Ukraine at D+522: Progress, albeit slow, in Ukraine's counteroffensive.

Ukraine's counteroffensive continues to grind forward, slowly. The weekend was marked by one notable event: the capture of the village of Staromaiorske, in the southeastern axis of advance. The New York Times reports signs of combat refusals in some of the Russian units in the zone, although these fall far short of a general collapse.

Ukrainian President Zelenskyy warned that "war was coming to Russia." There is no reason Russia should expect immunity on its own territory. He said, "Gradually, the war is returning to the territory of Russia -- to its symbolic centers and military bases. And this is an inevitable, natural, and absolutely fair process," Three Ukrainian drones hit Moscow on July 30th. Whether they reached their targets or were shot down by Russian air defenses is unclear, but the incident forced the temporary closure of Moscow's Vnukovo airport. In an unrelated event, an explosion last week at a large Russia oil refinery in Samara has been assessed as sabotage. Russian authorities have accused a plant worker of responsibility; he is said to have been apprehended while attempting to flee to Kazakhstan.

Russian missile strikes continued to hit Ukrainian cities, with both Kherson and Kryvyi Rih hit early Monday morning. At least four civilians died in the Kryvyi Rih attack. The New York Times reports that Kyiv expects renewed Russian efforts to destroy Ukraine's power grid.

Russia has attempted to regain the initiative with local attacks at several points, but Saturday the UK's Ministry of Defense (MoD) assessed those attempts as having so far failed. "Over the last 48 hours there has been an uptick of fighting in two sectors in southern Ukraine. South of Orikhiv, fighting is focused near the village of Robotyne, in the area of responsibility for Russia’s 58th Combined Arms Army. Eighty kilometres to the east, Ukrainian forces defeated elements of Russian airborne forces’ (VDV) 247th Guards Air Assault Regiment to capture the village of Staromaiorske. Meanwhile, in the north, other VDV units continue offensive operations in the Serebriansk Forest west of Kremina but have achieved little ground." The deployment of airborne forces, considered by most armies to represent an elite (and in the Russian Army especially so), would seem to indicate the importance Russian commanders attached to the attacks.

A renewed Russian nuclear threat.

Russia’s former president Dmitry Medvedev, currently deputy chair of its Security Council, explained that Ukrainian success in its counteroffensive would leave Russia no choice but to use nuclear weapons. “Imagine if the.. offensive, which is backed by Nato, was a success and they tore off a part of our land, then we would be forced to use a nuclear weapon, according to the rules of a decree from the president of Russia,” Mededev explained. “There would simply be no other option. So our enemies should pray for our warriors’ (success). They are making sure that a global nuclear fire is not ignited.”

Wagner Group's cantonment in western Belarus.

Sunday morning's situation report from the UK's MoD describes the Wagner Group's establishment in Belarus. "Since mid-July 2023, at least several thousand Wagner troops have likely established themselves at a military camp at Tsel, in central Belarus. Imagery shows that since mid-July 2023, hundreds of vehicles have arrived at the previously mostly empty facility. Separate reports suggest most of the visible vehicles are trucks and minibuses with few armoured combat vehicles. It remains unclear what has happened to the heavy equipment Wagner used in Ukraine; there is a realistic possibility that it was forced to return these to the Russian military. Wagner’s ability to secure heavy equipment and enablers such as air transport will be key factors in its future combat effectiveness."

The Wagner Group's current tactical capabilities may be unclear, but its presence in Belarus is disturbing to neighboring countries. Poland last week redeployed troops to regions bordering Belarus and warned of the threat posed by the Wagnerites' staging in western Belarus. At week's end both Poland and Lithuania said they were considering closing their borders to Belarus as a security measure.

Obtaining manpower for a long war.

Monday's situation report from the UK's MoD describes legislation aimed at boosting available military manpower. "The Russian authorities are prioritising amending legislation to allow more men to be rapidly drafted into the military. In mid-July 2023, the state Duma increased the maximum age of liability for conscription from 27 to 30, while retaining the current lower limit at 18. While conscripts are not currently deployed in Ukraine, extra draftees free up professional and mobilised soldiers from other duties inside Russia." Such conscripts would also furnish a pool of manpower available for recall as reserves. "On 24 July 2023, President Putin signed a bill which will gradually increase the upper age limit for those liable for call up as reservists, with senior officers can now be mobilised up to 70. Reservists made up the Autumn 2022 'partial mobilisation' and could provide a more immediate boost to the number available to fight in Ukraine. The increased chance of being compelled to fight, drone attacks on Moscow, exceptional level of domestic repression, and the recent Wagner mutiny combine to highlight the Russian state’s failure to insulate the population from the war."

Dealing with dissent, both hard- and anti-war.

The Institute for the Study of War wrote, over the weekend, that the sometimes fractious Russian mil-bloggers--hard-war men, but often critical of the way their Ministry of Defense has been running the fight--"appear to be coalescing around the Kremlin’s narrative effort to portray the Ukrainian counteroffensive as a failure, increasingly overstating Ukrainian losses and writing less about Russia's losses and challenges than they had been." There's reason to believe they've been encouraged to do so by the arrest of Igor Girkin, who had been among the most prominent and intemperately critical of the hard-war malcontents. At a July 29th press conference President Putin addressed suppression of dissent. He explained in response to a journalist who asked whether it was "normal for people to be arrested for things they have written or said," that, since Russia "is in an armed conflict with a neighbor," stands to reason that "there must be a certain attitude toward people who are causing harm inside the country."  

SVR cyberespionage against diplomatic services.

Recorded Future's Insikt Group is tracking a cyberespionage campaign against diplomatic services that Russia's SVR ran between February and June of this year. The researchers don't have a great deal of direct insight into the targets' environment, but their reasonable conjecture is that the operation has reflected Russia's continuing interest in European governments, especially their diplomats. As is commonly the case, the attack begins with spearphishing, the phishbait being such lures as an ambassador's schedule, an invitation to an embassy reception, or, in a case we've seen before, an ad for a used BMW. The message redirects to a compromised domain from which BlueBravo (as Recorded Future calls the SVR threat actor) installs malware that gives it persistence in the target's network. BlueBravo has cycled through at least three major tools this year. The one most recently used the researchers call "GraphicalProton," a loader that's staged in an ISO or ZIP file. GraphicalProton exploits legitimate services, especially Microsoft OneDrive for delivery to the target.

Recorded Future concludes, "We assess that as the war in Ukraine continues, it is almost certain BlueBravo will continue to consider government and diplomatic institutions high-value targets, with a likely focus on entities in Europe or those who are aligned with Ukraine. As such, we believe it is likely these entities will continue to be central in BlueBravo’s targeting calculus for the foreseeable future. BlueBravo’s targeting of these entities highlights their importance to decision-makers in military and strategic leadership positions in the Russian government."

A note on designations. The names of state-directed threat groups tend to be Legion. In this case, BlueBravo's activity tracks, Recorded Future explains, the activity of the groups known as APT29, Cloaked Ursa, and Midnight Blizzard (that last one being Microsoft's replacement for the former name "Nobelium").