As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report. 

Russia escalates Avdiivka, Marinka front lines; Belgorod accidentally bombed by a Russian jet

Russia’s Bashkir battalions form a new motor rifle regiment as more are sent to Ukraine to replenish Russian forces

Russian mobilized soldiers report signs of coercion to join Wagner in support of Bakhmut offensive

Russia cancels Victory Day parades and moves “Immortal Regiment” marches online

Pro-Kremlin experts use false story to claim military upper hand over Ukraine and NATO

Wagner members claim killing of Ukrainian civilians

US investigates ex-Navy officer allegedly behind notorious pro-Russia social media accounts

The offensive actions of the Russian army in Eastern Ukraine continue, as well as the defensive efforts of the Ukrainian forces. In recent days, there has been an escalation of attacks on Ukrainian positions in the direction of Marinka, Avdiivka, and Bakhmut. 

On April 17, the General Staff of the Armed Forces of Ukraine reported that more than seventy attacks by the Russian army were repulsed during the day. The most difficult areas to defend remain Bakhmut and Marinka. Offensive actions were registered in the direction of Avdiivka, with separate attacks carried out in the Kupiansk and Lyman areas. The Russian forces continued the assaults on Bakhmut and Marinka on April 18 and April 19 on par with offensive operations in the Avdiivka area, where Ukrainian forces repulsed attacks in the areas of six settlements. Between April 18-19, the Ukrainian army recorded more than sixty Russian attacks.

According to British intelligence’s April 18 assessment, even though heavy fighting continued in the directions of Avdiivka and Marinka, the Russian command still gave priority to the Bakhmut front. The front line there has become relatively stable, running along the railway line, as Ukraine’s soldiers are effectively resisting attempts by Russia to encircle the town. The question of sending reinforcements to Bakhmut is acute for both sides, since the Ukrainian command wants to attract as many units as possible for a future offensive, while the Russian army wants to form an operational reserve. On April 20, Russian forces reportedly attempted to advance near Kreminna and Serebryanske Forest, as well as Khromove, Vodyane, Pervomaiske, Pobieda, and Vuhledar. 

On the night of April 20, the Russian army attacked the south and east of Ukraine with Shahed attack drones. Ten out of eleven drones were shot down, the Ukrainian East Air Command reported. Sirens for Russian attacks were reported in Chernihiv, Cherkasy, Kyiv, Odessa, Rivne, Sumy, Poltava, and other regions of Ukraine.    

Meanwhile, Telegram users reported an explosion in Belgorod, Russia, near the Ukraine border, on the night of April 20-21. Images shared online show an explosion crater near a residential area of the city. There were reports moments before the explosion of Russian bombers launching a guided bomb in the direction of Kharkiv. At first, it was unclear whether the explosion was the result of a failed Russian attack that hit Belgorod instead of Kharkiv, or whether it was a drone attack from the Ukrainian side. Later, a Russian Ministry of Defense statement that was re-shared by Ukrainian sources said, “On the evening of April 20, during the flight of a Su-34 aircraft over the city of Belgorod, an abnormal derailment of aviation ammunition occurred.” The explosion was apparently large and caused material damage.

—Ruslan Trad, Resident Fellow for Security Research, Sofia, Bulgaria

Radiy Khabirov, head of the Republic of Bashkortostan, announced on April 10 that the republic’s volunteer formations would undergo reformation as part of the creation of a new motor rifle regiment. Like many ethnic regions of Russia, the Republic of Bashkorstostan has been subjected to targeted military recruitment. These volunteers, alongside contract soldiers and mobilized military personnel of the Russian reserve, are constantly sent to Ukraine to replenish the regular Russian forces.

According to the federal media outlet FedPress, the idea was suggested by the commanders of the two national battalions, “Northern Amurs” and “Dayan Murzin,” created in Bashkortostan at the beginning of March. The newest regiment would comprise several motor rifle divisions and an artillery division, totaling between 900 to 1,500 men. Moreover, Bashkortostan has recently been pushing for more servicemen to be deployed to Ukraine. During an April 12 ceremony in the regional capital city of Ufa, Bashkirs celebrated the creation of yet another volunteer formation before it was deployed to Ukraine. The new volunteer formation, “Vatan,” Bashkir for “Fatherland,” was created at the beginning of 2023; estimates indicate it could comprise around 720 men. This would bring the number of volunteer formations in the republic to six, including four volunteer formations named after war heroes and local figures, and two volunteer battalions like “Vatan” and “Northern Amurs.” 

