Image: Instagram logo displayed on a phone screen and Russian flag displayed on a screen in the background are seen in this illustration photo taken in Krakow, Poland on March 14, 2022 (Photo illustration by Jakub Porzycki/NurPhoto)NO USE FRANCE

As Russia expands its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the US, NATO, and the European Union, DFRLab’s global team presents the latest installment of the Russian War Report.

Meta officially declared “extremist organization” in Russia; full impact remains unclear

Unauthorized pro-Ukrainian post appears on official VK group

Donetsk People’s Republic falsely claims US instructors were killed in Donbas

Kremlin stages concert to showcase public support for Putin’s “military operation”

Ukraine reports ammonia leak after Russian shelling and false flag allegations

Activists seek to sabotage railway operations in Belarus and Ukraine to hinder Russian movements

On March 21, Meta was officially designated an “extremist organization” in Russia. This designation came at the request of the Russian Prosecutor General’s Office and was granted in a hearing of the Tverskoy Court of Moscow. The speed of the designation comes as a surprise to some experts, who assumed that the decision would be delayed by appeals and ultimately determined by Russia’s Supreme Court. This marks the conclusion of a process that began on March 11, when the Russian government took aggressive action against Meta following a Reuters story that the company was permitting calls to violence against Russian soldiers by Ukrainian users on Facebook and Instagram. 

The practical consequences of enforcing this designation remain unclear, even to the Russian government itself. In the hearing, the Prosecutor General’s Office stated that it was seeking only to declare the company as an extremist organization, not Meta’s products. This lawsuit was not intended to hold Russian citizens liable for using Meta products, and it targeted only Facebook and Instagram, not WhatsApp, which remains Russia’s most popular messaging platform. 

However, as Russian jurist Pavel Chikov noted, many of these distinctions are impossible under current Russian law regarding extremist organizations. The law bans “any public demonstration of symbols” of extremist organizations: on business cards, on websites, and social networks themselves. Practically, this means that any Russian who operates a website that links to Facebook or Instagram would be liable for criminal prosecution, as would the owner of any storefront that advertises its presence on Meta platforms. On the other hand, it appears that the distinction between Facebook/Instagram and WhatsApp is legally enforceable, which means that WhatsApp may continue to operate normally in the country for now. 

The Russian FSB, which was an informal party to the suit, unambiguously endorsed the move against Meta. In a statement, FSB spokesperson Igor Kovalevsky accused the company of abetting “information warfare” against Russia.

—Emerson T. Brooking, Resident Senior Fellow, Washington DC

On March 20, VKontakte’s official group page was reportedly hacked. The group began publishing information about Russian destruction in Ukraine, which would be highly out of character for the company, as it is partly owned by a longtime ally of Russian President Vladimir Putin. The group has more than 12 million subscribers.

A pro-Ukrainian post describing the reality of the war was reportedly published in the group and shared via private messages. The post was reportedly visible on the group for “a few minutes” before being removed. The post noted that 3,500 civilian infrastructure targets have been destroyed in Ukraine and that Ukrainian children and civilians are among the casualties. It also highlighted the failure of the “special operation” by noting that Ukraine has reported 11,000 deaths among the Russian forces and 560 prisoners of war captured. These figures are much higher than the official Russian toll, which has not been updated since early March. The post also described a dark future for the Russian economy, claiming it was inevitable that Russia will default on its debt. It concluded with a statement alleging that the entire VK platform had been hacked, and that all personal data, messages, and posts were downloaded by the alleged hackers. 

It remains unclear whether this incident was the result of an actual hack; at the time of publishing, no group had claimed responsibility. The anonymous Telegram channel @LBOgd wrote that the “group’s token was shared with a third party,” allowing unauthorized posts to be published, but the platform itself had not been hacked.

Meanwhile, VK continues to shutter popular groups that share independent information about the war in Ukraine and the political situation in Russia. For example, on, March 19, it blocked a fan group for independent Russian political scientist  Yekaterina Shulman. The group, still available outside Russia, has approximately 35,000 members. The group’s administrator said they received a note informing them the page was blocked for sharing “materials about alleged Russia’s invasion in Ukraine” that may cause “mass violations of public order.”

Recently, VK has also blocked independent media outlets from its platform, including 7×7, The Village, Echo Moscow, Dozdy TV, Meduza, Current Times, Radio Liberty, and many others.

—Roman Osadchuk, Research Associate

—Nika Aleksejeva, Lead Researcher, Riga, Latvia

On March 17, the People’s Militia of the so-called Donetsk People’s Republic said on Telegram that three instructors from the United States were killed in Maryinka city in Donetsk Oblast. The separatists alleged that they discovered the American instructors’ personal belongings, which included a Tennessee flag. The post said that foreigners were fighting alongside Ukraine’s 1st Mechanized Battalion of the 54th Brigade. It claimed that the killed Americans were Cpt. Michael Hawker, Lt. Logan Shrum, and Lt. Cruz Toblin, and alleged they had arrived in Ukraine to kill civilians. Pro-Kremlin Russian media widely amplified the narrative.

