As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report. 

Belarus accuses Ukraine of plotting terrorist attack against Russian consulate

Identifying potential host sites for Russian tactical nuclear weapons

Individuals linked to Russian army form ‘angry patriots club’

Russian propaganda reaches Ukrainian users via Facebook ads

Poland and Ukraine sign cooperation deal for production of tank shells

On April 4, Belarusian state-controlled TV channel ONT aired a documentary titled “Loud failures of the Ukrainian special services in Belarus. Gaspar did not get in touch.” Reports from Belarus’ State Security Committee (KGB) informed much of the program, which asserted that, under the leadership of Ukrainian special services, a network of Russian and Belarusian citizens planned several terrorist attacks in the Belarusian city of Grodno. The alleged perpetrators reportedly planned to target several facilities, including the Consulate General of Russia, a military enlistment office opposite Zhiliber Park, a military unit in southern Grodno, and two oil depots. 

The KGB claimed that Vyacheslav Rozum, an alleged employee of the Main Directorate of Intelligence in the Ukrainian defense ministry, planned the attacks. Ukrainian authorities had not commented on the accusations at the time of writing. According to the documentary, Rozum asked Russian citizen Daniil Krinari, known as Kovalevsky, to form a network of people to carry out terrorist acts. Krinari was reportedly arrested in Grodno in December 2022 and extradited to Russia at the request of the Russian Federal Security Service (FSB). He was charged in Russia for cooperating with Ukraine and acting in the interests of Ukraine. The Belarusian KGB asserted that, before his extradition, Krinari managed to recruit at least two people, Russian citizen Alexei Kulikov and Belarusian citizen Vadim Patsenko. Kulikov had allegedly fled Russia in 2022 to avoid conscription and moved to Belarus. 

The ONT documentary includes interviews with Kulikov and Patsenko, who argue that Rozum asked them to take photos and videos of the target facilities in Grodno. Moreover, Patsenko argued that Vyacheslav tasked him with blowing up an oil depot with a drone. The program claims Ukrainian special services promised Kulikov and Patsenko $10,000 each. While Patsenko and Kulikov allege that Ukrainian security services were involved in the operation, the ONT program does not include concrete evidence to prove this claim. 

The documentary also contains an interview with Nikolai Shvets, the main suspect behind a February 26, 2023, attack on an AWACS A-50 Russian military aircraft at Machulishchy airfield in Belarus. Shvets is reported to be a Russian-Ukrainian dual citizen and served in the Ukrainian army. In the ONT interview, he claimed he was working with a person from the Ukrainian security service while planning the sabotage. The Belarusian independent media outlet Nasha Niva reported that Maxim Lopatin, one of arrested suspects in the Machulishchy attack, had a broken jaw when he filmed the ONT doumentary. Nasha Niva suggested that he was possibly beaten by Belarusian law enforcement authorities. Belarus arrested more than twenty people in connection to the February aircraft incident and announced on April 3 that the suspects were charged with committing an act of terrorism, for which the maximum sentence is capital punishment. However, the ONT program again provides no concrete evidence linking Shvets to Ukrainian security services. 

In addition, the ONT documentary aired on the same day that Alyaksandr Lukashenka met Sergey Naryshkin, the head of Russia’s Foreign Intelligence Service, in Minsk to discuss joint counterterrorism measures undertaken by Belarus and Russia. 

—Givi Gigitashvili, Research Associate, Warsaw, Poland

On March 28, Belarus confirmed it would accept Russian tactical nuclear weapons. The announcement came after Russian President Vladimir Putin announced on March 25 plans to store tactical nuclear weapons in Belarus, promising to build a nuclear weapons storage facility in the country. Putin made the comments after the United Kingdom said it would supply Ukraine with ammunition containing depleted uranium. “The heavy metal is used in weapons because it can penetrate tanks and armour more easily due to its density, amongst other properties,” Reutersreported. On April 4, Russian Minister of Defense Sergei Shoigu reported the transfer of Iskander-M tactical missiles, which are nuclear capable and have been utilized by the Russian military against Ukraine. 

Two days after the start of Russia’s invasion of Ukraine, on February 26, 2022, Belarus approved via referendum constitutional amendments to remove the country’s non-nuclear status. The constitutional change allows Belarus to host nuclear weapons for foreign states. 

