As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report. 

Military camps for Wagner reportedly under construction in Belarus

Pro-Kremlin sources spreading disinformation to justify missile strike in Kramatorsk

Kremlin blames Colombian victims for the injuries they sustained in the Kramatorsk attack

Prigozhin’s online assets reportedly blocked in Russia

Questions abound over the future of Wagner contracts and Prigozhin-linked businesses in Africa

Analysis: With Wagner mutiny, Russia’s loses plausible deniability about its involvement in Africa

Investigation sheds light on how Putin’s childhood friends allegedly evade sanctions

Russian independent outlet Verstka reported on the construction of camps for Wagner forces near Asipovichi, Mogilev Oblast, located in Belarus approximately two hundred kilometers from the Ukraine border. According to Verstka’s local forestry source, the area will cover 2.4 hectares (5.9 acres) and accommodate eight thousand Wagner fighters. The source also claimed that there will be additional camps constructed. Family members of Wagner fighters also confirmed to Verstka that they were deploying to Belarus. 

Radio Svaboda, the Belarusian-language edition of Radio Liberty, reviewed satellite imagery from Planet Labs that suggested signs of expansion at the Unit 61732 military camp adjacent to the village of Tsel, twenty kilometers northwest of Asipovichi. The outlet interviewed Ukrainian military analyst Oleg Zhdanov, who suggested it was “too early to tell” as to whether the military camp’s expansion is specifically for Wagner forces. “Very little time has passed to start building a camp specifically for the Wagnerites—it’s unreal,” Zhdanov told Radio Svaboda.

On June 27, in his first speech after the Wagner mutiny, Russian President Vladimir Putin reaffirmed the deal that ended the rebellion on June 24 in which Yevgeniy Prigozhin would relocate to Belarus. Putin praised those Wagner fighters who did not participate in the revolt and said they could sign a contract with the Russian Ministry of Defense of other services. He added that other mercenaries who do not want to join could go either home or follow Prigozhin to Belarus.

—Eto Buziashvili, research associate, Tbilisi, Georgia

Pro-Kremlin sources denied Russia targeted civilians when a missile struck a crowded pizza restaurant in Kramatorsk, killing at least twelve civilians and injuring more than fifty others. According to this narrative, RIA Pizza was actually a military base hosting US and Ukrainian soldiers. To support the claims, pictures taken after the strike were published on Telegram and Twitter.

To support the claim that soldiers of 101st Airborne Division were located at the pizza “military base,” pro-Kremlin sources circulated grisly footage of the attack aftermath recorded by freelance journalist Arnaud De Decker. The clip shows a man wearing a morale patch of a US flag with the words “Always Be Ready: 5.11 Tactical.” 5.11 Tactical is a military apparel company that sells branded merchandise, including morale patches, worn to offer support to various causes and slogans but not used official unit patches. Various types of 5.11 Tactical’s “Always Be Ready” patches are readily available for purchase online.

Similarly, another post from Aleksandr Simonov’s Telegram channel that a man wearing an 101^st Airborne t-shirt was a member of the US Army division. These t-shirts are also readily available from online retailers.

—Sayyara Mammadova, research assistant, Warsaw, Poland

In addition to pro-Kremlin accusations that the Kramatorsk attack targeted a base housing US Army soldiers, Kremlin influencers also targeted citizens of Colombia, three of whom were injured in the attack, for being at the site of the incident. Colombian President Gustavo Petro said the attack targeted “three defenseless Colombian civilians” in violation of the protocols of war and called for the Colombian Foreign Ministry to submit a note of diplomatic protest to Russia. While the Kremlin acknowledged launching the attack, it insisted the assault struck military personnel rather than civilians.

The three Colombian citizens injured in the attack include acclaimed Colombian writer Hector Abad Faciolince; Sergio Jaramillo Caro, who previously led Colombia’s peace negotiations with FARC rebels; and Ukrainian-based journalist Catalina Gomez. According to the New York Times, Abad and Jaramillo were in Kramatorsk “collecting material” in support of their initiative, ¡Aguanta Ucrania! (“Hang On Ukraine!”), which seeks to garner support for Ukraine in Latin America.

Following the attack, Colombian influencers and officials criticized the attack through media outlets and social media accounts in Spanish. Danilo Rueda, Colombia’s current high commissioner for peace, issued a statement expressing support for the victims without mentioning Russia, while the Ministry of Foreign Affairs expressed its “strongest condemnation of the unacceptable attack by Russian forces on a civilian target.” 

