As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report.
Security
Ukrainian attack damages Kerch Bridge
Wagner moves soldiers to Belarus following apparent disbandment in Russia
Wagner vehicle columns are seen driving from Voronezh to Belarus
Tracking narratives
Media policy
FSB colonel alleged to be behind popular Telegram channel detained for extortion
International response
Wagner continues to advertise its services in Africa
Wagner troops arrive in Central African Republic ahead of critical referendum
Lavrov to replace Putin at BRICS summit
Ukrainian attack damages Kerch Bridge
Russia accused Ukraine of conducting a drone strike against the Kerch Strait Bridge on July 17. The bridge, also known as the Crimean Bridge, connects Ukraine’s Crimean Peninsula with Russia’s Krasnodar region. The bridge is used for civilian movement and as an essential logistical route for the Russian army.
Explosions were reported at around 3:00 a.m. local time. Footage of the aftermath indicates that a span of the bridge’s road had collapsed while another suffered damage but remained intact. Traffic reportedly resumed several hours after the explosion, but in the interim, occupation authorities asked civilians to consider alternate evacuation routes. Russian Telegram channels reported extensive traffic jams in Crimea’s Dzhankoi area and in the occupied Kherson region towards Melitopol.
Ukraine defense intelligence spokesperson Andrii Yusov told Suspilne News that damage to the bridge could create logistical difficulties for Russian forces, but said Kyiv would not comment on the cause of the explosion. CNN, citing a source in the Security Service of Ukraine (SBU), reported that the attack on the bridge was a joint operation of the SBU and Ukrainian naval forces. Ukrainian media outlet LIGA also reported that the SBU and Ukrainian naval forces were responsible for the attack, citing sources in the SBU. LIGA also noted that the strike was likely conducted with surface drones. The SBU said that information about the incident would only be revealed once the war ended. Some Russian military bloggers, including former Russian officer and pro-war nationalist Igor Girkin, stated that Russian authorities had focused too heavily on road security and not enough on maritime security. Alexander Kots, another prominent blogger and Kremlin-appointed Russian Human Rights Council member, also blamed Russian authorities for focusing too much on land security.
Natalia Humeniuk, a spokesperson for Ukraine’s Southern Operational Command, speculated without evidence that the attack may have been a provocation by Russia amid talks on prolonging the Black Sea Grain Initiative. The grain deal, brokered by Turkey and the United Nations in July 2022, has been essential for stemming a global surge in food prices. The agreement, necessitated after the Russian navy blocked all Ukrainian ports, permits Ukraine to export products. It has has been prolonged several times, with the last extension expiring on July 17. The Kremlin announced on July 17 that it had suspended its participation in the initiative but claimed that the decision was unrelated to the bridge attack.
Meanwhile, about twenty-four hours after the attack on the Kerch Bridge, explosions were heard in Odesa in southern Ukraine. Unconfirmed reports claimed the explosions were a response from Russia. The attack on Odesa continued for a second night on July 19, described by Ukrainian officials as “hellish.” Odesa is an essential port for Ukrainian exports and was allowed to remain open under the conditions of the grain deal.
—Ruslan Trad, resident fellow for security research, Sofia, Bulgaria
Wagner moves soldiers to Belarus following apparent disbandment in Russia
The Wagner Group appears to have disbanded its operations in Russia and relocated to Belarus, according to footage reviewed by the DFRLab documenting the movements of Wagner military columns in the days following the mutiny through July 18. Additionally, satellite imagery captured the entry of troops and equipment at the Tsel military camp, located near the Belarusian town of Asipovichy.
On July 17, a video shared on Telegram depicted Wagner soldiers taking down the Russian flag and the Wagner flag at the group’s original military base in Molkino, Krasnodar Krai, Russia. In another video published on July 19, Prigozhin addressed Wagner fighters as they left the Molkino base, describing the situation on the front as “a shame.” In addition, he declared that the group is relocating to Belarus and will focus on its activities in Africa. For the time being, he said, Wagner soldiers are no longer participating in Russia’s special military operation in Ukraine, although they “will perhaps return to the special military operation at the moment when [they] are sure [they] will not be forced to shame ourselves.”
