Ukraine at D+89: Russian disinformation and cyber reconnaissance.
N2K logoMay 24, 2022

Russian leaders say all is going according to plan (and that the root cause of the crisis is an Anglo-American plot centuries in preparation), but some signs of internal dissent may be surfacing in Russia. Disinformation efforts continue, and some FSB reconnaissance is detected in Austrian and Estonian networks.

Ukraine at D+89: Russian disinformation and cyber reconnaissance.

This morning's situation report from the UK's Ministry of Defense (MoD) concentrates on the renewed Russian push in Luhansk. "Russia has increased the intensity of its operations in the Donbas as it seeks to encircle Severodonetsk, Lyschansk, and Rubizhne. At present the northern and southern axes of this operation are separated by approximately 25 km of Ukrainian-held territory," the MoD says. "There has been strong Ukrainian resistance with forces occupying well dug-in defensive positions. Ukraine’s long-established Joint Force Operation likely retains effective command and control of this front. Russia has, however, achieved some localised successes, due in part to concentrating artillery units. Russia’s capture of the Severodonetsk pocket would see the whole of Luhansk Oblast placed under Russian occupation. While currently Russia’s main effort, this operation is only one part of Russia’s campaign to seize the Donbas." But there's a downside to advancing, for Russia. "If the Donbas front line moves further west, this will extend Russian lines of communication and likely see its forces face further logistic resupply difficulties."

The 155mm artillery the US provided Ukraine's army is now in action, the New York Times reports. Enough Ukrainian troops have been familiarized with the M777 howitzers to be able to use them. The Times doesn't know what targets the gun-howitzers were being used against, but it seems likely that they're being employed in a counterfire role against Russian artillery.

The Kremlin's presentation of its war against Ukraine.

The Russian advance has been slow and uncertain, "bogged down," in the AP's summary of its progress so far, as Russia shifts to smaller, possibly more achievable goals in the Donbas. Russian Defense Minister Shoigu says that this is all part of the plan, and that what Western observers see as combat incapacity is in fact humanitarian restraint, since Russia has taken extraordinary pains to avoid harm to noncombatants. In any case, all is proceeding according to plan, or so he tells RIA Novosti. "Russian troops, unlike the Armed Forces of Ukraine," RIA Novosti paraphrases, "do not strike at civilian infrastructure where civilians may be. The firing positions and military facilities of the enemy are hit with the help of high-precision weapons, the general stressed."

General Shoigu (in fairness the rank comes with his office, not his service record: the Defense Minister is a costumed civilian, not a professional soldier) is not the only Russian official to indulge improbable insistence. Argumenty i Fakti has an interview with Nikolai Patrushev, Secretary of the Security Council of the Russian Federation, who doubles down on the claim that Russia is fighting Nazis in Ukraine, and that the hidden hand behind those Nazis is that of the Anglo-American financiers, who are manipulating war (that is, Russia's invasion of Ukraine), starvation (that is, Russia's blockage of Ukrainian grain exports), and pestilence (that is, deliberate introduction of engineered pathogens into the wild to goose the profits of the pharmaceutical companies). The Anglo-Americans have been doing this for centuries, Mr. Patrushev explains. The world should hope for the success of Russia's special military operation, he says, but "Probably, Westerners will not take off their rose-colored glasses until the brutalized Ukrainian thugs start to rage on their streets."

Mr. Patrushev dismisses perceptions that Russia's operation is slowing. Instead, it's just thorough. "We are not chasing deadlines. Nazism must either be 100% eradicated, or it will rear its head in a few years, and in an even uglier form." And he's confident of success, and emphasizes the righteousness of Russia's conduct in Ukraine. "All the goals set by the President of Russia will be fulfilled. It cannot be otherwise, since truth, including historical truth, is on our side. Not for nothing that General Skobelev once said that only our country can afford such a luxury as to fight out of a sense of compassion. Compassion, justice, dignity are powerful unifying ideas that we have always put and will put at the forefront."

It seems safe to say that no one really believes any of this. For counterpoint, see the Guardian's account of the Russian way of war in Ukraine. For context, see the Washington Post's primer on war crimes.

Ukrainian military intelligence chief says President Putin survived an assassination attempt.

