Russian War Report: Kremlin claims Bucha massacre was staged by Ukraine
Civilians have been found dead, many with their hands bound and simply left on the street, in Bucha. Despite the evidence, the Kremlin is trying to cover it up through disinformation and confusion.
Russian War Report: Kremlin claims Bucha massacre was staged by Ukraine
Image: Ukraine’s President Volodymyr Zelenskiy speaks as he is surrounded by Ukrainian servicemen as Russia’s invasion of Ukraine continues, in Bucha, outside Kyiv, Ukraine, April 4, 2022. REUTERS/Marko Djurica
As Russia expands its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the US, NATO, and the European Union, DFRLab’s global team presents the latest installment of the Russian War Report.
Tracking narratives
Security
Cyber warfare
Kremlin claims Bucha massacre was staged by Ukraine
Over the weekend of April 2, journalists and Ukrainian authorities reported on dozens of dead civilians found in Bucha, northwest of Kyiv, after Russian troops left the area. Images captured by multiple sources documented how some of the dead had their hands tied. Ukrainian President Volodymyr Zelenskyy accused Russia of committing genocide in Ukraine, while Charles Michel, president of the European Council, used the hashtag #BuchaMassacre when he announced the EU was preparing further sanctions against Russia.
Despite the overwhelming evidence of mass civilian casualties in Bucha, the Kremlin is trying to cover up the killings through false claims and distortion. On April 3, Russia’s Ministry of Defense shared a post from the pro-Kremlin War on Fakes Telegram channel that called the massacre a “coordinated media campaign.” The post claimed that Russian forces left Bucha on March 30, and footage of the dead only appeared four days later as a result of shelling by Ukraine. The Telegram post also included a graphic video that it claimed was proof that bodies had been placed in the streets to generate public outrage, and that some of the bodies were actually actors pretending to be dead.
A few hours later, the Ministry of Defense posted an official statement claiming that “not a single local resident has suffered from any violent action” during the Russian occupation of the city. It reiterated the narrative that footage of dead civilians only emerged four days after Russian troops left the city, and asserted that locals had been allowed to leave beforehand. The statement also claimed that the bodies did not show any signs of stiffening or decomposition. It concluded that the scenes in Bucha had been staged by “the Ukrainian regime” for Western media, and that Ukraine had done the same in Mariupol and other cities.
The Twitter account for the Russian Ministry of Foreign Affairs disseminated a summary of the Defense Ministry statement and called that the Bucha massacre “another hoax by the Kyiv regime for the Western media.” Foreign Ministry spokeswoman Maria Zakharova claimed that Ukraine staged the massacre to scuttle peace negotiations and escalate the conflict. Russia then demanded a meeting of the UN Security Council to be convened on April 4 to discuss the events in Bucha.
Notably, Kremlin media’s own reporting undermines the narrative that Russian troops had departed Bucha four days before the bodies were documented. On April 1, Zvezda TV reported that Russian Marines were still conducting “clean-up” operations in Bucha and other cities to regain a foothold in the region. That same day, the Kyiv Oblast administration still included Bucha in its list of the most dangerous areas due to Russian forces retreating from there. These reports seemed to align with a Kyiv military administration statement the previous day, which reported that Bucha was still under the control of Russian armed forces. All of this suggests that Russia’s claims of having evacuated the city on March 30 are false.
Additionally, April 3 was not the first day that reports of civilian deaths surfaced, as the Kremlin suggested. On April 1, graphic footage from Bucha appeared on the Irpin Bucha Gostomel Telegram channel (“Ирпень | Буча | Гостомель”) in which a car is seen driving around corpses on the same street featured in the War on Fakes Telegram channel video. One of the corpses seen in the April 1 video matches a body in the April 3 War on Fakes video, despite the fact that the Telegram channel claimed the body in question was moving. On April 2, AFP reported that bodies of at least 20 men in civilian clothes had been found on a single street in Bucha. The Ukrainian fact-checking outlet StopFake also cited a graphic YouTube video filmed on April 2 by Ukrainian journalist Dmitry Komarov documenting civilian deaths in the city.
As for the War on Fakes Telegram post showing footage it claimed proved the bodies were actually actors, Russian independent outlet Mediazona analyzed the video and concluded that the “movement of a corpse’s hand” alleged in the original post was actually a visual distortion caused by a drop of water or a scratch on the windshield of the car from where video was filmed. Mediazona also debunked the War on Fakes Telegram claim that one of the alleged corpses was attempting to stand up, concluding that the “movement” seen in the footage was due to distortion from capturing the footage through the car’s rear-view mirror.
