As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report.
Security
Ukraine secures new territory as Prigozhin recruits Russian prisoners
Renewed clashes between Armenia and Azerbaijan as Armenia calls for Russian military aid
War crimes and human rights abuses
Ukraine says hundreds of dead civilians unearthed in Izyum
Tracking narratives
Kremlin claims Russian troops are ‘regrouping’
Moscow police investigate journalist for ‘gay propaganda’
Fake RAND Corporation document promoting US conspiracy to weaken Germany spreads online
Russian War Report: Ukraine secures new territory as Prigozhin recruits Russian prisoners
Ukraine has successfully pushed back Russian forces over the last several weeks, launching counteroffensives in the regions of Kharkiv, Donetsk, and Kherson. With active fighting concentrated in the eastern and southern parts of the country, there has been an increase in civilians attempting to flee hard-hit areas. The Ukrainian army regained 600 square kilometers in the Kherson counteroffensive, according to Ukrainian media reports. In Kharkiv, Ukraine retook roughly 300 settlements across 3,000 square kilometers and liberated 150,000 people from Russian occupation. The frontline of the battle in the Kharkiv region is reaching closer to occupied areas of Luhansk and Donetsk oblasts. On September 13, reports claimed that Russian army units had abandoned Kreminna in Luhansk oblast; while partisans raised the Ukrainian flag over the town, as of September 14, Ukrainian forces had not entered the city.
Separate attacks have also affected humanitarian assets in Donetsk oblast. On September 12 and 13, the Russian army shelled cities on the frontline of Sloviansk, killing at least one person and injuring another. An agricultural technical school and eight buildings were damaged in the shelling. Russian rockets also hit a hospital and a private residence in Kramatorsk. The town of Hostre, in area of Kurakhove, also came under fire. Meanwhile, Russia has shelled Avdiivka for several days in a row. Russian forces also launched an airstrike on Siversk on September 12.
As the counteroffensive by Ukrainian forces continues, Russia is attempting to obstruct Ukraine’s progress in various parts of the country. Ukrainian sources reported that eight Russian missiles struck targets in Kryvyi Rih, in the Dnipropetrovsk region, resulting in flooding. The water level of the Inhulets River, which runs south of Kryvyi Rih, rose as result of the strike on the Kherson-Mykolaiv axis, flooding area homes. The target of the attack was likely the Karachun dam.
Meanwhile, Russian oligarch Yevgeny Prigozhin was filmed making an appeal to convicts, promising amnesty if they sign up to fight in Ukraine. In the footage, Prigozhin revealed that prisoners have already been fighting on the frontlines with the Wagner Group. “In the first attack in Ukraine using forty prisoners, three died and seven were injured….Nobody goes back behind bars,” he said. “If you serve six months, you are free.” Russian law does not permit commuting prison sentences for military service, though it is unclear if exceptions can be made during wartime. Prigozhin is mobilizing combat power for the Russian army, which has suffered heavy losses in recent weeks. Prigozhin’s comments are not just about recruiting mercenaries; they are also an indication that Russia is seeking further mobilization, a practice that, even in Soviet times, relied on prisoners.
Prigozhin’s comments coincide with increasing domestic pressure on the Kremlin to mobilize more recruits and to officially declare the “special operation” in Ukraine a war. Chechen leader Ramzan Kadyrov called on regional governors in Russia to carry out self-mobilization and not wait for the Kremlin’s decision. Gennady Zyuganov, the leader of the Russian communist party, joined the calls for a nationwide mobilization.
These recent developments indicate that paramilitary formations, like those in Syria who fought alongside the forces of President Bashar Assad’s regime, may be emerging in Russia. In Syria, amid the worst fighting in the civil conflict, the government allowed businessmen to gain influence in the state apparatus in exchange for sponsoring and creating local militias to support the army. The latest developments in Russia indicate that a similar process could be unfolding.
According to the Ukrainian Ministry of Defense, officials in the occupation administration of Crimea and southern Ukraine have begun to secretly evacuate their families to Russia, indicating that the state of security in Russian-occupied territories is poor. These claims have not been independently confirmed.
Meanwhile, the first visual confirmation of Iranian drones being used by Russia in Ukraine surfaced this week. A Shahed-136 (Герань-2) drone was most likely used in Ukaine’s Kupiansk region. This is a critical revelation that strongly suggests Tehran is sending Russia military aid, despite earlier denials. It also indicates that Russia may be experiencing a shortage of high-tech equipment and weapons.
In addition, global sanctions may further hinder the Kremlin’s military efforts, as the group of seven nations is working to cap the price of Russian oil in an attempt to limit Moscow’s ability to fund its invasion of Ukraine. Currently, Russia relies on revenue from exporting energy resources to Asia.
Lastly, Ukraine’s Cabinet of Ministers approved the draft budget for 2023, Minister of Finance Serhiy Marchenko announced on Facebook. The 2023 state budget is the budget of a country that will become stronger, strengthen its defense capabilities, be able to rebuild after damage caused by Russian armed aggression, and also take care of those citizens who need it,” he said.
