s eyes is still available online for Russian internet users using circumvention tools such as virtual private networks (VPNs) to access it. Russia has already blocked several VPNs, but the move was not total or system-wide. It seems that a more comprehensive crackdown on VPNs will come about in 2024, however.
In early September, Russia’s Ministry of Digital Development introduced a draft government resolution expanding the powers of internet regulator Roskomnadzor in terms of blocking information about or access to prohibited online resources in Russia. In the same period, Digital Development Minister Maksut Shadayev stated that authorities would not penalize Russians for using VPNs—technology that helps Russians to circumvent government blocks to access restricted information.
Later in September, Roskomnadzor developed criteria for blocking information that provides tips on how to bypass censorship, describes the advantages of such tools, or urges their purchase. Reportedly, the restrictions will not be applied to scientific, technical, and statistical information on ways of bypassing the blockage. The proposal, if approved, would come into force on March 1, 2024, and be valid through September 1, 2029.
According to digital rights organization Roskomsvoboda, the proposal would not only violate digital rights but also possibly the right to privacy. There would be a high risk of “getting blocked for any publication about the capabilities of VPNs, proxies, anonymizers, Tor” and out-of-court decision making would deprive website owners and authors the right to defend themselves, the organization noted.
In October, Artem Sheikin, a member of Russia’s Federation Council Committee on Constitutional Legislation and State Building, stated that, starting in 2024, the country’s internet regulator will be able to block all VPN services available in app stores that provide access to prohibited websites.
In November, the Ministry of Digital Development “clarified” that Russian authorities would only block specific VPN services that “a commission of experts identify as a threat to the security of the internet.” In his Telegram post, head of the State Duma Committee on Information Policy Alexander Khinshtein wrote that “VPN services pose a threat to users, as some of them collect their personal data and activity history” and leaks of databases of public services with real IP addresses of users have recently begun to occur more and more often.”
In 2023, Russia’s internet restrictions reached previously unheard-of levels. According to Freedom House, Russia’s freedom on the net score decreased from the previous year in 2023. Russian outlet Kommersant reported Roskomnadzor’s estimation that the number of blocked resources in Russia had increased by 85 percent from 2022 through the middle of 2023.
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
Image: Members of Ukraine's National Guard Omega Special Purpose fire a SPG-9 anti-tank grenade launcher toward Russian troops in the front line town of Avdiivka, amid Russia's attack on Ukraine, in Donetsk region, Ukraine November 8, 2023. Radio Free Europe/Radio Liberty/Serhii Nuzhnenko via REUTERS