As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report. 

Putin illegally annexes Ukrainian territory

Ukraine attempts to encircle Lyman; civilian convoy hit in Zaporizhzha

Russian men resist mobilization across the country

Russia-based Facebook operation targeting Europe with anti-Ukraine messaging revealed

Kremlin spins quotes from the Western leaders to blame the US in Nord Stream 1 and Nord Stream 2 gas pipeline explosions

Thousands of Russian citizens flee to neighboring Georgia, raising security concerns among Georgian civil society

On September 30, Russian President Vladimir Putin officially annexed four Ukrainian oblasts, including Donetsk, Luhansk, Zaporizhzhia, and Kherson, effectively incorporating all of southeastern Ukraine into Russia. “There are four new regions of Russia,” he told the assembled audience at the Kremlin, and insisted that annexing the regions was “the will of millions of people.” After a brief history lesson in which he lamented the collapse of the Soviet Union as a “catastrophe,” he called for Ukraine to accept a ceasefire. Putin was open to negotiating a settlement, he continued, but added that he would defend the newly annexed territories “by all means available.” In reference to the possible use of nuclear weapons, he said the US “created a precedent” for their use when it bombed Hiroshima and Nagasaki in 1945. 

Prior to the annexation ceremony, Reuters and the Guardian reported Kremlin spokesman Dmitry Peskov discussing how Russia would “’de jure’ incorporate parts of Ukraine which are not under the control of Russian forces into Russia itself.” Russia would therefore consider Ukrainian attacks on annexed areas that Russia does not even control as an attack on Russia itself. 

Response to today’s developments have been swift. UK Defense Minister Ben Wallace declared on Twitter, “The UK will never recognise Russia’s illegal annexations in Ukraine.” 

Estonian Prime Minister Kaja Kallas lambasted the move as a “land grab” and put the annexation into stark geographic terms: 

US President Joe Biden also condemned Putin’s annexation move. “Make no mistake: these actions have no legitimacy,” he said in a statement. “The United States will always honor Ukraine’s internationally recognized borders.”

—Andy Carvin, Managing Editor, Washington DC 

Russian and Ukrainian analysts on Telegram are predicting that Lyman could fall into Ukrainian control, as Ukraine continues its efforts to encircle the Russian-controlled city. A Ukrainian armed forces spokesman told Ukrainian outlet Suspilne that the encirclement of Lyman is “nearing its completion.” There are unconfirmed reports that Russian forces are attempting a pullback from the city.  

In recent days, Russian army shelling was most active in the front areas of the front near Bakhmut and Pokrovsk. In the Bakhmut area, Toretsk and Svitlodarsk came under fire. There is a Ukrainian breakthrough reported in Stavky, the liberation of Yampil which reportedly fell under Ukrainian control on this morning, and a blockade of Drobysheve, which is important for the Russian defense of the city. 

Outside of Zaporizhzhia, a missile struck a civilian convoy of residents attempting to relocate. Initial reports from the scene suggest a death toll of more than two dozen people, but at the time of writing had not been confirmed. 

The news from the front comes against the background of the Kremlin’s announcement to annex four more areas of Ukraine after self-styled referendums condemned by Ukraine and the West as a sham. It is worth noting that Russia does not fully control any of the four regions it has decided to annex. Although most of Luhansk remains under Russian control, Moscow only controls 60 percent of Donetsk. The capital of the southern region of Zaporizhzhia is under the control of Ukraine’s government while the frontlines in Kherson remain unstable.

—Ruslan Trad, Resident Fellow for Security Research, Sofia, Bulgaria 

—Andy Carvin, Managing Editor, Washington DC 

Against the backdrop of Ukrainian pressure on the front lines in the Donbas, signs of resistance in the Russian Federation against the announced mobilization continue to emerge. Authorities detained an individual after an arson incident took place at the military enlistment office in Uryupinsk. At least fifty-four arson incidents have been document documented in recent weeks, according to Russian independent media outlet Mediazona.  

On September 26, a Russian man lit himself on fire at a bus station in Ryazan while yelling he didn’t want to take part in the Ukraine war. In another incident that same day, a commander was killed at a military enlistment office in eastern Russia. A video emerged of a Russian man opening fire and killing the commander in the city of Ust-Ilimsk, who was also the head of the local draft committee. 