—Ruslan Trad, Resident Fellow for Security Research, Sofia, Bulgaria
Renewed clashes between Armenia and Azerbaijan as Armenia calls for Russian military aid
On September 13, the Armenian Ministry of Defense reported that Azerbaijani Armed Forces shelled Armenian military positions in Goris, Sotk, and Jermuk. Azerbaijan reportedly used large-caliber artillery, small arms, and drones in the attack. Azerbaijan reported fifty casualties, while Armenia said 105 Armenian servicemembers were killed in the strikes. Prior to the recent escalation, both parties had accused each other of planning and organizing a large-scale provocation. Armenian Prime Minister Nikol Pashinyan said that Azerbaijan had gained ten square kilometers of Armenian territory this week. For comparison, in May 2021, Azerbaijan occupied forty square kilometers of Armenian territory. OC Media reported at least nineteen different Armenian locations along the border with Azerbaijan were hit by missiles this week.
Amid renewed clashes, Armenian authorities asked the Collective Security Treaty Organization (CSTO), a Russian-led military block, to aid in restoring the territorial integrity of Armenia. Pashinyan stated that Armenia was invoking Article 4 of the agreement, which stipulates that an attack on a member state is an act of aggression against other member states. In response to this request, CSTO held an emergency meeting and proposed the creation of a working group to assess the situation on the Armenia-Azerbaijan border. Armenia previously invoked Article 4 in May 2021, when Azerbaijan made advances in Armenia’s Gegharkunik and Syunik provinces; in response, CSTO advocated diplomatic negotiations. Armenia also asked Russia to provide military aid under the Russian-Armenian treaty on mutual defense that was signed in 1997. The Kyiv Independent reported that Russian President Vladimir Putin had declined to provide military assistance to Armenia, but did not cite a source.
On September 13, US Secretary of State Antony Blinken urged Azerbaijan to stop the military operation along the border with Armenia. State Department Spokesperson Ned Price noted that the US has seen “significant evidence of Azerbaijani shelling inside Armenia and significant damage to Armenian infrastructure.” Freedom House also called for Azerbaijani armed forces to stop their attacks on Armenia.
On September 13, Armenian media reported that mobile providers had blocked access to TikTok, but the app remained accessible via cable internet. The DFRLab used OONI Explorer to reviewed the connectivity of TikTok’s website in Armenia; we found that DNS tampering/spoofing began on September 13 at 4:03pm local time. OONI Explorer also showed that DNS spoofing of TikTok’s website took place in Azerbaijan on September 14. Azerbaijan’s State Security Service announced that it had temporarily suspended TikTok in Azerbaijan due to the fact that information published on the platform “casts a shadow on the successes of our army, contains military secrets, and aims to create a wrong opinion in the society.” Samvel Martirosyan, co-founder of Armenian CyberHUB, said that in order to prevent people from using virtual private networks (VPNs), state-aligned Azerbaijani bloggers were spreading rumors that major VPN services were controlled by Armenia.
On September 14, Pashinyan announced that he was willing to recognize the territorial integrity of Azerbaijan, as long as Armenia’s Soviet-era border was recognized. He added that he was willing to sign an agreement with Azerbaijan. “Many people will criticize us, curse us, call us traitors, the people may even decide to remove us from power, and we will be grateful if as a result of this,” he said. “Armenia will get lasting peace and security with an area of 2,800 square kilometers.” Following the release of the statement, Armenian citizens gathered in front of the National Assembly building to protest the comments, with some demanding Pashinyan’s resignation. Pashinyan later clarified that no such document had been signed as of yet, and any claims to the contrary were rumors propagated by “external unfriendly forces.
Armenia and Azerbaijan negotiated a ceasefire that took effect at 8pm local time on September 15.
—Givi Gigitashvili, Research Associate, Warsaw, Poland.
Ukraine says hundreds of dead civilians unearthed in Izyum
Ukrainian officials said they had found 440 bodies in woodlands near the city of Izyum. They said most of the dead were civilians, and that the site proved war crimes had been committed by Russian occupiers. Video from Izyum showed a pine forest dotted with graves. Wooden crosses marked the locations. One handwritten sign read, “Ukraine armed forces, seventeen people, Izyum city, [taken] from the morgue.”
If confirmed, this would be the largest mass grave identified in Europe since Tomašica, where the Bosnian authorities uncovered a mass grave in September 2013. It contained the remains of 435 people, mostly war victims, who were killed by the Bosnian Serb forces in various places around Prijedor from 1992 to 1995.
Reports from Kupiansk also indicate potential Russian war crimes, including instances of torture. In jail cells at a local police station, Ukrainian forces found blood on the floor and stains on mattresses. Russian occupation forces hastily abandoned the police station after destroying records they had kept there.
