As Russia expands its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the US, NATO, and the European Union, DFRLab’s global team presents the latest installment of the Russian War Report.

Russia sends military contractors from Georgian breakaway region to Ukraine

Belarus resists sending ground forces to Ukraine

Kremlin creates imitation Instagram as Russians use VPNs to circumvent Internet restrictions

Latvian information space rapidly changing as authorities move to restrict Kremlin propaganda

US tech companies face dire decision: abandon Russian civil society or benefit some Russian war propagandists

“Dead” platforms like Clubhouse find second life for Russians

Russia launches cyberattack on multiple Ukrainian media websites

Russia accuses Ukrainian Azov battalion of destroying Mariupol Theater 

Chinese narratives shift from pro-Russia to emphasizing neutrality while reviving COVID-19 bioweapon theory

Council of Europe suspends relations with Lukashenka’s regime 

Amid sanctions, Moscow wants Georgian breakaway regions to be less dependent on Russia 

On March 16, video footage circulated on social networks depicting the movement of military equipment in the Georgian breakaway region of South Ossetia. In a video compilation published by RFE/RL’s Echo of the Caucasus, military columns are seen leaving the regional capital of Tskhinvali, exiting South Ossetia through the Roki Tunnel towards Russia. According to Echo of the Caucasus, the convoy included a contingent of private military contractors who are residents of South Ossetia and served with the 4th Guards Military Base of the Russian Armed Forces, located in Tskhinvali.

Former South Ossetia President Eduard Kokoity confirmed the news on his Telegram channel. “Our boys are going to Ukraine to finish off the Nazis who terrorize their people,” said Kokoity in a post that included two videos showcasing the military column’s movement.

—Sopo Gelava, Research Associate, Tbilisi, Georgia

On March 15, Belarusian President Alyaksandr Lukashenka stated, “Belarus had intercepted a missile fired at it two days ago from Ukraine.” Despite the alleged attack, which could have been a hoax or a Russian false-flag operation intended to draw Belarus into the war, Lukashenka is reportedly resisting sending troops across the border. 

March 17 reports from open-source investigators MotolkoHelp suggest that more Russian Iskander missiles were recently brought to the military airfield in Machulishchy, Belarus. They stated that there have also been signs that Russian Air Defense Forces are active on Belarusian territory. Pantsir-S1 missile systems were seen in the Minsk region and near the town of Mazyr, MotolkoHelp reported, while S-400 missiles systems were spotted in transit in Baranavichy.

Meanwhile, wounded Russian soldiers continued to arrive in Belarus. On March 17, five ambulance buses were reported in Gomel. Belarusian soldiers are reportedly doing the “dirty work” to help Russian forces regroup, like repairing damaged military equipment and cleaning tanks of dirt and human remains.

—Lukas Andriukaitis, Associate Director, Brussels, Belgium

To placate citizens displeased with the impacts of sanctions, the Kremlin has begun creating copycats of Western social media platforms that are no longer operating in the country. In addition to companies pulling their services from Russia, the Kremlin is also blocking access to a number of social media platforms and online outlets. 

Russia introduced a copycat of the photo-sharing app Instagram on March 14. Rossgram bears a remarkably similar name and logo to Instagram. The creation of Rossgram was announced on the platform’s official Telegram channel, created the previous day, and the company’s website. The channel, which already has more than 57,000 subscribers, stated that Rossgram is the Russian version of Instagram, but will include several additional features, like paid access to content and crowdfunding support. Rossgram is likely highlighting these features in response to complaints from Russian Instagram influencers who are losing income due to the blocking of the platform. The Rossgram website states that it will soon be available for “top bloggers and partners,” while “ordinary users” will have to wait until April 2022. 

In addition, Vedomosti.ru reported that VK, which owns the Russian social network VKontakte, will bring ICQ messenger back to Russia. The messaging client, popular in the early 2000s, was developed by an Israeli company bought by VK in 2010. Vedomosti reported that an ICQ relaunch was previously discussed at the beginning of 2020, but Western sanctions have expedited the process. 

