As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report. 

Wagner sends vehicles to Kherson while Iran increases military support

Russian troops arrive in Belarus as joint force announced

Belarusian Telegram channels say a flurry of increased military personnel activity is raising concerns of a possible mobilization

Putin declares martial law in annexed parts of Ukraine

Russian deputy prime minister boasts of forced deportations from Kherson

The DFRLab is continuing to monitor reports of Wagner Group activity in Ukraine, where the Kremlin-aligned private military company is assisting Russian forces in fighting and fortifying positions in the Donbas. A video posted on October 13 shows Russian servicemen of the 126th Coastal Defense Brigade of the Black Sea Fleet in the Kherson region complaining that they have been fighting in the area since the beginning of the war without relief or troop rotation. After the video circulated, a Wagner-affiliated Telegram channel announced on October 14 that Wagner fighters would transfer vehicles to the 126th Coastal Defense Battalion in support of their efforts to hold the frontline in Kherson.  

There are also signs of a possible rift between the Russian military and pro-war bloggers. On October 14, Russian military blogger Semyon Pegov announced the existence of “hit lists,” reportedly originating with the Russian Defense Ministry, that target bloggers and journalists for their coverage of the war in Ukraine. Pegov, who is part of the WarGonzo Telegram channel, accused “individual generals and military commanders” from the Russian defense ministry of developing a list of bloggers who the ministry intends to prosecute for “discrediting” Russia’s handling of the war in Ukraine. One day later, he retracted the claim. At the time of writing, Pegov’s original post had garnered more than 2.8 million views. His claim was amplified by several other prominent pro-war bloggers and generated a discussion about censorship. 

Further, new revelations this week indicate that Iran is playing an increasingly large role in aiding Russia’s war against Ukraine. Ukrainian and Russian Telegram channels reported that Russia has purchased an unknown number of Arash-2 drones, which are purportedly faster and more destructive than the Shahed-136 drones that are currently in use by Russian forces against critical infrastructure in Ukraine. Reports that the Russian army is receiving munitions from Tehran are in line with a report from the US Treasury Department stating that Russia is running out of microelectronics, essential to maintaining its military operations, due to the impact of sanctions. The US warned it will sanction “people, companies, or countries” that provide ammunition or support to Russia’s military. It also alleged the presence of Iranian trainers on the ground in Crimea, assisting Russia in drone operations, though this has not been independently verified. Iran, meanwhile, also promised to provide Russia with surface-to-surface missiles, in addition to more drones.  

On October 19, the US Department of Justice charged five Russians with sanctions evasion, oil smuggling, and organizing a money laundering scheme. One of the accused is Artyom Uss, the son of the governor of Krasnoyarsk. The other accused are Yury Orekhov, Svetlana Kuzurgasheva, Timofey Telegin, and Sergey Tulyakov. Orekhov was detained in Germany on October 17 and Uss in Italy, both at the request of the US, which will seek extradition. In addition to the Russians, the scheme allegedly involved two Venezuelans, Juan Fernando Serrano Ponce and Juan Carlos Soto, who reportedly helped broker the sale of oil, organizing illegal transactions with Venezuela’s state owned oil company PDVSA, in violation of sanctions. According to the US Department of Justice, Orekhov and Uss were co-owners of the German company Nord-Deutsche Industrieanlagenbau GmbH (NDA GmbH). 

In addition, a Russian citizen on his way to Svalbard was detained by Norwegian police after taking photographs at the Tromsø and Kirkenes airports. The arrest comes only days after another Russian, found with two drones in his possession, was detained at the Storskog border checkpoint. Norway also arrested the son of Vladimir Yakunin, a close ally of Russian President Vladimir Putin, for illegally flying a drone at Svalbard.  

Lastly, a hack targeted Bulgaria in the early hours of October 15, which prosecutor general Ivan Geshev said came from Russia. The cyber attack comes after Russia accused Sofia of being involved in the Kerch bridge explosion. The hacker collective KillNet, which has carried out similar hacks against other European and NATO countries in the past few months, is believed to be behind the attack, which affected Bulgarian government websites.

—Ruslan Trad, Resident Fellow for Security Research, Sofia, Bulgaria

On October 10, Belarusian President Aleksandr Lukashenka announced that Belarus had reached an agreement with Russia to deploy a joint Russian-Belarusian grouping of troops on Belarusian territory. He said the formation of this group began two days before the announcement and that more than 1,000 Russian troops would be deployed to Belarus. To justify the joint military group, Lukashenka alleged that Ukraine was preparing strikes against Belarus. One week before the announcement, Lukashenka claimed that Ukraine had moved 15,000 service members to the Belarusian border. According to the BBC’s Russian service, the number of the permanent Russian service members stationed in Belarus was around 1,000 people until recently. 

On October 15, the first group of Russian forces arrived in Belarus, reportedly accompanied by MiG-31 fighter interceptors. According to the independent Belarusian Hajun Project, Russian military groups arrived at the Palonka, Zaslonava and Losvida rail stations, none of which are close to the border with Ukraine. 

