As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, the DFRLab’s global team presents the latest installment of the Russian War Report.
Security
Russian governor accuses Ukraine of launching multiple attacks on Kursk
Tracking narratives
Pro-Kremlin Telegram channels accuse Ukraine of selling Western weapons, again
A fake letter declared the supposed mobilization of women in Ukraine
Event Recap
360/Open Summit: Contested Realities, Connected Futures
Russian governor accuses Ukraine of launching multiple attacks on Kursk
On June 15, the governor of Russia’s Kursk Oblast, Roman Starovoyt, accused the Ukrainian army of opening fire on two locations in the Russian region, the first in the Rylsky district and the second at a border checkpoint. According to Starovoyt, there were no casualties or damages and Kursk “repelled the attack by launching counter-fire.” Russian state media outlet TASS reported on the checkpoint attack. On June 17, another claim surfaced from Starovoyt, this time accusing the Ukrainian army of shelling the Gordeyevka settlement in Kursk. According to the claim, the settlement was shelled with mortars, but counter-battery fire quickly suppressed the attack. TASS also amplified these claims.
Meanwhile, on June 16, a video emerged online purporting to show a large explosion in Kursk. Local media reported on the footage. In the video, a loud blast is heard, but Kursk administrators said the blast was “connected with the performance of tasks by military personnel as part of a special military operation.”
Another video that surfaced on June 16 claimed to show a Russian jet breaking the sound barrier over the Kursk region. According to open-source analysts, the jet was on its way to attack targets in the Sumy region of Ukraine. The DFRLab cannot independently confirm the jet’s location.
In addition, another video purported to show the launch of multiple missiles from the Kursk region toward targets in north-eastern Ukraine.
Elsewhere, photos emerged of a Ukrainian farm damaged during the shelling of the village of Horodyshche. Livestock sustained damage from artillery fire, specifically multiple rocket launchers.
—Lukas Andriukaitis, Associate Director, Brussels, Belgium
Pro-Kremlin Telegram channels accuse Ukraine of selling Western weapons, again
Pro-Kremlin Telegram channels continue to promote stories about Ukraine selling weapons provided by the country’s Western allies. Previously, the DFRLab reported on a forged letter alleging that Ukraine was selling surplus weapons to African countries.
In the newest iteration, pro-Telegram channel “Signal” (СИГНАЛ) published a screenshot from a dark web website that was supposedly selling Javelins, a Western-made anti-tank missile, in Kyiv. The cited ad has the tag “Ukraine” but does not confirm the weapon’s origin. Moreover, there is no indication of who is behind the website, so there is some possibility that it might have been placed as a false flag. However, the channel chose to cite the weapon’s price and claimed that various munitions would end up in the hands of terrorists around the world. A few days later, the channel “Military Informant” (Военный Осведомитель) published screenshots of pistols and automatic rifles supposedly being sold from Ukraine. Different from Signal’s post, the Military Informant screenshots showed .onion website addresses – .onion is a common suffix for dark web URLs – alongside more detailed information about the “goods.” However, one of the screenshots featured the info that “delivery for Germany within 1-2 days” (as seen on the screenshot below) and to a neighboring country within a week.
The DFRLab investigated the website and found that geotags from the “delivery for Germany” picture had been changed, as the original good was being sold from Cologne, Germany. Another screenshot featured comments and reviews, three of which were at least ten months old. Signal published the same screenshots as well. In one of its publications, Signal used a headline from a Toronto Star article to support its claims that Ukraine is selling weapons, but the article only mentions that Ukraine is experiencing a shortage of ammunition and that any cases of humanitarian or military aid misuse are punished by a prison term.
Around the same time, the channel “Dill Fresh” (УКРОПСКИЙ ФРЕШ) – “dill” is a pejorative term for Ukrainians – published an “investigation” that appeared to feature the same website but with different weapons and sellers, claiming that they had contacted a person in Ukraine about the weapons for sale; Dill Fresh’s investigation, however, did not provide a URL for the website under investigation, making it impossible to verify its claims. The screenshots featured photos of guns alongside a user handle for the supposed seller, but nothing could be confirmed from the screenshots as the handle was anonymous. Dill Fresh then claimed without evidence that Ukrainian territorial defense and Armed Forces commanders are selling weapons. This time the ad featured “Kyiv” again with a slightly out-of-the-place font – i.e., the “Kyiv” text seemed to have been photoshopped over the original text. The DFRLab subsequently visited the original .onion website and found the original text, which listed the location as “Cologne.”