Amidst the speculation surrounding Russia’s nuclear deployment to Belarus, the most pressing questions concern the potential location of airfields capable of nuclear deployment and which type of equipment is nuclear capable in terms of maintenance and modernization efforts.  

Along with the confirmed transfer of the Iskander-M missiles (a mobile, short-range ballistic missile system with a range of up to 500 kilometers), Sukhoi Su-25 fighter jets are also a top contender in the Russian and Belarusian aviation arsenals. This aircraft is capable of carrying two nuclear bombs, which the Russian military categorizes as “special aviation bombs.” In June 2022, Belarusian President Alyaksandr Lukashenka personally called on Putin to help upgrade and retrofit the Belarusian Su-25 fleet to be nuclear-capable. This resulted in a long-term project to enable Belarusian nuclear capabilities, legalize hosting Russian nuclear technology and nuclear-capable craft, enable joint-training programs for aviation sorties, and direct training for Belarusian pilots.

In conjunction with the Su-25’s capabilities against Ukraine’s current air defence networks and Russia’s non-strategic nuclear policy, Belarus’ acceptance of Russian tactical nuclear weapons can be viewed as escalatory. Video footage showed the Su-25’s capacity to evade Ukraine’s man-portable air defence system (MANPAD).

On April 2, the Russian envoy to Minsk announced that the nuclear weapons deployment would occur along Belarus’ western border. The exact location has not been specified, but Belarus has a number of bases along its western border, including Osovtsy, Ross, and Bereza. However, Lida is a primary staging base for the Belarusian fleet of SU-25s, and open-source researchers have confirmed a large presence of the aircraft on the base. Currently, Osovtsy is not one of the highly utilized bases in Belarus, but its proximity to the western border, especially in terms of proximity to Poland and the northern border of Ukraine, makes it a primary location to watch for potential signs of development, land-clearing operations, and heightened military activity.

—Kateryna Halstead, Research Assistant, Bologna, Italy

On April 1, former Russian army commander Igor Strelkov (also known as Igor Girkin) published a video announcing the formation of the “angry patriots club” (Клуб рассерженных патриотов). According to Strelkov, the club aims “to help Russian armed forces” and “meet the stormy wind that will soon whip our faces as one team.” In the video, Strelkov says that Russia “is moving toward military defeat” because “we got into a long, protracted war for which our economy turned out to be completely unprepared. Neither the army nor the political system was ready for it.” In a Telegram post, Strelkov said the club “was created two weeks ago. So far, organizational issues have not been resolved publicly.” Strelkov previously played a crucial role in forming a separatist movement in the Donbas region.

Vladimir Kucherenko, an Odesa-born Russian propagandist better known by his pen name Maksim Kalashnikov, said, “We are not afraid to criticize the actions of the government. Why? Because it can somehow help victory. Otherwise, they will do nothing, they will not move.” He called the Russian elite “looters,” “resource grabbers,” and “corrupts.” He predicted the war would turn into “carnage to death” and that the “corrupt Russian elites” would organize a coup that would “betray the country” by agreeing to Russia’s “separation” and “giving up of nuclear arms” in order to “earn the forgiveness of the West.” In 2015, the Ukrainian Ministry of Culture included Kucherenko in the list of Russians “threatening national security.”

Another figure in the video is Maksim Klimov, a pro-Kremlin military expert, who said, “The authorities do not know the real situation.” He added, “They do not hear nor see what is happening in the special military operation zone.” Klimov also did not rule out Russia’s defeat. 

—Nika Aleksejeva, Resident Fellow, Riga, Latvia

This week, the Center for Strategic Communications and Information Security (CSCIS) and Ukrainian civil society members reported that Facebook advertising campaigns are being used to spread negative content about Ukraine. The ads range from posts that claim “Romania wants to annex Ukrainian territories” to videos that claim “This is the end. There are no men to fight for Ukraine.” While these campaigns were quickly de-platformed and the pages sharing them were banned, the DFRLab was able to investigate some of the ads via the Facebook Ad Library. The DFRLab previously reported on Facebook ads promoting pro-Russia disinformation to Ukrainian users.