As the Russian State Duma recently approved a new e-drafting bill and is planning to conduct testing in Moscow and Saint Petersburg during its annual spring conscription, replenishment of military forces has become a top priority for the Kremlin. The DFRLab previously reported on regional ad campaigns targeting national minorities, including the Udmurt population. A new Bashkortostan-hosted recruitment website called BashBat  – short for “Bashkir Battalion” – launched on April 17. The domain’s WHOIS record directly points to the Bashkir Ministry for Digital Transformation. Like the Udmurt portal Delomuzhchin.rf (деломужчин.рф), BashBat was advertised in the press using the local Udmurt language, as well as on the Russian federal resource portal for recruitment, Ob’yesnyayem, in both Russian and Bashkir.

–Valentin Châtelet, Research Associate, Security, Brussels, Belgium

An April 14 article posted by independent Russian-language media outlet Astra reported that hundreds of Russian mobilized soldiers had re-enlisted with Wagner Group. News outlets inside Russia described the situation as “volunteer enrolment.” However, information posted by Twitter user @Tatarigami_UA and subsequent reporting indicate that these episodes might have occurred forcibly. The report by Astra pointed at a video where a mobilized soldier declared that Wagner had been training mobilized personnel. Satellite imagery released by that same account points at a military training facility in Kursk, where instructors are reportedly “experienced Wagner soldiers.”

Later reports indicated one hundred soldiers disappeared after being sent into Ukraine’s Luhansk Oblast and refusing to sign Wagner contracts. Astra’s leaked texts indicate the soldiers were forced to give up their phones and threatened by thirty Wagner representatives with rifles at the Stakhanov railway station. Other signs of coercion were brought to the attention of the Russian MoD after six mobilized soldiers from Yakutia informed their families they had been forcibly recruited by another PMC. In an April 19 post, Wagner Group financier Yevgeny Prigozhin denied these accusations. 

Although user @Tatarigami_UA reports that the instructors are said to be part of a PMC called Volk (“Wolf”), the DFRLab could not confirm this. However, job ads analyzed in a previous DFRLab report mentioned instructors as “participants of the special military operation.” In their accusations of coerced re-enlistment, mobilized soldiers from the Sakha Republic also pointed to yet another subsidiary of the Wagner Group, called PMC Veteran.

–Valentin Châtelet, Research Associate, Security, Brussels, Belgium

Russia’s Ministry of Defense (MoD) canceled May 9 Victory Day parades in annexed Ukrainian territory and adjacent Russian territory because of security concerns. “Immortal Regiment” marches were moved from their usual offline space to online. Previously, Victory Day celebrations and parades have traditionally been a significant event in Russia. 

Citing the Russia-installed head of annexed Sevastopol city Mikhail Razvozhaev, TASS reported on April 20 that it was the MoD’s decision to cancel the parade. Earlier, on April 12, Russia-installed head of Crimea Sergey Aksenov stated that parades were cancelled across annexed Crimea “due to security concerns.” Victory Day parades were also canceled in Ukraine-neighboring Russian regions of Kursk and Belgorod. In Krasnodar Krai the parade will only be held in the city of Novorossiysk. According to the governor of the Belgorod region, such a measure was necessary in order “not to provoke the enemy with a large accumulation of equipment and military personnel.”

UkraineAlert has named equipment shortages as one of the possible reasons behind the Kremlin’s decision to cancel parades. According to the report, “[N]umerous commentators have speculated that Moscow is increasingly short of tanks and is understandably eager to avoid highlighting the scale of the losses suffered by the Russian army in Ukraine.”

Similarly there will be no traditional organized march of the “Immortal Regiment” this year. The organizers have moved the march online, which previously happened twice during COVID pandemic years in 2020 and 2021. They told RBC that Russian regions will be posting “portraits of heroes” in interactive online formats. 

Citing Russian Defense Minister Sergei Shoigu, Meduza reported that military parades are planned to be held in twenty-eight Russian cities, including Moscow, where “more than 10,000 military personnel are planned to participate,” with enhanced security measures.

—Eto Buziashvili, Research Associate, Tbilisi, Georgia

Pro-Kremlin media continue to amplify a false story about the Russian army allegedly destroying a bunker in Lviv occupied by NATO officers with a Kinzhal supersonic missile. Snopes, the US fact-checking outlet, debunked the story as early as April 3, labeling it as “a lazy piece of obvious propaganda.” Russia previously attacked Ukraine with Kinzhal missiles on March 9 and hit two residential building in Lviv, according to Ukrainian fact-checking outlet StopFake, which debunked the story on April 19. There is no evidence of any underground NATO command center in Lviv. Both fact-checking outlets argued that it did not make sense to have such command center in Lviv, which around one hundred kilometers from Poland, a NATO member state. 