Shortly after the mutiny ended, Russian authorities conducted raids on Wagner’s accounting divisions in Saint Petersburg, according to information purportedly shared by the wives and mothers of Wagner fighters in an online forum. Additional raids took place on Prigozhin’s residence. The movements of Prigozhin’s private jet also indicate frequent travel to Belarus over the past three weeks.
An investigation by Belarusian opposition media outlet Motolko.help revealed a photograph of a man resembling Prigozhin in his undergarments allegedly at the Tsel military base, where he reportedly spent the night on July 12. According to flight data posted on the online portal Radarbox, Prigozhin’s personal Embraer Legacy 600 jet, registration number RA-02795, completed four round-trip flights between Belarus’ Machulishchy air base and Russia.
Radar imagery acquired on July 17 also shows the tents where Wagner fighters appear to be housed and several places for vehicles parked inside the military base.
—Valentin Châtelet, research associate, Brussels, Belgium
Wagner vehicle columns are seen driving from Voronezh to Belarus
On July 16, several videos emerged on Telegram documenting Wagner vehicles departing Voronezh Oblast along Russia’s M-4 Don highway. Utilizing social media footage, the DFRLab determined the location of the vehicles and identified forty registration plates. At least two-thirds of these vehicles displayed military registration plates from the self-proclaimed Donetsk and Luhansk People’s Republic. However, the Belarusian monitoring project Belaruski Hajun reported that many other vehicles used tape to cover their registration plates.
The columns are composed of various buses and trucks, of which only a few could transfer construction equipment. Most of the convoys consist of UAZ Patriot pickup trucks, Ural vans, and Lada cars. No heavy military equipment was observed at the time of writing.
Another video shared on the Russian Telegram channel VChK-OPGU revealed a Wagner convoy of soldiers entering Belarusian territory. According to a post by Belaruski Hajun, at least sixty vehicles entered Belarus through Mogilev Oblast in the early hours of June 15 using the R-43 and M-5 roads. A photograph on Telegram showed the Russian and Wagner Group flags flying at a border outpost.
According to Belaruski Hajun, since July 14, nine distinct military convoys have entered Belarusian territory. They are likely located at the Tsel military camp near Asipovichy. The camp is home to military unit 61732 and was previously identified by Verstka Media as a potential site to accommodate Wagner soldiers. Further, the Belarusian military TV channel VoyenTV posted a video on July 14 showing Wagner soldiers arriving in Belarus and training local forces. According to updated estimates from Belaruski Hajun, as many as 2,500 Wagner members may have relocated to the Tsel military camp since last week.
—Valentin Châtelet, research associate, Brussels, Belgium
Russian officials and state media change their tune about the Kerch Bridge attack after Kremlin announces terror investigation
In the immediate aftermath of the July 17 attack on the Kerch Bridge, Russian officials and state media were relatively mild in their initial language addressing the incident, referring to it as an “emergency.” However, once Kremlin agencies began referring to the attack as a “terror act,” state media and officials began changing their language to follow the Kremlin.
“Traffic was stopped on the Crimean bridge: an emergency occurred in the area of the 145th support from the Krasnodar territory,” Sergei Aksenov, the Russian-installed head of occupied Crimea, wrote on his Telegram channel at 4:21 a.m. local time. Notably, Aksenov did not use the words “explosion,” “attack,” or “terror” to describe the destruction of the bridge. Two subsequent posts, made at 5:03 a.m. and 6:59 a.m., also avoided these terms. It wasn’t until 1:51 p.m. that Aksenov used the phrase “terror act” to describe the attack.
In between Aksenov’s posts, Russia’s National Antiterrorism Committee reported at 10:04 a.m. that they had assessed the Kerch Bridge explosion as a “terror act,” according to Kremlin-owned news agency TASS. Several minutes later at 10:07 a.m., Russia’s Investigative Committee announced that it would open a criminal case investigating the “terror act” on the Kerch Bridge.
