As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report.
Security
Russia claims Snake Island losses were “gesture of goodwill”
Tracking Narratives
Comment from former Latvian minister sparks outrage from Russian politicians
Russian hackers exaggerate impact of Lithuanian cyberattack
Pro-Kremlin Telegram channels blame Ukraine for Kremenchuk mall attack
Pro-Kremlin Telegram channels spread disinformation about Ukraine selling weapons, again
Media Policy
Ukraine says YouTube removed hundreds of pro-Russian channels
Russia claims Snake Island losses were “gesture of goodwill”
On June 30, reports surfaced that Russian forces had abandoned Zmiinyi Island, better known as Snake Island, fleeing in small speedboats after Ukrainian forces shelled the island.
The Ukrainian Ministry of Defense posted a drone video that day of the island being attacked. The footage appears to show Ukraine targeting a Pantsir-C1 Russian air defense system. Ukrainian media shared a similar video the previous day, claiming that on June 27, ten precision strikes hit Snake Island, destroying a Pantsir-C1 system. Given this context, the exact date and number of attacks remain unconfirmed.
In high-resolution satellite images taken on June 29, large smoke plumes can be seen on the island. This coincides with other images of the island also taken on June 29 showing large smoke plumes.
The Russian Ministry of Defense claimed that the withdrawal from the island was planned as a “gesture of goodwill.” In a statement, the ministry said, “The Russian Federation does not interfere with UN efforts to organize a humanitarian corridor for the export Ukrainian of grain.” Ukraine and the West have accused Russia of fueling a global food crisis by blockading Ukrainian ports.
A video of Russian Ministry of Defense Spokesman Igor Konashenkov claiming that Russia’s withdrawal of forces from Snake Island was a “gesture of goodwill.” (Source: @rian_ru/Archive)
—Lukas Andriukaitis, DFRLab Associate Director, Brussels, Belgium
Russian diplomatic accounts spread questionable story about anti-Russian stickers placed at Auschwitz memorial
On June 23, the Russian Arms Control Delegation in Vienna claimed that anti-Russian stickers had appeared at the Auschwitz-Birkenau museum in southern Poland. The alleged stickers said in English, “Russia and Russians: The only gas you and your country deserve is Zyklon B.” Zyklon B is a reference to a type of poisonous gas” used by Nazi Germany in the gas chambers at Auschwitz. The tweet also contained photos of the stickers allegedly displayed around the Auschwitz memorial.
The tweet was retweeted by other Russian diplomatic Twitter accounts, including the Russian Ministry of Foreign Affairs and the Russian embassies in Canada, Israel, and North Macedonia. The first tweet about the stickers was posted on Twitter around 6 pm CET on June 22 by @politoptimist, which appears to be a pro-Kremlin Twitter account.
Pro-Kremlin Russian media also reported on the stickers. Eurasia Daily reported that the event took place on June 22 as a symbolic act, as this is the day when Russia commemorates the beginning of World War II. Pravda alleged that the stickers were placed by Ukrainian refugees. Other pro-Kremlin online outlets also reported on the incident, including Polit Rossiya, Vesti Podmoskovie, Russian Federal News Agency, Fin journal.info and Politika Segodnya.
Polish fact-checking platform Konkret24 found that Twitter posts with photos of stickers were published in multiple languages, including French, Spanish, Portuguese, Polish, English and German.
On June 24, the official Twitter account of the Auschwitz Museum commented on the tweet posted by the Russian Arms Control Delegation, saying, “the photographs are simply a manipulation and the incident should be treated in terms of primitive and gross propaganda.”
The DFRLab analyzed the photos posted by the Russian Arms Control Delegation using error level analysis on FotoForensics. The analysis suggests that the sections of each image containing the sticker had a different error level compared to the rest of the image, which can indicate digital editing or compositing. When a photo is modified and re-saved, it increases the error level of the altered areas, which can be distinguished in error level analysis by different hues. This indicates that the stickers were likely composited into the images. The DFRLab also found a very similar sticker online, which could have been edited to create the manipulated sticker.
—Givi Gigitashvili, Research Associate, Warsaw, Poland
Comment from former Latvian minister sparks outrage from Russian politicians
On June 27, former Latvian Interior Minister Maris Gulbis commented on Lithuania’s decision to ban Russia from transiting sanctioned goods through the country to Kaliningrad. Gulbis told the television program Preses Klubs, “I am now thinking that [the ban] is the first step by NATO and the European Union to separate Kaliningrad…from Russia.” He added that “a very clear signal was sent to Russia – if you will keep fooling around, we will take and give Konigsberg [the former Prussian name of Kaliningrad] back to Germany.”
Gulbis’s comment was noted by former Russian President and Prime Minister Dmitry Medvedev, who now serves as deputy chairman of Russia’s Security Council. Medvedev took to Telegram to threaten Gulbis, writing, “When he comes to his senses, he will be afraid of every rustle at the door. And rightly so. We have a good memory.”
