Ukraine at D+110: A Sandworm sighting as Russia faces the UN.
the cyberwire logoJust Now

Russia's partial mobilization draws international criticism at the United Nations. Domestically, it's proving unpopular with those who face either conscription or recall to active service, and hardliners snort that it's another half-measure. In cyberspace, the GRU's Sandworm appears to have undertaken a new campaign against Ukrainian targets.

Ukraine at D+110: A Sandworm sighting as Russia faces the UN.

Ukraine makes its case at the UN.

President Zelenskyy addressed the United Nations by video conference yesterday, the AP reports, and a number of other world leaders in attendance seconded the Ukrainian president's remarks about a shift in battlefield fortunes in Ukraine's favor and Russia's responsibility for the war.

Russia's partial mobilization is running into difficulties.

The UK's Ministry of Defence (MoD) this morning took stock of Russia's partial mobilization, a large call-up of reservists. "On 21 September 2022, Russia’s Putin announced a ‘partial mobilisation’ to support operations in Ukraine. Russian Defence Minister Shoigu later confirmed this would involve the mobilisation of 300,000 reservist troops." Pulling together and organizing so many reservists presents logistical and managerial challenges that are likely to stress the Russian army. As the MoD puts it, "Russia is likely to struggle with the logistical and administrative challenges of even mustering the 300,000 personnel. It will probably attempt to stand up new formations with many of these troops, which are unlikely to be combat effective for months." International reaction to the mobilization (and to the nuclear threats that accompanied them) was, the New York Times reports, strongly adverse.

There are also issues of popular morale. The MoD says, "Even this limited mobilisation is likely to be highly unpopular with parts of the Russian population. Putin is accepting considerable political risk in the hope of generating much needed combat power." This prediction seems already to have been borne out. The Washington Post reports protests and arrests, and the Moscow Times says that there's "panic and fear" as thousands of young men seek to either leave the country or find some other way of avoiding a call-up. The AP reports a run on flights leaving Russia as some citizens seek to get out of the country before they can be called up. Belgrade, Istanbul, and Dubai were the most popular destinations until tickets sold out. The Baltic States are not permitting Russians fleeing military service to cross theii borders. Reuters quotes an email the news service received from Estonian Foreign Minister Urmas Reinsalu that explained, "A refusal to fulfil one’s civic duty in Russia or a desire to do so does not constitute sufficient grounds for being granted asylum in another country." The MoD concludes with an observation: "The move is effectively an admission that Russia has exhausted its supply of willing volunteers to fight in Ukraine."

Dissatisfied Russian nationalists, arguably more Putinist than Mr. Putin himself.

Bellingcat's Christo Grozev has been following the Wagner Group and the more extreme Russian nationalist circles. He thinks Wagner Group boss Prigozhin is posturing as a war leader, possibly laying pipe for a bid to succeed Putin, should the Russian President face ouster. "Prigozhin continues leaking videos of him[self] in commander-in-chief role (on this one, doing that 3 am meeting your commanders thing. Wagnerites tell me they'd vote for him over Putin any time, and it seems to me he smells blood." The tweet attracted some derisive outrage from pro-Kremlin trolls who follow Grozev, but Russian modes of succession are sufficiently unstable and ad hoc to make the possibility worth thinking about.

A recent prisoner exchange involving Azov Battalion troops and some foreign fighters has attracted outrage from Mr. Putin's hardline supporters. Grozev tweeted, "Russia's ultranationalist and mercenaries, who had briefly been appeased by Putin's mobilization announcement,are getting a heart attack now hearing that he also exchanged all Azov commanders and dozens more for Medvechuk - whom they despise. Instability in paradise." Among those protesting is Igor Ivanovich Strelkov, formerly known as Igor Vsevolodovich Girkin, formerly the self-proclaimed minister of defense in the self-proclaimed Donetsk People's Republic, now under indictment for his role in the destruction of  Malaysia Airlines Flight 17 (MH17). Mr. Strelkov regards Mr. Putin's policies as fatally soft, and has for some time argued for full mobilization.

Some observers have regarded increased expressions on Russian television of dissatisfaction with the progress of the special military operation as an additional sign that President Putin's nationalist supporters are growing dissatisfied with their leader. That may be so (and see this New York Times op-ed for a clear presentation of this reading of Russian opinion) but it's equally possible that the harder line being taken by the commentariat is being put out by the government in an effort to provide astroturfed support for escalation of the war.

A GRU campaign masquerades as Ukrainian telecommunications providers.

Recorded Future's Insikt Group reports that the GRU has established new infrastructure for cyberespionage against Ukrainian targets. The threat actor UAC-0113 (which CERT-UA thinks is probably associated with the GRU's Sandworm operation) is using dynamic DNS domains as it masquerades as telecommunications providers. It uses HTML smuggling to distribute Colibri Loader and the Warzone remote access Trojan (RAT). The objectives of the campaign remain unclear, but Recorded Future thinks it's a Russian combat support effort. The tools deployed in the attacks aren't bespoke tools developed in-house by the intelligence services, but are rather commodity malware publicly available in the criminal-to-criminal market.

Russian telecommunications outfits have indeed established services in territories occupied by the Russian army, but these are overt operations intended to replace Ukrainian providers with Russian ones. WIRED reports that, as Russia's battlefield fortunes have experienced reversals, the telcos have retreated with the troops. The point of setting up Russian services to replace Ukrainian ones is at least twofold. It helps normalize the Russian occupation, acclimating the population to accepting it as an accomplished, permanent state of affairs. Equally importantly, it increases the Russian ability to control what Ukrainians say, show, see, and hear.