Image: Satellite imagery captured by Maxar shows Russian troop deployments in Yelnya, Russia (about 150 miles north of the Ukrainian border) on December 5, 2021. Photo by REUTERS

As the crisis in Europe over Ukraine heats up, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the US, NATO, and the European Union, DFRLab’s global team presents the first installment of the Russian War Report.

Ukraine: Heavy weapons on the move

Ukraine: False flags abound

Ukraine: Behind the cyberattacks

Belarus: Tracking the joint exercise

NATO: Russian narratives spin up friction

Venezuela: The backstory on Russia’s presence

Russian military equipment continues its westward movement from the Russian far east. As of January 17, this equipment has begun arriving in Belarus, a movement Russia claims is for the two nations’ upcoming Allied Resolve joint exercises. Using open-source information, the DFRLab has tracked units from the far east to field camps on the Belarusian border with Ukraine and in the west of the country. Iskander ballistic missile launchers from the 103^rd and 107^th missile brigades in the far east have been spotted moving westward with spare missiles.

More recently, the DFRLab observed equipment from the 36^th Motor-Rifle Brigade in Transbaikal and the 155^th Naval Infantry Brigade in Vladivostok arriving in Brest, the 37^th Motor-Rifle Brigade in Buryatiya arriving in Rechitsa near Gomel, and the 38^th Motor-Rifle Brigade arriving in Yelsk near Mazyr. Equipment from an undetermined unit has also been observed arriving in Gomel city. 

This equipment includes but is not limited to BM-27 heavy rocket artillery, BMP-2 and BMP-3 infantry fighting vehicles, T-72B3 main battle tanks, and fuel trucks. This deployment adds additional pressure to the Ukrainian northern flank and would likely thin out Ukrainian defenses in other parts of the country.

—Michael Sheldon, Research Associate, Washington DC

Russian military equipment spotted in Belarus as tensions heighten with Ukraine

Missile systems and tanks spotted in Russian far east, heading west

Since January 12, Ukraine has experienced a wave of false reports alleging that explosives or “mines” had been planted in schools, malls, and airports. According to the Ukrainian Security Service (SBU) and local police, locations featured in the false flags include airports, metro transit, and malls in Kyiv; schools in Cherkasy and Dnipro; and Odesa shopping malls. Overall, they received false reports regarding more than six hundred locations over a single day. Additional bomb threats have been received since January 12, including in President Volodymyr Zelenskyy’s hometown of Kryvyi Rih, with new threats on January 13, 14, 17, and 18. Schools in the cities of Mykolaiv and Cherkasy have switched to distance learning because of ongoing bomb threats. Ukrainian police stated that many of these threats, in the form of phone calls or messages, originated from the occupied territories of Luhansk and Donetsk oblasts, as well as from prisons. The SBU came to similar conclusions, confirming that the threats originated in the occupied eastern territories and neighboring post-Soviet countries. 

There have also been similar false reports of mines and bomb threats in Russia. On January 12, there were false allegations about mines in 151 Ekaterinburg schools. The following day, schools in Krasnoyarsk were evacuated, while Arkhangelsk and Saratov switched all schools to distance learning because of the additional threats. Russian media outlets immediately blamed Ukrainian “special operation forces” for planting mines. For example, RT featured an interview with an expert who claimed without evidence that he had successfully identified Ukrainian special forces as the culprits. Tsargrad TV went further and alleged that emails about mine threats came from Ukrainian, Polish, and Baltic servers, citing an anonymous source. The article concluded with a call for Russia to stop tolerating these threats and asymmetrically respond with special forces that had “proved themselves” in annexing Crimea. 

Separately, a Telegram channel tied to the Kremlin promoted the narrative that the West provokes media hysteria about a Russian invasion to “use Ukraine as a trading lot”—in other words, to exploit Ukraine as a bargaining chip in negotiations with Russia. The same source claimed that Russia and the United States are bargaining over global spheres of influence, and that Ukraine’s fate will be decided in behind-the-scenes talks. Another anonymous Telegram source alleged that the United States is destroying the Ukrainian economy to force it to make concessions to Russia.  

—Roman Osadchuk, Research Associate

Sergei Demedyuk, deputy secretary of Ukraine’s National Security and Defense Council, told Reuters on January 16 that UNC1151, a hacker group with connections to Belarusian intelligence, could be behind a cyberattack on Ukrainian government websites two days earlier.

On January 14, attackers hacked the websites of several Ukrainian government ministries, posting statements in Ukrainian, Russian, and Polish. The statements cited a large-scale leak of personal data of Ukrainians and claimed that the hack was an act of revenge for the genocide of Poles by the Ukrainian Insurgent Army during World War II. The metadata of the image featuring the statement included the geographic coordinates for Warsaw, a possible attempt to shift blame for the cyberattack to Poland. However, the Polish version of the statement contained grammatical errors and appears to have been translated from Russian into Polish via Yandex Translate. 

—Givi Gigitashvili, Research Associate, Warsaw, Poland 

As noted earlier, significant open-source evidence has emerged suggesting a heavy Russian military buildup in Belarus. The official explanation for this buildup is the upcoming joint military exercise Allied Resolve, which is being organized to train soldiers from Russia and Belarus in “repelling an external attack.” Combat readiness for the exercise is expected to be achieved by February 9, with military drills scheduled for the following day.

