Digital Forensic Research Lab
As Russia continues its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than seven years of experience monitoring the situation in Ukraine—as well as Russia’s use of propaganda and disinformation to undermine the United States, NATO, and the European Union—the DFRLab’s global team presents the latest installment of the Russian War Report.
Belgorod raid sparks trolling activity on social media
Drone imagery from a burning border control outpost in the Russian region of Belgorod sparked a frenzy on social media this week. According to Riga-based Russian news outlet Meduza, members of the Russian Volunteer Corps and other Russian nationals crossed from Ukraine into Belgorod Oblast and attacked a border outpost in Grayvoron. The Russian Volunteer Corps, an anti-Putin military unit made of Russian pro-Ukrainian partisans, claimed responsibility for the attack; the Free Russia Legion also claimed responsibility.
An assessment by Russian news outlet RBC regarding the broader situation in Belgorod indicated an armed incursion, with shelling and artillery fire reported. On the evening of May 22, Russian government declared a state of counterterrorist emergency in Belgorod Oblast. Although the governor of the oblast did not officially issue an order to evacuate the civilian population immediately, footage and photographs posted on social media indicated that at least some residents evacuated to other areas in the region. Meduza also reported several drone strikes on the city of Belgorod itself.
Conflicting reports emerged on May 23 after Russian officials lifted the counterterrorist alert. While the Russian Ministry of Defense claimed to have “liquidated” around seventy “saboteurs,” reporting from the news outlet Mash indicated the deployment of additional Russian law enforcement in nearby Bryansk Oblast. In an effort to support their assertions of having eliminated the insurgency, Russian news outlets also released photos of military-class vehicles allegedly used by the insurgents stuck in the mud; some open-source analysts, however, questioned the authenticity of the photos. Russian media chased these reports with claims of destroyed Ukrainian tanks, while the Russian Volunteer Corps posted footage to Telegram seemingly showing intact military equipment.
Shortly after the news broke out, footage of a drone attack on the local Russian border outpost, APP Grayvoron, appeared on the outpost’s Google Maps profile, though it was later deleted. At the time of writing, it had been replaced with footage showing a convoy of vehicles, one flying the flag of the Russian Volunteer Corps.
The Google Maps profile for a Russian border outpost in Belgorod featured a video of a mechanized convoy flying the flag of the Russian Volunteer Corps. (Source: Google Maps/archive)
The Google Maps profile for a Russian border outpost in Belgorod featured a video of a mechanized convoy flying the flag of the Russian Volunteer Corps. (Source: Google Maps/archive)Simultaneously, trolling reviews appeared on the border outpost’s Google Maps profile, calling the border guards “friendly” and the facilities “understaffed.” These too have been deleted, though not before they were documented by the Saint Javelin Twitter account and other Twitter users.
Trolls post mocking reviews of Russia’s Belgorod border post. (Source: @SaintJavelin/archive)
Trolls post mocking reviews of Russia’s Belgorod border post. (Source: @SaintJavelin/archive)Other trolls took to Twitter, where members of the NAFO meme movement, a pro-NATO and pro-Ukrainian community on the platform, renamed their account to “Government of The Bilhorod’s Peoples Republic” as a joking reference to the self-proclaimed Donetsk and Luhansk Peoples Republics. “Bilhorod” is the Ukrainian name for Belgorod.
NAFO meme account @nitro19820 changes its Twitter name and bio to joke that it now represented a new “People’s Republic” in Belgorod. (Source: @nitro19820/archive)
NAFO meme account @nitro19820 changes its Twitter name and bio to joke that it now represented a new “People’s Republic” in Belgorod. (Source: @nitro19820/archive)—Valentin Châtelet, research associate, Security, Brussels, Belgium
Russian pro-war military bloggers criticize the handling of Belgorod incursion
Following the apparent border incursion into Belgorod Oblast and subsequent attacks on the region, pro-war military bloggers condemned Moscow’s handling of the war in Ukraine, including its border defenses.
Telegram channel Vоенкор Котенок Z (“Milblogger Kitten Z”) criticized the Kremlin for being late in declaring a counterterrorism operation in Belgorod and not knowing how to fight “for real.” “There is a war, and in Russia … they are afraid to call the war a war,” stated the Telegram post.
The channel ДШРГ Русич (“DShRG Rusich”) questioned “commanders of all levels” on how the incursion happened. It also blamed Russia’s intelligence services for failing to reveal “plans of an enemy.” The channel added that as long as there is no photographic evidence of corpses or burned equipment, “the enemy has no losses, and the [Russian] propagandists crapped themselves a little, saying that everything is fine.”
The Kotsnews Telegram channel addressed pro-Kremlin pundits who dismissed military blogger concerns as “hysteria” by insisting that the threat to Russian territory is real and that there are uncomfortable questions around Russia’s defensive capabilities that nobody wants to ask. “What is happening with our technical equipment at the border, surveillance systems, tracking, motion detection?” the channel asked. “What about the mining of potentially dangerous areas? What about anti-tank weapons? Why did the enemy armored group calmly penetrate deep into our territory?”
As Russia’s war against Ukraine has dragged on, the frequency and intensity of pro-war military bloggers’ criticism have increased and become bolder. The DFRLab has previously covered how Russian military bloggers criticized Russian President Vladimir Putin and the Ministry of Defense.
