Ukraine at D+614: Riots and disinformation.

Ukraine's incremental advance near Bakhmut and in western Zaporizhia Oblast have been independently confirmed, the Institute for the Study of War (ISW) reports. The ISW also quotes Russian milbloggers who continue to criticize the use of poorly trained Storm-Z penal formations in murderously costly, ill-supported frontal assaults against Ukrainian positions in Avdiivka. The milbloggers call the attacks "meat assaults" and say the Storm-Z units are expended in a few days of operation, losing between 40% and 70% of their personnel in these engagements. (A comparative note: US targeted doctrine considers a unit that's taken 20% losses to have been destroyed, effectively rendered permanently incapable of combat operations.)

According to Al Jazeera Russian forces have committed more troops to the defense of Bakhmut. Indiscriminate Russian shelling continues to exact a toll in civilian lives.

The UK's Ministry of Defence reports a change in command in the crucial Kherson sector. "As reported by Russian state-backed media, the deputy commander of Russian forces in Ukraine, Colonel General Mikhail Teplinsky, has likely personally taken over command of Russia’s Dnipro Grouping of Forces. He replaces Colonel General Oleg Makaevich. The force is responsible for the occupied areas of Kherson Oblast, including the eastern bank of the Dnipro River. Fighting has intensified in this area in recent weeks as Ukrainian forces have contested Russian control of the river’s eastern bank. Teplinsky is likely held in high regard by the Russian General Staff and has experience commanding operations in the area: he was the officer on the ground in charge of Russia’s relatively successful withdrawal from west of the Dnipro in November 2022. It is almost certain that repelling Ukrainian attacks across the Dnipro and holding territory in occupied Kherson Oblast remains a high priority objective for Russian forces in Ukraine. Teplinsky’s appointment is likely an indication of increased pressure on Russian forces defending the area."

Russia blames the West for the Dagestan pogrom, and sees Ukrainian denunciation of an atrocity as an attempt to foment interethnic hatred.

According to the ISW, Russian officials said that MVD and Rosgvardia troops "suppressed the antisemitic riots in Makhachkala, Republic of Dagestan," yesterday. The rioting was centered on the local airport, and at least one-hundred-fifty rioters were identified by authorities. Sixty were detained, and the search for other rioters continues. Dagestan leader Sergey Melikov said that physical force was used against the rioters only as a last resort, and that the MVD and Rosgvardia personnel sought to calm the rioters with an appeal to their reason.

Melikov also said that pro-Ukrainian Telegram channels have been seeking to destabilize the region by spreading rumors of an influx of Israeli refugees. President Putin seconded the broad outlines of Malikov's assertions: the riots “were inspired, among other things, through social networks, from Ukraine’s territory by Western intelligence services.” Why Western intelligence services would need to be in Ukraine to post in Telegram is unclear, but the big point is that outside agitators, in Mr. Putin's view, are responsible for social disorder. The rioters aren't being directly condemned. They have no agency in this: it's the West and the West's Ukrainian puppets who are responsible for "instituting pogroms." At least, that's the view from the Kremlin. The state television service Rossiya 1 reported the rioting as being straightforwardly a Ukrainian provocation, the riot itself amounting to a deliberate Ukrainian pogrom designed to undermine Russian national unity. This is implausible, to say the least, since pogroms in Russia are overdetermined and require no outside inspiration, but this is the narrative the Russian government has adopted. (See the Russian Media Monitor for valuable selections of official domestic Russian self-presentation.)

US officials dismissed the Russian accusations. The Guardian quotes National Security Council spokesman John Kirby: " “Classic Russian rhetoric, when something goes bad in your country, you blame somebody else. The west had nothing to do with this. This is just hate, bigotry and intimidation, pure and simple. Some people will compare it to the pogroms of the late 19th and early 20th century and I think that’s probably an apt description, given that video that we’ve seen out there.” 

Elsewhere, there are credible reports of Russian troops murdering a Ukrainian family in the occupied Donetsk town of Volnovakha, Russian commentators and milbloggers deplored not the incident itself, but rather the suggestion that Chechen troops were responsible. This is read as Ukrainian perfidy: Kyiv is trying to foment interethnic strife within Russia. The ISW observes, "The fixation on the Ukrainian accusation rather than on the atrocity itself, the need to hold the perpetrators accountable, or the unprofessionalism and indiscipline of soldiers committing such crimes suggests that these Russian commentators are very concerned about inter-ethnic tensions in Russia and the Russian armed forces."

Russia will establish an autarkic substitute for VirusTotal.

The Record reports, citing an account in Rosiskaya Gazeta, that Russia is in the process of establishing a free security package for Internet users. Called "Multiscanner," the project will be prototyped this year, further developed in 2024, and released in finished form during 2025. It will perform, Deputy Minister of Digital Development, Communications and Mass Communications Alexander Shoitov says, all the functions of VirusTotal, and then some. Replacement of VirusTotal, however, is a principal goal of the program: Russian authorities regard VirusTotal as a security risk. The Record explains, "Similarly to VirusTotal, the service would ultimately not only remotely check files and links using static analysis, but also conduct behavioral analysis on the suspected malware in virtual controlled sandbox environments."

Commodity tools empower low-grade Russian cybercriminals.

"Kopeechka" ('Little Penny," in the familiar diminutive form with which Slavic languages are so rich) is a commodity tool that enables criminals to create large numbers of fake social media accounts by enabling its users to bypass requirements that accounts be associated with unique email addresses and phone numbers. Active since 2019, Kopeechka, the Record reports, has enabled creation of fraudulent accounts in Facebook, X (formerly Twitter), Discord, Telegram, and Roblox.

Trend Micro, whose researchers have investigated the criminal service, says, "Kopeechka does not provide access to email inboxes, but it provides access to emails received from social media platforms. The service has been designed so that the mailbox account is still controlled by Kopeechka and not by any third-party user." The study adds, "We suspect that these email addresses are either created by Kopeechka actors themselves or possibly compromised email inboxes, as we’ve previously seen these actors post messages in underground communities’ compromised email threads. Kopeechka also purchases email accounts."

The service is actively hawked in criminal-to-criminal (C2C) online souks, and it's supported with user-friendly training and customer service. It's also cheap, with bogus email addresses available for pennies, not dollars. Trend Micro concludes its report with an appraisal of the service's value proposition. "Kopeechka’s services can facilitate an easy and affordable way to mass-create accounts online, which could be helpful to cybercriminals. Kopeechka customers use the service to easily create a large number of accounts without the hassle of SMS and email verification. While Kopeechka is mainly used for multiple accounts creation, it can also be used by cybercriminals who want to add a degree of anonymity to their activities, as they do not need to use any of their own email addresses to create accounts on social media platforms."

Given Russophone criminal gangs' closeness to Russian intelligence and security services, Kopeechka can be expected to turn up in state-sponsored attacks.

(Added, 5:45 AM ET, November 14th, 2023.) Kopeechka Store wrote to say that they don't condone criminal abuse of their tool, that advertising for their service on underground fora appeared there due to a "mistake" and will be removed, and that Kopeechka Store neither steals credentials and mailboxes nor knowingly trades in such stolen online commodities.