As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report. 

Failed Russian push on Vuhledar results in losses as Moscow increases troops in the area

Heavy fighting across Luhansk as Ukraine warns of new Russian offensive

Moldova reacts to alleged Russian plot against its pro-Europe government

Kremlin-linked group arranged bribes for European politicians to support the annexation of Crimea

While Wagner Group soldiers concentrate their efforts around Bakhmut, Mariinka, Ivanivske, and Chasiv Yar, Russian forces have made minimal progress on the southern flank. The town of Vuhledar is viewed as a strategic stronghold lying in between the northern and southern fronts. The Russian army has spent two weeks unsuccessfully attempting to seize the town, likely in an effort to maintain its early offensive successes ahead of the one-year anniversary of the Ukraine invasion on February 24.  

The DFRLab analyzed the composition of the Russian brigades leading the assault on Vuhledar. Russia’s strategy appears to be storming the city with infantry backed by artillery fire. The plan has not proven successful, as nearly all soldiers of the Russian 155th Naval Infantry Brigade were reportedly either killed or taken prisoner. Footage posted by the Ukrainian Telegram channels НЕ ЖДИ меня из Украины (“Don’t wait for my return from Ukraine”) and Ищи своих (“Look for your own”) provides evidence of the increasing Russian losses and reveals that the Russian army has indeed sent a significant part of its brigades to fight on this front. 

OSINT analysis based on Project Owl’s Ukraine Control Map indicates that most of the fifteen brigades engaged in the southern offensive are based out of Russia’s remote Eastern Military District and beyond the Lake Baikal military bases. The Russian infantry groups also include special units like the 14th Spetsnaz Brigade, which was originally supposed to focus on counterterrorism.

Other brigades and regiments deployed to the area belong to newer Russian army formations, like the 3rd Army Corps, which includes the Atal battalion from the Republic of Chuvashya and the Alga battalion from Tatarstan. Also present were forces from the 7th Akhmat-North Regiment, located in Chechnya and comprised of soldiers under Ramzan Kadyrov’s supervision. Geographic analysis of Russian brigades located within twenty-five kilometers of Vuhledar reveals that most of the Russian soldiers are coming from Siberia, including Buryatia, Primorsky Krai, and the Pacific fleet.

In a now-deleted February 10 TikTok video preserved in a tweet by Igor Girkin, the DFRLab identified fifteen armored class vehicles, including T-80 tanks, BTR-82 APCs, and KaMAZ military class trucks. One of these, a KamAZ 6350 truck with a registration plate ending with region code 87, suggests technical equipment from the Siberian Military District had deployed more than 5,000 kilometers across Russian territory to back the Vuhledar offensive operation. 

Another BMP-80 tank bearing the name of the city of Kazan, Tatarstan, reveals that the Russian General Staff deployed servicemen from the Volga region. Locals from the region are said to belong to the Alga volunteer battalion as part of the 3rd Army Corps, created by the Russian General Staff in June 2022 before the declaration of “partial mobilization” by Russian President Vladimir Putin. According to the highest estimates, the Alga battalion amounts to around 500 men.

Russia will likely continue its offensive on Vuhledar in the upcoming week. However, with no tactical advantage besides occasional Lancet drone strikes, it does not seem likely that the territory will be overturned soon.

—Valentin Châtelet, Research Associate, Brussels, Belgium

As previously noted, the Russian army continues to place pressure on Bakhmut. On February 16, five people were killed and nine wounded in the shelling of Bakhmut, according to the Ukrainian prosecutor general’s office, which added that it had received reports of shells hitting the residential quarter of the city. Nearby, the Russian army also shelled Spirne, Vyimka, Rozdolivka, Fedorivka, Vasyukivka, Bilohorivka, Paraskoviivka, Klishchiivka, Ivanivske, Chasiv Yar, Stupochky, Predtechyne, and Kurdumivka. Due to the intensifying fighting and shelling, civilians are reportedly fleeing Chasiv Yar to escape the Russian attacks. The Russian army is attempting to advance in Hryanykivka, Avdiivka, and Mariinka. Russian attacks were also reported in the direction of Kherson.

