Target Transnistria: Russia’s Maskirovka and Pathways to Escalation (Threatcast)

KEY JUDGEMENTS  I. We assess that Russian intelligence staged the recent provocations in Transnistria as part of a military deception campaign (“maskirovka”). Russia aims to prevent Ukrainian forces in Odesa…

Russian Mass-Casualty Attack on Civilians at Kramatorsk Train Station

A Russian missile attack on Kramatorsk train station in eastern Ukraine has killed at least 50 people, likely only civilians, and wounded 100 others, on 8 April 2022. Kramatorsk hosts…

Defeated in Kyiv, Russia Downsizes War Aims to Donbas and Southern Ukraine

Key Judgements I. Defeated by Ukrainian maneuver defenses and counter-attacks, Russian forces have withdrawn from northwest Kyiv, and are reducing their presence in Chernihiv province. Returned to their launch points…

Russia Invades Ukraine: First Day of War Through OSINT

In the early hours of 24 February 2022, Russia commenced a series of pre-assault operations to soften Ukrainian defenses ahead of an all-out, multi-axis invasion, which is now in progress….

No Time To Dispute: Russia’s A2/AD in the South Kurils

Remote and derelict, riddled with active volcanoes and disputed between Russia and Japan, the South Kurils make the perfect secret lair for any self-respecting evil genius. It’s no wonder the…

Putin’s Mercenaries on Tour: Mapping the Wagner Group’s Global Activities

Key Judgements Since its inception in 2014-2015, the Wagner group has expanded from a frontline contractor in Eastern Ukraine, to spearheading Russia’s foreign policy and private business objectives in Syria,…

"Do Not Enter:" Using OSINT to Monitor Russia's Wargames in the Black Sea

Russia has concentrated warships from all fleets, except the Pacific fleet, in the Black Sea for joint drills. While not unprecedented, it is rare to see such a show of…

Echoes of the Cold War: Why "Bears" Like the G.I.U.K. Gap

Russian military activity in the Greenland-Iceland-UK (GIUK) gap has increased exponentially in the past years. Launched from the Northern Fleet “bastion,” submarine-hunting, anti-surface, and maritime surveillance missions are at the…

Iran Tests Carrier-Killing Missile, Suicide Drones (and Other Insights from Exercise “Great Prophet 15”)

During the latest military exercise(“Great Prophet” 15), the Iranian Revolutionary Guards Corps – Aerospace Forces (IRGC-AF) demonstrated how Iran would attack U.S. military bases and warships in the region. Great…

What We Know About the Secret Israeli-Saudi Meeting in Neom

On 22 November 2020, U.S. Secretary of State Mike Pompeo, the Saudi Crown Prince Mohammed Bin Salman (MBS), and Israeli Prime-Minister Netanyahu met in Neom (Kingdom of Saudi Arabia). The…

Target Transnistria: Russia’s Maskirovka and Pathways to Escalation (Threatcast)

KEY JUDGEMENTS  I. We assess that Russian intelligence staged the recent provocations in Transnistria as part of a military deception campaign (“maskirovka”). Russia aims to prevent Ukrainian forces in Odesa…

KEY JUDGEMENTS 

I. We assess that Russian intelligence staged the recent provocations in Transnistria as part of a military deception campaign (“maskirovka”). Russia aims to prevent Ukrainian forces in Odesa province from reinforcing positions in Donbas and Kherson.

II. The Transnistrian maskirovka is contingent and could escalate into more palpable operational objectives in the short term. While the Operational Group of Russian Forces in Transnistria (OGRFT) is unfit to engage in significant combat, we cannot ascertain that Moscow will see the Group’s precarious condition as an obstacle to joining the fight. One possible scenario is that the OGRFT could attempt to contest or seize the Palanca road segment of the Reni-Odesa highway – controlled by Ukraine although on Moldovan territory (Stefan Voda raion). 

III. We assess that the Kremlin retains the intention of linking up with Transnistria, but the Russian military is operationally unable to reach this goal in the medium term.  The vast majority of Russian battalion tactical groups (BTGs) are committed to Donbas and Kherson, where they are desperately needed, and continue to suffer a heavy attrition rate. 

IV. We have threatcasted three notional scenarios that Russia might consider at any given time to link up with Transnistria:

  • landbridge from Kherson to Transnistria (via Odesa);
  • air assault into Tiraspol;
  • amphibious landing in Budjak province followed by an incursion into Moldova’s Stefan Voda raion.

These scenarios are purely imaginative and do not aim to predict to future. Instead, their role is to reduce uncertainty. 


SITUATION REPORT: RUSSIA ENGINEERS A POTENTIALLY MALIGN DISTRACTION

OGRFT: THE FORGOTTEN “LITTLE GREEN MEN”

1. The self-proclaimed and unrecognized “Pridnestrovian Moldavian Republic” hosts roughly 1,000 to 1,500 Russian soldiers as part of the Operational Group of Russian Forces in Transnistria (OGRFT). The OGRFT is the “peacekeeping force” Russia left behind after the 1992 invasion of Moldova. It is a direct successor to the locally-based Soviet 14th Guards Army, which served under the command of the Odesa Military District. The OGRFT consists of three units: 

-82nd Separate Guards Motorized Rifle Battalion [unit 74273]

-113th Separate Guards Motorized Rifle Battalion [unit 22137]

-540th Separate Command Battalion [unit 89353]

Together these three units could likely assemble only one battalion tactical group (BTG) – Russian Ground Forces’ (RGF) combined-arms formations for combat use.  Based on our open-source research, all three OGRFT units are headquartered at Karl Liebknecht 159, Tiraspol, Republic of Moldova. However, the units are most likely garrisoned elsewhere, as the Soviet-era military quarter has been largely abandoned and re-purposed into new apartment projects.