Kremlin-owned outlet RIA reported that the Russian social network Odnoklassniki, which is also owned by VK, has seen a record influx of users since the beginning of March, with a more than 66 percent increase in user registrations. The Russian social network was popular in Russia and neighboring countries in the late 2000s.

As the Kremlin tries to imitate Western social platforms or bring new life to old communications tools, the demand for Virtual Private Networks (VPNs) in Russia has “spiked 2,088 percent higher than the daily average demand in mid-February,” according to a Euronews reported based on data presented by the monitoring firm Top10VPN. Business Insider also reported that the average weekly sales of the Lithuanian VPN Surfshark have increased by 3,500 percent since Russia invaded Ukraine. 

Meanwhile, the Twitter account for the Russian bank Tinkoff may have accidentally exposed the lack of resources available in Russia. Tinkoff has developed a Russian national payment system called Mir (“peace”), which they describe as similar to Visa and Mastercard, both of which suspended operations in Russia. When a Twitter user asked Tinkoff whether one would be able to exchange their Mastercard for a Mir card, the banking company responded that they are not producing physical cards because of a plastics shortage. Before deleting the tweet, Tinkoff said the tweet was a mistake and issued a separate tweet attempting to persuade readers that there is no shortage of Mir cards.

—Eto Buziashvili, Research Associate, Tbilisi, Georgia

Russian neighbor Latvia is experiencing rapid changes in its information environment as authorities move to clamp down on Russian media. However, the consequences of two decades of Kremlin propaganda can still be felt in the country.

On February 24, the day Russia launched its war on Ukraine, Latvia’s National Electronic Mass Media Council (NEPLP) banned several Kremlin-owned and pro-Kremlin television channels. Since March 10, NEPLP has also gained the right to ban Kremlin-affiliated websites. By March 15, NEPLP had blocked seventy-one websites sharing Kremlin propaganda. It also announced that anyone using illegal devices to watch Kremlin TV channels would face a €700 fee.

Changes are also occurring in online spaces known for COVID-19 disinformation and conspiracy theories. On March 7, the Latvian State Security Service (VDD) detained four people for “targeted and systematic support and justification of Russia’s military aggression to Ukraine and its people.” One of the detainees was Aivis Vasilevskis, a notorious author of anti-Western conspiracies and anti-vaccine disinformation; he has previously supported Putin publicly. Vasilevskis regularly provides content to anti-establishment websites such as Brivibas Platforma and Mainam Pasauli, and hosts two social media shows, Brivvalsts TV and Brivibas Modinatajs. As a result of his detainment, Brivibas Platforma has not published a story since February 8, and Mainam Pasauli has not posted since March 11. Both outlets are active on Telegram, where they are raising money for Vasilevskis’s lawyer. Most of Vasilevskis’s personal accounts have been taken down, including his Telegram channel and his website, where he previously shared the Kremlin conspiracy about Ukrainian bioweapon labs. 

Though there are now fewer options for Kremlin propaganda to reach people in Latvia, exposure to the pro-Kremlin worldview in Latvia has existed since the collapse of the Soviet Union. SKDS, a Latvian public opinion research company, shared an opinion poll online asking which side people supported in Russia’s war on Ukraine. Among Latvian speakers, 90 percent of respondents answered “Ukraine.” Among Russian speakers, who make up 36 percent of Latvia’s total population, only 22 percent supported Ukraine, while 21 percent supported Russia and 46 percent did not choose either side. 

While the poll was criticized for being overly simplistic, it still indicates how difficult it can be for Russian speakers in Latvia to condemn Russia’s actions in Ukraine. For example, on March 15, Aivars Broks, the director of a music school in Daugavpils, Latvia’s second-largest city, substituted the school’s flag with a Ukrainian flag. This action enraged many people who came to the school demanding the flag be taken down. Protesters chanted “shame” in Russian, with some claiming that Broks “wants war” and others saying, “This is not our conflict.” Some also repeated Kremlin narratives falsely alleging that Ukraine provoked the war by bombing Donetsk.