Valery Revenko, head of international military cooperation for the Belarusian defense ministry, said on Twitter, “The total number [of] arrived military personnel in Belarus will be up to 9,000 personnel, about 170 tanks, up to 200 armored combat vehicles and up to 100 guns and mortars with a caliber of more than 100 mm.” Belarusian journalist Tadeusz Giczan reported that the Russian trains arriving in Belarus weren’t carrying heavy equipment – “only trucks, petrol tankers and passenger cars with soldiers.” On October 16, Gazeta.ru published a video supporting this claim, showing the arrival of a Russian train in Belarus with only military trucks visible on the train. On September 29, the Ukrainian Ministry of Defence stated that Belarus was preparing facilities to accommodate 20,000 mobilized people from Russia. 

According to Meduza, the motives behind the Belarus-Russia joint group include distracting Ukraine’s army away from other fronts; allowing Russia to conduct more precise aerial attacks from Belarusian territory; preparing for any provocations from the West; and allowing Russia to open new fronts in the north or west of Ukraine. 

After the announcement, Poland recommended its citizens leave Belarus “with available commercial and private means” as soon as possible. Meanwhile, Ukrainian President Volodymyr Zelenskyy asked G7 countries to send international observers to the Belarusian border to monitor the security situation. He also stated that Ukraine is not planning military actions against Belarus.

—Givi Gigitashvili, Research Associate, Warsaw, Poland

On October 15, Belsat, an independent Belarusian media outlet, reported that military-eligible men in Rogachev and Gomel Oblasts received letters asking them to report to military enlistment offices to verify their personal information. Some men reportedly received a call to attend “urgent gatherings” (срочные сборы); according to Pavel Latushka, a Belarus opposition activist in exile, President Lukashenka employs the phrase to avoid referring to a “mobilization.” The Telegram channels Realynaya Belarus and Basta! also published similar information about men receiving letters from military offices in Gomel Oblast. The Realynaya Belarus channel noted that “men who previously served in interior troops and air forces” received the notes. The Basta! channel cited an anonymous source who works in the agriculture industry in Gomel, who claimed that department heads were told to send men under the age of fifty to report their personal information. “These are almost all drivers and tractor operators,” the source said.  

The Motolyko Pomogi Telegram channel published similar observations. The post noted that all of the men who served in the 5th brigade of the Belarusian special operations forces in Marina Gorka, Minsk Oblast, had received letters to gather for “retraining.” On October 17, the Realynaya Belarus channel said seventeen special forces service members had mustered in Pinsk. 

Additionally, on October 15, Motolyko Pomogi reported that some Belarusian companies received orders to provide a list of eligible conscripts to authorities. The authorities reportedly asked one company in Brest Oblast to provide information about vehicles that the company could provide for “transportation of the mobilized.” The post also mentioned the creation of an “alert headquarters” at one unnamed Belarusian company in Brest. All mobilization notices would be sent to the headquarters, which would carry the duty of alerting conscripted employees. The involvement of state-owned companies and other types of organizations in military conscription is a legally mandated procedure in Belarus. 

Belarus holds an annual military record verification process. On October 19, the Belarusian Ministry of Defense claimed on its Telegram channel that latest actions were part of the annual military record verification and not part of a mobilization effort. The DFRLab could not verify reports of individuals being forced to join Belarusian military. While Belarusian authorities are seemingly acting within legal bounds, questions arise when considering that Belarus recently announced it will join Russians in the war against Ukraine.

—Nika Aleksejeva, Lead Researcher, Riga, Latvia

During a meeting of Russia’s Security Council on October 19, President Putin announced he had signed a decree implementing martial law in illegally annexed Ukrainian territory. Martial law would apply in four Ukrainian regions – Donetsk, Luhansk, Zaporizhzhia, and Kherson – in the wake of sham referendums held last month that have not been recognized by Ukraine or the broader international community.  

According to pro-Kremlin outlet Kommersant, martial law “is introduced in the event of aggression against the Russian Federation or a direct threat of aggression.” According to the outlet, martial law provides Russia with the authority to impose curfews; compulsory screening of citizens and detention for up to thirty days; seizure of property; military censorship of postal services and the media; control of phone conversations; expulsion of foreigners; suspension of the activities of political parties, foreign and international organizations “whose propaganda undermines the security of the country”; and restriction of entry, exit, and freedom of movement. Kommersant added that Russia will suspend its obligations under international treaties regarding the rights of citizens after the introduction of martial law.  

The last time Russia implemented martial law was during World War II, when the Soviet Union imposed it in 1941.  

In addition to martial law, Putin declared the Kremlin would apply security measures based on three different tiers – basic, medium, and increased. Russian regions close to the Ukraine border require a medium response level, while Moscow falls under the increased category. According to these response levels, Russia can gain control over different sectors like communications and automated systems and repurpose them for the military needs.

—Eto Buziashvili, Research Associate, Tbilisi, Georgia

Russia continues to conduct massive, forced deportations of Ukrainians. Russian Deputy Prime Minister Marat Khusnullin stated on October 14 that “several thousand” children from the Kherson region are “already in other regions of Russia, resting in rest homes and children’s camps.” As noted by Human Rights Watch, “deportation has been recognized as a crime against humanity in each of the major international criminal instruments.” 

—Ruslan Trad, Resident Fellow for Security Research, Sofia, Bulgaria