Ukraine at D+53: Retaliation and disinformation.
Disinformation and nuisance-level cyberattacks.
N2K logoApr 18, 2022

As Russia increases missile and rocket strikes against Ukrainian cities (in retaliation for Ukrainian "diversions," "sabotage," and "terrorism," says Moscow; in revenge for the loss of the cruiser Moskva, says everyone else) and redeploys forces to Donbas and the coast, nuisance-level cyber operations continue.

Ukraine at D+53: Retaliation and disinformation.

Russia's war on the ground against Ukraine is marked, as the week opens, by three salient features: first, the continuing, slow reconstitution of forces for a shift of attention to the Donbas and the Black Sea coast (especially the besieged city of Mariupol), second, long-range rocket and missile strikes against Kyiv, Lviv, and Kharkiv (these thought be retaliation for the loss of the cruiser Moskva to Ukrainian anti-shipping missiles, and, finally, continuing Russian atrocities in occupied and contested areas.

The UK's Ministry of Defence commented on the reduction of Mariupol in this morning's situation report "Russian commanders will be concerned by the time it is taking to subdue Mariupol. Concerted Ukrainian resistance has severely tested Russian forces and diverted men and materiel, slowing Russia’s advance elsewhere. The effort to capture Mariupol has come at significant cost to its residents. Large areas of infrastructure have been destroyed whilst the population has suffered significant casualties. The targeting of populated areas within Mariupol aligns with Russia’s approach to Chechnya in 1999 and Syria in 2016. This is despite the 24 February 2022 claims of Russia’s Defence Ministry that Russia would neither strike cities nor threaten the Ukrainian population."

On Sunday the MoD noted Russian redeployment from Belarus. "Russian forces continue to redeploy combat and support equipment from Belarus towards eastern Ukraine. This includes locations close to Kharkiv and Severdonetsk. Russian artillery continues to strike Ukrainian positions throughout the east of the country where Russia plans to renew its offensive activity. Though Russia’s operational focus has shifted to eastern Ukraine, Russia’s ultimate objective remains the same. It is committed to compelling Ukraine to abandon its Euro-Atlantic orientation and asserting its own regional dominance."

On Saturday, the MoD commented, "Road infrastructure in conflict affected areas of Ukraine has sustained significant damage. Russian troops have exacerbated this by destroying bridges, employing land mines and abandoning vehicles along key routes as they withdrew from northern Ukraine. The destruction of river crossings in and around Chernihiv has left only one pedestrian bridge in the city itself across the Desna River. Prior to the war, the city had approximately 285,000 residents. Damage to Ukraine’s transport infrastructure now presents a significant challenge in delivering humanitarian aid to areas formerly besieged by Russia."

The MoD's most recent situation map summarizes the fighting on the ground. Mariupol is very hard-pressed, with the UN warning of widespread starvation in and around the city. Ukrainian defenders are holding a large steel mill, the Illich Steelworks, as the linchpin of their defense, and they have rejected a Russian ultimatum that comes down to an alternative of surrender or death, Time reports. According to the Guardian, Ukrainian President Zelenskyy says he will terminate negotiations with Russia should its forces carry out their threat to "eliminate" the defenders.

Face-saving disinformation.

Russia has claimed that the guided missile cruiser Moskva was lost due to a combination of an internal explosion followed by unfavorable weather while the damaged vessel was under tow. Most foreign intelligence services seem to have concluded that the Ukrainian account of having hit the Moskva with Neptune anti-ship missiles is correct.

A wave of intense, long-rang fire was over the weekend delivered against Ukrainian targets by Russian rocket and missile units. According to the Telegraph, Russian official source said the strikes were retaliation for Ukrainain "sabotage" and "terrorism." On Friday the Russian Ministry of Defense said that such attacks were coming, and would intensify. Military Times reports that the strikes are, in Moscow's telling, legitimate retaliation for what the Kremlin calls Ukrainian “diversions on the Russian territory.” Most foreign observers regard the attacks as revenge for the sinking of the Moskva, and as providing a slantendicular confirmation of Ukraine's account of the sinking.

The Moskva had a crew of five-hundred-ten, and, while TASS and other official sources initially claimed they'd all been evacuated from the damaged vessel, subsequent accounts eliminated the word "all," and survivors' homecoming have not been featured in Russian news sources. The Telegraph cites observers' informed speculation that casualties may have been very heavy, perhaps numbering in the hundreds, but these estimates are unconfirmed.

Some video and images that appear to show the sinking of the Moskva have appeared. These too are unconfirmed, the Guardian reports, but they appear to have been taken from one of the tugs that came to the cruiser's assistance.

Nuisance-level cyberattacks continue.

Interfax-Ukraine relays a warning from the State Service for Special Communications and Information Protection that Russian operators are sending phishing messages that represent themselves as communications from Kyiv's security service, the SBU. The State Service's warning says, in part, "The enemy does not abandon attempts to arrange cyberattacks in Ukraine. And although they are usually unsuccessful, each of us should be attentive to information security. Yes, this time the occupiers are sending out computer viruses, allegedly on behalf of the SBU. Cybercriminals use popular instant messengers for correspondence, in messages they ask to download a file with seemingly instructions for actions for a period of wartime. Although in fact it is a computer virus." The targets of the phishing campaign are for the most part government officials. The authorities advise the usual precautions against social engineering.

The Gibraltar-based crypto exchange Currency.com has disclosed that it experienced a distributed denial-of-service (DDoS) attack last Tuesday. It describes the attack as "unsuccessful," and, while offering no attribution, notes that the incident occurred the day after the exchange announced it "was halting operations for residents of the Russian Federation."

Russian organizations have come under hacktivist assault. The Record summarizes recent activity by OldGremlin and NB65 against a range of Russian interests. NB65's motivations in particular are clearly and explicitly expressed in terms of opposition to Russia's war against Ukraine.