—Nika Aleksejeva, Lead Researcher, Riga, Latvia

 On March 16, the workplace communications platform Slack locked the accounts and data of all Russian users. This disruption came without warning. It echoed recent decisions by Namecheap, a domain name registrar, and Mailchimp, an enterprise email manager, to terminate all Russian services. 

These broad technology service suspensions have disrupted the work of Russian independent media and human rights groups. In one widely publicized case, Namecheap wrote to a Russian customer and informed them, “We’ve detected that your website supports the regime.” That customer, Teplitsa ST, is a nonprofit devoted to teaching Russians how to safely use VPNs and the Tor browser to circumvent Russian internet controls. It does not support the regime. 

At the same time, US technology companies that continue to support Russian citizens also run the risk of supporting government-adjacent propagandists. Cloudflare, which has publicly pledged to remain in Russia, was criticized this week for protecting TopWar.ru, a pro-Kremlin disinformation website, from DDoS attacks. Nonetheless, a US State Department spokesperson appeared to endorse Cloudflare’s decision to remain available to Russian civil society, telling the Washington Post, “It is critical to maintain the flow of information to the people of Russia to the fullest extent possible.”

—Emerson T. Brooking, Resident Senior Fellow, Washington DC

Following the Russian state censor’s ban of Instagram and increasingly hostile position toward YouTube, Russian citizens have turned to less popular social media platforms in a bid to avoid government surveillance. Clubhouse, an audio-only chat application whose global popularity peaked and then declined sharply in 2021, has become a popular destination for Russians and Westerners to discuss the war in an unmediated setting. 

Because of user anonymity and a lack of effective transcript or surveillance methods, Clubhouse is likely to grow in popularity until the Russian government institutes a general ban.

—Emerson T. Brooking, Resident Senior Fellow, Washington DC

On March 17 at 6 pm local time, several Ukrainian media websites were targeted in a cyberattack. According to the Ukrainian Institute of Mass Information, a non-governmental organization supporting journalists and conducting media monitoring, multiple websites experienced technical issues. Some websites were hacked to display the Russian flag, the St. George Ribbon (a banned symbol in Ukraine), and the letters “V” and “Z,” which have become symbols of Russian patriotism. 

Among the targets of the hack were the national media outlet Hromadske Radio, the mobile website for Censor.net, and local media organizations including Kremenchuk Telegraph, Poltava News, Rivne Media, and NTK TV, among many others. The digital team of Hromadske Radio claimed that the flag, ribbon, and letters were an “unauthorized display of unacceptable advertising.” The exploit used in the hack was Redtram, a popular Eastern Europe traffic exchange system, according to Serhiy Omelchenko, the Head of Digital at Hromadske Radio. The digital team urged colleagues and other traffic systems to delete Redtram-related source code from their websites.

—Roman Osadchuk, Research Associate

On March 16, the Mariupol City Council announced on Telegram that a Russian aircraft had bombed a drama theater that was being used as a shelter for roughly 1,000 civilians. Satellite imagery revealed that the Russian word for children, “ДЕТИ,” was written in large letters on two sides of the building’s exterior, intended to be seen from the sky. The building’s basement withstood the aerial bombardment, and survivors continue to emerge from the building’s ruins. 

The Russian Defense Ministry denied responsibility for the bombing, claiming that Ukrainian Azov Battalion militants blew up the building. The Russian embassy in the United Kingdom reinforced this narrative by posting a video on Twitter of a woman alleged to be a refugee from Mariupol, saying that the Ukrainian Azov Battalion blew up the drama theater and was using civilians as human shields. The woman also claimed that the people in the shelter feared the Azov Battalion members. A longer video of the interview was posted on the Telegram channel Neoficialniy BeZsonoV.

The reliability of witness has been questioned, however. RFE/RL journalist Mark Krutov first noticed that at the beginning of the video, the woman says she was in the basement of the Terrasport fitness club, not in the basement of the drama theater. Google Maps shows that the Terrasport fitness club in Mariupol is three kilometers away from the theater building.

