As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, the DFRLab’s global team presents the latest installment of the Russian War Report. 

Russian forces use incendiary munitions in Mariupol

Polish far-right influencers and Russian media capitalize on Warsaw murder to spread anti-refugee narratives

Russia plans to launch pre-installed app store on smartphones

Russian-occupied South Ossetia sets date for referendum on Russian unification

Telegram channels and youth groups rally against Riga following Victory Day controversy

New photo and video evidence suggests that the Russian military continues to use incendiary and cluster munitions against Ukrainian forces. A video released on May 15 shows the Azovstal plant in Mariupol being shelled by what appears to be incendiaries.

The DFRLab analyzed the footage and found the strike targeted the western section of the plant. 

While warfare experts speculated on social media that the shells used in the bombardment were white phosphorus, it is more likely that Russian 9M22S incendiary munitions from Grad multiple launch rocket systems were used. The 9M22S shells are a more conventional incendiary munition that use a thermite mixture. These munitions have previously been used during the war in Ukraine. The same 9M22S munitions were also reportedly used in the eastern Ukrainian city of Izyum earlier this week. Meanwhile, a report from Ukrainian media suggests the city of Mykolaiv was also targeted by cluster munitions.

On May 15, the Security Service of Ukraine released what it reported to be an intercepted phone call in which a Russian soldier confirmed using weapons that are banned by international treaties. “Phosphorous bombs, cluster munitions – they have allowed us to use everything that is banned,” he said in the recording.

—Lukas Andriukaitis, Associate Director, Brussels, Belgium

On May 8, a Polish man in Warsaw was stabbed to death. A few days later, a graphic recording of the incident appeared online, filmed by an unidentified witness who spoke Ukrainian. Polish far-right actors, social media accounts, and Russian pro-Kremlin media outlets capitalized on the incident to push anti-Ukrainian sentiments.  

Polish media outlet Oko.press reported that while the murder happened on May 8, claims accusing the murderers of being Ukrainian refugees didn’t emerge until four days later. The claims began circulating after Warsaw police released photos of the suspected perpetrator. The Twitter account @otwieramy complained that Polish media did not report that the perpetrators were “drunk foreigners speaking in Ukrainian.” The Twitter account also alleged that the victim’s family was pressured not to reveal the attackers’ nationality.  

Right-wing Polish journalist Wojciech Sumlinski claimed without evidence that a group of Ukrainians “tortured a young boy in the center of Warsaw.” This is not the first time Sumlinski has accused refugees of being violent. The DFRLab previously reported on Sumlinski’s March 1 tweet that falsely claimed a group of “Arab-looking” men had attacked a pregnant Polish woman on a train. That claim was later amplified by the far-right political party Confederation, with members inciting violence against non-Ukrainian refugees in eastern Poland.  

Piotr Panasiuk, a Confederation party member who ran for parliament in 2019, claimed without evidence that the perpetrator of the crime in Warsaw was a Ukrainian army defector who had escaped into Poland. Grzegorz Braun, the leader of the Confederation party, asserted during a press conference on May 13 that opening Poland’s borders to uncontrolled migration and mass displacement had resulted in negative social and political consequences. According to Braun, nobody in Warsaw was safe anymore.   

Russian media outlets also amplified rumors about the Warsaw murder. News Front and EurAsia Daily asserted that a group of drunk Ukrainian migrants stabbed a Polish citizen because he interfered in their attempt to sexually assault a woman. The EurAsia Daily article quoted Katarzyna Sokolowska, chairwoman of the Polish organization Wołyń Pamiętamy (”We Remember Volhynia),” who claimed that Polish authorities were pressuring the family of the Polish victim, who died “at the hands of Ukrainian migrants.” The DFRLab has previously reported on an anti-Ukraine campaign launched on Facebook by Wołyń Pamiętamy prior to Russia’s invasion of Ukraine. 

On May 13, Warsaw Police announced they were still investigating the crime but said that there was no evidence indicating that the perpetrators were citizens of another country.

—Givi Gigitashvili, Research Associate, Warsaw, Poland

On May 25, Russia’s Ministry of Digital Development and the social networking company VK plan to launch a beta version of the RuStore, the Russian analogue of the Google Play store. Their goal is to include the Russian app store to come pre-installed on Android phones in the country.  

The Kremlin has begun developing domestic smartphone services in response to Western sanctions. VK, which owns the social media platform VKontakte, is developing the domestic app store without government funds, according to Maksut Shadayev, Minister of Digital Development.  

This week, the Russian ministry proposed a law titled “On a Single Application Store,” which would allow the RuStore to be included on the list of software required to be pre-installed on smartphones and tablets in Russia. According to the draft law, the Russian government will identify app developers who will be required to add their apps to the RuStore. The proposed law also states that these actions will “counter sanctions from foreign states.” 

Russian anti-virus software developer Kaspersky Lab will manage the app store “in order to prevent malicious applications from getting into RuStore,” Russian media reported. 

No information is available on whether the RuStore will work on iOS systems.

—Eto Buziashvili, Research Associate, Washington, DC

The Russian-occupied Georgian breakaway region of South Ossetia will hold a referendum on joining the Russian Federation on July 17, 2022. The decree was signed on May 13 by the outgoing separatist president Anatoly Bibilov. “We are going home, we are heading to Russia,” he wrote on his Telegram channel. The referendum will ask voters, “Do you support the unification of the Republic of South Ossetia and Russia?” 

The referendum has already led to tensions with some Russian politicians. State Duma Member Konstantin Zatulin, first deputy chairman on the parliamentary committee for Russian nationals living outside the country,  said Bibilov’s referendum was “not very appropriate.” Noting the fact that Bibilov was about to leave office, he added, “If you lose elections, then the newly elected president should call a referendum.”  

Anatoly Bibilov lost to Alan Gagloev, leader of the Nykhas party, during the second round of the presidential elections on May 8. Gagloev is set to take office on May 24. According to Civil.ge, Gagloev has expressed doubts about whether Bibilov coordinated his decision with Moscow. “I fully support the idea of reunification of divided Ossetian nation within the united Russia,” he said. “But the question is whether it is the moment in history when we should issue a decree on calling a referendum and forcing it to happen…In 2014, referendums on reunification were held in the Luhansk and Donetsk People’s Republics without Russian approval. Eight years have passed, and they have not yet achieved their goal.” 

Gagloev added that he will take further steps “in compliance with international legal norms, consultations, and implementation of agreements with the Russian Federation.”

—Sopo Gelava, Research Associate, Tbilisi, Georgia

Tensions between Latvia and Russia are on the rise after the city of Riga voted to demolish a Soviet monument and arrested pro-Kremlin supporters at an annual Victory Day gathering. In response, pro-Russian Telegram channels have rallied behind one of the arrested individuals, with posts garnering hundreds of thousands of views. Pro-Kremlin youth organizations in Russia also launched flash mobs to protest the actions in Riga. Read more in the DFRLab’s latest update on the controversy.

—Nika Aleksejeva, Lead Researcher, Riga, Latvia