—Givi Gigitashvili, Research Associate, Warsaw, Poland
Pro-Kremlin accounts denying Bucha massacre dominate VKontakte conversations
Pro-Kremlin accounts dominated conversations about the Bucha massacre on the Russian social media platform VKontakte (VK), denying and deflecting any Russian responsibility. Ekaterina Gubareva, a former politician in the self-proclaimed Donetsk People’s Republic and the wife of Donetsk separatist leader Pavel Gubarev, wrote on VK that the Russian soldiers in Bucha treated the local population “with love.” The post received more than 25,000 views. Reuters reported that civilians in Bucha were told by the Russian forces to use white armbands to identify themselves. However, Russian soldiers have also previously worn white armbands. Ukrainian military sources have reported that the Russians are deliberately marking civilians with white armbands to confuse Ukrainian forces. Gubareva suggested that any dead civilians wearing white armbands were killed by the Ukrainian military, who she claimed shot at civilians while liberating the city.
In addition, Denis Tukmakov, a pro-Kremlin columnist, and Igor Levitas, an author at the pro-Kremlin EADaily, stated that the Bucha killings were staged. Tumakov claimed that the bodies were not stiff and that Russian commanders would not leave the bodies behind. In his post, Tumakov listed atrocities that the West has accused Russia of committing and concluded that there would be no more peace talks. “So Russia has no other option but to win,” he wrote. “Otherwise, we will not just lose – we will be turned into Hitler.”
Other VK posts that received less attention expressed shock, but did not condemn Russia. For example, Nikolay Rybakov, a member of the liberal Russian party Yabloko, wrote, “I am shocked by the horrifying photographs of murdered civilians from the city of Bucha, Kiev region.” Similarly, a pro-Alexei Navalny user, Vadim Orlov, posted an image with a crying statue and wrote: “Bucha. F*cked up. I saw it.”
In contrast, Russian writer Dmitry Glukhovsky re-posted Ukrainian President Volodymyr Zelenskyy’s speech addressing Russians and condemning the Russian military’s atrocities in the Kyiv suburbs. The post received more than 22,000 views.
—Nika Aleksejeva, Lead Researcher, Riga, Latvia
Kremlin attempts to reboot pro-war symbols online and offline
On March 30, Kremlin-owned outlet RT reported on the popularization of pro-war symbols in Russia. According to RT, Russian entrepreneurs became interested in branding their products with the letters V and Z, which are now considered “patriotic symbols” in the country. The letter Z has become almost ubiquitous among Kremlin media, officials, and supporters rallying support for the war in Ukraine, as well as a tool for spreading propaganda.
RT reported that since the start of Russia’s “special operation” in Ukraine, the Russian patent and trademark office has received “dozens of applications for the registration of various trademarks using the symbols V and Z.” Russian entrepreneurs are rushing to register their right to use pro-war symbols exclusively on various products, ostensibly because trademark pirates might want to hijack the symbols.
RT also reported on requests to register pro-war hashtags, including #своихнебросаем (“we don’t leave ours [behind]”), #мненестыдно (“I am not ashamed”), and #ярусский (“I am Russian”). The combination of the letter Z and the “I am not ashamed” hashtag has already appeared on t-shirts of pro-war campaigners.
The DFRLab previously reported on the failed attempts to popularize the “I am not ashamed” hashtag on Twitter and Facebook. Examination of #МнеНеСтыдно showed that engagement with the hashtag on social media was minor and decreased dramatically in the period of February 26 to March 2.
Further analysis of the hashtag over the last month shows that engagement remains very low. Russia’s attempts to block Western social networks might explain some of the limited engagement. However, a recent report analyzing blocked social media outlets published by the pro-Kremlin online outlet RBC.ru showed that millions of Russians are still using Facebook, Instagram, and Twitter, likely through the use of VPNs.
—Eto Buziashvili, Research Associate, Washington DC
Russian soldiers allegedly sent stolen goods from Ukraine to Russia
The Security Service of Ukraine published what it claimed were numerous intercepted phone calls between Russian soldiers and their relatives in Russia in which they boast about looting and theft. Evidence of Russian looting has previously emerged, such as when Ukrainian troops captured a Russian infantry fighting vehicle containing an assortment of items, including a toy car, frying pan, and Ukrainian coupons that had not been in use since the 1990s. Previously, the Main Directorate of Intelligence of the Ukrainian Ministry of Defense reported that Russian soldiers received instructions to establish self-sufficiency until further notice, essentially condoning looting to make up for Russia’s logistical problems.
