As Russia expands its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the US, NATO, and the European Union, DFRLab’s global team presents the latest installment of the Russian War Report.
Tracking narratives
Russian Duma members falsely claim Ukraine is creating ethnicity-targeting bioweapons
Undercover Russian reporter identifies anti-Ukraine “troll farm”
South Ossetian officials spread Kremlin bioweapon narratives in Georgia
Russian tabloid publishes and deletes casualty figures, blaming hack
Media policy
VK reports sharp user growth even as it intensifies censorship of anti-war content
Security
Troops from Georgian breakaway region South Ossetia arrive in Donbas
Documenting dissent
Activists in Poland, Lithuania block cargo trucks from entering Belarus
War crimes and human rights abuses
International Criminal Court seeks to charge South Ossetian officials with war crimes over 2008 war
Russian Duma members falsely claim Ukraine is creating ethnicity-targeting bioweapons
On March 22, the Liberal Democratic Party of Russia proposed an investigation into Ukraine’s supposed role in the COVID-19 pandemic and accused the country of creating bioweapons. The LDPR faction in the Russian Duma unanimously supported the initiation of a parliamentary commission to investigate the activities of biolabs in Ukraine. The false narrative claiming Ukraine was involved in the creation of COVID has been debunked.
Aleksey Didenko, a deputy leader of the LDPR, falsely claimed, “Ukrainian traces can be found in the dissemination of COVID in recent years.” He added that the Pentagon funds COVID-19 related research in Ukrainian biolabs. Didenko said that Americans should pay for the economic damages caused by COVID-19, arguing that the US should be a co-defendant alongside Ukraine for “encouragement of anti-humanity activities.”
Sergey Leonov, Deputy Chairman of the State Duma Healthcare Committee, alleged that Ukraine is preparing biological weapons and claimed that Ukraine was researching “regional infections aimed at Russian regions.” He mentioned “Crimean fever” as an example, likely referencing Crimean-Congo hemorrhagic fever, which was first documented in Crimea in 1944. The World Health Organization has reported that Crimean-Congo hemorrhagic fever “is endemic in all of Africa, the Balkans, the Middle East, and Asia,” contradicting Leonov’s statement. He also amplified the debunked claim that a recent spike in tuberculosis cases in separatist areas is connected to Ukrainian biolabs. Leonov stated that Ukraine is researching ethnicity-targeting biological weapons, another disinformation narrative that echoes the Soviet-era campaign Operation Infektion. Viruses cannot be controlled or restricted to targeting a specific region or ethnicity.
—Roman Osadchuk, Research Associate
Undercover Russian reporter identifies anti-Ukraine “troll farm”
An investigation by Fontanka.ru, a pro-Kremlin media outlet in St. Peterburg, has uncovered details of a coordinated information campaign intended to counter “Ukrainian fakes.” An undercover reporter responded to an advertisement on the Telegram channel Kiber Front Z (“Cyber Front Z”), seeking people to “fight back in the information field.” The undercover reporter contacted a Telegram user named Aleksander Kapitanov and met him for a job interview the next day. The job was “unofficial” and without a contract. The monthly salary was RUB 45,000 ($431.96). The schedule consisted of two working days followed by two days off. The job entailed writing about 200 comments per day addressing “Ukrainian disinformation” on social media platforms like YouTube, TikTok, and Telegram. Employees were given access to fake accounts and told what to write and where to post it.
Fontanka’s undercover reporter said they were told to leave comments on an interview between historian Tamara Eidelman and Yury Dudy, a popular Russian independent blogger; briefings from Zelenskyy advisor Aleksey Arestovich; a news broadcast from the independent Russian media outlet Current Time (now banned in Russia); and other content that does not support Kremlin narratives. The undercover reporter shared one of the comments they were told to leave: “The weapons that the Westerners hand over to the Armed Forces of Ukraine do not reach the front but are smuggled out at the border states of the EU. The weapons then fall into the hands of criminal gangs.” In addition, the Fontanka reporter said they were told to leave positive comments under a March 18 broadcast of a pro-war rally at Moscow’s Luzhniki Stadium.
The people behind this operation remain unknown. However, when the reporter skipped one day of work, they received a phone call asking if they would continue working on the project. The reporter investigated the phone number and found it belonged to Aleksey Nekrilov, who works for companies linked to Project Lakhta, which the US government has linked to Russian influence operations.
The workplace was a building named Arsenal, which was previously used as an arms manufacturing center. Oleksandr Yanukovych, the son of the former Ukrainian President Viktor Yanukovich, reportedly rented out the building for his company Arsenal Invest in 2014. The reporter described this as a “coincidence.”
