Image: Men look at the Antonivskyi (Antonovsky) bridge closed for civilians, after it reportedly came under fire during Ukraine-Russia conflict in the Russian-controlled city of Kherson, Ukraine July 27, 2022. REUTERS/Alexander Ermochenko

As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report.

Russia minimizes Ukrainian damage of strategic bridge in Kherson

Ukraine’s security service claims to uncover Russian plan to annex occupied territories of Ukraine

VPN downloads surge in Russia as authorities crack down on Internet access

During a video speech on July 27, Ukrainian President Volodymir Zelensky stated that the Ukrainian military had disabled the Antonovsky bridge in Kherson to the point that was no longer usable by occupying Russian forces. The bridge has been targeted by Ukrainian forces for more than a week. While it remains standing, it has been hit multiple times by high-precision HIMARS munitions provided by the US.

Kremlin-controlled news agency RIA Novosti initially reported the bridge was still “intact” and “all missiles were intercepted by air defense systems.” Later, the outlet cited Kiril Stremousov, the pro-Kremlin deputy head of occupied Kherson, who acknowledged that “traffic on the Antonovsky bridge is blocked.” Stremousov qualified his remarks to RIA Novosti by stating “a big part of the [Ukrainian] missiles were intercepted by the air defense system,” suggesting that not all Ukrainian missiles had been intercepted by Russia, as first reported by RIA. He also claimed without evidence that “American specialists” were manning the HIMARS systems rather than Ukrainians. Some hours later, RIA Novosti added that “specialists are studying the damage done to Antonovsky bridge” and that “the bridge will be restored.” Meanwhile, alternative means to cross the river like pontoon bridges will be used, Stremousov said.

While the Antonovsky bridge has been damaged, it has not been destroyed, as some Kherson-based Telegram channels have suggested. According to local Telegram channels, Ukrainian Armed Forces began shelling the bridge on July 19. As the DFRLab reported last week, damage to the bridge can be corroborated by satellite imagery. On images provided by Planet.com, dated July 20 and July 27, dark spots of missile damaged can be seen; these spots were absent in a July 18 satellite image.

The Antonovsky bridge is the main crossing point over the Dniepr River used to supply Russian occupying forces in Kherson. Destruction of the bridge is part of ongoing Ukrainian attempts to de-occupy Kherson.

—Nika Aleksejeva, Lead Researcher, Riga, Latvia

The Security Service of Ukraine (SBU) claimed to have exposed a Russian plan to annex occupied parts of eastern Ukraine. On July 26, the SBU stated that Russia had begun an active phase of preparing “a pseudo-referendum” on joining occupied Ukrainian territories with Russia. According to the statement, Russia plans to carry it out with the so-called Donetsk People’s Republic and rename the annexed Ukrainian territory “Greater Russia.”

To prepare the ground for annexation, the USB stated, Russia planned to send Kremlin pundits to Russian-occupied territories to “spread propaganda in support of the pseudo-referendum [on joining Russia] and set up ‘polling stations.’” Concurrently, Russia would use Kremlin media “to reach more than 50 million viewers from Russia and eastern Ukraine with their propaganda about fake events.”

The SBU published documents that supposedly revealed how Russia has prepared an appeal allegedly from local Ukrainian residents to the leadership of the occupation administration on the “accession” of the Donetsk region into Russia. The documents provided by the SBU are dated August 1, 2022, suggesting they were intended to be released later.

While the SBU claims cannot be independently verified, in recent days, various Russian actors on VK and Telegram, as well as fringe Russian outlets, have started to promote the propaganda slogan “For Greater Russia.” Some outlets boasted that for the last eight years, the Donetsk People’s Republic has defended Russia’s border, building a bridge between the region and Russia, and that Vladimir Putin was changing the world by taking over the region. Other fringe outlets suggested that when Russia defeats Ukraine, the creation of a “Greater Russia” will encourage the world to ally with Russia rather than the United States. Links to these narratives were spread by pro-Kremlin accounts on the Russian social network VK.

On Telegram, the channel Za Большую Россию (“For Greater Russia”) was created on June 27 and began activity on July 1. It currently has more than 2,800 subscribers. The channel shares narratives regarding Russia liberating Ukraine’s eastern regions, as well as information on issuing Russian passports for residents of the occupied territories.

—Eto Buziashvili, Research Associate, Washington DC

On July 26, Russian media outlet RBC wrote that VPN services were downloaded in Russia six times more frequently in July than they had been in January, prior to Russia’s invasion of Ukraine. Since March, they reported, Russia has downloaded VPN apps more than any country besides India.

More specifically, VPN services in Russia were downloaded more than 12 million times during first three weeks of July, compared to two million times in January. VPN download data was provided by the app market intelligence company AppMagic. According to Stanislav Shakirov, founder of Roskomsvoboda, a Russian NGO that protects digital rights of citizens, the VPN penetration rate in Russia is around 30%, proportionally similar to usage in China. VPN services allow Russians to bypass local restrictions preventing access to certain sites, as well as maintain their privacy on the Web. It is worth noting that the number of VPN downloads in Russia should not be equated with the number of new VPN users, as one user can download multiple VPN services.

Google Trends analysis shows a significant spike in Russia-based user searches for “VPN” and the Russian equivalent “ВПН” at the beginning in March. Google Trends also showed that these keyword searches were most common in the cities of Moscow and Saint Petersburg, as well as Moscow and Kaliningrad oblasts.

The DFRLab used Meltwater Explore to track mentions of “VPN” and “ВПН” across multiple platforms and found that these keywords were mentioned more than 1,000 times per day on average between February 1 and July 25. Mentions spiked above 7,500 mentions per day following Russia’s February 24 invasion of Ukraine, then decreased over the course of March.

Since the start of the invasion, Russia has tried to censor news about the war, blocking hundreds of foreign and Russian websites. On July 22, the VPN review website Top10VPN reported that Russia had blocked 2,633 websites since February 24, the majority of which were news websites.

It is worth underlining that Russia also tries to block VPN use in the country; at least 15 VPN services have been blocked so far. This, however, has not prevented Russians from using other VPN services to access the global Internet. In June, 2022, Maxut Shadayev, Russian minister for digital development, communications, and mass media, argued that Facebook, Instagram, and Twitter accounted for 10-12 percent of all internet traffic in Russia prior to the invasion. After Russian authorities blocked these platforms, traffic decreased by 80 percent, he claimed.

—Givi Gigitashvili, Research Associate, Warsaw, Poland