Ukraine at D+546: Yevgeny Prigozhin dies in a plane crash.

Ukrainian forces continue to expand the gains they've made along their axis of advance toward the Sea of Azov.

Ukraine's military intelligence service announced, with supporting video, that it had destroyed a Russian S-400 Triumf mobile air defense system (NATO reporting name SA-21 Growler) stationed in occupied Crimea. How the attack was accomplished, whether by drone strike or sabotage or some other means, is unclear, but the Telegraph shares drone video of a very large explosion said to show the destruction. The S-400 is a new, relatively capable Russian missile system. How a cruise missile or large strike drone was able to penetrate the site is unclear. It's also unclear why a reconnaissance drone was permitted to loiter over the target, and do so in daylight, is also unclear. It's unlikely that a Growler would be expended against a small drone, but then "mix" is one of the three principles of air defense (the other two being "mass" and "mobility"), and it's surprising that other, smaller, shorter-range systems wouldn't have been employed to defend the airspace.

Russian drone and missile strikes continued to concentrate on Ukrainian grain storage and shipment sites.

Yevgeny Prigozhin is apparently killed in a plane crash.

Yevgeny Prigozhin, head of the mercenary Wagner Group and leader of the short-lived march on Moscow, is said to have died yesterday in the crash of an Embraer Legacy 600 outside the town of Kuzhenkino in the Tver Oblast. The business jet, with seven passengers and three crew members, was enroute to St. Petersburg from Moscow. All aboard were killed in the crash, Radio Free Europe | Radio Liberty said. The dead include not only Mr. Prigozhin, but also one of his principal lieutenants, Dmitry Utkin (whose callsign "Wagner" gave the Group its name), and five other men associated with the Wagner Group: Sergey Propustin, Evgeny Markaryan, Alexander Totmin, Valery Chekalov, and Nikolay Matuseev.

The Embraer Legacy 600 has a solid safety record, Reuters reports, with only one accident recorded in more than two decades of service, and that one due to pilot error. The crash is under investigation, but multiple unofficial (and in fairness unconfirmed) reports out of Russia say that the aircraft was shot down. Video of the crash made available in Russian state media showed the Embraer in a flat spin, trailing fuel from what appears to be extensive structural damage, and exploding on contact with the ground. There are unconfirmed reports that the aircraft was shot down by a Russian air defense system--the video includes what some think is a missile plume. One such report came from the Wagnerite Telegram channel Grey Zone, which was also among the first sources to announce Mr. Prigozhin's death. It remembered him as a hero and a patriot, and said his death was the work of "traitors to Russia."

TASS is authorized to disclose that the Federal Agency for Air Transport, Rosaviatsia, is investigating the mishap. "An investigation into the Embraer plane crash that occurred in the Tver Region this evening has been launched. According to the passenger list, the first and last name of Yevgeny Prigozhin was included in this list," Rosaviatsia said. Russian state television has announced that Rosaviatsia and other authorities have opened an investigation into the crash, with the initial focus being the state of the aircraft's maintenance, weather conditions, and the possibility of criminal negligence. The news report said that the aircraft "fell apart" during its descent, with some debris scattered over two kilometers. It also mentioned the possibility of "violations of transportation and safety rules," which will be investigated. Some Russian channels have speculated that the crash could have been due to "terrorism."

Whatever an investigation concludes, few are likely to buy the story that the crash was an accident. Many find it significant that the crash occurred a day after the (reported, rumored) dismissal of General Surovikin from his post at the head of Russian aerospace forces.

Thus immediate and widespread speculation has held that the plane was destroyed on the orders of President Putin, and thus that the apparent reconciliation between the President and Mr. Prigozhin amounted to little more than a feigned truce. The Daily Beast reviews the circumstantial but strong case for the crash having been a Kremlin-directed political assassination. US officials disclaim any confirmed knowledge of the incident, but US President Biden in this case spoke for informed Western opinion when he said he "wouldn't be surprised" if President Putin were behind the aircraft's destruction. The Institute for the Study of War assesses the crash as not only a deliberate shoot-down by a Russian air defense unit, but as a shoot-down with presidential authorization. "Putin almost certainly ordered the Russian military command to shoot down Prigozhin’s plane," the ISW writes. "Elements of the Russian military, especially Russian Defense Minister Sergei Shoigu and Chief of the General Staff Army General Valery Gerasimov, would be extremely unlikely to execute Prigozhin without Putin’s order. The entirety of the Russian political and security sphere likely viewed Prigozhin’s continued survival following Wagner’s rebellion as at Putin’s discretion."