The first mention of the rumor was a March 1 report published by “Cossack Colonel Yuri Kominyenko” on the fringe website Cairns News. According to Snopes, the Greek outlet Pronews made the claim “regain virality” starting on March 12. From April 14 to April 18 pro-Kremlin media outlets resurfaced the story by citing pro-Kremlin experts who voiced contradicting numbers of NATO’s alleged casualties.  For instance, TopNews and Sibnet.ru cited Nikolay Sorokin, a pro-Kremlin political expert saying that “Kinzhal destroyed 300 officers from NATO countries.” 

Ekonomika Segodnya, ZOV Kherson, Lenta.ru, and Tsargrad cited Viktor Baranets, an author on Komsomolyskaya Pravda, who asserted, “Kinzhal destroyed secret bunker with 200 NATO and Ukrainian Armed Forces’ officers.” Baranets also claimed with no evidence that the US embassy called the representatives of Ukrainian Ministry of Defense and Armed Forces to “reprimand” them for “poor control center security” and that “capitals of NATO countries are silent about the incident because they are ashamed to admit this biting slap from Moscow.” 

Pravda.ru and RG.ru cited Anatoly Matveychuk, a military expert who declared, “Kinzhal destroyed 160 NATO and Ukrainian Armed Forces’ officers in Ukrainian bunker in Lviv.” Matveychuk reportedly suggested this led to Ukraine to cancel its plans for a spring counteroffensive. 

—Nika Aleksejeva, Resident Fellow, Riga, Latvia

On April 17, a Russian human rights project released testimonies of two Russian former prisoners, Azamat Uldarov and Alexei Savichev, who allegedly fought in Ukraine within the ranks of Wagner Group. In a conversation with Gulagu.net, Savichev and Uldarov reported the killing of Ukrainian civilians, including children, allegedly on personal orders from Wagner founder Yevgeny Prigozhin. The Ukrainian Prosecutor General’s Office launched an investigation into Uldarov and Savichev’s confessions.

Savichev argued that Wagner mercenaries in Bakhmut received an order to kill everyone over fifteen years old; he admitted killing at least ten teenagers and more than twenty unarmed Ukrainians in February 2023. In addition, Savichev claimed that he personally witnessed the killing of about seventy Russian former prisoners who served in Wagner and refused to comply with orders. He also asserted that he blew up a pit full of bodies of dead and wounded citizens of Russia and Ukraine then subsequently set fire to the remnants of dead people to hide traces of the crime. Uldarov, meanwhile, said that he killed minors in Bakhmut and Soledar and admitted that one of his victims was a girl who was “five or six” years old. 

Gulagu.net also published documents allegedly proving that Azamat Uldarov and Alexei Savichev were previously pardoned by presidential decree in September 2022 then sent to the front line in Ukraine. The founder of the Gulagu.net project, Vladimir Osechkin, argued that both of them are currently located on the territory of Russia and that they gave their testimony voluntarily. 

Following the publication of these claims, Yevgeny Prigozhin publicly addressed Alexei Savichev on April 28 and stated that he had been searching for him over the previous twenty-four hours. Prigozhin demanded that Savichev contact Wagner and explain “why he spoke falsehoods, who was behind it, how he was blackmailed.” Prigozhin promised that Savichev will be “left alive and unharmed” if he is willing to explain in person what took place. The events discussed by the ex-prisoners have not been verified independently. 

—Givi Gigitashvili, Research Associate, Warsaw, Poland

The Wall Street Journal identified the individual allegedly behind the pro-Russian social media persona “Donbas Devushka” as Sarah Bils, a thirty-seven-year-old US Navy veteran from New Jersey who served as an aviation electronics technician at Whitby Island in Washington state. The US Department of Justice is currently investigating her for allegedly disseminating leaked classified documents. 

Donbas Devushka allegedly presented herself to her followers as a Russian Jew from occupied Luhansk. Their Twitter and Telegram accounts largely grew after Russia invaded Ukraine in February of last year. The accounts continuously spread Kremlin propaganda, with their Telegram channel amplifying graphic content of possible war crimes by Wagner Group.

According a Bellingcat investigation, Donbas Devushka’s Telegram account was found to be the first to have shared leaked intelligence currently under investigation by the Justice Department and Pentagon. According to the Wall Street Journal, Bils played a key role in spreading the leaked documents, though she has denied these claims. Bils admitted she was the administrator of Donbas Devushka, however; she also said that there were fourteen other people involved in running the network but refused to name them.

Bils also ran a tropical fish business, which in part led to her discovery. During her stint in the US Navy, Bils imported tropical fish from Poland. According to Malcontent News, she appeared in a video from the Aquarium Co-op podcast; Malcontent and the pro-Ukrainian group North Atlantic Fella Organization (NAFO) then matched her voice and home décor with footage from the Donbas Devushka account. 

—Ani Mejlumyan, Research Assistant, Armenia