Major General Kyrylo Budanov, chief of Ukrainian military intelligence, told Ukrainska Pravda that Russia's President survived an assassination attempt. "There was an attempt to assassinate Putin," General Budanov said. "He was even attacked, it is said, by representatives of the Caucasus, not so long ago. This is non-public information. [It was an] Absolutely unsuccessful attempt, but it really happened… It was about 2 months ago. I repeat, this attempt was unsuccessful. There was no publicity about this event, but it took place." No other details have been reported, still less any independent confirmation, but the story has been widely circulated in Western media.

Unexplained explosions and fires continue in Russia.

An unusual number of fires continue to be observed in Russia, Newsweek reports, and some have been associated with unexplained explosions. Many of the fires have been wildfires, and could simply be a seasonal phenomenon. But fires at oil facilities, apartment buildings, recruiting stations, and at least one military propellant plant are harder to explain, and seem to be arson. Whether they're the result of Ukrainian special operations or are the work of disaffected Russians is unclear.

Dissent in Russia's war.

It's easy to misread the extent of dissent in any war, and it's particularly easy for media to overestimate it when they're in broad sympathy with that dissent. But, while an alleged assassination attempt might represent wishful thinking or disinformation, and while fires may be accidents misread as arson, there are some instances of dissent that seem incontrovertible. How significant they may prove to be remains unknown.

The highest profile and best attested case involves Boris Bondarev, counselor at the Permanent Mission of the Russian Federation to the United Nations in Geneva. On Monday he announced his resignation from the Foreign Ministry and the civil service because of his unwillingness to be complicit in what he characterized as a war of aggression. His LinkedIn post announcing his resignation is worth quoting in full. As of this morning it read:

"Long overdue, but today I resign from civil service. Enough is enough.

"For twenty years of my diplomatic career I have seen different turns of our foreign policy, but never have I been so ashamed of my country as on February 24 of this year. The aggressive war unleashed by Putin against Ukraine, and in fact against the entire Western world, is not only a crime against the Ukrainian people, but also, perhaps, the most serious crime against the people of Russia, with a bold letter Z crossing out all hopes and prospects for a prosperous free society in our country.

"Those who conceived this war want only one thing - to remain in power forever, live in pompous tasteless palaces, sail on yachts comparable in tonnage and cost to the entire Russian Navy, enjoying unlimited power and complete impunity. To achieve that they are willing to sacrifice as many lives as it takes. Thousands of Russians and Ukrainians have already died just for this.

"I regret to admit that over all these twenty years the level of lies and unprofessionalism in the work of the Foreign Ministry has been increasing all the time. However, in most recent years, this has become simply catastrophic. Instead of unbiased information, impartial analysis and sober forecasting, there are propaganda clichés in the spirit of Soviet newspapers of the 1930s. A system has been built that deceives itself.

"Minister Lavrov is a good illustration of the degradation of this system. In 18 years, he went from a professional and educated intellectual, whom many my colleagues held in such high esteem, to a person who constantly broadcasts conflicting statements and threatens the world (that is, Russia too) with nuclear weapons!

"Today, the Ministry of Foreign Affairs is not about diplomacy. It is all about oil, lies and hatred. It serves interests of few, the very few people thus contributing to further isolation and degradation of my country. Russia no longer has allies, and there is no one to blame but its reckless and ill-conceived policy.

"I studied to be a diplomat and have been a diplomat for twenty years. The Ministry has become my home and family. But I simply cannot any longer share in this bloody, witless and absolutely needless ignominy."

The New York Times has confirmed with Mr. Bondarev that the post was indeed his, and was genuine. He elaborated to the times on what he saw as the Foreign Ministry's contribution to the intelligence failures that accompanied Russia's decision to invade Ukraine. “They got Ukraine wrong, they got the West wrong, they basically got everything wrong,” Mr. Bondarev said. “We diplomats of the Foreign Ministry are also at fault for this, for not passing along the information that we should have — for smoothing it out and presenting it as though everything was great.” Mr. Bondarev has, the Washington Post reports, no plans to leave Geneva.

