As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report. 

Prigozhin threatens Wagner withdrawal from Bakhmut

Russia accuses Ukraine of conducting “terrorist attack” targeting Putin

Russia carries out attacks across Ukraine, attempting to break through Ukrainian defenses

In a Telegram video published on May 5, Yevgeny Prigozhin stood in front of a group of Wagner fighters and threatened to withdraw Wagner forces from Bakhmut on May 10. He added that they will “celebrate” Russia’s May 9 Victory Day “with the brilliance of Russian weapons” and then hand the positions over to the Russian defense ministry.   

The withdrawal threat came on the heels of a May 4 post on the Telegram channel Kyepka Prigozhina (“Prigozhin’s Hat”) featuring a graphic video of Prigozhin furiously addressing Russia’s military leadership over an ammunition shortage. In the video footage, Prigozhin stands in front of dozens of dead bodies and identifies them as Wagner Group fighters killed in Ukraine. Shouting, Prigozhin addresses Russian Defense Minister Sergey Shoigu and Armed Forces Chief Valery Gerasimov, “Shoigu! Gerasimov! Where the [expletive] is the ammunition?” Prigozhin says that Wagner is “lacking 70 percent of needed ammunition” and that those who are not providing them shells “will be in hell.” Continuing with more profanities, Prigozhin complains that Russian military leadership is sitting in their luxurious offices with their children living their best lives, while Wagner fighters are dying without ammunition in Ukraine.  

Prigozhin has repeatedly complained about not receiving sufficient ammunition from the Russian defense ministry.

—Eto Buziashvili, Research Associate, Tbilisi, Georgia 

On the night of May 3, CCTV footage showed two drones crashing into a flagpole located atop the Kremlin Senate Palace in Moscow. Later in the day, statements emerged from the Kremlin, alongside reporting from TASS and other pro-Kremlin outlets, referring to the action as a “terrorist attack” and “an attempt on the life of the president.” 

The two drones crashed into the flagpole of the Kremlin’s presidential residence, located next to Moscow’s Red Square, which at the time was closed for preparations ahead of the annual May 9 Victory Day parade. The drones reportedly crashed within fifteen minutes of each other, the first coming from the south of Moscow, and the second came from the east. 

Although the Kremlin brought forward no hard evidence to prove the incident was an assassination attempt, Russian politicians and media figures nonetheless called for retaliation. RT editor-in-chief Margarita Simonyan tweeted, “Maybe now it will start for real?” Former Russian president Dmitry Medvedev called for the elimination of Ukrainian President Volodymyr Zelenskyy. Pro-Russian Telegram channel BALTNEWS referenced a Ukrainian crowdfunding initiative to buy drones for Ukrainian forces, claiming that Ukraine is raising funds to launch new attacks on Russia. The initiative is connected to a Ukrainian drone manufacturer’s announcement offering a prize if someone could land a drone during Moscow’s May 9 Victory Day parade. Crowdfunding is not limited to the Ukrainian side; the Russian armed forces and Wagner Group also collect money for such drones using similar tactics. These allegations do not establish causality with the May 3 attack.  

Although no party has officially claimed responsibility for the attack, Ukrainian drone strikes have intensified over the past two weeks, with several disruptive actions carried out targeting trains in the Bryansk region, as well as strikes against oil units in Sevastopol, Crimea and Illinski, Russia. Ukraine appears to have increased its offensive actions in trying to disrupt supply routes to Russian forces. 

An investigative thread posted on Twitter by the open-source project GeoConfirmed raised the possibility of Ukrainian partisans having carried out the attack. However, as reported by Meduza, Russia uses effective GPS jamming systems in the area surrounding the Kremlin. This, in conjunction with the January 2023 deployment of defense systems next to President Putin’s offices and private residences, raises questions about the feasibility of such an attack. According to data from the map-based web project GPSJam, GPS jamming was enforced over the entire Moscow Oblast on May 2. In addition, the Guardian reported on the possibility of a false-flag operation led by Russia to excuse escalating violent measures against Ukraine.  

As the rumored Ukrainian counteroffensive remains an open question, the Russian military is trying to replenish its reserve, causing unrest amongst the civilian population in Russia. A post from the Russian Telegram channel VChK-OPGU quoted an unnamed source who claimed that “’unprecedented’ safety measures will be introduced by the Moscow municipal authorities,” including “patrolling the area of objects, educational institutions, prefectures and administration [buildings] by staff of local institutions.” They added that staff members are asked to report any “suspicious flying object as well as people, check seals of basements and attics,” indicating the possibility of enhanced monitoring for dissent.

–Valentin Châtelet, Research Associate, Security, Brussels, Belgium

Donetsk remains the most active sector of the frontline in eastern Ukraine, where the Russian army continues its attempts to break through Ukrainian defenses in the direction of Bakhmut and Marinka. Vuhledar is also a target of attacks, including an exchange of heavy artillery shelling between Ukrainian and Russian forces.  

The General Staff of the Armed Forces of Ukraine claimed it had repelled forty-one attacks from Russian forces on May 1. In addition, the Russian army tried to attack Severnoye and Pervomaiskoye in the direction of Avdiivka, and in the area of Bilohorivka and Novoselivka in the direction of Lyman. On May 3, Russian forces reportedly conducted more than forty offensive operations while attempting to advance near Bilohorivka, Bakhmut, Severnoye, Marinka, and Novomykhailivka. Between May 3 and the morning of May 4, the Russian army is believed to have carried out two missile strikes, sixty-eight airstrikes, and sixty-seven shellings with multiple launch rocket systems (MLRS) across Ukraine.  

On May 1, Russian forces launched a rocket attack on Kramatorsk, wounding one person and damaging a school, according to Ukrainian reports. Another rocket attack targeted Kramatorsk on May 4, damaging an educational institution and nearby residential buildings. There were no initial reports of casualties. 

In Russia, local media reported fires at the Ilyinsky refinery in the Krasnodar region and the Novoshakhtinsky oil products plant in the Rostov region, allegedly due to drone strikes. On May 4, Russian occupation authorities in Crimea reported a drone was shot down near Belbek.

—Ruslan Trad, Resident Fellow for Security Research, Sofia, Bulgaria