Serhiy Haidai, the current head of the Luhansk Regional Military–Civil Administration, reported intense Russian shelling in the crucial towns of Kreminna and Bilohorivka. Ukraine said it had repelled some of these attacks. This comes amid a warning from Ukrainian presidential advisor Mykhailo Podolyak that Russia’s new large-scale offensive is already under way. The DFRLab is closely following the events and movements on the frontlines related to the offensive, which is taking place despite Russia’s recent losses on the battlefields and significant losses in equipment and armored vehicles.

Due to the heavy fighting, the Ukrainian army will require a secure flow of military equipment and ammunition, which is among the top requests of Ukrainian officials to allied countries. According to US Secretary of Defense Lloyd Austin, the Ukraine Defense Contact Group will continue to support Kyiv. The Ukraine Defense Contact Group is a coalition of fifty-four countries supporting Ukraine’s defense efforts. The Washington Post also reported on February 13 that the US is planning a new aid package for Ukraine. US intelligence has assessed that Ukraine’s army would not be able to simultaneously defend Bakhmut and launch a spring counteroffensive, allies have reportedly urged Ukraine to prioritize the spring counteroffensive over defending Bakhmut.

As fighting continues in eastern Ukraine, new signals are emerging of Iran’s involvement in the war. A recent investigation by The Guardian found that Iran has used boats and a state-owned airline to smuggle advanced long-range armed drones to Russia. Meanwhile, Ukrainian military intelligence reportedly intercepted audio on February 10 of two Shahed drone operators coordinating targets. Ukraine’s military intelligence claimed the operators spoke in a Kurdish dialect mixed with Farsi words, suggesting the operators could be from Iran’s Kurdistan region. Iran has previously deployed forces organized by ethnicity; for example, the Fatemiyoun Division is composed mainly of Hazaras, an ethnic Afghan minority, which fought in Syria under the umbrella of Iran. 

—Ruslan Trad, Resident Fellow for Security Research, Sofia, Bulgaria

The Moldovan government was quick to respond after Ukrainian President Volodymyr Zelenskyy accused Russia of planning to destabilize Moldova. The first to react was the Information and Security Service of Moldova (SIS), which confirmed on February 9 that it had received intel from Ukrainian partners identifying subversive activities that aimed “to undermine the Republic of Moldova, destabilize, and violate public order.” 

The following day, a missile reportedly launched by Russia over Ukraine entered Moldovan airspace. Hours later, Prime Minister Natalia Gavrilita announced her resignation. In her final speech, Gavrilita stated “Moldova is entering a new phase, one in which security is our priority.” Later, Moldovan President Maia Sandu appointed defense and security adviser Dorin Recean as prime minister. While there is no evidence connecting the missile incident with Gavrilita’s resignation, as the government reshuffle has been a topic of discussion since November, security concerns may have accelerated the process.

On Monday, President Sandu organized a press conference in which she provided further details of the alleged plot, accusing Russia of trying to overthrow Moldova’s pro-Europe government. “The operation involved saboteurs with military training posing as civilians to carry out violent acts, assault on government institutions, and hostage-taking,” she said. Sandu added that the intel received from Ukraine included “good documentation of the locations and logistical aspects of the organization of such subversive activities,” and warned that citizens of Russia, Montenegro, Belarus, and Serbia could be among those involved.

These concerns about subversive Russian activity in Moldova are playing out in the sports world as well. On February 14, twelve fans of the Serbian football team Partizan Belgrade were banned from entering Moldova ahead of a match with Sheriff Tiraspol. The Moldovan Football Federation said that authorities decided the Europa League match would be played without spectators. Elsewhere, on February 15, authorities at Chisinau airport stopped a group of boxers from the Budva club in Montenegro and ordered them to leave Moldova. In a Facebook post, the club noted that they were given no explanation from Moldovan authorities.