In another case, this one less convincing, CNN reports an interview with a Russian officer (name, rank, and personal details withheld to protect him, CNN says) who resigned his commission rather than continue to serve in Russia's war. Apparently his commanding officer accepted his resignation, which is surprising, if the story is accurate. "He told me there could be a criminal case. That rejection is betrayal. But I stood my ground. He gave me a sheet of paper and a pen," CNN quotes the dissident officer as saying. This report comes amid other, unconfirmed reports of combat refusals within Russian units deployed to Ukraine. It seems unusual, to say the least, that an officer's attempt to resign in an active theater would be treated as anything other than an offense under military law. It would not be so casually received in most armies, let alone in Russia's.

Finally, a larger and more demotic protest, as well-attested as Mr. Bondarev's resignation, has been reported in St. Petersburg, where people attending a weekend concert by the girl group Kis Kis shouted "F*ck the war!" in unison. The Telegraph has an account, with video from the concert. Again, the importance of the incident is difficult to assess, but that it occurred at all is significant, coming as it did in a country not accustomed to protest.

Kounterfeit Krewe of Karens for the Kremlin.

Hyperlocal sites have been marshaled by Russian influence operators to normalize the occupation of Ukrainian villages controlled by Russian forces, CyberScoop reports. They source their story to Detector Media, which says that the effort is being organized over Telegram. "We managed to find 88 newly created Telegram channels of the occupiers," Detector Media writes. "However, their list is growing. The vast majority of such channels were registered a few days after February 24th. A significant part of local channels was created long before the actual military occupation of the cities, and some of those are the ones that the Russians did not manage to occupy. Conventionally, such channels can be divided into two categories:

  • "Those that can act as "official" sources of the occupiers. That is, such Telegram channels post on behalf of the occupiers. For example, inform about humanitarian aid or call for reporting on the movement of Ukrainian military equipment;
  • "Those that mimic the media's behavior, i.e., publish news about the occupied city/village but are overfilled with propaganda and misinformation."

The content mirrors familiar Russian lines of disinformation:

  • "Discreditation of Ukraine and its leadership, including mayors and regional administrations.
  • "Russian military victories and demonization of the Ukrainian army.
  • "Conspiracy theories about the actions of the "collective West" in Ukraine.
  • "Local "denazification": reporting on "nazis" whom the Russians allegedly managed to catch in the occupied settlements and also informing about the destruction of Ukrainian state symbols.
  • "Restoration of normal life after eight years of suffering." Much of the information is related to the life of the occupied cities, particularly the schedules of shops or churches and the education of children in school. However, the propagandists present all this under the guise of the "Russian world" victory. Preparations are underway for the May 9th celebrations.
  • "New "administrative units" such as the self-proclaimed "DNR" and "LNR". Propagandists try to explain why such a path is beneficial for Ukrainians and generally advertise the "benefits of Russian occupation." For example, they write that Russia will write off debts for utilities.
  • "Evacuation. Most readers are urged to evacuate to the previously occupied parts of the Donetsk and Luhansk regions or the occupied Crimea. Information on evacuation corridors officially agreed with Ukraine is rather an exception.
  • "Humanitarian aid from Russia. Propagandists assert that Russian aid is a salvation from the humanitarian crisis that the Ukrainian political leadership must be blamed for."

The evidence of Russian creation and coordination Detector Media cites is circumstantial but convincing.

Turla reconnaissance detected in Austrian and Estonian networks.

BleepingComputer reports that the Russian threat actor Turla, also known as Snake or Venomous Bear, and associated with the FSB, has staged typosquatting domains for use against Austrian and Estonian targets. The activity so far represents a cyber reconnaissance phase of battlespace preparation. It is, as the Sekoia researchers who discovered it say, a phishing campaign:

"SEKOIA.IO Threat & Detection Research (TDR) Team have expanded the search on Russian-linked TURLA’s infrastructures from a Google’s TAG blog post. It exposes a reconnaissance and espionage campaign from the Turla intrusion set against the Baltic Defense College, the Austrian Economic Chamber which has a role in government decision-making such as economic sanctions and NATO’s eLearning platform JDAL (Joint Advanced Distributed Learning) pointing Russian Intelligence interest for defense sector in Eastern Europe and for topics related to the economic sanctions against the Russian Federation."