—Ruslan Trad, Resident Fellow for Security Research, Sofia, Bulgaria
Kremlin claims Russian troops are ‘regrouping’
After a successful Ukrainian counteroffensive forced Russian troops to retreat from the vicinity of Kharkiv, Russian officials and pro-Kremlin sources rebranded the withdrawal as “regrouping.”
As Ukraine regained territory, Igor Konashenkov, spokesperson for the Russian Ministry of Defense, said the MoD decided to “regroup” Russian forces in the areas of Balakliia and Izyum “to build up prospects at the Donetsk level.” The MoD continued, “During this operation, a number of distraction and demonstration activities were carried out with the designation of the real actions of the troops.”
Meanwhile, Kremlin-owned and pro-Kremlin media outlets attempted to justify Russia’s retreat as a strategic decision. Outlets such as iz.ru, vz.ru, crimea.ria.ru, topcor.ru, and rk-news.com published interviews with pro-Kremlin pundits who offered varying justifications for the Russian withdrawal. In one interview, a “military expert” claimed that Russia’s MoD “carried out a whole range of measures to mislead the Armed Forces of Ukraine, creating the illusion that we had a weak defense.” Another interview reinforced the claim that Russia retreated to “mislead the enemy.” A third interview alleged that the “regrouping” took place because there was a “need to concentrate forces and strengthen positions in the Donbas.”
Online mentions of the word “Перегруппировка” (“regrouping”) skyrocketed on September 10 and 11, according to a query conducted using the social media monitoring tool Meltwater Explore.
In addition, Chechen leader Ramzan Kadyrov claimed, “The regrouping of troops in the Kharkiv region is a forced measure, which is explained by military strategy and the goal of saving human lives.”
—Eto Buziashvili, Research Associate, Washington DC
Moscow police investigate journalist for disseminating ‘gay propaganda’
Moscow police are investigating TV personality Ksenia Sobchak for disseminating “gay propaganda,” Russian state-owned media outlet RIA reported on Monday.
According to RIA, the investigation was initiated after a Russian citizen contacted police to “examine publications shared on the channel of journalist Ksenia Sobchak for LGBT propaganda among minors.” RIA reported that the case is being investigated under Article 6.21 of the Code of the Russian Federation on Administrative Offenses, which pertains to the “promotion of non-traditional sexual relations among juveniles.” Article 6.21 carries a fine of up to 100,000 rubles ($1,676) for individuals and up to one million rubles for legal entities, in addition to a possible 90-day work suspension.
Ksenia Sobchak is the daughter of the late Anatoly Sobchak, the former mayor of St. Petersburg and mentor to Vladimir Putin. In 2018, she ran as a presidential candidate against Putin, but some argued that Sobchak was a decoy candidate who only ran to create the illusion of a democratic election.
On her Telegram channel, Krovavaya Barynya (“Кровавая барыня,” “Bloody Lady”), Sobchak suggested that police might be investigating her YouTube channel after she published an interview with Russian tennis player Daria Kasatkina, who recently came out as gay. “Now even just a conversation with LGBT people about their lives might be considered LGBT propaganda,” Sobchak added. The police have not confirmed which of Sobchak’s platforms is being examined. Sobchak’s YouTube channel has more than three million subscribers, and the interview with Kasatkina garnered more than 1.5 million views.
Earlier this month, Russian internet regulator Roskomnadzor announced its support for a draft law “on administrative responsibility for propaganda of LGBT people and pedophilia.” The bill was introduced by Alexander Khinshtein, the head of the State Duma Committee on Information Policy.
Last month, Russia revealed plans to construct an online surveillance system that could hunt down “homosexual propaganda,” among other “prohibited data.” In addition, Runiversalis – the Russian analog of the internet encyclopedia Wikipedia– announced that it will not cover “homosexual propaganda” on its platform.
—Eto Buziashvili, Research Associate, Washington DC
Fake RAND Corporation document promoting US conspiracy to weaken Germany spreads online
On September 11, the Russian television program Vesti Nedeli reported on what it claimed was a “confidential document” from the RAND Corporation, a US think tank. The document claimed the US had planned the war in Ukraine in advance and had deliberately provoked Russia. Reporter Mikhail Antonov argued that the document, said to be dated January 25, 2022, outlined a US strategy to force Germany into applying sanctions against Russia, in an attempt to weaken Germany’s economy. Antonov cited the German outlet Weltexpress as the source of the document.
RAND Corporation denied the allegation. “A supposedly leaked RAND report about a bizarre U.S. conspiracy to ‘weaken Germany’ is fake,” it said in a statement.
Weltexpress, the first German language outlet to publish about the document, titled their article, “The economic crisis in Germany is the result of a deliberate provocation by the USA. The Americans collapsed the German economy to destroy a competitor.” Two days later, Weltexpress published in English what they claimed to be an excerpt from the alleged RAND report.
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Image: Ukrainian police patrol an area, as Russia's attack on Ukraine continues, in the town of Izium, recently liberated by Ukrainian Armed Forces, in Kharkiv region, Ukraine September 14, 2022. REUTERS/Gleb Garanich