As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report. 

Alleged Ukrainian drones conduct attack in Moscow region

Georgian prime minister blames NATO for Russia’s war in Ukraine

One week after the incursion in the Belgorod region allegedly orchestrated by Russian Volunteer Corps, Russia’s border has become more permeable to Ukrainian attacks. Nearly a month after the first attack against the Kremlin’s Senate building in Moscow, another drone attack was reported in the morning of May 30.  

Reports posted on Telegram channel SHOT revealed footage taken by civilians showing drones and explosions in suburban Moscow. Throughout the day, Moscow Oblast Governor Andrey Vorobyov and Moscow Mayor Sergey Sobyanin confirmed several drones had struck various locations, which resulted in evacuation of civilians. According to Russian media outlet Mediazona, drones hit residential buildings in three different parts of the city. Two civilians were reportedly injured, although their condition did not require them to be hospitalized; there were no reported fatalities. 

Russian officials, including government spokesperson Dmitry Peskov, accused “the Kyiv regime” of orchestrating the attack as “retaliation for effective drone attacks against Kyiv’s decision-making centers on Sunday [May 29]”. This theory was also embraced by Russian President Vladimir Putin, whose comments also referenced the “effective work of the air defense systems.” Meduza reported that the Kremlin ordered Russian media to cover the drone attacks using specific talking points, though this has not been independently confirmed. In contrast, the Moscow Prosecutor’s Office recommended that bloggers and the media refrain from commenting on the incident, as unverified claims would be punishable by law. The Moscow Investigative Committee launched an investigation into the drone attacks as an act of “terrorism.”  

Meduza additionally geolocated drones that appeared in open-source footage, and estimated that between five to seven UAVs were downed in the Moscow area. Other unconfirmed reports from the opposition Telegram channel Baza claimed twenty-five drones took part in the attack, while Telegram channel SHOT reported on thirty-two drones. These figures remain unconfirmed, however. There were also conflicting estimates on the number of drones successfully intercepted by Russian air defense systems; while Russia’s defense ministry claimed only eight drones were shot down, SHOT reported nineteen drones as intercepted and destroyed. 

Although Ukraine has not claimed responsibility for the attack, one piece of footage points at an alleged UJ-22 airborne drone of Ukrainian fabrication. Despite circumstantial evidence which could indicate Ukraine’s direct involvement, presidential adviser Mykhailo Podolyak denied the allegations. Information posted by opposition media outlet Agentstvo quoting a tweet by Foreign Policy Research Institute Senior Fellow Rob Lee, indicated that the drones responsible for the May 30 attack appear to be the same ones that conducted another attack on May 26 in Russia’s Krasnodar region. 

Meanwhile, a report posted by Mediazona quoting a list published by Russian MP Alexander Khinshtein regarding the alleged locations of the drone suggested they may have targeted the houses of oligarchs in Moscow’s wealthy Rublyovka neighborhood. While this has not been confirmed, a separate report posted by the Telegram channel Baza alluded to an orchestrated attack in the same area.  

This is the second drone attack reported in the Russian capital city since the May 3 drone attack against the senate building of the Kremlin. The DFRLab reported on that incident and assessed that defense countermeasures, including a ban on flying commercial drones, would likely be enforced as a defensive measure. GPS interference data also indicated elevated levels of GPS interference on May 30 in the Moscow area. This information would be consistent with an assessment expressed by Russian businessman and former Roskosmos chief Dmitry Rogozin, who proposed suspending GPS across Russia.

Lastly, on June 1, multiple sources reported movements of the Russian Volunteer Corps and the Free Russia Legion in the villages Shebekino and Novaya Tavolzhaka in Russia’s Belgorod Oblast, adjacent to the Ukrainian border. The oblast’s governor reported shelling by Grad rockets and initiated an evacuation of the local population to Belgorod Arena stadium, in the region’s capital. The DFRLab will continue to monitor the situation.

—Valentin Châtelet, research associate, Security, Brussels, Belgium

Speaking at the GLOBSEC forum in Bratislava, Georgian Prime Minister Irakli Garibashvili claimed that NATO enlargement was to blame for Russia’s 2022 invasion of Ukraine, a long-standing Kremlin narrative used to justify Russia’s war in Ukraine. 

“I think everybody knows the reason… one of the main reasons was NATO, NATO enlargement,” Garibashvili said, adding that “Ukraine’s determination” to become a NATO member state had its “consequences.” According to recent polling by IRI, 80 percent of Georgians support the country joining NATO. 

Several Kremlin-owned and pro-Kremlin outlets quoted Garibashvili and used his remarks to reinforce pro-war narratives. The outlets also reported on additional comments made by the prime minister during GLOBSEC on how the Georgian government is “setting a good precedent by maintaining peace and stability in a turbulent environment.” 

The DFRLab has previously covered how the Georgian Dream-led government and the Kremlin spread similar narratives blaming the West for orchestrating protests in Georgia. 

—Eto Buziashvili, research associate, Tbilisi, Georgia