Eurasia Press & News
As the crisis in Europe over Ukraine heats up, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union, DFRLab’s global team presents the latest installment of the Russian Hybrid Threats Report.
Putin recognizes DNR and LNR during angry speech after security council meeting
On February 21, Russian President Vladimir Putin gave an angry speech in which he recognized the independence of the breakaway Donetsk and Luhansk people’s republics (DNR and LNR) while simultaneously challenging Ukraine’s right to exist as an independent state. The speech touched upon many of the same arguments and grievances he outlined in his July 2021 essay in which he insisted that Ukraine and Russia have always been historically linked, and that Ukraine as an independent state was both a twentieth century invention and a disastrous mistake for Russia. He ended the speech with a chilling warning “to the Kyiv elite that has usurped power: Stop any military activity, or you will be responsible for the bloodshed that will ensue.” Within hours, the Kremlin confirmed it was sending “peacekeepers” into the breakaway republics, later adding that they consider Ukraine-occupied regions of the Donbas as DNR/LNR territory, including the Ukrainian city of Mariupol.
The speech came shortly after Russian state media interrupted normal programming to broadcast an ad-hoc session of the Russian Security Council. The meeting concerned formal Russian recognition of the DNR and LNR, a move that would effectively mark Russian abandonment of the Minsk accords. The meeting was ostensibly a response to televised appeals by Russian-backed separatist leaders Denis Pushilin (Donetsk) and Leonid Pasechnik (Luhansk) for Russian recognition and support.
The meeting, held in the vast Hall of the Order of St. Catherine in the Grand Kremlin Palace, appeared to be highly choreographed. For roughly ninety minutes, Putin quizzed Russian security officials on the state of Russian-Ukrainian relations. In turn, the officials cited Russian-orchestrated false flags and disinformation in order to claim Ukrainian aggression. Alexander Bortnikov, Director of the Federal Security Service, claimed that Ukraine had directly attacked Russian territory. Minister of Defense Sergei Shoigu asserted that Ukraine had launched a war of aggression against Dontesk and could soon pose a nuclear threat.
The most noteworthy exchange came between Putin and Sergei Naryshkin, director of the Foreign Intelligence Service. Naryshkin was visibly uncomfortable as he spoke about how Russia might leverage the threat of Dontesk and Lunhansk recognition to strengthen the Russian negotiating position. Putin dismissed this, pressing him repeatedly to state his support for the immediate recognition of the separatist-controlled regions. Naryshkin ultimately endorsed this position, as did every other official who spoke.
The broadcast ended as Putin declared that “a decision will be taken today.”
Although the Russian Security Council broadcast appeared to follow the appearances by Pushilin and Pasechnik, it appears to have been recorded about five hours in advance, as the time displayed on Shoigu’s watch did not match the time the speech was broadcast.
—Emerson T. Brooking, DFRLab Senior Fellow, Washington DC
Russian forces move closer to Ukraine
Russian forces along the Russian and Belarusian borders with Ukraine, as well as in Crimea, continue to move from temporary camps into smaller holding areas closer to Ukraine. Equipment in Kursk and Belgorod oblasts has been spotted with a painted-on zig-zag or “Z” pattern, believed to be intended as a means to identify friendly units in the event of an offensive. Satellite imagery of Belgorod Oblast, which has enjoyed mostly clear weather recently, showed more than a dozen confirmed and suspected military positions across the border from the Ukrainian city of Kharkiv. Only two of these locations contained military equipment prior to February 2022. Similar positions are likely present throughout Kursk and Bryansk oblasts, as well as in Belarus.
In addition to the increased ground-force presence, satellite imagery also revealed three new improvised heliports to house dozens of attack and transport helicopters. Reports from local residents claimed that helicopters flew low overhead day and night, particularly in Shebekino, which lies just six kilometers from the border with Ukraine.
Large-scale deployments of rotary-wing assets were also detected in Crimea, Rostov Oblast, and Belarus.
