Image: Belarusian soldiers from the Unit 103rd Vitebsk Guard Aircraft Brigade conduct joint combat exercises with police units in the Gomel region of Belarus, Feb 16, 2022. (Source: Eyepress via Reuters Connect)

As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, the DFRLab’s global team presents the latest installment of the Russian War Report. 

Signs of renewed Belarusian troop movements towards Ukrainian border

Kremlin media spread claims of NATO officers being captured and murdered in Mariupol

Kremlin shifts blame to Western sanctions for growing global food crisis

Russia attempts to limit the use of VPNs and Tor

On May 26, Belarusian President Alyaksandr Lukashenka ordered the creation of a new military command center in southern Belarus, which borders Ukraine. Russian state media outlet TASS reported on the new command post, saying that Belarus “has to practice defending its southern frontiers quickly.”  

Ukraine’s Ministry of Defense said on May 25 that it had received intelligence that Belarus was taking practical actions to check “the combat readiness” of its armed forces and that exercises were planned at ten training grounds in Belarus, including Brest, Grodno, Minsk, Mogilev, and Vitebsk. “As part of the same exercises, it is planned to remove weapons and military equipment from storage, as well as to carry out marches,” said Oleksandr Motuzianyk, spokesperson for the Ukrainian Defense Ministry.  

On June 2, videos of Belarusian military equipment being transported via railway appeared online. Ukrainian journalist and former presidential spokesperson Iuliia Mendel said the video captures more than fifty units of military equipment being transported from Grodno in the north to Brest in the south. Mendel said the train carried thirty-seven infantry fighting vehicles and anti-aircraft missile systems. However, the DFRLab could not confirm these figures as the video features cuts and transitions that make it difficult to accurately assess the amount of equipment visible.

A video that surfaced on June 2 shows Belarusian military vehicles being transferred via railway. The DFRLab geolocated the footage to Baranavichy, Belarus. (Source: @AZmilitary1/archive)

The DFRLab geolocated another June 2 video of military equipment in transit to an area near the rail station in Baranavichy, in the western Brest region.

It remains unclear how many Belarusian forces are being relocated to the Ukrainian border, what their purpose is, or how long their deployment will be. 

—Lukas Andriukaitis, Associate Director, Brussels, Belgium

On May 19, Veterans Today, a US-based website with a history of circulating antisemitic and conspiratorial content, published an article titled, “NATO Officers in Azovstal Murdered & Mutilated by Azov to Spare Western Governments Embarrassment?” The article suggests that the “Azov Brigade and other associated neo-Nazi groups” killed and disposed of the bodies of NATO officers who were trapped inside Mariupol’s Azovstal steelworks. After a three-month siege, Russian forces took control of the Azovstal plant on May 20. The article claimed the Russian army would not be able to find evidence of the NATO officers’ presence as “Moscow doesn’t have access to the DNA databases of Western military institutions,” and “it’s not clear that the stakes would be worth the bother.”  

Pro-Kremlin media outlets in Russia reported on the article, including Pravda.ru, Krasnaya Vesna, Narodnye Novosti, Yuzhny Federalny, Kurer Sreda, Yakutsk.ru, Politichesky Vestnik, OSN, and Gals.ru. Pravda.ru translated and published large excerpts on May 20. The rest of the listed publications published articles about the column the following day, except for Kurer Sreda, which reported on the article on May 25.  

The article also spread on Telegram. TGStat, a Telegram analysis tool, identified seventeen original posts and the reposts mentioning “Michael Brenner,” the person listed as the author of the article, in Russian from May 18 to May 25. Thirty-four channels that amplified the story were in Russia, while three channels were in Belarus and two in Ukraine. While most pro-Kremlin media wrote about the article on May 21, on Telegram, Brenner garnered the most mentions on May 23.

In late March, the narrative claiming that NATO officers were trapped inside the Azovstal steelworks first started to spread on pro-Kremlin Telegram channels and in pro-Kremlin media. On March 31, Tsargrad, a right-leaning pro-Kremlin media outlet, cited the Telegram channel Ukraina/Open Ukraine to claim that a “group of twenty American and British military advisors…did not manage to leave the city [of Mariupol] in time.” On April 1, Thomas Gast, a German YouTuber, claimed “High ranking NATO commanders” were in the Azovstal steelworks. On April 3, Gast’s video was translated and cited in a post on LiveJournal, a Russian-owned blogging platform. 

On April 5, English and Russian pro-Kremlin Telegram channels asserted there were “French, German, British and ‘neutral’ Swedish NATO officers” in the Azovstal plant. Pro–Kremlin media and fringe English-language media also spread the rumor. 