As of March 23, the Telegram channel Kiber Front Z had 54,461 subscribers. The pinned post on the channel calls on subscribers to amplify different types of content, including political information; exposing Ukrainian and Western “propaganda”; eyewitness reports from Donbas separatist republics; briefs about the frontline; information about “traitors” who are against the “military operation”; and visual media, such as posters, videos, and stickers.
—Nika Aleksejeva, Lead Researcher, Riga, Latvia
South Ossetian officials spread Kremlin bioweapon narratives in Georgia
The so-called State Information Agency of Russian-occupied South Ossetia published a statement from the local KGB titled “Biolaboratories – a threat to yourself.” The statement warned Georgians of the “danger of a US biological laboratory” in Georgia, asking “Georgian citizens and patriots” to provide information about US weapons of mass destruction stockpiled in the country, as well as evidence of biological sabotage, coverups, or sample collection in the country.
The Kremlin has amplified bioweapons and biolab threat narratives as a justification for war in Ukraine and potential false flag operations. The statement of the South Ossetian KGB appears to be an attempt to spread the narrative to Georgia, which has previously been targeted by similar Kremlin narratives.
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
Russian tabloid publishes and deletes casualty figures, blaming hack
On March 20, the pro-Kremlin Russian tabloid Komsomolskaya Pravda published an article claiming nearly 10,000 Russian soldiers had died in the Ukraine war. “According to the Ministry of Defense of the Russian Federation, the Russian Armed Forces lost 9,861 people, 16,153 people were injured during the special operation in Ukraine,” it stated.
The outlet later walked back the claim by saying the website had been hacked, and that they immediately deleted the “inaccurate information.”
Throughout the war in Ukraine, Russia has obscured information about its casualties. The only public acknowledgment from Russia about its casualties came on March 2, when the Ministry of Defense reported 498 deaths and 1,597 injuries. On March 16, the New York Times, citing Pentagon officials, reported 7,000 Russian troops had been killed in Ukraine, while Ukrainian officials placed the Russian death toll at 13,500.
The DFRLab found that the casualty figures were not included when Komsomolskaya Pravda first published the article at 18:09 GMT on March 20. The first archived snapshot of the article was captured by the Internet Archive’s Wayback Machine at 18:14 GMT and does not include the paragraph about Russian casualties. This is further confirmed using a cached version of the article, captured at 18:17 GMT on March 20, which does not include the paragraph about Russian casualties. The second archived version of the article was captured by the Wayback Machine at 12:13 GMT on March 21, and it includes the paragraph about Russian casualties. This indicates the casualty figures were added sometime between March 20 at 18:17 GMT and March 21 at 12:13 GMT.
The paragraph containing information about Russian casualties remained in the article until at least 18:48 GMT on March 21. The article was removed from Komsomolskaya Pravda’s website by 18:52 GMT. However, an article without the casualties figures reemerged on the website between 18:54 GMT and 19:29 GMT. Later, on March 22 between 00:07 and 03:44 GMT, Komsomolskaya Pravda’s editors released a statement claiming that Komsomolskaya Pravda’s website had been hacked and false information was planted.
—Givi Gigitashvili, Research Associate, Warsaw, Poland
VK reports sharp user growth even as it intensifies censorship of anti-war content
VKontakte (VK), long described as the “Russian Facebook,” has seen a sharp increase in web traffic following the Russian government’s ban on Facebook and Instagram and its impending ban on YouTube. According to a VK press release, VK’s daily user base increased by 8.7 percent between February 1 and March 10. The platform now has over 50 million daily users.
This growth comes at a time that VK has essentially become a state-controlled social media network. On December 3, 2021, Gazprom—Russia’s state-owned energy conglomerate—acquired majority control over VK. At the same time, Vladimir Kiriyenko (son of Sergey Kiriyenko, a former Russian prime minister and longstanding apparatchik of Vladimir Putin) was named VK’s new CEO. This change placed VK’s content moderation policy firmly under the control of the Russian government.
Consequently, VK has responded immediately and without objection to state censorship requests. According to tracking conducted by Meduza journalist Kevin Rothrock, VK has blocked numerous independent media outlets as well as fan pages of public figures who have opposed (or simply not publicly supported) the war. VK has also removed popular anti-war videos without explanation, including the video address by former Russia One journalist Marina Ovsyannikova in which she articulated her decision to protest the Russian invasion during a live broadcast on March 14.
Even as VK’s user base expands, Russian citizens’ freedom of expression grows more constrained.
—Emerson Brooking, Resident Senior Fellow, Washington DC
Troops from Georgian breakaway region South Ossetia arrive in Donbas
Anatoly Bibilov, president of the Georgian breakaway region of South Ossetia, confirmed on March 20 that military contractors from Russia’s 4th Military Base in Tskhinvali had been sent to fight against Ukraine. Bibilov wrote on his Telegram channel that he did not give the official order, as the military base is controlled by the Russian Army, but he expressed his support for Russia.