Additionally, BMD-2 airborne infantry fighting vehicles packed with parachutes were spotted moving in the direction of Khotilovo air base in Tver Oblast, located in western Russia.
—Michael Sheldon, DFRLab Research Associate, Washington DC
Russian troops to stay in Belarus as joint drills end
Belarusian Defense Minister Victor Khrenin announced on February 20 that Russian troops would stay in Belarus despite completing the “Allied Resolve” joint exercises. “Due to increased military activity near the borders and escalation in Donbas, Belarus and Russia decided to continue joint inspections of response forces,” he said said in a statement. This contradicts the February 16 announcement from Belarusian Foreign Minister Uladzimir Makey, who said the entire Russian military would leave Belarus after the end of the drills.
According to the New York Times, an estimated thirty thousand Russian soldiers remain in Belarus. Local Belarusian activists have referred to the situation as an “occupation with [President Alyaksandr] Lukashenka’s permission.” These strategic deployments also make the Baltic states anxious, said Marius Laurinavicius, a Lithuanian analyst: “We [the Baltics] are becoming West Berlin, as a smaller country surrounded by an enemy that has much more military might.”
Meanwhile, on February 19, eyewitness reports emerged of heavy drinking, black-market sales of fuel supplies, and littering from Russian soldiers in southeastern Belarus during the military drills.
—Lukas Andriukaitis, Associate Director, Brussels, Belgium
Russian-backed separatists record evacuation announcement video days before release
Following the February 18 release of two videos by the leaders of the DNR and LNR announcing an emergency mass evacuation, open-source investigators at Radio Free Europe/Radio Liberty’s Russian service and Bellingcat discovered that the footage contained metadata suggesting they were filmed on February 16, two days before the emergency evacuation was ordered. Ukrainian authorities responded by saying they had no plans to conduct military operations in the Donbas region.
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
TikTok blocks account of Russian state-media outlet RIA “by mistake,” reports RIA
On February 19, Russian state media outlet RIA reported that the video platform TikTok blocked its account after removing a video from DNR leader Denis Pushilin that called for an emergency evacuation in eastern Ukraine. RIA shared a screengrab of TikTok’s notice, which stated, “Your account was permanently closed due to multiple violations of the community guidelines.” RIA said TikTok did not provide a specific reason for closing the account.
Later, RIA reported that Roskomnadzor, Russia’s communications regulator, “intervened in the situation,” and as a result, TikTok unblocked RIA’s account and restored the deleted video of Pushilin. The Kremlin-owned outlet stated that TikTok “clarified that the blocking occurred by mistake.” At the time of publication, RIA’s TikTok account was accessible.
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
Luhansk internet provider warns of service disruptions
On Sunday, Kremlin-owned and pro-Kremlin online outlets reported a possible disruption to mobile and internet connectivity in Luhansk, Ukraine. The outlets cited a statement from Lugacom, an internet provider which provides service to eastern Ukraine via Russia. “Due to the current circumstances, in the near future, there may be a lack of mobile communications by Lugacom and the Internet throughout the republic,” the statement said, before it was later taken down. The pro-Kremlin outlet Life.ru reported that employees of Lugacom followed a call to mobilize and “went to the military commissariats of the LNR in accordance with the decree issued by the head of the republic.”
—Eto Buziashvili, Research Associate, Tbilisi, Georgia
Ukraine separatists release doctored video of Polish-speaking “saboteurs” trying to blow up Donbas chlorine tank
As noted in our February 18 threat report, Kremlin media and DNR officials claimed that DNR forces had prevented an attempt by a Ukrainian sabotage group to blow up a chlorine tank at a treatment plant in Horlivka. According to the DNR, the “people’s police” opened fire on the group, killing two and injuring three, then forced the rest to retreat.
The people’s police also claimed to have found a camera that belonged to the so-called saboteurs. They published a recording from this camera in a Telegram channel, saying it depicted a confrontation between the people’s police and the Ukrainian and Polish saboteurs. Kremlin-controlled media outlets in Russia also amplified this story.