—Eto Buziashvili, research associate, Tbilisi, Georgia
Russian media spins Australian solidarity rally for Julian Assange as an anti-NATO event
On May 20, a series of so-called “World Wide Freedom Rallies” took place in many cities around the world. The Telegram account for Simeon Boikov, a pro-Kremlin activist and blogger in Australia, claimed to have organized the Sydney edition of the rally, part of a decentralized movement that originated in 2021 to express dissatisfaction with COVID security measures. Boikov promoted a poster for the event on April 6, a day before the event announcement on the movement’s official Telegram channel.
The rally ostensibly focused on demanding the release of WikiLeaks founder Julian Assange, who is currently being held in London facing potential extradition to the United States. After the event, however, Boikov highlighted a speech by Assange’s father, John Shipton, in a video showing scenes from the rally and emphasized that Shipton was wearing a “double headed eagle and St George’s ribbons,” both of which are Russian symbols. Additional videos and images from the rally showed many people carrying Russian flags and wearing pro-Kremlin symbols.
Kremlin-controlled media outlets emphasized in their headlines not just the pro-Russia nature of the event, but also claims of anti-NATO sentiment, which appear to have been exaggerated. Reviewing footage from the event, the DFRLab identified only one instance of someone sporting anti-NATO messaging. Nonetheless, Russian media embraced the event as specifically anti-NATO, including state outlets Gazeta.ru, TASS, RIA Novosti, and Komsomolyskaya Pravda, and pro-Kremlin media such as News Front, Inforeactor, Ekonomika Segodnya. Additionally, The Eastern Herald, an Indian media outlet, and Belarus state-controlled television both framed the event as anti-NATO in their English-language publications.
—Nika Aleksejeva, resident fellow, Riga, Latvia
US sanctions Armenian company for helping Russia evade sanctions
On May 22, the US Department of Commerce announced that it had amended its list of sanctioned entities and individuals by adding seventy-one entities that the US government had determined to be acting “contrary to [US] national security or foreign policy interests.” Alongside Russian companies, one Kyrgyz company, Tro.Ya LLC, and one Armenian company, Medisar LLC, were included in the amended list. According to the Department of Commerce, both companies engaged in conduct that “prevented the successful accomplishment of an end-use check.” In other words, the Department of Commerce suspected that the final destination for the products was Russia but the companies themselves had obfuscated this information.
Medisar LLC, which was registered in Armenia in 2001, is an importer of chemicals and laboratory equipment. The company is one of the thousand largest taxpayers in Armenia, paying about one million dollars in taxes in 2022. It also has a longstanding trade history with Russian companies. On its website, Medisar indicates that one of its trading partners, dating back to 2011, is Russian company Minimed.
Screenshot from the Organized Crime and Corruption Reporting Project’s (OCCRP) Aleph database, made available through Friends of OCCRP access, about Medisar’s trade. The third and fourth companies on the list are both OOO Minimed, a Russian company with a long-term trading relationship with Medisar. (Source: DFRLab via OCCRP)
Screenshot from the Organized Crime and Corruption Reporting Project’s (OCCRP) Aleph database, made available through Friends of OCCRP access, about Medisar’s trade. The third and fourth companies on the list are both OOO Minimed, a Russian company with a long-term trading relationship with Medisar. (Source: DFRLab via OCCRP)On May 20, Armenian investigative website Hetq reported that data obtained from the country’s customs service showed that in 2022, Medisar exported equipment from Armenia to Russia, including electronic integrated circuits, diodes, transistors, and similar semiconductor devices.
A company executive who did not want to be identified acknowledged to RFE/RL that Medisar imported chemicals and laboratory equipment from the United States and the European Union and re-exported them to Russia.
Medisar is the second-largest company registered in Armenia to be sanctioned by the United States. The US Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned the other firm, TAKO, in April. The company is in the wholesale of electronic and telecommunications equipment and parts. TAKO, spelled TACO in Armenia’s legal entities register, was registered in May 2022 in Armenia and is fully owned by a Russian citizen, according to public registry records.
On April 18, the New York Times reported that in 2022, Armenia imported 515 percent more chips and processors from the United States and 212 percent more from the European Union than in 2021, and that Armenia exported 97 percent of those same products to Russia.
During a May 22 press conference, Armenian Prime Minister Nikol Pashinyan said that despite Armenia’s “strategic” relationship with Russia and membership in the Russian-led Eurasian Economic Union, the country “cannot afford to come under Western sanctions.” Pashinyan underscored that if Armenia faced sanctions, “it wouldn’t be good for any of our allies, while we would ruin our relations with our Western partners.”
A joint “compliance note” issued on March 2 by the US Departments of the Treasury, Justice, and Commerce, titled “Cracking Down on Third-Party Intermediaries Used to Evade Russia-Related Sanctions and Export Controls,” mentioned Armenia, along with China, Turkey, and Uzbekistan, as “transshipment points commonly used to illegally redirect restricted items to Russia or Belarus.”
According to the Statistical Committee of the Republic of Armenia, Russian-Armenian trade soared in 2022, including exports to Russia, which nearly tripled to $2.4 billion.
—Ani Mejlumyan, research assistant, Yerevan, Armenia
No comments:
Post a Comment