Russia vehemently denied accusations that it wants to destabilize Moldova, accusing Ukraine of trying to draw Moldova into a confrontation with Russia. “The actual purpose of Kyiv, which disseminated the disinformation, is to drag Chisinau into a tough confrontation with Moscow,” said Russian Ministry of Foreign Affairs Spokesperson Maria Zakharova. Echoing false and misleading narratives previously used to justify the invasion of Ukraine, Russia has claimed that the West is inciting a conflict in Moldova. In early February, Russian Foreign Minister Sergey Lavrov told Russian media that the West is considering turning Moldova into “another Ukraine.”

Due to its proximity to Ukraine, Moldova faces serious security challenges. Russian rockets regularly breach the country’s airspace. Several days after the February 10 incident, airspace over Moldova was temporarily shut down on February 14 after reports of a balloon-like object flying over the country. On February 16, the Border Police of Moldova discovered the remains of a rocket. This marks the fourth time that missile remnants have fallen on Moldovan territory.

—Victoria Olari, Research Assistant, Moldova

Leaked emails released in an investigation on February 3 revealed that a covert organization run from inside Russian parliament interfered with European policies on occupied Crimea by offering cash and benefits to European politicians to propose pro-Russian motions in their local legislatures. The actions also included paying far-right activists to publish pro-Kremlin articles in European media outlets and arranging trips to occupied Crimea for European politicians and businesspeople.

The joint investigation, conducted by the Organized Crime and Corruption Reporting Project (OCCRP), Estonia’s Eesti Ekspress, Italy’s IrpiMedia, Austria’s Profil, and Russia’s iStories, focused on Russian parliamentary staffer Sargis Mirzakhanian, who previously ran the International Agency for Current Policy in the years following Russia’s annexation of Crimea. The investigation found that Mirzakhanian was working with several European politicians and activists, including Robert Stelzl, a pro-Russia political activist from Austria; Manuel Ochsenreiter of Germany’s right-wing Alternative for Germany (AfD) party; Mateusz Piskorski, a Polish political activist arrested in 2016 for spying for Russia; and Piskorski’s wife, Marina Klebanovich, who reportedly assisted with the coordination of the agency’s activities in Europe.

Mirzakhanian’s group allegedly drafted pro-Russian resolutions and paid politicians to put them forward in European legislatures. According to the investigation, the group planned for Italian Senator Paolo Tosato and Austrian Member of Parliament Johannes Hübner, both from far-right parties, to put forward resolutions to lift sanctions against Russia. A submitted resolution was valued at 20,000 Euros ($21,000 USD), with a further bonus of 15,000 Euros ($15,900 USD) for “successful voting.” The document in the leaked emails does not specify whether the money was intended to be paid directly to the two politicians or budgeted for the entire project.

Hübner and Tosato both presented resolutions against Russian sanctions on their respective parliament floors, but legislators did not adopt them. Both denied receiving money from Russia.

In 2016, a local council in Veneto, Italy, adopted a motion recognizing the Russian annexation of Crimea and calling to suspend European Union sanctions against Russia. Councils in the regions of Liguria and Lombardy followed Veneto’s example; soon after, Cyprus adopted a similar resolution.

The leaked emails reveal how Mirzakhanian worked with Russian politicians to bring European observers to local elections in Russia in 2017, violating the code of conduct for international election observers. The invitations were arranged through an NGO led by Kremlin-aligned politician Leonid Slutsky, and at least 68,000 Euros ($72,000 USD) was spent on the observation project. Politicians with ties to Mirzakhanian’s International Agency for Current Policy observed other Russian elections, and some allegedly sought to monetize their Kremlin connections by organizing promising contacts for business ventures.

Despite Mirzakhanyan’s disappearance from the public eye, his group’s European allies continue to make pro-Moscow statements and agitate for Russian interests. AfD’s Markus Frohnmaier criticized Germany for helping Ukraine. Austria’s Stelzl was photographed at a pro-Russian rally in Vienna in November of 2022 wearing a t-shirt with the pro-war Russian “Z” symbol, while Freedom Party of Austria (FPÖ) member Axel Kassegger demanded in September 2022 that Austria review its position on sanctions against Russia. 

—Ani Mejlumyan, Research Assistant, Armenia