However, the video’s metadata revealed it was recorded on February 8, not February 18 as the people’s militia asserted. The metadata also showed that the video was edited in Adobe Premiere Pro and that audiovisual assets were added to it, giving additional credence to the argument that the video is inauthentic. The footage is likely a montage composed of different video and audio files.
The metadata also showed the name “M72A5 LAW and APILAS live fire.mp4” under the “pantry ingredients file path,” which includes details about the elements used in a composed file. Twitter user @foodz found a 2010 YouTube video with the same file name and featuring similar audio of explosions. Journalist August Graham and Twitter user @mistercw conducted a spectral analysis to compare the explosion sounds in the DNR’s footage and the 2010 YouTube video. They found that the two videos’ timing, waveforms, and spectrogram details were in sync, indicating that that explosion audio from the YouTube video was likely used in the video released by the DPR people’s police.
In addition, metadata from the Telegram video revealed that some of the assets in the video were stored in a folder named Проекты\2021\02 Февраль\2021-02-04 ДРГ (“Projects/2021/February 2/2021-02-04 DRG”) with the dates in the folder name suggesting the video had been in the works for more than a year.
—Givi Gigitashvili, DFRLab, Research Associate, Warsaw, Poland
Leaked documents from Donetsk detail media coverage instructions
On February 20, Ukraine’s Centre for Strategic Communications published a leaked DNR document covering four strategic narratives and how the media should cover them over the weekend of February 19. The narratives included mobilization, evacuation, how the DNR government functions, and Ukrainian crimes in the Donbas. The document, titled “Republican Temnik,” listed names of speakers and organizations that would be the best fit to cover each topic. Each topic included multiple talking points.
The word temnik describes when authorities provide instructions to media about what topics should be covered or avoided, and whether this coverage should be positive or negative. First coined in Ukraine in the early 2000s, the temnik phenomenon is believed to be actively used in Russia to control coverage of specific topics in mainstream media and on Telegram channels.
While it is hard to prove the document’s authenticity, examples of the messages described in the document have previously been observed in separatist messaging. The “mobilization” section included talking points such as “We need to stand up for protecting our land” and “We didn’t give out our land in WW2 or 2014, so won’t do it now.” On February 20, multiple billboards were placed in Donetsk with similar concepts, including “We won in 1943, we’ll win now” and “Everyone for the defense of the Motherland.”
—Roman Osadchuk, Research Associate, Kyiv, Ukraine
Ukraine accuses Russia of using false messages to provoke conflict
On February 19, multiple Russian and pro-Kremlin outlets reported that three Ukrainian projectiles exploded in the Rostov region of Russia, two of which, they claimed, hit buildings. The reports identified the projectiles as originating from a Grad rocket launcher, presumably launched from Ukraine.
The Investigative Committee of Russia opened a criminal case into the matter. Reports from the committee and Russian media state that the first projectile landed three hundred meters from an unoccupied residence in the village of Mityakinskaya, the second landed on an unoccupied building in Mityakinsky, and the third landed in an unspecified area in the Tarasovsky district of Rostov. The presumed poor accuracy of these alleged attacks prompted social-media users in Rostov to raise doubts about their veracity.
Ukraine’s Ministry of Foreign Affairs denied the accusation that it launched rockets on Rostov. Lieutenant General Valerii Zaluzhnyi, commander-in-chief of the Armed Forces, also denied the allegation. He underlined that Ukrainian artillery units are stored more than twenty-one kilometers from the contact line, so those Rostov sites would exceed the maximum firing range of the Ukrainian Grad systems. He also provided a screenshot of a Russian article from 2014 claiming shelling in the same location in Rostov. “Invaders blow up infrastructure in the occupied territories themselves, conduct chaotic shelling of civilian objects and provoke false messages,” Zaluzhnyi concluded.
