Ukraine at D+330: Russian private militias on the rise.

With little change in the fighting on the ground, NATO continues to deliver weapons to Ukraine, and to plan its continuing support for Ukraine's defensive war against Russian invasion. The Telegraph and Al Jazeera both report that tanks are regarded as particularly important and that a number of countries who've purchased Leopard II main battle tanks are pressing Germany for permission to transfer them to Ukraine. The UK is dispatching 600 Brimstone anti-armor missiles to Ukraine, and the US yesterday announced a military aid package valued at some $2.5 billion. It includes:

• Additional munitions for National Advanced Surface-to-Air Missile Systems (NASAMS);
• Eight Avenger air defense systems; 
• 59 Bradley Infantry Fighting Vehicles (IFVs) with 590 TOW anti-tank missiles and 295,000 rounds of 25mm ammunition;
• 90 Stryker Armored Personnel Carriers (APCs) with 20 mine rollers;
• 53 Mine Resistant Ambush Protected Vehicles (MRAPs);
• 350 High Mobility Multipurpose Wheeled Vehicles (HMMWVs);
• 20,000 155mm artillery rounds; 
• Approximately 600 precision-guided 155mm artillery rounds;
• 95,000 105mm artillery rounds;
• Approximately 11,800 120mm mortar rounds;
• Additional ammunition for High Mobility Artillery Rocket Systems (HIMARS);
• 12 ammunition support vehicles;
• 6 command post vehicles;
• 22 tactical vehicles to tow weapons;
• High-speed Anti-radiation missiles (HARMs);
• Approximately 2,000 anti-armor rockets;
• Over 3,000,000 rounds of small arms ammunition;
• Demolition equipment for obstacle clearing;
• Claymore anti-personnel munitions;
• Night vision devices;
• Spare parts and other field equipment.

The Wagner Group and incipient warlordism in Russia.

The situation report this morning from the UK's Ministry of Defence focused on the Wagner Group. "On 27 December 2022, the Russian Unified State Register showed that the proxy paramilitary Wagner Group had formally registered as a legal entity. The group declared their core activity as ‘management consultancy’; no mention was made of combat services. It is not yet clear to what extent the ‘PMC Wagner Centre’ entity will be used to administer Wagner’s paramilitary activity. Private Military Companies (PMCs) remain illegal in Russia, despite protracted discussion about reforming the law. Wagner’s owner, Yevgeny Prigozhin, has likely partially funded the organisation via inflated government contracts awarded to his other companies. The registration continues the remarkably rapid development of the traditionally opaque group’s public profile. Prigozhin only admitted to founding Wagner in September 2022; in October 2022, it opened a glossy HQ in St Petersburg."

The note goes on to offer an appreciation of Wagner's end strength in the theater of operations. "Wagner almost certainly now commands up to 50,000 fighters in Ukraine and has become a key component of the Ukraine campaign." 50,000 troops amounts to a bit more than three division-equivalents, not a negligible force in any army. "The registration likely aims to maximise Prigozhin’s commercial gain and to further legitimise the increasingly high-profile organisation."

The higher profile is unlikely to be entirely welcome to the Russian government. Mr. Prigozhin has been critical of the Defense Ministry, calling it out for poor preparation of the special military operation. An essay in World Politics Review argues that President Putin has been more successful in suppressing liberal dissent than nationalist criticism. Indeed, nationalist voices have increasingly been raised against the conduct of the war, calling for its harder and more extreme prosecution. Mr. Prigozhin is generally aligned with this tendency.

There's a risk of descent into warlordism, with the attendant instability that inevitably produces. The Wagner Group is the largest and most prominent private military corporation, but it's not the only one, as the Odessa Journal pointed out in October. There's also a Chechen militia committed to the fight in Ukraine: Akhmad-Khadzhi Kadyrov's Kadyrovtsy have committed more than a thousand troops to battle. And even Defense Minister Shoigu has what World Politics Review calls a "lucrative side hustle" in the form of his own Patriot Private Military Company.

The essay in World Politics Review sees recent Russian command moves as an implicit rebuke to Mr. Prigozhin:

"Is Putin nervous about Prigozhin’s rise? Undoubtedly, he values the advances Wagner has achieved on the battlefield. But it’s notable that when Putin reshuffled the war’s command structure last week, he demoted Prigozhin’s favorite general and added to the responsibilities of one of the main targets of his criticism. Gen. Sergei Surovikin, the “butcher of Syria” whom Prigozhin admires, lost his post leading the invasion to Gerasimov, the man Prigozhin has been insulting. Perhaps it is a poisoned chalice for Gerasimov, but it is also a signal to Prigozhin about the limits of his influence in the Kremlin."

Wagner Group sponsors a hackathon.

The Wagner Group hasn't neglected information technology, either, sponsoring a hackathon last month designed to contribute to the "development of IT projects to protect the interests of the Russian army." The hackathon offers another example of the ways in which criminals serve as cyber auxiliaries for the Russian organs. The Atlantic Council reports that the winners were, from first to third place, GrAILab Development, SR Data-Iskander, and Artistrazh. Artistrazh's co-founder is one Igor Turashev, wanted by the US FBI for his involvement with, among other things, Dridex banking malware. Mr. Turashev was indicted in the Western District of Pennsylvania on November 13, 2019. The charges he faces, if the US ever gets its hands on him, include "Conspiracy, Conspiracy to Commit Fraud, Wire Fraud, Bank Fraud, and Intentional Damage to a Computer."

Gamaredon APT runs Telegraph phishing against Ukrainian targets.

BlackBerry researchers reported yesterday that they'd observed Gamaredon operators running phishing attacks against Ukrainian targets. The phishbait consists of spoofed Ukrainian government or corporate documents. "The Gamaredon Group’s network infrastructure relies on multi-stage Telegram accounts for victim profiling and confirmation of geographic location," BlackBerry says, "and then finally leads the victim to the next stage server for the final payload. This kind of technique to infect target systems is new." The final payload is an information stealer first observed in September of this past year. Gamaredon, also known as Primitive Bear or Actinium, is generally believed to be an FSB operation run out of occupied Crimea. This particular operation seems to be hands-on, and not heavily automated.