That same day, the US National Guard refuted the claims made by the separatists and Russian media. A press release published on the National Guard’s website said that the reports claiming Tennessee National Guard members were killed in Ukraine were false. It stated that the named soldiers were indeed “current or former members of the Tennessee National Guard,” but they were “accounted for, safe, and not, as the article headline erroneously states, US mercenaries killed in Donetsk People’s Republic.” The press release added that it believes these individuals were targeted due to their appearance in articles published on the Defense Visual Information Distribution Service website. 

The National Guard confirmed that members of the Tennessee National Guard were part of a multinational training group deployed in 2018 to support the Ukrainian Armed Forces in developing the Yavoriv Combat Training Center, but they returned home safely in 2019 after completing their mission.

—Givi Gigitashvili, Research Associate, Warsaw, Poland

On March 18, concerts and rallies celebrating the anniversary of the annexation of Crimea took place all around Russia. Many Kremlin–controlled TV channels broadcast a concert titled “Crimean Spring” from Luzhniki Stadium in Moscow. President Putin attended the concert and addressed the crowd.

The broadcast of the concert showed a crowd waving Russian flags and wearing the Ribbon of Saint George, sometimes shaped to form the letter “Z,” which has become a symbol of Russian patriotism. Russia’s Ministry of Interior estimated about 95,000 people attended the concert, and another 100,000 gathered outside the stadium. 

A VKontakte user claimed he could not attend the event because it was at capacity. The user said a staff member told him that “militaries, students, and other administrative staff” were brought to the stadium earlier in the day. Social media posts published the day before the show offered RUB 500 (approximately USD $5) to attend the concert at Luzhniki Stadium.

Meduza, an independent media outlet now blocked in Russia, reported from the concert. The report mentioned at least five attendees who said they only attended the concert because their employer or university requested it. Many attendees refused to talk with the press, Meduza reported. A video report from Novaya Gazeta, an independent media outlet still available in Russia, showed a similar reluctance from attendees to address the media.

On March 21, Putin’s spokesperson Dmitry Peskov told pro-Kremlin media outlets that the concert demonstrated Russian people’s “sincere” and “maximum” support for Putin.

—Nika Aleksejeva, Lead Researcher, Riga, Latvia

Ukraine’s state emergency service reported the Sumykhimprom chemical plant in Sumy was shelled by Russian forces on March 21 just prior to 4am local time. “As a result of the shelling, one tank with ammonia was damaged,” they noted. There were no reports of injuries from the chemical leak.

Two days earlier, Russian Colonel-General Mikhail Mizintsev specifically referenced the Sumykhimprom chemical plant, stating that “Ukrainian Nazis” would engage in a false-flag operation.  According to Mizintsev, they “mined storage facilities containing ammonia and chlorine in order to massively poison the inhabitants of the Sumy region if units of the Russian Armed Forces enter the city.” Mizintsev also claimed that these Nazis were “preparing provocations using poisons” in Kotlyarovo, near Mykolaiv. “For this, containers with toxic chemicals have already been delivered to the building of the local elementary school, which are planned to be blown up when Russian troops approach,” the general added.

This appears to be the latest example of Russia alleging without evidence that the Ukraine would use biological, nuclear, or chemical agents. Similar allegations by the Kremlin circulated immediately prior to President Putin announcing his invasion of Ukraine.

—Eto Buziashvili, Research Associate, Tbilisi, Georgia

On March 20, Pavel Latushka, a leading member of the Belarusian opposition, shared a map allegedly depicting railway sabotage operations on Belarusian territory. Belarusian activists seeking to hinder the movements of Russian forces had reportedly targeted the country’s railway systems in multiple locations. Latushka said the activists managed to disable railway alarms, centralization and blocking systems, and protective relays and transformers. The incidents have not yet been confirmed, however.

The previous day, Oleksandr Kamyshin, chairman of Ukrainian Railways, told Nastoyaschee Vremya that railway communication between Belarus and Ukraine had been wholly cut off. Few other details were shared, but it was suggested that there was coordination with Belarusian railway workers. “I appealed to Belarusian Railways not to carry out criminal orders and not to lead Russian military convoys to Ukraine,” Kamyshin noted, according to Ukrainska Pravda. “I can now say that there is no connection between Belarus and Ukraine.” 

The alleged incidents took place several days after a video began circulating of Oleksiy Arestovich, the adviser to the office of the Ukrainian President, calling for a “total rail war.” Arestovich encouraged activists to sabotage railways, not only on Ukrainian territory, but also in Belarus.

—Lukas Andriukaitis, Associate Director, Brussels, Belgium