The ads included links to the website luxurybigisland.net, with some ads sharing variations of the URL, such as luxurybigisland.net/rbk or luxurybigisland.net/pravda. The website was built using the Russian website builder Tilda, and its the landing page featured German text that translates to, “Nothing that can’t be removed. We care for your textiles as gently as possible with the utmost care, iron and steam, so that you can enjoy your clothes for a long time. We care.” The same phrase appeared on the now-defunct Tilda-made website google-seo-top.com and the website of a German textile care company. Registration data for luxurybigisland.net is redacted, but WhoIs data for google-seo-top.com shows that the website was registered in Russia. Both luxurybigisland.net and google-seo-top.com include metadata, shown in Google results, that states, in German, “the USA are against the entire world.”

One URL shared in the ads, luxurybigisland.net/pravda, remained online at the time of writing. The URL redirects to a forged article mimicking the Ukrainian news outlet Pravda. The article shared in the ads never appeared on the authentic Pravda website, but its byline cited a genuine journalist working at the outlet. The DFRLab confirmed the article was a forgery by reviewing the journalist’s author page on the authentic Pravda website, reviewing Pravda’s archived section, conducting a Google search for the forged headline, and then a more specific website search via Google.

Visually the forged website is identical to the authentic one and even features links to contact information copied from the original website. However, the forged website’s image format is different. The text of the forged article claims that the Ukrainian economy is heavily damaged and that “continuation of the war will lead to even greater losses in the economy.” The data shared in the article appears to be copied from multiple media sources and is not false, but the article’s framing contains pro-Russian sentiments as it calls for Ukraine’s surrender.

A second forged article, discovered by CSCIS, was shared on the now-offline URL luxurybigisland.net/RBK. The article mimicked the website of the reputable Ukrainian outlet RBC. 

Meta itself has taken – and continues to take – action against similar cross-platform, pro-Russia networks that push users to websites designed to impersonate legitimate news organizations. The DFRLab could not tie its identified assets to those previous Meta actions, but there is some probability that they were related given the similarity of behavior.

A Facebook page with “Cripto” in its name shared some of the ads. The DFRLab identified another Facebook page with the word Cripto in the name sharing pro-Kremlin narratives via Facebook ads. The ads pushed a false story claiming there was a “riot in Kyiv over losses.” CSCIS previously debunked another narrative pushed by a similarly named page that also fomented anti-Ukrainian military sentiment.

—Roman Osadchuk, Research Associate

During Ukrainian President Volodymyr Zelenskyy’s visit to Poland, Polish manufacturer Polska Grupa Zbrojeniowa and Ukroboronprom signed a cooperation agreement for the joint production of 125-mm tank ammunition. The agreement assumes that the deployment of new production lines will be in Polish cities and the agreement indicates that they plan to produce a large amount of ammunition for 125-mm guns. The decision to start production in Poland was made due to the high risks of Russian missile attacks on production facilities if they were to be based in Ukraine. In place of locating the production in the country, the Ukrainian side will provide technologies and highly qualified specialists with experience in production. This will be the second factory that will produce 125-mm tank shells.

The supply of shells is of particular importance to Ukrainian forces, which are preparing a counter-offensive in southern and eastern Ukraine as heavy fighting with the Russian army continues in the Bakhmut and Donetsk regions.

Separately, German manufacturer Rheinmetall is building a service center for Western military equipment used by Ukraine’s armed forces in Romania, Reuters reported on April 2. The construction for the center is already underway in the Romanian city of Satu Mare, close to the country’s border with Ukraine. The hub is expected to open later this month. 

This development is happening against the background of diplomatic activity and statements. Ukraine is not ready to sign any peace agreement with Russian President Vladimir Putin, but the war could end as early as this year, according to an April 5 interview with  Ukraine’s Minister of Defense Oleksii Rezniko, who said, “I think this war will end soon. Of course, I would like it not to start, but I personally believe in this year as a year of victory.”

Rezniko also commented on a statement made in March by Czech Republic President Petr Pavel, who claimed that Ukraine had only one chance to conduct a successful counter-offensive this year. “I think that the president of the Czech Republic now speaks more like a military man than a politician, and the logic of the military is such that they constantly calculate the worst options. But even if this is his assessment, it is subjective, and he still lays down useful for us. The message is that European countries should unite more powerfully and strengthen assistance to Ukraine,” said Reznikov. Later, Andriy Sybiha, an adviser to Zelenskyy, told the Financial Times that Kyiv is willing to discuss the future of Crimea with Moscow if its forces reach the border of the Russian-occupied peninsula.

—Ruslan Trad, resident fellow for security research, Sofia, Bulgaria