Medvedev has about 589,500 Telegram subscribers; his post about Gulbis received more than two million views, about four times more views than subscribers, according to TGStat, a Telegram analysis tool. The post was shared 565 times to public groups and channels. Medvedev frequently receives high engagement on his Telegram channel; according to TGStat, the percentage of subscribers who typically read Medvedev’s Telegram posts is around 240 percent, which suggests an audience much broader than his subscriber based.
Additionally, RBK, a Kremlin-controlled media outlet in Russia, shared statements from three Russian politicians commenting on Gulbis’s suggestion that NATO and the European Union will take Kaliningrad away from Russia. Dmitry Lyskov, press secretary for the governor of the Kaliningrad region, said, “This is the private opinion of some individual Lithuanian [sic], and nothing more.” Andrey Klimov, deputy chairman of the Federation Council Committee on International Affairs, added, “They may want to chop off a lot of things, but there is a big difference between wanting and being able to do that.” Vladimir Dzhabarov, first deputy chairman of the Federation Council Committee on International Affairs, was more hostile. “Any attempt to tear Kaliningrad away from us will end with a military clash with Russia,” he said. “I don’t think NATO doesn’t understand this. Lithuania, Poland should think, because they are the first to seriously fall into this meat grinder.”
Both Medvedev and Dzhabarov’s comments were picked up by other Russian language media outlets. A query conducted using the social media analysis tool Meltwater revealed that 191 news publications mentioned Dzhabarov’s comment, and ninety-nine publications mentioned Medvedev’s comment. In both cases, it was primarily Russian media that amplified the hostile comments from Medvedev and Dzhabarov.
—Nika Aleksejeva, lead researcher, Riga, Latvia
Russian hackers exaggerate impact of Lithuanian cyberattack
On June 23, the Lithuanian Cyber Security Center (NKSC) announced an increase in distributed denial of service (DDoS) attacks that were “leading to temporary disruptions of services” impacting public authorities and the transport and finance sector in Lithuania. On June 25, Killnet, a pro-Kremlin hacker collective, claimed responsibility for the attack, saying it was carried out to pressure Lithuania to reverse a ban on Russian goods being transported through the country.
Killnet had threatened that more intense cyberattacks would take place on June 27. By noon on June 27, Killnet claimed “1,089 Lithuanian web resources are disabled due to local ISP [internet service provider] failure.” The post did not name any provider and said to wait for official sources to comment on the disruption. The DFRLab did not find any Lithuanian media reporting on internet provider disruptions. The next day, Killnet claimed that “In 39 hours, we achieved the isolation of 70 percent of the entire Lithuanian network infrastructure.”
The claims from Killnet appear to be exaggerated. The DFRLab reviewed Killnet’s Telegram channel and identified 16 instances, between June 27 and 29, where the hacker group claimed to have taken down websites. When the DFRLab reviewed the websites on June 30, 14 were online. On June 30, Lithuanian police announced an investigation into the disruption of “more than 130 websites” between June 20 and June 29. This figure is nine times less than the figure published by Killnet on June 27.
Giedrius Meskauskas, a cyber security expert in Lithuania, published an op-ed piece in a regional news outlet saying that “these attacks are like if a gang of teenagers were running through the district at night, say, pouring five liters of fuel from each car. Unpleasant? Yes. For those for whom it was the last five liters of fuel, it is very unpleasant. Those who had a full tank of fuel would probably not even notice the incident.” Meshkauskas explained that “DDoS attacks are unpleasant, but one of the most primitive means of cyber warfare that can affect a limited amount of time and actually do no greater damage to an organization’s IT resources.”
—Nika Aleksejeva, Lead Researcher, Riga, Latvia
Pro-Kremlin Telegram channels blame Ukraine for Kremenchuk mall attack
On June 27, Russian troops launched X-22 missiles from a TU-22M3 bomber, striking a busy shopping mall in Kremehchuk. In response, Ukrainian President Volodymyr Zelenskyy described Russia as a “terrorist state.” Russian President Vladimir Putin denied the attack. As the shopping mall was still burning, the Russian propaganda machine began obfuscating the truth. Several state officials, state media, and pro-Kremlin Telegram channels rushed to disseminate “alternative” explanations of what happened, most of which were debunked by fact-checkers.
The first claim suggested that the attack struck a weapons depot and the resulting fire spread to a neighboring shopping mall. Nearby the mall there is a concrete mixing plant, but no weapons depot has been identified. Satellite imagery also shows extensive damage to the mall but not to any surrounding buildings. The only other impact is the site of the second strike, located roughly 500 meters from the mall. However, the buildings located in between the two areas of impact appear largely undamaged, further debunking the claim that a fire spread through the area. Lastly, Zelenskyy published surveillance footage of a missile hitting the shopping mall. Bellingcat geolocated and verified the footage, but pro-Kremlin propagandists continue to cast doubt on the video’s authenticity.
