Ukraine at D+313: OPSEC failures and the return of GhostWriter.
N2K logoJan 4, 2023

Cellphones are again shown to be an opsec disaster. GhostWriter is back, and pretending to be Polish.

Ukraine at D+313: OPSEC failures and the return of GhostWriter.

Russia continues to hit civilian targets (art museums, homes, a hockey rink). The strikes now have the coloration of retaliation for Ukraine's destruction of Russian barracks in Makiivka.

Update on the Makiivka strike.

The Wall Street Journal reviews the mistakes that led to the Russian disaster in Makiivka: among them concentrated administrative troop billeting, storage of ammunition adjacent to the billets, and generally poor operations security (manifested in undisciplined use of cellphones and failure to camouflage). “The Russian military is not a learning organization,” the Journal quotes US Army Lieutenant General Ben Hodges, a former commander of U.S. Army forces in Europe. “To learn," General Hodges added, "first you have to acknowledge that you were wrong, and that’s not the culture.” Official Russian sources initially put the death toll at sixty-three, which, although the highest reported loss in any single incident during the war so far, was generally suspected of being an underestimation. Since that initial announcement the official death toll has risen to eighty-six, and more recently, in an unofficial Telegram channel with close ties to the Ministry of Defense, over a hundred. Ukrainian official sources and local separatists have placed the casualty count much higher, perhaps as much as four hundred.

The UK's Ministry of Defence this morning offered an assessment of the New Year's Eve HIMARS strike against a Russian barracks and ammunition storage site in occupied Makiivka. "On 31 December 2022, Ukraine struck a school building in the Russian-held town of Makiyivka near Donetsk city, which Russia had almost certainly taken over for military use. The building was completely destroyed and, as the Russian MoD confirmed, 89 Russian personnel were killed.) Given the extent of the damage, there is a realistic possibility that ammunition was being stored near to troop accommodation, which detonated during the strike creating secondary explosions. The building was only 12.5km from the Avdiivka sector of front line, one of the most intensely contested areas of the conflict. The Russian military has a record of unsafe ammunition storage from well before the current war, but this incident highlights how unprofessional practices contribute to Russia’s high casualty rate."

Criticism, and explanations of failure.

Russian popular outrage over the Makiivka disaster has been surprisingly widespread, but directed mostly inwardly, at Russian military commanders. Many of the dead were apparently recent conscripts taken from Samara, where public expressions of grief have been particularly strong, the Washington Post reports: “The incident in Makiivka, where dozens of Russian draftees died, should be the last of its kind,” tweeted Sergei Mironov, a fierce war supporter and head of a pro-Kremlin political party. “The investigation will determine whether this was treason or criminal negligence. We need personal criminal liability under the laws of war for all officials.” According to the Telegraph, there are widespread calls for responsible officers to be prosecuted for treason.

Two features of the criticism are noteworthy. First, it's coming largely from the pro-war hardliners, core supporters of President Putin. Second, it's so far avoided blaming Mr. Putin or his war. Instead, the criticism is in an old familiar Russian tradition of blaming wicked counselors around the throne, and not the tsar himself. "If only the tsar (or, now, the president) knew," runs the refrain.

There's also some public criticism from Wagner Group boss Yevgeny Prigozhin, who blames his mercenary army's failure to take Bakhmut on the inadequacy of the supplies they're receiving from the Ministry of Defense. His diagnosis of failure, as reported by the Telegraph, runs like this: "Speaking to troops from what appeared to be an underground gym, he said they didn't have enough equipment to quickly win territory in and around the city. Mr Prigozhin added: 'We are lacking vehicles, BMP-3, and 100mm shells, in order to move through Arymovsk [the Russian name for Bakhmut] quicker and with more confidence. We're lacking ammunition and armoured vehicles.' An unnamed Wagner soldier appeared to agree, adding: "We don't have enough equipment, not enough BMP3 and shells." The BMP3 is a Russian infantry combat vehicle.

Update on Russian cyber activity against Poland.

The threat group GhostWriter has resurfaced in phishing campaigns against Polish targets, according to authorities in Warsaw. BleepingComputer reports that "the Russian hackers set up websites that impersonate the gov.pl government domain, promoting fake financial compensation for Polish residents allegedly backed by European funds." The goals of the campaign are believed to be intelligence collection and disinformation. The EU has linked GhostWriter to Russia's GRU military intelligence service. Mandiant has also discerned a connection to Belarusian services. GhostWriter has long specialized in impersonation.