Ukraine at D+559: A Fancy Bear sighting.
N2K logoSep 6, 2023

A GRU cyber campaign against Ukainian energy infrastructure is detected. Ukrainian forces work to expand local breakthroughs amid reports of discontent in Russian ranks.

Ukraine at D+559: A Fancy Bear sighting.

Reuters reports Ukrainian claims of gains on the offensive, and of successful defense elsewhere. At the same time Russian Defense Minister Shoigu, speaking for the Kremlin, ritualistically derided Ukrainian military operations as having uniformly failed, despite their forces having been "trained by Western instructors."

"Ukrainian forces continue to advance in western Zaporizhia Oblast," the Institute for the Study of War (ISW) reported yesterday evening, citing geolocated video of Russian forces hitting Ukrainian positions to the northwest and north of Robotyne, areas Russia had claimed to control. The ISW adds, "Additional geolocated footage posted on September 5 shows that Ukrainian forces have also advanced south of Robotyne and northwest of Verbove (about 10km east of Robotyne). Geolocated evidence of Ukrainian forces northwest of Verbove suggests that Ukrainian forces are advancing along the line of Russian fortifications that runs into the settlement. Ukrainian military sources also confirmed that Ukrainian forces have been successful in the Robotyne—Novoprokopivka directions south of Orikhiv, and further reported that Ukrainian forces are pursuing successful offensive operations south of Bakhmut."

Discontent among the mercenaries.

The Telegraph has reported that fighters of the mercenary group Rusich, one of the minor formations now attracting attention with the eclipse and fragmentation of the Wagner Group, have said in their Telegram channels that they've laid down their weapons to protest of the Russian government's failure to prevent the extradition of one of their leaders, Yan Petrovsky, from Finland to Ukraine, where he's an accused war criminal. "Rusich stops performing any combat missions," the mercenaries said. "If a country cannot protect its citizens, then why should citizens defend the country?" Business Insider cites experts who think it likely that Rusich was involved in the defense of Robotyne, and that their labor action may have been partially responsible for the fall of that town to Ukrainian forces.

Discontent among the regulars.

Reuters reports on phone calls Ukraine's SBU intercepted and released. The news service has been able to authenticate some of the calls. Russian soldiers in Ukraine are phoning home a consistent litany of grievances. They complained of poor supply. “They are [effing] us up,” one soldier complained on July 12th. “No [effing] ammunition, nothing ... Shall we use our fingers as bayonets?” They also complained of high casualties. “That’s it. There is no second battalion left. They [effing] turned it to crumbs.” Combat lifesaving, that is, emergency medical care of casualties, is also said to be bad. “Basically, they couldn’t even retrieve the (cargo) 300s. The 300s became 200s.” "Cargo 300" is slang for a wounded soldier; "Cargo 200" is one killed in action--the slang originated during Russia's invasion of Afghanistan. Another soldier said of casualties, “They were torn apart. They’re lying there: they can’t even collect some of them. They’re already rotten - eaten by worms.” And they think their leaders are lying to the public and are indifferent to their soldiers. “Everyone’s scared... They’re sending mobilised troops to the front line. In the end, the generals couldn’t care less.”

There are some obvious grains of salt that should accompany the consumption of this report. First, it's sourced, with some confirmation, to Ukrainian intelligence, which is hardly unbiased. Second, the sample of calls is small, with seventeen conversations excerpted and reported. And third, it's a military truism that soldiers in all armies are inveterate complainers. But these complaints seem more detailed and more embittered than the norm, and they're consistent with other reports of poor morale among Russian forces.

New frontiers in training and recruiting.

Cuba has begun criminal proceedings against what prosecutors characterize as a human trafficking operation working to bring Cuban men into the Russian army. The trafficking network targeted, the New York Times reports, Cubans in Russia as well as those in Cuba. A statement from Havana's Ministry of Foreign Affairs said, in part, "Cuba is not part of the war in Ukraine. It is acting and it will firmly act against those who within the national territory participate in any form of human trafficking for mercenarism or recruitment purposes so that Cuban citizens may raise weapons against any country." Cuban officials did not explicitly say the Russian government was behind the network, and Russian officials did not comment. There have been earlier cases in which prosecutors have claimed their citizens were being recruited to fight for Russia in Ukraine. The Times writes, "In late June, a prosecutor’s office in the Kostanay region of north Kazakhstan issued a statement saying that advertisements attempting to recruit people to “participate in the armed conflict in Ukraine” had been appearing on social media and elsewhere online."

Military training and nationalist indoctrination now begins early, in Russia. The national curriculum has been adapted to serve the purposes of long-term mobilization, the UK's Ministry of Defence writes in this morning's situation report. "Russia’s new school year has begun with a new curriculum incorporating both military skills and the Kremlin’s view of the history of Ukraine. Russian President Vladimir Putin personally held an open lesson with 30 schoolchildren on the first day of term. Topics in the updated national history exam include Crimean reunification with Russia and the ‘Special Military Operation’ in Ukraine. Russia’s parliament approved the curriculum last year." It includes weapons training. "One element, the "Basics of Life Safety", is aimed towards senior students and includes a basic military training module. This will include handling Kalashnikovs, the use of hand grenades, uncrewed aerial vehicle (UAV) operations, and battlefield first aid. Pupils may also be visited by Ukraine veterans. The new curriculum serves three objectives: to indoctrinate students with the Kremlin rationale for the ‘Special Military Operation’, instil students with a martial mindset, and reduce training timelines for onwards mobilisation and deployment."

Fancy Bear makes an attempt on Ukrainian energy infrastructure.

CERT-UA reported Monday that the GRU's APT28, Fancy Bear, has attempted to compromise an unspecified energy facility with a phishing campaign that carries a malicious payload in a zip file (said to contain links to photos) attached to an email. If the attachment is opened, the victim is open to remote code execution. The phishing email is unusual, the Record points out, in that the phishbait is gaudier than the stodgy and sober come-ons that have characterized much Russian phishing of Ukrainian targets. The text of the email often reads, "Hi! I talked to three girls, and they agreed. Their photos are in the archive; I suggest checking them out on the website." Should the recipients incautiously do so, they'll be taken to some apparently innocent websites where the malware will be served.

A look at NoName057(16).

The Record has published a report on the Russian hacktivist auxiliary, NoName057(16). Like other such auxiliaries, they've specialized in distributed denial-of-service (DDoS) attacks, most recently against financial institutions in Poland and Czechia. Compared to its peers, however, the Record finds NoName057(16) more disciplined, selecting targets and studying their vulnerabilities before initiating the attack. The group also doesn't rely on widely traded commodity malware, preferring to rely on its own bespoke tool, DDoSia. The group lacks a public persona analogous to KillNet's noisy (yet still mysterious) figurehead KillMilk. Who funds NoName057(16) remains unclear. It obviously acts in the Russian interest, with a preference for NATO targets, but there haven't been, according to the Record, any obvious signs of money flowing to the group from the Russian government.