The most substantial evidence of Russian looting emerged on April 3, when the Belarusian Telegram channel Belaruski Gayun published a three-hour-long CCTV video from the Mozyr branch of CDEK, a Russian delivery company. In the video, Russian troops with the 56th Guards Air Assault Brigade are seen mailing stolen goods to an unconfirmed location. The destination is likely Russia, however, as the receiver’s phone number and last name are briefly seen in the video. Among the stolen goods captured in the CCTV footage are a video card, an e-scooter, liquor, four air conditioners, car batteries, and dry rations from the Russian Army. Some of the goods were wrapped in packaging from the Ukrainian supermarket chain Epicentr.
—Roman Osadchuk, Research Associate
Russian troops abandon Hostomel Airport, leaving destruction behind
On March 31, local and government reports first indicated that Russian troops were repositioning from the outskirts of Kyiv. As Ukrainian troops regained control of the area, footage emerged showing the extent of the damage at Hostomel Airport, which Russian troops maintained control of after an intense battle from February 24 to 26.
On April 1, CNN released photos confirming the Russians’ departure from the airport. Footage taken by Ukrainians on the ground show the airfield is clear of hostilities.
On March 31, Babylon’13, a Ukrainian documentary group, released drone footage of the airport. The footage captured demolished buildings, discarded military vehicles, and numerous planes in ruins, including the An-225 Mriya, the world’s largest aircraft. The video showed no sign of Russian troops.
By April 1, photos and videos began appearing on Telegram that appeared to be taken by Ukrainians on the ground in Hostomel. One post showed an image of the destroyed An-225 Mriya.
Another video posted on Twitter showed multiple destroyed Russian BMDs located in the airport parking lot, which the DFRLab geolocated to Avtodorozhnia Street, along the edge of the airfield.
Although more images and videos continue to emerge from around Hostomel, it is still unclear if the Russian military is truly abandoning its war aims in the outskirts of Kyiv, or if this merely an attempt to regroup.
—Ingrid Dickinson, Young Global Professional, Washington DC
Signs of Russian forces preparing to re-deploy from Belarus
New footage surfaced on social media showing growing numbers of Russian troops in Gomel, Belarus. An increasing numbers of social media posts documented large Russian military formation movements in the city, likely moving towards the train station for re-deployment. Some videos show Russian VDV airborne troops rolling through Gomel, which the DFRLab geolocated to Bahdan Chmialnicki Street.
Additional videos that surfaced on April 4 show military equipment being loaded on trains. These videos were geolocated and verified to be in the southern railway station in Gomel. Other footage showed destroyed Russian equipment already on trains departing in an unknown direction.
These logistical movements are thought to be preparation for increased operations in the Donbas region. On April 4, the head of the Luhansk regional military administration said that Ukrainians are seeing that “Russian accumulation is very, very powerful in the vicinity.” According to the Pentagon, troops from Belarus are likely to be redeployed in the southern front as well.
—Lukas Andriukaitis, Associate Director, Brussels, Belgium
Roskomnadzor warns of spearphishing attacks using agency’s identity
On April 1, Russian censor Roskomnadzor issued an unusual alert about fraudulent emails sent under its name. It warned that such emails could be used for spearphishing attacks. Roskomnadzor did not mention a specific security incident that precipitated the press release, nor have any such incidents been reported in the Russian media.
Roskomnadzor has risen to international prominence through its frequent condemnations of Western social media companies and increasingly aggressive censorship of Russian civil society. This higher profile has also made the agency a target. On March 10, Distributed Denial of Secrets, a “transparency collective,” released 360,000 hacked files from Roskomnadzor. These files, totaling 526.9 GB, provided significant insight into the agency’s technical and legal processes as well as its administrative structure. The source of the hack claimed to be associated with Anonymous.
The compromise of Roskomnadzor’s internal data and emails, coupled with its unprecedented enforcement actions and public visibility, have created a perfect storm for spearphishing attacks co-opting the agency’s identity to target Russian individuals and media organizations.
—Emerson T. Brooking, Resident Senior Fellow, Washington DC