Gomez, who was injured in the attack, broadcast a video for France 24 from the site of the explosion. Meanwhile, Abad and Jaramillo conducted interviews with Colombian media outlets such as El Tiempo in which they described the incident.

Actualidad RT, a Russian media outlets with enormous reach in the Spanish-speaking world, insisted that the victims of the attack were mercenaries and instructors of NATO and Ukraine rather than civilians. Actualidad RT quoted statements from Igor Konashenkov, spokesperson for the Russian Ministry of Defense,  and Kremlin spokesperson Dmitri Peskov, who said the attack struck “military targets” and that “Russia does not attack civilian infrastructure.” Actualidad RT promoted its claims via Twitter and Facebook multiple times on June 28.

Colombian radio station WRadio interviewed Kremlin foreign policy spokesperson Maria Zakharova on the morning of June 28. Zakharova stated that the restaurant was a Russian military target and called for an investigation into Victoria Amelina, a Ukrainian writer who was gravely injured while purportedly hosting the Colombians at the restaurant, claiming without evidence that Amelina had prior knowledge that the restaurant was a military target. Zakharova reiterated this statement after a WRadio journalist asked her to confirm the accusation. In contrast, Abad stated that it was Gomez who suggested they visit the restaurant, and that she apologized for doing so after the attack.

The Russian embassy in Colombia amplified Zakharova’s narrative later that same afternoon and evening. On Twitter, the embassy insisted that the city was “an operational and logistical-military hub, not a suitable place to enjoy Ukrainian cuisine dishes.” It also seemed to celebrate that the “reckless trip [of the Colombians] did not turn into an irreparable tragedy.”

—Daniel Suárez Pérez, research associate, Bogota, Colombia

Over the course of the thirty-six-hour Wagner mutiny, the Kremlin attempted to limit information about Yevgeniy Prigozin on Russian social media and search engines, eventually blocking websites affiliated with Prigozhin. On June 24, the Telegram channel of Russian state-owned propaganda outlet RT reported that several Prigozhin-controlled media outlets including RIA FAN, People’s News, and Patriot Media Group were no longer accessible in parts of Russia. RT added that the reason for their disappearance was unknown. Similar reports appeared in Mediazona and several Telegram channels. 

The DFRLab used the Internet censorship measurement platform OONI to verify the claim and check the accessibility of RIA FAN within Russia. OONI detected signs that riafan.ru was blocked in the country. 

On June 29, independent Russian outlet The Bell claimed the Kremlin was searching for a new owner for Patriot Media Group, which includes media assets associated with Prigozhin. The following day, multiple Russian outlets reported that Prigozhin had dissolved Patriot Media Group.

—Eto Buziashvili, research associate, Tbilisi, Georgia

For years, Wagner has acted as Russia’s primary form of influence in Africa—spreading disinformation and propaganda, securing military contracts, and exporting natural resources to support Putin’s war effort. Following Prigozhin’s attempted mutiny, the future of Wagner’s operations on the continent has come into question. While it is highly unlikely the Kremlin would willingly abandon its influence in Africa, if Wagner is retired or its troops absorbed into the Ministry of Defense, it is uncertain who would maintain the group’s operations on the continent.

Russian Foreign Minister Sergei Lavrov confirmed that Russia’s work in Africa will continue. In a TV interview with Russia Today, Lavrov said, “In addition to relations with this PMC the governments of CAR and Mali have official contacts with our leadership. At their request, several hundred soldiers are working in CAR as instructors.”

A top advisor to Central African Republic President Faustin-Archange Touadéra appeared unconcerned about the weekend’s events. Speaking of Wagner’s military instructors, Fidèle Gouandjika said, “If Moscow decides to withdraw them and send us the Beethovens or the Mozarts rather than Wagners, we will have them.” In a statement released to its Telegram channel, the Officer’s Union for International Security—a US-sanctioned Wagner front company operating in CAR—claimed CAR’s defense minister had apologized for Gouandjika’s remarks. It quoted Defense Minister Claude Rameaux Bireau as saying, “The people of the CAR are grateful to the Russian instructors of Wagner, ask any Central African on the streets of Bangui or in the village of the CAR—he will confirm my words.”

