Ukraine at D+111: International isolation and domestic discontent.
the cyberwire logoSep 23, 2022

Ukraine's counteroffensive continues to progress. Russia begins staging referenda on annexation in territories it still controls. The Kremlin faces growing isolation internationally and increasing dissatisfaction with the war at home. Russian security and intelligence service forge closer ties with cyber criminals.

Ukraine at D+111: International isolation and domestic discontent.

Ukraine continues to push east.

In its morning situation report, the UK's Ministry of Defense covers the progress of Ukraine's counteroffensive. "In the last three days, Ukrainian forces have secured bridgeheads on the east bank of the Oskil River in Kharkiv Oblast. Russia has attempted to integrate the Oskil into a consolidated defensive line following its forces’ withdrawals earlier in the month. To the south, in Donetsk Oblast, fighting is ongoing as Ukrainian forces assault the town of Lyman, east of the Siverskyy Donets River, which Russia captured in May. The battlefield situation remains complex, but Ukraine is now putting pressure on territory Russia considers essential to its war aims."

Russia's partial mobilization.

"The Kremlin’s attempt to fight the war with an army of expendables had failed," as the Telegram described the situation on the eve of Russia's partial mobilization this week. That is, Russia has run out of troops who don't count. The government is now reaching into a mixed pool of reservists, ex-soldiers who had received some military training but have not remained in the reserves, and in some cases young men with no military training whatsoever. The call-up seems to be proving broadly unpopular in Russia, the New York Times reports, even within the constraints of that closed society. Discontent seems to be fairly well distributed across the spectrum of political sentiment, with the partial mobilization upsetting those affected by it, and the prisoner exchange with Ukraine that was announced at the same time as the mobilization outraging the committed nationalists. The Washington Post describes the reaction to the two announcements as "fury."

Mr. Putin's stated intention is to field, rapidly, another 300,000 troops in Ukraine. Some sources close to the Russian government have suggested that the true number is higher, the Telegram reports, and indicate that the intention is actually to field roughly a million additional soldiers. Even the lower figure will be a tall order. The US Army, by way of comparison, reported an active-duty end strength of 485,900 at the beginning of fiscal year 2022. Thus the lower, official estimate, would involve collecting, processing, training, organizing, equipping, and transporting a force that's somewhat more than 60% the size of the American army. Or, if you care for another standard of comparison, 300,000 troops is well over twice the 112,000 active and reserve soldiers in the UK's Royal Army. Few observers think it likely that anything remotely approaching 300,000 effectives could be fielded over the course of a few weeks. CNN reviews the reasons why, even if all the conscripts Mr. Putin desires were scooped up and delivered to it, the Russian army wouldn't be able to train or equip them.

An essay in Foreign Affairs discusses why even a force increase that went off as planned would fail to redress the strategic errors and systemic shortfalls that underlie Russia's entire campaign against Ukraine. Fatally misleading intelligence about the enemy and the enemy's likely support from third-parties, poor training, abysmal logistics, incompetent battlefield leadership, a culture of micromanagement, and equipment that failed to perform up to expectations have combined to produce battlefield failure. The essay concludes:

"It is a common refrain among those who worry about Russia’s next moves that Putin cannot lose. But he can and he might. A series of terrible decisions has led him to undermine Russia’s international position and economic prospects, shatter the reputation of the Russian Federation as a serious military power, and fail in the most important gamble of his career. As with all wars, the future course of this one will have unpredictable aspects, but Ukraine, with a clear strategy, better weapons, and committed forces, has seized the initiative. The mobilization he has announced will not turn this around, and the use of nuclear weapons would make a bad situation catastrophic. Putin is on course to lose, and given the many thousands of lives already sacrificed, he fully deserves to do so."

Russia's international isolation increases.

Battlefield failure, atrocities, and manifest aggression have also produced increasing international isolation. UN investigators, the Guardian reports, have concluded that Russia has committed war crimes in Ukraine. At the UN this week, according to the AP, Belarus was the only country to express support for Russia's war, and even Belarus called the war a tragedy. Even China failed to repeat its (very tepid) support for Moscow's policy. In its clearest condemnation of Russia's war yet, India called for war criminals to be held to account. And many at the UN meetings denounced the coming referenda on annexation to be held in the occupied territory Russia still holds as shams, illegal gestures the international community won't recognize.

The Russian propagandist and television personality Vladimir Solovyov has offered a soliloquy on Russia's plans for Ukraine, and Russia's proper indifference to international opinion, From the Russia Media Monitor: "You want the inviolability of borders? Restore the USSR. What are they coming up with, saying 'We'll never recognize it?' Ukraine existed for thirty-one years. So it won't exist any more. Who cares? As Nikolai Vasilyevich Gogol wrote, 'I gave you life, and I will take it away.' And that's it. What do we even care? All of these assurances, all of this screaming, all of this buffoonery. So, you say you'll never recognize it. Who gives a damn about your 'never?' So don't recognize it. But we will, and that's that."

The GRU's close coordination with cyber criminals.

Russia has long tolerated cyber gangs, affording them a territorial safe haven from which they could work with impunity as long as their operations worked generally to the detriment of Russia's international rivals. A report this morning in the Wall Street Journal, citing research by Google's recently acquired Mandiant unit, describes the "unprecedented" ways such sufferance and toleration have evolved into active coordination and direction. The relationship has apparently developed well beyond the familiar permissive privateering the gangs have been encouraged to undertake.

Mandiant's report on this development, released this morning, focuses on the GRU, which is organizing the activities of nominally hacktivist groups and supplying them with GRU tools to attack Ukrainian networks. "Mandiant is tracking multiple self-proclaimed hacktivist groups working in support of Russian interests. These groups have primarily conducted distributed denial-of-service (DDoS) attacks and leaked stolen data from victim organizations. Although some of these actors are almost certainly operating independently of the Russian state, we have identified multiple so-called hacktivist groups whose moderators we suspect are either a front for, or operating in coordination with, the Russian state." Killnet is among those hacktivist front groups.

Cyber mercenaries.

SentinelLabs yesterday published an update on the Void Balaur cyber mercenary group. The hack-for-hire operation, which has operated in the criminal-to-criminal market since 2016, has expanded its activities. "New targets include a wide variety of industries, often with particular business or political interests tied to Russia. Void Balaur also goes after targets valuable for prepositioning or facilitating future attacks." Its infrastructure is described as "sprawling" and its methods are called "careless," but Void Balaur's volume is up. It's not generally clear who the group's customers are, but SentinelLabs points to some indications that a Russian security service may be among them. "A unique and short-lived connection links Void Balaur’s infrastructure to the Russian Federal Protective Service (FSO), a low-confidence indication of a potential customer relationship or resource sharing between the two."