On April 6, false information began to circulate about the capture of Lieutenant Roger Cloutier, the chief of NATO’s Allied Land Command in Europe. The claim spread on social media, in English and other languages, and in Russian pro–Kremlin media. Reuters and Vox Ukraine debunked the claim. 

On May 22, Tsargrad falsely claimed that US Admiral Eric T. Olson and British Lieutenant Colonel John Bailey were captured alongside Ukrainian fighters inside the Azovstal steelwork. France 24 and Techarp debunked these claims.

—Nika Aleksejeva, Lead Researcher, Riga, Latvia

As Russia blocks trade routes in the Black Sea halting all Ukrainian exports, Kremlin officials sought to blame sanctions imposed by Western countries for the growing threat to food security. On June 1, Kremlin spokesperson Dmitry Peskov claimed that the world was facing a food crisis “linked to the introduction of illegal restrictions against us [Russia] and the actions of Ukrainian authorities.” On May 18, Russian Foreign Ministry spokesperson Maria Zakharova said that the “rise in global food prices is a direct result of the senseless buildup of unilateral anti-Russian restrictions.”  

Russian Duma speaker Vyacheslav Volodin also echoed these claims. “By imposing illegitimate sanctions against Russia, these countries pushed up energy and food prices, and they are to blame for the current problems and future crises globally,” he said. On his Telegram channel, Volodin went so far as to claim that the US wanted to organize a “Holodomor” in Ukraine, in reference to the Soviet Union’s mass starvation campaign against Ukraine in the 1930s, because the US wants to sell Ukrainian grain to recoup its financial losses from investing in Ukraine’s defense.    

In May, United Nations Secretary-General António Guterres warned that the war in Ukraine was “amplifying and accelerating” food insecurity and global hunger. The UN World Food Programme recently said, “When a country like Ukraine that grows enough food for 400 million people is out of the market, it creates market volatility, which we are now seeing.”   

Western officials have dismissed the claim that sanctions are to blame for rising food insecurity. United States Secretary of State Antony Blinken said the US and many other nations have exempted food, fertilizer, and seeds from sanctions. In May, Russia’s Union of Grain Exporters stated, “Sanctions and export controls against Russia do not and will not target essential exports of food and agricultural inputs to developing countries.” 

In reality, the growing food crisis can be linked to Russia’s decision to block all of Ukraine’s ports on the Black Sea, effectively halting all Ukrainian exports. “The food supply for millions of Ukrainians and millions more around the world has quite literally been held hostage,” Blinken said. UK Foreign Minister Liz Truss added, “It is completely appalling that Putin is trying to hold the world to ransom, and he is essentially weaponizing hunger and lack of food amongst the poorest people around the world.”

—Givi Gigitashvili, DFRLab Research Associate, Warsaw, Poland

On May 31, Russian communications regulator Roskomnadzor demanded that Google Play remove the Tor browser, a tool used to anonymize internet browsing, from its app store. Tor was banned in Russia in 2017 when the Saratov regional court ruled that the “anonymizer” makes it possible for an internet user to access illegal content in Russia. The ruling did not impact the availability of Tor in Russia until December 2021, when Roskomnadzor banned the Tor website. Weeks later, German public broadcaster Deutsche Welle’s Russian branch reported that Tor was still working in Russia due to user-generated “bridges” that served as proxies to help circumvent the blocks enacted by internet providers.  

In addition to Tor, Russian residents have used virtual private networks (VPNs) to access content restricted by Russian authorities. On May 29, Global Check, a service for monitoring outages and availability of online resources, said on Telegram that it had observed problems in some Russian regions with IPsec and IKEv2, the encrypted internet protocol technology used by VPNs. Global Check said that on some operators, including Rostelekom, one of Russia’s largest internet providers, “IPsec does not even pass between the server and the client in Russia. This is a big blow, including to corporate networks – many administrators of such networks are now urgently looking for solutions to bypass.”  

On June 2, Proton VPN tweeted, “The Russian government has blocked ProtonMail and ProtonVPN within Russia.” The company added, “It is likely that the local ISPs and the authorities are interfering with VPN connections, in which case it may not be possible for us to solve such issues.” 

This is not the first time Russian authorities have cracked down on VPNs. In March 2019, Roskomnadzor demanded that ten VPN services connect to federal government IT systems. Only one company, owned by Kaspersky Lab, complied with the request. In September 2021, Roskomnadzor demanded that six VPN services be blocked.

—Nika Aleksejeva, Lead Researcher, Riga, Latvia