—Givi Gigitashvili, Research Associate, Warsaw, Poland

In recent days, China’s narrative on the war in Ukraine has shifted from one that had been largely pro-Russia to one that emphasizes China’s neutrality and commitment to a peaceful settlement of the issue. However, what remains consistent is China’s blaming of the US for both the outbreak of the war and for the continued hostilities. It has also revived the conspiracy theory connecting US biolabs to the outbreak of COVID-19.

During the initial phase of Russia’s invasion, Chinese media outlets were instructed to avoid any coverage “unfavorable to Russia or [that is] pro-Western.” As the scale and aims of Russia’s invasion became clear, China’s narrative shifted to emphasize two seemingly contradictory principles: official public support for Ukrainian sovereignty, and Russia’s “legitimate security interests” in the region. China also employed a strategy of moral equivalence to deflect criticism of its support for Russia, often raising US interventions in the Middle East as a response to questions on the issue.

In the last few days, China’s approach has shifted once again. Official narratives emphasize China’s neutrality in the war, its longstanding role as a force for peace in the international system, China’s humanitarian contributions to Ukraine, and to urge a peaceful resolution to the conflict through negotiations. In Chinese media, more reporting of Russian military losses has appeared. In official media, Russia has moved from being depicted as a “hero protagonist” to a more neutral “other involved party.” 

At the same time, China is also trying to deflect attention by reviving the unsubstantiated claim around US-funded biolabs being a potential origin site of COVID-19. On the front page of Xinhua on March 18, coverage of the war in Ukraine was limited to a single article featuring anodyne descriptions of ongoing diplomatic engagements on the issue; however, articles on Russian military reports accusing the US of carrying out “biological military projects” in US-funded biolabs across Ukraine was featured prominently both on official media websites and across Chinese social media platforms.

—Kenton Thibaut, Resident China Fellow, Washington DC

On March 17, the Committee of Ministers of the Council of Europe suspended all ties with Belarusian authorities due to the country’s active participation in the war against Ukraine.

Sviatlana Tsikhanouskaya, head of the Belarusian opposition, said this was a groundbreaking decision to “completely reject [President Alyaksandr] Lukashenka’s regime and switching to work with democratic forces.” The decision to sever ties with Lukashenka could be viewed as the first step to considering the Belarusian opposition as the legitimate representatives of the Belarusian nation. Furthermore, the decision impacts Belarus’s participation in Council of Europe agreements.

That same day, Tsikhanouskaya addressed a gathering of UN ambassadors in Geneva, raising four demands: first, to label Lukashenka’s actions as crimes against humanity; second, to try his regime before a war tribunal in Ukraine; third, to recognize the de facto Russian occupation of Belarus; and fourth, to help release Belarusian political prisoners. “The future of Belarus depends on the fate of Ukraine,” Tsikhanouskaya later told AFP.

—Lukas Andriukaitis, Associate Director, Brussels, Belgium

On March 9, Russia’s Deputy Economic Minister Dmitry Volvach met with the leadership of the Georgian breakaway region of Abkhazia. Georgian news outlet Civil.ge cited the Russian-owned news agency TASS to report that Moscow is seeking to reduce Abkhazia and South Ossetia’s economic dependence on Russia within the next three years. Volvach told TASS that Moscow sought to cut financial aid and that Abkhazia and South Ossetia must attract investments, develop their economies, and increase their gross domestic product. Volvach noted that Russian financial aid amounted to over five billion rubles ($42.2 million) for Abkhazia and over seven billion rubles ($60.7 million) for South Ossetia in 2021.

For years, Georgia’s two breakaway regions have been heavily dependent on Russian security, financial aid, and trade. Both regions use the Russian ruble as their primary currency. In 2020, Abkhazia and Russia adopted a plan to create a shared socioeconomic space and integrate Abkhazia’s economy with Russia’s. Similarly, President Putin signed an “alliance and integration” treaty with South Ossetia in 2015 to integrate their economy and military sectors.

—Sopo Gelava, Research Associate, Tbilisi, Georgia