As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union (EU)—the DFRLab’s global team presents the latest installment of the Russian War Report. 

Strike on Ukrainian cafe leaves more than forty dead

Website impersonating Ukrainian news agency spreads narratives aimed at undermining Ukrainian morale

Russia increasingly using criminal charges for online activities, says digital rights group

Russia’s federal budget draft indicates a funding boost for state media

Putin meets South Sudanese President Salva Kiir

An attack on the village of Hroza in northeast Ukraine left more than four dozen people dead, according to a Telegram statement from Ukraine’s Office of the General Prosecutor. According to the statement, the attack occurred around 1:25 p.m. local time on October 5, destroying a local cafe shop. It also noted local prosecutors have launched a pre-trial investigation. In a separate Telegram post, which included graphic imagery, Ukrainian presidential adviser Oleksiy Kuleba blamed Russia for the attack, stating, “A terrorist country deliberately kills peaceful Ukrainians. The world needs to see what true evil is.”

The United Nations Office for the Coordination of Humanitarian Affairs (UN OCHA) also condemned the attack. “Intentionally directing an attack against civilians or civilian objects is a war crime,” UN OCHA Humanitarian Coordinator for Ukraine Denise Brown stated. “Intentionally launching an attack knowing that it would be disproportionate is a war crime.”

Meanwhile, a Reuters report published on October 3 claimed that the Russian army has embedded so-called “Storm-Z” units within conventional Russian units to conduct counterattacks against Ukrainian gains in crucial front sectors. Reuters reported that the Storm-Z units comprise 100-150 personnel, including civilian penal recruits and Russian soldiers under punishment. The Russian army and defense ministry have not confirmed the existence of the Storm-Z units.

—Andy Carvin, managing editor, Washington DC

—Ruslan Trad, resident fellow for security research, Sofia, Bulgaria

The DFRLab has identified at least one Facebook ad promoting a website impersonating a Ukrainian news agency. The now-defunct Facebook page “Onaqaq online shop” published the ad. It accused Ukrainian President Volodymyr Zelenskyy and Ukrainian leadership of corruption and misusing aid provided by the United States. The ad featured a caricature of the president alongside text noting the creation of a US team to monitor how aid to Ukraine is being used. The ad declared that all of Ukraine’s elite are corrupt and shared a debunked claim about a former “commander-in-chief,” likely a reference to Oleksii Reznikov, buying a villa for his daughter. 

The ad included a link to the website thumbra.com, which when accessed by the DFRLab redirected to unian.in, a page masquerading as the website for the Ukrainian Independent Information Agency, unian.ua. At the time of writing, the website no longer redirected to the copycat website. Much of the content on the copycat website links back to UNIAN’s actual website, including share buttons. The link in the ad led to a forged story regarding Ukraine’s allies becoming skeptical of its ability to succeed in the war against Russia. The article cited decreased military aid as an indicator that allies are abandoning Ukraine.

Multiple aspects of the forgery point to it likely being of Russian origin. The strongest indicator is that the URL address includes “skepsis-i-podozritelnost,” which is transliterated from Russian, not Ukrainian. Second, the article is written in Ukrainian, but the tone and style differ from that of the information agency. Third, the faux article’s banner image, a stock photo, does not have a caption, as is standard for UNIAN. The image was also edited to include a text overlay, which reads “Allies don’t believe in us anymore?” UNIAN does not edit the stock photography it uses for banner images.

These types of forgeries are not unique. On September 18, a Ukrainian researcher found a similar forgery replicating the UNIAN website, which spread a narrative claiming that Ukraine’s allies are decreasing weapons shipments to Ukraine to force it to negotiate with Russia. The article stated that Ukraine’s losses were “in vain” as its allies plan to “sacrifice” the country for their own self-interest. 

Campaigns such as this are likely intended to decrease the morale of Ukrainians. The DFRLab has previously covered similar attempts by Russia to impersonate media, including Operation Doppelganger, in which Russian assets impersonated prominent European news outlets.

—Roman Osadchuk, research associate

In its latest monthly digest, Russian digital rights organization Roskomsvoboda examined high-profile cases in which Russian politicians or activists were punished, via administrative or criminal charges, for their online activities. According to Roskomsvoboda, the cases illustrate an increasing use of criminal charges rather than administrative ones, a reversal of what it observed in 2022.

The report also noted instances of Russians being punished for Telegram posts that “disrespect” or “discredit” Russian authorities or the army. One person was criminally charged for giving an interview to Ukrainian media, while another was charged for “participating in an extremist community.”

—Eto Buziashvili, research associate, Tbilisi, Georgia

On September 29, the Kremlin submitted the 2024-2026 draft federal budget to the State Duma. According to the independent Russian news outlet Verstka, the Kremlin plans to increase funding for its state-run platforms, which are known to sow disinformation and propaganda. The increase coincides with Russia’s 2024 presidential elections. 

The budget reportedly allocates 315 billion rubles ($3 billion) to support Russian media for the next three years. The budget assigns 121.3 billion rubles ($1.2 billion) for 2024, 94.1 billion rubles ($945 million) for 2025, and 99.5 billion rubles ($1 billion) for 2026. Overall, the draft media budget represents a decrease of 20 billion rubles ($200 million) from the previous budget; according to Verstka, the draft indicates that state-owned media will receive the largest funding stream in the election year, after which funds will decrease.

The report also noted that in 2024, RT will receive 1.8 billion rubles ($18 million) more than it received last year, and Vladimir Solovyov’s channel Solovyov LIVE will receive 750 million rubles ($7.5 million).

—Eto Buziashvili, research associate, Tbilisi, Georgia

South Sudanese President Salva Kiir travelled to Moscow to meet with Russian President Vladimir Putin on Thursday, September 28, where the two reportedly agreed to strengthen the relationship between the two countries, particularly focusing on trade, energy, and oil.

According to a transcript posted by the Kremlin, Putin told Kiir, “This is only the beginning. We have many good opportunities in a variety of fields, including energy.”

Oil-rich South Sudan seceded from Sudan in 2011 with Kiir at the country’s helm. South Sudan was admitted to the United Nations in the same year. The country has had a tenuous relationship with the international body, however, which extended an arms embargo against South Sudan in 2022; Russia abstained from that vote. Given that Russia is a permanent member of the UN Security Council, Kiir may look to Russia as an ally in his bid to have the embargo lifted. Notably, Kiir told Putin that Russia was a “strong friend” of South Sudan. 

In his statement, Putin claimed Russia would also support South Sudan on the domestic front. Kiir is facing mounting pressure from the international community to move forward with a peace deal signed in 2018 and prepare for elections in 2024.

Putin’s meeting with Kiir comes off the back of the July 2023 Russia-Africa summit, in which Russia attempted to strengthen and solidify its relationships with African countries. In May 2023, the African Union warned that African countries should “resist all forms of instrumentalization” in a conflict that threatens to “transform Africa into a geostrategic battleground,” adding that it would come at the detriment of the continent.

—Tessa Knight, research associate, London, United Kingdom