Several Kremlin-owned Russian media outlets, including RIA Novosti and TASS, also used the term “emergency” (“чрезвычайное прошествие” or ЧП) to first describe the bridge explosion before later pivoting to using “terror act.” Neither outlet referred to the destruction of the Kerch Bridge as a “terror act” prior to the official announcements from the Investigative Committee and Antiterrorism Committee. In the case of RIA Novosti, they published a story using the word “emergency” in the headline at 11:41 a.m., more than ninety minutes after the terror investigation announcement, while TASS used the term as late as 7:31 p.m., even though it had already published a report on the investigation. Similarly, many other Kremlin-controlled media outlets, like Komsomolskaya Pravda, Gazeta.ru, RBC, Lenta.ru, and Izvestiya used both “emergency” and “terror act” in their publications throughout the day interchangeably.
—Nika Aleksejeva, resident fellow, Riga, Latvia
FSB colonel alleged to be behind popular Telegram channel detained for extortion
According to Russian media outlet RBC, former Federal Security Service (FSB) Colonel Mikhail Polyakov, the purported administrator of the Telegram channel Kremlevskaya Prachka (“Kremlin Laundress”), was detained for suspected extortion. The press office for the Moscow court released a statement that said Polyakov is “suspected of extorting 40 million rubles [around $440,000] from JSC Lanit, the leader of the Russian industry of information technology.”
“According to the prosecution, from 2020 to 2023, Polyakov received a large sum of money from a group of IT companies for not publishing information (the so-called ‘negative block’) that could cause significant harm to the rights and legitimate interests of Lanit JSC and the management of Lanit JSC,” the Moscow court continued. The “negative block” is a guarantee that a channel will not mention a particular person or a company in a negative light in exchange for money; this is reportedly a popular practice among Russian Telegram channels.
The independent Russian media outlet Vazhnyye Istorii (“Important Stories”), citing a source close to Russian intelligence services, reported that Polyakov was behind the Kremlevskaya Prachka Telegram channel. According to the outlet, Polyakov supervised an unnamed service at the FSB’s Office for the Protection of the Constitutional Order. In addition, he reportedly oversaw pro-government Telegram channels and was engaged in promoting the Kremlin’s agenda via media and social networks. According to Important Stories, he worked in coordination with Vladimir Putin’s deputy chief of staff, Sergey Kiriyenko.
Important Stories noted that the Telegram channel 112 also named Polyakov as Kremlevskaya Prachka’s administrator, along with the Telegram channels Siloviki, Nezigar, and Brief, which are not as staunchly pro-govern cited by Kremlin propagandists and proxies.
Kremlevskaya Prachka has not posted since the evening of July 13, corresponding with the reported detainment of Polyakov.
—Eto Buziashvili, research associate, Tbilisi, Georgia
Wagner continues to advertise its services in Africa
On July 16, the Wagner-affiliated Telegram channel REVERSE SIDE OF THE MEDAL posted an advertisement offering Wagner’s services to African states. The post included an image from the Prigozhin-funded film, Granite, as well as an email address, seemingly for interested African countries to communicate with Wagner.
In French, the advertisement reads: “PMC Wagner offers its services to ensure the sovereignty of states and protect the people of African from militants and terrorists.” The fine print emphasizes that “various forms of cooperation are possible,” as long as the cooperation does not “contradict Russia’s interests.” Russia’s interests are not specified.
While the Telegram channel claimed the advertisement was replicated on African social media channels, the DFRLab has not found additional evidence to support this claim.
—Tessa Knight, research associate, London, United Kingdom
Wagner troops arrive in Central African Republic ahead of critical referendum
Alexander Ivanov, director of the Officer’s Union for International Security (COSI), released a statement on COSI’s Telegram channel regarding the recent arrival of dozens of Wagner operatives in Central African Republic. According to US authorities, COSI is a front company for the Wagner Group in Central African Republic.
In the statement, Ivanov confirmed the Wagner troop rotation while stressing that the new personnel have no contract with Russia’s Ministry of Defense. He reiterated that both in CAR and across the continent, “security work is carried out by private companies that enter into contracts directly with the governments of sovereign states,” and that these private companies have nothing to do with official Russian state entities. Ivanov also indicated that this staff rotation should not impact the activities of Russia in Ukraine, and he claimed to have been in contact with Yevgeny Prigozhin.