Bibilov’s Telegram post was accompanied by an image showing a military convoy of South Ossetian units with “death is better than shame” written on the Ossetian flag. The DFRLab found that the image is a frame from a video that has circulated online since at least March 17. The video included a URL for the Telegram channel The video was posted that day in the pro-Russia channel Война История Оружие (“War History Weapons”) by a user named Stanislav Belenky. The video caption reads, “Ossetian volunteers in a convoy heading to Ukraine. The writing ‘death instead of shame’.”
Screengrabs from a video showing a South Ossetia convoy. Anatoly Bibilov confirmed on March 20 that South Ossetian units were sent to Ukraine. The video was posted on March 17. (Source: Anatoly Bibilov, left; War History Weapons, right).
The Война История Оружие Telegram channel was created on October 17, 2020, and has more than 600,000 subscribers. The channel owner is Riga-based Russian blogger Kirill Fyodorov, who posts under the nickname Alconafter. According to Latvian public broadcaster LSM.lv, Latvian security services detained Fyodorov on March 17, accusing him of justifying Russia’s war in Ukraine and targeting Latvian citizens. On March 22, Russia’s Ministry of Foreign Affairs demanded Fyodorov’s “immediate release.
A screengrab shows that the owner of the TG channel Война История Оружие is Russian blogger Kirill Fyodorov. (Source: Война История Оружие, left; Kirill Fyodorov, right)
On March 17, another video of the South Ossetian convoy emerged online and was geolocated by Twitter user @doppelot, who verified the convoy was moving north towards Russia and Ukraine.
@GeoConfirmed 43.013637, 44.224721
— Doppelot 🌻 (@doppelot) March 19, 2022
Confirmed, South Ossetian column moving north pic.twitter.com/hXaYCx1N91
On March 20, a third video emerged online of South Ossetian units claiming to have arrived in Donbas. The two-minute-long video depicts soldiers in uniforms bearing the Ossetian insignia and holding Ossetian flags. At the beginning of the video, one of the soldiers says, “Hello from Donbas.”
Ossetians appear to have already arrived in Ukraine. pic.twitter.com/1NaMgNvkSj
— Visioner (@visionergeo) March 20, 2022
According to South Ossetia’s government information agency RES, three volunteers from South Ossetia saved a woman’s life in the Donbas town of Volnovakha. RES also published an image depicting the three South Ossetian soldiers. The DFRLab geolocated the image to Volnovakha’s Liberation Memorial Park.
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Activists in Poland and Lithuania block cargo trucks from entering Belarus
Protesters in Poland and Lithuania are blocking traffic on the Belarusian border to prevent trucks from entering Belarus.
On March 22, activists reported around 950 trucks were blocked at the Polish-Belarusian border. A drone video and numerous videos on the ground, including some taken by truck drivers, were posted on social media showing the scale of the blockade. A group of protesters in Poland blocked the road at the Koroszczyn border crossing and demanded the Polish government ban trade with Russia and its ally Belarus. Many of the demonstrators are displaced Ukrainian refugees. Some reports claim there are 1,500 trucks stuck on the border. The situation intensified as angry drivers confronted the protesters.
The previous day, protesters in Lithuania carried out a similar but smaller-scale demonstration. Protesters aimed to send a message to the Lithuanian government “to cut trade links with the Belarusian regime,” according to LRT English. Roughly 150 Russian and Belarusian truck drivers approached the protesters, provoking them, ridiculing Ukraine, shouting pro-Russia slogans such as “Glory to Russia,” and threatening the protesters. The blockade, which lasted forty minutes, was dispersed by Lithuanian Police.
—Lukas Andriukaitis, Associate Director, Brussels, Belgium
International Criminal Court seeks to charge South Ossetian officials with war crimes over 2008 war
The International Criminal Court (ICC) has filed requests for arrest warrants for three officials from the Georgian breakaway region of South Ossetia. The ICC is accusing the three officials of committing war crimes in South Ossetia during the 2008 Russia-Georgia war. According to ICC prosecutor Karim Khan, the three officials bear criminal responsibility for “unlawful confinement, torture, inhuman treatment, outrages upon personal dignity, hostage taking, and unlawful transfer,” Civil.ge reported.
The three officials are Mikhail Mindzaev, the de facto interior minister between 2005-2008; Hamlet Guchmazov, the head of the preliminary detention facility under the Interior Ministry; and David Sanakoev, the de facto presidential representative for human rights in South Ossetia.
On March 22, the authorities of South Ossetia said they would not cooperate with the ICC, calling it a “politically biased” organization.
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Image: Russian State Duma member Sergey Leonov speaks at a press conference in Moscow, March 22, 2022. (Source: DumaTV)