Another narrative claimed that Ukraine had staged the attack. The narrative echoed debunked Russian denials that were made after the atrocities in Bucha. Some pro-Kremlin sources even dubbed the Kremenchuk tragedy “Bucha 2.0.” Meanwhile, other commenters cited the Latin phrase “cui bono,” which suggests that crimes are committed to benefit their perpetrator. One Telegram channel claimed that Kremenchuk was chosen because there is a small population, meaning less people are around to film the attack. The same pro-Kremlin channel twisted a statement from the Ukrainian Minister of Internal Affairs Denys Monastyrsky to suggest that Ukraine was planning more attacks.
Some pro-Kremlin Telegram channels claimed that the mall had been shuttered since March, while others suggested that since there were not many cars in the parking lot, the mall must have been empty. However, multiple stores confirmed that their employees were injured in the attack. Shoppers even published receipts with the date to further prove the mall was open on the 27th. Bellingcat analyzed historical satellite imagery and found the mall is typically not very busy on Monday afternoons.
Another conspiracy appeared on the channel of pro-Kremlin blogger Zergulio, who claimed that Google had indexed news stories about Kremenchuk from France24 and The Guardian before the event had occurred. However, both France24 and the Guardian run daily live blogs covering the war, which are created in the morning and updated throughout the day. The webpage indexed by Google in the morning can make changes to its content without altering the indexation time.
—Roman Osadchuk, Research Associate
Pro-Kremlin Telegram channels spread disinformation about Ukraine selling weapons, again
On June 25, the Kremlin-tied Telegram channel Spletnitsa (“Gossip Girl”) published a post accusing two Ukrainian businessmen of assisting the Presidential Office of Ukraine in selling weapons to Middle Eastern countries. The Telegram channel declared that firearms were being marked in official documents as destroyed to hide the sales. The channel also stated that the Armed Forces of Ukraine would have benefited from possessing the weapons, as their current supplies were dwindling.
The channel did not provide any evidence to support its claims. The DFRLab previously covered attempts by pro-Kremlin Telegram channels to promote similar disinformation using forged government letters and doctored images of dark web sites where transactions allegedly took place.
The original post was amplified by another pro-Kremlin Telegram channel, MediaKiller, which added that the alleged arms dealers also earn money from the Presidential Office. MediaKiller also cited an unrelated investigation conducted by the Security Service of Ukraine examining the theft of aircraft components in the Odesa region. Spletnitsa then forwarded the post from MediaKiller, using it as evidence that another channel agreed with its claims.
—Roman Osadchuk, Research Associate
Ukraine says YouTube removed hundreds of pro-Russian channels
The Security Service of Ukraine (SBU) said on June 25 that YouTube had responded to a request and blocked around 500 pro-Russian channels, that had a combined audience of more than 15 million subscribers. YouTube has not commented on the matter.
An SBU statement said that Russia is spreading “insane fakes about ‘biolabs’ and radio-controlled geese, hatred of Ukrainians, and refined nonsense for their citizens,” producing “an endless stream of delusion.”
According to the statement, in addition to YouTube, the SBU also requested the blockage of 1,529 Telegram channels and bots, 426 Instagram accounts, 93 Facebook accounts, and 1,050 TikTok accounts. The SBU called on Telegram users to use the chatbot @Traitor_Search_bot to report information about “internet agents” who leak “important data” to the enemy.
On June 29, Russia’s Communist Party reported that YouTube had taken down their channel Красная Линия (Red Line). According to the statement, the YouTube channel was deleted due to “the videos with General Secretary of the Communist Party Gennady Zyuganov and the patriotic politics of the TV channel.” On the same day, TASS reported that YouTube had previously deleted a video on the Red Line channel in which Zyuganov laid flowers at the Tomb of the Unknown Soldier in Moscow and made assessments about the situation in Ukraine.
In May, YouTube removed more than 70,000 videos and 9,000 channels related to Russia’s war in Ukraine. Despite threatening YouTube with a ban, Russia has not acted against Youtube, the popular video platform in the country.
—Eto Buziashvili, Research Associate, Washington DC
Image: New satellite imagery taken this morning June 30, 2022 shows smoke coming from the contested Snake Island (45.255721, 30.204173) which Russia announced its withdrawal from June 30. Russian forces have left Snake Island in the Black Sea, the Ukrainian Armed Forces said on Thursday June 30, after carrying out what they said was a successful operation. The Ukrainian Armed Forces said that the enemy hastily evacuated the remnants of the garrison in two speedboats and probably left the island. (Maxar via EYEPRESS)