Despite the official explanation, the US State Department and various security experts fear this exercise could be cover to build up equipment and troops in order to attack Kyiv from the north. An attack from the north would tie up a significant number of Ukrainian forces, preventing them from fighting on the eastern border with Russia or toward Russia-occupied Crimea in the south. Additionally, an attack from the north gives Russian troops an advantage of being able to reach Kyiv without crossing the Dnipro River. Kyiv is just ninety kilometers from the Belarusian border.

Currently, the DFRLab is tracking Russian military arrivals in multiple regions in southern Belarus, including Brest, Minsk, Kolodishchi, Mozyr, Gomel, and Rečyca. Many of these sightings have been verified using open-source rail data. There are also new reports of Russian military units in the Orsha and Asipovichy regions of Belarus. 

This military buildup in Belarus also stokes fears for NATO members Lithuania and Poland, as joint military exercises are also planned for Belarus’s western borders. These worries were expressed on January 19 by Lithuanian Minister of Defense Arvydas Anušauskas, who said the troops “pose a direct threat.”

—Lukas Andriukaitis, Associate Director, Brussels, Belgium

Belarus strengthening its borders with Ukraine and Lithuania

The DFRLab has spent the last five years monitoring the Russian-language online information space to examine narratives regarding NATO in the context of Russian military threats. The most significant current development involves news stories portraying a lack of unity between NATO member states. 

For example, Ukraine-based pro-Kremlin media outlet Ukraina.ru portrayed a January 18 meeting between German Minister of Foreign Affairs Annalena Baerbock and Russian Foreign Minister Sergei Lavrov as “unexpectedly” positive. The article emphasized that Baerbock, who also visited her Ukrainian counterpart, was not hostile to Russia and was seeking a dialogue. But coverage of the meeting from Germany’s state-owned broadcaster Deutsche Welle told a different story, reporting that Baerbock criticized Russia’s military buildup, calling it a “threat” to Europe. 

The narrative that Germany would ally with Russia is based on the opinions of two German parliament members, Stefan Korte (the far-right Alternative for Germany party) and Andrej Hunko (The Left party). The Kremlin-controlled outlet Rambler cited Korte making the argument that Russia has the right to demand NATO not accept Ukraine. Kremlin-owned RIA Novosti cited Hunko when reporting that Baerbock was wrong about her position that Ukraine should have the freedom to join NATO. 

On January 19, Turkish President Recep Tayyip Erdogan offered to serve as an intermediary between Russia and Ukraine in light of the possible military conflict. In response, Kremlin-owned broadcaster RT published a feature article that expressed Russia’s lack of interest in the idea, noting that Turkey is delivering Bayraktar TB2 drones to Ukraine. The RT article bore many similarities to another article previously published by Kremlin-owned TASS on December 29, 2021. 

The DFRLab also observed Kremlin–controlled media reporting about the United Kingdom delivering defensive weapons to Ukraine, amplified by lower-profile media outlets in Ukraine and Russia. The articles speculated that the United Kingdom would provide Ukraine with next-generation Light Anti-Tank Weapons, alleging that they are “ideal for combat in urban environments.” 

Lastly, pro-Kremlin and fringe Russian online outlets have intensified warnings about nuclear war between Russia and the United States. The outlets claimed that the West supports the use of nuclear weapons, and that the United States would strike first. Concurrently, Russian state-owned TV broadcasters are pushing the narrative that Russia would prevail over the United States in a nuclear war. 

Some of these outlets are spreading propaganda via infographics claiming joint Russian-Belarus military superiority over the United States regarding various types of weapons. The infographics reference the US nuclear arsenal as well, with an accompanying narrative claiming that the potential for a nuclear apocalypse is real, given the size of US and Russian nuclear arsenals.

— Nika Aleksejeva, Lead Researcher, Riga, Latvia

—Eto Buziashvili, Research Associate, Tbilisi, Georgia

On January 13, Russian Deputy Foreign Minister Sergei Ryabkov told Russian media outlet RTVI that he would not confirm or deny anything regarding the possibility of deploying Russian military infrastructure in Cuba and Venezuela. US National Security Adviser Jake Sullivan noted the issue was not raised during NATO talks. “If Russia were to move in that direction, we would deal with it decisively,” he said. Most international affairs commentators have so far dismissed Ryabkov’s statement.  

Nonetheless, Russia and Venezuela have built up a political alliance over the past eighteen years, with military cooperation ongoing since 2008. Russian Tu-160 Blackjack bomber planes have flown over Venezuelan airspace in several publicized demonstrations between 2008 and 2020. The Tu-160 can fly more than twelve thousand kilometers without refueling—approximately the same distance between Russia and Venezuela. These Russian military aircraft have twice violated Colombian airspace while on missions from Venezuela to Nicaragua. 

Since 2019, Russian soldiers have been deployed in Venezuela to provide technical assistance in maintaining S-300 air defense missile batteries at the Captain Manuel Rios Airbase, located in Venezuelan central plainlands. The number of troops is reported to be between 150 and 350, which would not constitute a significant threat to the United States. In addition, a contingent of four hundred Wagner Group private military contractors deployed from Russia to Venezuela in 2018 and 2019 to provide personal protection for President Nicolas Maduro

—Iria Puyosa, DFRLab research fellow, Ann Arbor, Michigan