In Mali, where Wagner forces have taken over responsibility for pushing back jihadists after the departure of French forces, the online outlet Mali Actu reported that the situation could dramatically impact Mali. “This situation raises major concerns about the security, stability and sovereignty of Mali, as well as the impact on the local population and counter-terrorism efforts,” it wrote.

—Tessa Knight, research associate, London, United Kingdom

While Wagner’s future in Africa remains uncertain, it is important to consider that the Wagner Group not just a paramilitary force. It is also a conglomerate of companies active in different sectors, from mining and logistics to political warfare and moviemaking, able to travel the spectrum between private entrepreneurism to state proxy. This flexibility has previously allowed Moscow to deploy Wagner to act as a force multiplier in Africa while simultaneously denying Russia’s direct presence on the continent. In Africa, Russia has used Wagner multiple times as part of a strategy to help authoritarian leaders stay in power and gain a pro-Russian military presence on the ground, all while maintaining plausible deniability. Until now, the positive outcomes of this strategy have far exceeded the costs for the Kremlin, as Russia has built a strong network of African influence with relatively little effort, securing concessions in strategic extractive industries, and expanding military-to-military relations on the continent.

However, this principle of plausible deniability, which made Wagner so successful and so useful for Moscow as an extension of its foreign policy and influence, is now damaged. As previously noted, Russian Foreign Minister Sergei Lavrov, as well as Putin, publicly confirmed direct links between Wagner and the Russian state apparatus.

Africa is intimately linked to Wagner: In the wake of Wagner’s involvement in Syria, Africa became the scene of the group’s expansion. Engaging in Sudan, the Central African Republic, Libya, Mozambique, Madagascar, and Mali, Wagner employed an opportunistic strategy of supplying security while taking concessions to mine natural resources. While its forces were in most cases invited to stabilize fragile states, its actions actively invited further instability, creating more opportunities and a greater demand signal for its services, ultimately granting renewing opportunities to Moscow to reinforce its footprint in the continent.

While denying direct links to Wagner’s actions in Africa might have become more difficult for the Kremlin, Russia is unlikely to waste the network of influence built by the group in recent years. Instead, Moscow will likely continue to deploy hybrid tools such as Wagner, although organized in different shapes and forms, so Russia can continue displacing Western influence, exploiting natural resources, and evading sanctions through dozens of front companies.

—Mattia Caniglia, associate director, Brussels, Belgium

On June 20, the Organized Crime and Corruption reporting project (OCCRP) published a series of investigations titled “The Rotenberg Files” that shed light on the business dealings and alleged sanctions evasion attempts of Boris and Arkady Rotenberg, close friends of Russian President Vladimir Putin. The report is based on fifty thousand leaked emails and documents, examined by journalists from seventeen outlets. The OCCRP said the leak came from a source who worked for the brothers at a Russian management firm. The OCCRP investigation was conducted in partnership with the Times of London, Le Monde, and Forbes, among others.

Boris and Arkady Rotenberg are childhood friends of Putin. The billionaire brothers faced Western sanctions amid Russia’s 2014 annexation of Crimea, but their lavish lifestyles do not appear to have been impacted. 

According to the OCCRP, the leaked documents demonstrate how the Rotenberg brothers allegedly used Western lawyers, bankers, corporate service providers, and proxies to evade sanctions. 

One of the report’s findings also alleges the brothers maintain business links to Prince Michael of Kent, a cousin of the late Queen Elizabeth II who was previously accused by the Sunday Times and Channel 4 of profiting off close access to the Kremlin. According to the latest investigation, “Prince Michael distanced himself from earlier ties to the Putin regime in the wake of the 2022 invasion of Ukraine. But leaked emails and corporate records show he co-owns a company with two Russian businessmen who helped billionaire oligarch and Putin ally Boris Rotenberg dodge Western sanctions.” 

Another investigation from the Rotenberg files reported that Putin’s eldest daughter regularly visited a holiday property financed by Arkady Rotenberg in an exclusive Austrian skiing destination. Documents reviewed by the OCCRP suggest that the house was purchased by a Cypriot company in 2013 with a loan from a bank then owned by Arkady, using funds invested by another company he owned. Other records suggested that the former romantic partner of Putin’s daughter is connected to the company that owns the Austrian property. Residents claim to have seen Putin himself at the Kitzbühel residence, though this has not been confirmed. 

The Rotenberg brothers and Prince Michael declined to comment to the OCCRP investigative consortium.

—Ani Mejlumyan, research assistant, Yerevan, Armenia