Meanwhile, the number of Russians attempting to leave the Russian Federation has increased since Putin declared a partial mobilization. The Finnish Border Guard, for instance, reported an increase of 37 percent on September 24 compared with the previous weekend at the immigration checkpoints Salla and Raja-Jooseppi in Lapland. Further south, where Finland has several cross-border roads to Karelia and the St. Petersburg region, traffic was reportedly higher. A total of 38,444 Russian citizens entered Finland at land border checkpoints last week, the Border Guards stated. Considering the mass exodus from Russia, Novaya Gazeta reported that 261,000 men had left the country since mobilization, according to the FSB; most had fled to Georgia, Kazakhstan, and Mongolia. Especially dire is the situation on the Georgian border, where the Russian army even established mobile barricades to stop those of military age from departing the country. Several outlets reported that Russian authorities could close the border for military-aged men as soon as this week. These reports also suggested that Putin will make the final decision on a departure ban and the possible introduction of martial law prior to addressing both chambers of parliament today.  

Some Russian officials are going even further to convince more recruits. Kirill Kabanov, a member of the Presidential Council for the Development of Civil Society and Human Rights, proposed to depriving residents from Central Asia of Russian citizenship if they refuse military service. This proposal would also affect people who had received citizenship within the last ten years, as well as their immediate family, thus raising the possibility that they would be stripped of their citizenship. 

Russian Muslims announced protests against the mobilization on September 30 after Friday prayers. They also planned to express solidarity with Dagestan, whose population was among the first to protest earlier this month. In recent days, over 100 people have been arrested during protests in the Dagestani capital of Makhachkala, and tensions between residents and security forces continue to rise. Arrests were also reported in the Republic of Tuva following local protests.

—Ruslan Trad, Resident Fellow for Security Research, Sofia, Bulgaria 

In August 2022, the DFRLab discovered a network consisting of six inauthentic Facebook pages purchasing ads to promote posts about Germany’s impending energy crisis and called for the lifting of sanctions on Russian gas imports. An independent review of these assets by Meta, along with others separately identified by German media, led to the discovery of a much larger network consisting of 1,633 accounts, 703 pages, twenty-nine Instagram profiles, and one Facebook group. These assets promoted Kremlin interests beyond Germany, also targeting France, the UK, Italy, Ukraine, and Latvia.  

It was “the largest [network] of its kind we’ve disrupted since the war in Ukraine began,” Meta said in its report. 

The network exhibited an overarching pattern of targeting Europe with anti-Ukraine narratives and expressions of support for Russian interests. It manifested multiple indicators of previous Russian influence operations, including the amplification of pro-Kremlin and anti-Ukraine or anti-Western narratives; the paid promotion of content; calls for action on petition sites and other forms of audience engagement; amplification across multiple languages reflecting inaccurate and non-native grammar; impersonating real people or institutions or creating fake ones; and generating names with detectable patterns. 

The timing and narratives of the posts coincided with policy decisions made by the targeted countries pages regarding the war in Ukraine. For example, German Chancellor Olaf Scholz went to Canada for talks about liquified natural gas supplies on August 21, 2022. On August 22 and 23, five pages in the network posted a cartoon portraying Europe as a character named “Dr. EuroReich,” who is seen cutting Russian gas to a patient representing Germany’s economy. Similarly, in June 2022, France completed its first delivery of Caesar self-propelled howitzers to Ukraine. At the end of that month, four pages posted an image of the howitzer and suggested that France was getting itself involved in war crimes allegedly committed by Ukraine. 

Meta concluded that the network originated in Russia and spread out across multiple platforms beyond Facebook and Instagram. It spent the equivalent of about $105,000 in advertising on Facebook and Instagram, primarily in US dollars and euros. 

Some of the Facebook pages within the network posted links to websites of Russian origin, as well as links spoofing the domains of legitimate media organizations, including Bild and Welt in Germany, 20minutes in France, ANSA in Italy, RBC in Ukraine, and the Guardian in the UK. EU DisinfoLab, together with the Swedish non-profit foundation Qurium Media Foundation, were able to identify fifty-six spoofed domains that were part of the network.  

Read the full report

—Nika Aleksejeva, Lead Researcher, Riga, Latvia

Maria Zakharova, spokesperson for Russia’s Ministry of Foreign Affairs (MFA), demanded on her Telegram channel that US President Joe Biden “answer whether the United States realized its threat on September 25 and 26, 2022, when an emergency occurred on the three lines of Nord Stream 1 and Nord Stream 2, which is tentatively qualified as a pipeline rupture, suggesting that they were blown up.” Zakharova referred to a press conference on February 7, 2022, when Olaf Scholtz visited the White House. During the that meeting, President Biden said, “If Russia invades, that means tanks or troops crossing the — the border of Ukraine again, then there will be — there will be no longer a Nord Stream 2.” After a journalist asked to clarify on how exactly the US will stop Nord Stream 2, which is under German control, Biden said, “We will — I promise you — we will be able to do it.” 

Zakharova took out the video fragment of the press briefing and posted it on her Telegram. The post garnered more than 850,000 views, 85 shares to other Telegram channels and chats, 3,6000 forwards and 492 comments, according the TGStat.ru, a Telegram analysis tool.