Ukrainian President Volodymyr Zelenskyy called the explosion “a provocation and lie.” Russian Ministry of Foreign Affairs spokeswoman Maria Zakharova retorted that only a “soulless cynic” could have only made such a statement.
—Roman Osadchuk, Research Associate, Kyiv, Ukraine
Suspicion surrounds last week’s car explosion in Donetsk
As noted in our previous threats report, Kremlin–controlled media reported an explosion in downtown Donetsk center. The explosion occurred around 7pm next to DNR administrative headquarters. The car reportedly belonged to Denis Sinenkov, head of the DNR people’s police.
Semyon Pegov, a pro-Kremlin war correspondent, broadcasted live from the reported scene of the explosion, calling it a “terror act” and accusing Kyiv of “stepping out of any imaginable and unimaginable boundaries.” The pro-Kremlin TV show “60 Minutes” broadcasted Pegov’s footage and also referred to the incident as a “terror act.”
Later that evening, Anton Pustovalov, a writer at the independent Russian media outlet Mediazona, tweeted a side-by-side comparison of the damaged car and another newer, more expensive car. Both vehicles had the same license plate number, “ДК 0101.” Pustovalov wrote a Twitter thread suggesting that the DNR militia switched license plates and blew up an older model of the UAZ car, sparing Sinenkov’s expensive car. The license plate was prominently displayed in many public images of the vehicle remains.
Kremlin-owned outlets were quick to report on the incident. The source code of the articles reveals that RIA Novosti published its first report at 7:04pm Moscow time, followed by TASS and RT Russia six minutes later.
—Nika Aleksejeva, DFRLab Lead Researcher, Riga, Latvia
Georgia’s pro-Kremlin political parties call on the government to announce military neutrality
Irma Inashvili, the leader of the pro-Kremlin Georgian political party Alliance of Patriots, published an open letter on February 21 addressed to Vladimir Putin. The letter, signed by fifty-three pro-Kremlin political parties and organizations, stated that confrontation with Russia is detrimental for Georgia, and it called on the Georgian government to declare full military neutrality and amend the constitution accordingly. The letter also claimed that Georgia is not an independent state and that it cannot face regional and global challenges without Russia.
The letter went on to criticize Georgian authorities for proposing Georgian territory for NATO military exercises, stating that this is contrary to the country’s national interests and presents a direct challenge to Russia. “Georgia is long entangled by the network of foreign organizations that conduct false opinion polls and paint a picture of a common aspiration to join NATO,” the letter stated.
—Sopo Gelava, Research Associate, Tbilisi, Georgia
Georgia’s breakaway regions express readiness to support Ukrainian separatists
On February 20, Aslan Bzhania, president of the Georgian breakaway region of Abkhazia, said that Abkhazia is ready to provide military and humanitarian aid to Donetsk and Luhansk. According to Bzhania, Ukraine, encouraged by “Western curators,” is purposefully engaged in provocations that threaten the whole region’s security.
The previous day, seven organizations established a unified headquarters in Abkhazia to support Donetsk and Luhansk. A statement released by the groups claimed the DNR and LNR face an “unprecedented military situation on their borders from Ukraine and NATO.” They also stated that the Ukrainian Armed Forces, which they say are coordinated by the US and NATO, carried out massive shelling against civilians over the past twenty-four hours.
Meanwhile, Anatoly Bibilov, the president of the Georgian breakaway region of South Ossetia, had a telephone call with DNR leader Denis Pushilin. According to the South Ossetia state news agency Agency RES, Bibilov condemned the “shelling of peaceful civilians” and expressed readiness to receive and accommodate orphaned children from Donetsk. Bibilov also said that countries supporting Ukraine “gave the go-ahead for the start of open hostilities.” The parliament of South Ossetia also supported the Russian State Duma in its resolution to recognize of DNR and LNR as independent states.
—Sopo Gelava, Research Associate, Tbilisi, Georgia