Three essays in the Atlantic also make the case for assassination. One calls the crash "a very public execution," and one that "sends an unmistakable message." A second reviews recent Russian history and argues that "Vladimir Putin’s Russia has long been a land of mysterious deaths." The third piece suggests that Mr. Putin's victory over the one-time favorite he sees as having betrayed him may eventually prove pyrrhic. The crash is perceived in Russia and elsewhere, the Guardian reports, as a warning to potentially restive Russian elites: opposing Mr. Putin is fatal.

The Telegraph published a retrospective overview of Mr. Prigozhin's improbable rise and fall: petty criminal, yardbird, hotdog vendor, elite restaurateur and caterer, presidential confidant, private-sector intelligence service boss, warlord and war criminal, failed putschist, semi-exile, assassination victim.

The future of Russian influence operations in the post-Prigozhin era.

Mr. Prigozhin's troll-farming Internet Research Agency had already indicated after the march on Moscow that it was ceasing operations. It seems likely, however, that its template for disinformation and influence will continue in use by Russian intelligence services, especially the GRU. The Washington Post quotes an assessment by Gavin Wilde, formerly US National Security Council director for Russia, Baltic and Caucasus affairs, now a senior fellow with the Carnegie Endowment for Peace: “Prigozhin was for Russian information operations kind of what Kurt Cobain was for grunge music. The guy ushers in a certain era and perfects a certain craft, but now that he’s gone, what’s likely to follow is a saturated market of copycats, and that will probably end up falling far short of the kind of heyday or the prominence of what it once was."

A Russian pilot defects (with his aircraft) to Ukraine.

Ukraine's military intelligence service, the GUR, says it arranged the defection of a Russian pilot in his Mi-8 helicopter, Reuters reports. (The Mi-8 is a Soviet-era transport helicopter assigned the NATO reporting name HIP. (The hard-war Russian Telegram channel Fighterbomber said the pilot didn't defect, but just got lost, but this seems unlikely in the extreme.) The Mi-8 was carrying parts for Russian Su-27 and Su-30SM fighters. The defection had been long-planned, according to Ukrainska Pravda, with enough advance notice to enable the GUR to exfiltrate the pilot's family from Russia before he flew his aircraft to Kharkiv. It is sad to note that the two crewmen with the pilot were killed on arrival, by some accounts while resisting capture.

More on the doxing of a deputy Duma chair.

Cybernews close-reads the material posted about Aleksandr Babakov by InformNapalm and notices some interesting things. The deputy chairman of the Duma may have had a side-hustle smuggling iPhones into Russia, where the banned devices fetch a good price on the illicit market. The leaked documents the Ukrainian hacktivist auxiliary, Cyber Resistance, turned over to InformNapalm also include evidence of more obviously political misbehavior, including vote-rigging in bogus Crimean referenda. Kyiv's intelligence services have hailed, Teiss says, the "BabakovLeaks" as constituting a useful contribution to the cause of Ukraine.

Russian hacktivist auxiliaries make a major contribution to DDoS threat.

Radware's recently published 2023 H1 Global Threat Analysis Report looks, inter alia, at the current state of global distributed denial-of-service (DDoS) attacks and finds two Russian hacktivist auxiliaries atop the threat leader board. The researchers find that layer 7 attacks--layer 7 is the application layer--have surged, as have high-volume, long-duration attacks, while other forms of DDoS somewhat diminished. "NoName057(16) was the most active hacker group on Telegram, claiming 1459 DDoS attacks, followed by Anonymous Sudan with 660 attacks, and Team Insane PK with 588 attacks." NoNam057(16) and Anonymous Sudan are Russian operations. The group that showed in third place, Team Insane PK, is an Islamist group operating for the most part from Pakistan against targets in India.

APT TTPs as a red-teaming toolkit.

AttackIQ is offering a product that lets you test your resistance to an attack by the FSB's Turla group. You can run the test as a free trial.