Alternative für Deutschland (AfD), a German right-wing political party, used Facebook advertisements to promote the video fragment with Biden suggesting that the US might be behind the attack. 

Zakharova also used a tweet by Radek Sikorski, the former Polish Minister of Foreign Affairs, now Member of the European Parliament, in which he posted the bubbling surface of the Baltic Sea and wrote, “Thank you, USA.” Sikorski’s Tweet was amplified by the Russia’s MFA on Twitter to further suggest US involvement in the gas pipelines’ disruptions.

Sikorski later deleted this tweet but left another tweet celebrating the gas leak. Rafał Trzaskowski, the mayor of Warsaw, attempted to explain that what Sikorski might have meant was thanking the US for warning that such gas pipeline explosions might happen. Previously, on September 28, 2022, Spiegel, the German mainstream media outlet, wrote that the CIA warned Germany about possible attacks on the gas pipelines.  

Russian gas deliveries to Western Europe through Nord Stream 1 pipeline were among the Kremlin’s leverage over sanctions put on Russia after Russia invaded Ukraine. On September 5, 2022, Russian state-owned Gazprom company shut down Nord Stream 1 due to “necessary repairs.” Nord Stream 2 was never in use, as Germany decided to freeze the project amid Russia’s recognition on two breakaway regions in Eastern Ukraine. Putting both pipelines out of order does not change much for Western European countries in terms of gas supply, while the Kremlin has lost direct access to a large part of the European gas market.

—Nika Aleksejeva, Lead Researcher, Riga, Latvia

Putin’s partial mobilization order on September 21 has led to a second wave of mass exodus from Russia. Tens of thousands of Russian citizens have left the country. According to statistics published by the Ministry of Internal Affairs of Georgia, up to 79,000 Russian citizens entered Georgia between September 17–26, out of which 53,000 Russian citizens entered Georgia since September 21, after the mobilization announcement in Russia. This is the second large wave of Russian influx in Georgia. The first wave followed shortly after Russia invaded Ukraine on February 24 and peaked in summer.  Between March and August, up to 800,000 Russian citizens entered Georgia. The visa-free regime was introduced by the previous Georgian administration. The Georgian Dream-led government has expanded the visa-free stay in the country from ninety days to one year.  

Footage emerged on social media platforms depicting thousands of Russian citizens trying to cross the border with Georgia at the Upper Lars border crossing. Maxar Technologies published satellite imagery from September 27 depicting a sixteen kilometer traffic jam near the Lars border checkpoint. The Insider also published drone footage of long lines near the border crossing. 

The latest influx of Russian citizens has raised concerns among civil society actors and democracy activists in Georgia. On September 28, activists held a protest rally near the Georgia-Russia border demanding closure of the checkpoint. Citizens also started to mobilize on Facebook. A Facebook group called “ჩავკეტოთ ლარსის გზა“ (“Let’s block the Lars road”) was created on September 27 and garnered 9,300 members in two days. The group has already organized two events on Facebook to demand the closure of the Lars checkpoint.  

The Georgian Dream-led government has not been responsive to the situation. Earlier in August, Georgian Dream party chairperson Irakli Kobakhidze accused opposition parties, media, and civil society actors of holding “xenophobic” and “chauvinistic” attitudes towards Russian citizens. On September 27, the Interior Minister Vakhtang Gomelauri stressed that about 60 percent of Russian entrants had already left the country. “Russians have always entered Georgia…why should this become a problem today?” – he added. 

On Telegram, the increase in mentions of “Ларс” (Lars) following Putin’s September 21 “partial” mobilization announcement peaked on September 27, with 4,502 mentions and up to 88 million views.

Various Russian Telegram channels and groups with “Lars” in their titles have been growing audience and garnering engagement. The groups include “ВЕРХНИЙ ЛАРС 🇬🇪 ЧАТ” (Upper Lars 🇬🇪 chat), ВЕРХНИЙ ЛАРС 🇬🇪 ЧАТ | ГРУЗИЯ (Upper Lars chat 🇬🇪 | Georgia), ВЕРХНИЙ ЛАРС 🇬🇪 (Upper Lars 🇬🇪), among others. The subscribers of the channels and groups have been sharing information about where to get products, water, and petroleum; advertising the private services of transportation from Russia to Georgia; posting images and videos of people crossing Georgian border; and giving various tips to each other. 

For instance, ВЕРХНИЙ ЛАРС 🇬🇪 ЧАТ | ГРУЗИЯ (Upper Lars chat 🇬🇪 | Georgia) had around 11,000 members at the end of August; by late September the number reached 36,000.

—Sopo Gelava, Research Associate, Tbilisi, Georgia

—Eto Buziashvili, Research Associate, Washington DC