Notably, Ivanov stated that despite the recent changes in the structure of Wagner’s “African business,” Prigozhin “intends not to curtail, but to expand his presence in Africa.” This is somehow consistent with what some analysts are observing: Wagner appears to be trying to expand its presence in West African coastal states increasingly threatened by a spillover of the jihadist insurgency from the Sahel, or possibly taking advantage of upcoming elections in several fragile African countries.
Although Ivanov has often remarked on Wagner activities in CAR and Africa in the past, this statement, coupled with other recent comments, suggest that the COSI director might be now exercising a wider role as spokesman for all Wagner activity in Africa, as Wagner reorganizes its structure in the wake of last month’s failed mutiny.
The statement comes as a U-turn in recent communications over Wagner’s presence in CAR. In past weeks both CAR and Russian officials stated that the African republic had an agreement with Russia and not with a private military company. Ivanov seems to be returning to earlier narratives in which Wagner claimed that the CAR government signed an agreement with the PMC and not the Russian government. This narrative seems to confirm DFRLab reporting in the June 30 edition of the Russian War Report, in which we noted that denying direct links to Wagner’s actions in Africa has become more difficult for the Kremlin after recent events damaged the principle of plausible deniability, which had previously been a key aspect of Wagner’s success in Africa. However, Russia does not want to waste the network of influence built by its state proxy forces and is now attempting to reorganize, rebrand and develop a new narrative around Wagner and the Kremlin’s ability to conduct hybrid warfare.
The arrival of dozens of troops from Russia’s Wagner in CAR comes at a critical time as the country prepares to hold a constitutional referendum on July 30 that would eliminate presidential term limits and allow President Faustin-Archange Touadéra to extend his term. The CAR government stated earlier this month that Wagner operatives will help in securing the referendum. This could be seen as a strong signal from Moscow to reiterate the strategic importance of its influence in CAR and reassure local partners of its continued support, while sending a message of continuity and strength to other countries in the region where Wagner operates.
—Mattia Caniglia, associate director, Brussels, Belgium
Lavrov to replace Putin at BRICS summit
The Office of South Africa’s Presidency announced on July 19 that Russian Foreign Minister Sergey Lavrov would replace President Vladimir Putin at the upcoming Summit of BRICS Nations (Brazil, Russia, India, China and South Africa) “by mutual agreement.”
In Russian media, pro-Kremlin and opposition news outlets alike posted articles claiming that Russia had refused South Africa’s proposal to send Lavrov as head of the country’s delegation on July 14. Quoting an interview with South Africa’s deputy president, the Russian pro-Kremlin news outlet RTVI suggested that “negotiations are still ongoing.”
Putin is wanted by the International Criminal Court (ICC) for alleged war crimes committed during Russia’s war in Ukraine. A warrant for the arrest of both the Russian president and Presidential Commissioner for Children’s Rights Maria Lvova-Belova alleges that they were involved in organizing and participating in the deportation of Ukrainian children. As a signatory to the Rome Statute, which established the ICC, South Africa would have been obligated to arrest Putin had he attended the BRICS Summit in August.
South Africa’s largest opposition party, the Democratic Alliance, took to court in a petition to force the government to arrest Putin if he did attend. In a responding affidavit, South African President Cyril Ramaphosa stated that Russia would view South Africa arresting Putin as a “declaration of war.”
The Kremlin denied claims that Moscow had threatened South African authorities. However, Kremlin spokesperson Dmitry Peskov said on July 19 that “it is clear to everyone in the world what an attempt to encroach on the head of the Russian Federation means.”
—Tessa Knight, Research Associate, London, United Kingdom and Valentin Châtelet, Research Associate, Brussels, Belgium
Image: Russian officers from the wagner group are seen around Central African president Faustin-Archange Touadera as they are part of the presidential security system during the referendum campaign to change the constitution and remove term limits, in Bangui, Central African Republic July 17, 2023. REUTERS/Leger Kokpakpa