For additional verification purposes, the DFRLab ran a search using the WhatTheFont tool for the original publication fonts for both the “Kyiv” (in Russian, taken from a similar post) and “Cologne” (taken from the original post) texts and found that they were different fonts (Glen Jan and Ludwig Type, respectively). The text of the post itself, however, was written in the same font as “Cologne,” indicating that the “Kyiv” text had indeed been photoshopped over the original text.
While Ludwig Type does not support Cyrillic characters and it is possible that the vendor was selling the same goods in two different locations, the anonymous origin of Dill Fresh’s screenshots – seemingly taken from the same .onion website – indicates a possible intent to manipulate or deceive.
On top of that, Dill Fresh published unsubstantiated “research” that the allegedly illegally sold weaponry transit through Moldova with the assistance of former Ukrainian president Petro Poroshenko. They used additional screenshots with a different font from the visually similar website.
The Ukrainian Center for Countering Disinformation under the country’s National Security and Defense Council denied all allegations of the illegal sale of weaponry and said that Russian propaganda is trying to “discredit Ukrainian leadership by disseminating fakes about the weapons trade.”
—Roman Osadchuk, Research Associate
A fake letter declared the supposed mobilization of women in Ukraine
Pro-Kremlin Telegram channels, an anti-vaccination conspiracy Telegram channel, and some Russian media outlets disseminated a phony letter that announced the mobilization of women in southeastern Ukraine. The letter was debunked by the Center for Countering disinformation, the Ministry of Defense, and StopFake, a fact-checking initiative.
The letter had a few inaccuracies, such as “31 of June,” focusing on specific regions instead of the whole Ukrainian territory, and a bit off the place date and number of the order, compared to authentic documents.
In a somewhat curious move, the letter was also debunked by pro-Kremlin channel ZeRada. The channel mocked the forfeit and, after an official debunk from the Center for Countering Disinformation, mocked the institution for being slow. While the intent of the channel is uncertain, this Telegram channel previously amplified a forged letter regarding the arms trade.
—Roman Osadchuk, Research Associate
Event Recap: 360/OS: Contested Realities, Connected Futures
The DFRLab’s annual 360/Open Summit took place on June 6-7. Inevitably, Russia’s war on Ukraine was the focus of discussion throughout the event.
The first session of the first day featured the DFRLab’s Roman Osadchuk, Nika Aleksejeva, and Ingrid Dickinson. Osadchuk kicked off the entire event and discussed Russia’s online attacks on his home country and the real-life impact they have, saying “Russians do horrible things to Ukrainians, partially because they [Russians] were taught they [Ukrainians] were not human.” Aleksejeva and Dickinson followed by previewing the work they’ve been doing looking at Russia’s narrative build-up in advance of its invasion of Ukraine.
Following that introductory session, a panel discussed how open-source information can aid in the documentation of war crimes. The panel featured Liubov Tsybulska, founder of the Centre for Strategic Communications and Information Security in the Ministry of Culture and Information Policy of Ukraine; Charlotte Godart, investigator and trainer with Bellingcat, dialing in remotely; and Janis Sarts, director of the NATO Strategic Communications Centre of Excellence. Alice Stollmeyer, founder and executive director of Defend Democracy, served as moderator.
Day one’s morning session closed out with DFRLab Assistant Director Jacqueline Malaret, Resident Senior Fellow Emerson Brooking, and Anchor Change CEO Katie Harbath discussing the role social media platform policies play in times of war. “Platforms are actors in conflict,” said Brooking. The unprecedented actions taken by platforms against Russia after the invasion of Ukraine immediately affected how the Russian government and its propaganda apparatus could spread messages. They also impacted how Ukrainians could communicate their plight with the outside world.
The next day, in the final session of the conference, DFRLab Nonresident Fellow Kat Duffy moderated a discussion about fractures in global policies about the internet and what that means for the world. She was joined by Kenton Thibaut, DFRLab resident China fellow; Usama Khilji, executive director of Bolo Bhi; and David Frautschy, senior director for European government and regulatory affairs at Internet Society. Highlighting the role of China and Russia, Thibaut said that where China seeks to transform the system, Russia seeks to disrupt it. Khilji noted that products built for censorship were being made in Western democracies and exported to repressive regimes.
Read more about the discussions around the invasion of Ukraine that took place at 360/OS here.
—Layla Mashkoor, Associate Editor
—Iain Robertson, Deputy Managing Editor
—Nishtha Gupta, Young Global Professional
Image: Ukrainian service members fire a BM-21 Grad multiple rocket launch system, amid Russia's attack on Ukraine, near the town of Bakhmut, Donetsk region Ukraine June 12, 2022. REUTERS/Gleb Garanich