GEOINT: Overview of OGRFT HQ and assessed affiliated sites in Tiraspol

2. The OGRFT has three operational objectives in the region: 

-Patrol the Transnistrian border (and engage in the related capacity-building efforts)

-Guard ammunition storage sites in Transnistria. 

-Serve Moscow’s interest in whatever way necessary. 

3. While the OGRFT is probably the most ill-equipped and undertrained force in the entire Russian Armed Forces, it does pose a serious threat to the Moldovan military and could become a tactical distraction for Ukraine.

MASKIROVKA: KEEP UKRAINIAN UNITS FIXED IN ODESA, AWAY FROM “REAL FIGHT” IN KHERSON, DONBAS

4. We assess that Russian intelligence staged the recent provocations in Transnistria as part of a military deception campaign (“maskirovka”). Russia aims to prevent Ukrainian forces in Odesa province from reinforcing positions in Donbas and Kherson. Russia’s remaining main lines of effort (LOEs) in the invasion are the Donbas offensive and consolidating gains in Kherson province. Ukrainian reinforcements in these theaters could put a decisive dent in Russia’s sluggish and largely unsuccessful operations. 

5. Russian intelligence – likely FSB units attached to the OGRFT – orchestrated a series of incidents in Transnistria

  • a rocket-propelled grenade attack on the so-called “Ministry of Security;” 
  • two destroyed antenna towers in Grigoriopol raion (used to broadcast Russian radio channels).
  • claimed gunshots towards Cobasna village which hosts a Soviet-era ammunition depot.
  • explosions at Tiraspol airfield (confirmed by Moldovan authorities). 
  • Reported explosions at a border crossing with Ukraine. 

6. The “local government” responded by placing the Transnistrian military on high alert and ramping up anti-Romanian and anti-Ukrainian rhetoric. Moldovan and Ukrainian press outlets report that the Transnistrians have established checkpoints throughout the region (confirmed via social media photos), and are preparing for general mobilization (claim denied by the Transnistrian “authorities”). Tiraspol has placed its military on high alert according to the Ukrainian General Staff

MASKIROVKA IS CONTINGENT, ESCALATION POSSIBLE

7. While the recent provocations constitute a benign feint, the OGRFT’s maskirovka is contingent and could escalate into more palpable operational objectives in the short term. To craft a credible threat that will force the Ukrainians to divert attention to the Dniester river, the OGRFT (with or without the Transnistrian military) could launch limited cross-border attacks. Alternatively, although less likely, the OGRFT could launch a limited land incursion. 

8. One possible scenario is that the OGRFT could attempt to contest or seize the Palanca road segment of the Reni-Odesa highway – controlled by Ukraine although on Moldovian territory (Stefan Voda raion). Chisinau transferred the 7.7 km road segment near Palanca to Ukraine as per the Additional Protocol (AP) to the Treaty between the Republic of Moldova and Ukraine on the State Border (August 18, 1999). The two parliaments ratified the AP in 2001. 

Palanca Road (T-Intelligence 2022)

The Palanca road is now the sole remaining ground line of communication (LOC) between NATO member Romania and the eastern raions of Odesa province, as Russia bombed and damaged the Pidyomnyy bridge near Zatoka on April 26. The 

Russia bombed the Pidyomnyy bridge for military and economic reasons. On the one hand, Russia wanted to disrupt the flow of Ukrainian products exported through the Romanian seaport of Constanta as Russia has blockaded Odesa and the other Ukrainian ports. On the other hand, with the bridge disabled, Russia severed NATO’s most direct LOC with Ukraine’s frontlines. 

9. While the OGRFT is unfit to engage in significant combat, we cannot ascertain that Moscow will see the Group’s precarious condition as an obstacle to joining the fight. Based on our estimates, Belarusian President Lukashenko’s war map, and other indicators, Transnistria was scheduled to join the now-failed Southwestern Operational Direction (OD). The OGRFT and the Russian Southern Military District (MD) grouping would have linked up in the process.

Transnistrian and Russian link-up to take Odesa is shown in Lukashenko’s warplan presentation (modified version of EyePress News/Shutterstock image)

RUSSIA-TRANSNISTRIA LAND-BRIDGE UNFEASIBLE IN NEAR TERM

10. We assess that the Kremlin retains the intention of linking up with Transnistria, but the Russian military is operationally unable to reach this goal in the medium term. Sandwiched between a pro-European & NATO-friendly Moldova (Maia Sandu government) and a hostile Ukraine, the OGRFT is vulnerable to an attack. However, Russian BTGs are committed to Donbas and Kherson, where they are desperately needed, and continue to suffer a heavy attrition rate. A significant portion of BTGs is combat ineffective and close to collapse. Re-deployment will most likely not be an option. On its own, the OGRFT is unlikely to be able to break through Ukrainian territory and spearhead a landbridge. The calculus could change if Russia declares a general mobilization and generates new manpower.


THREATCAST: THREE NOTIONAL SCENARIOS FOR A RUSSIA TO LINK UP WITH TRANSNISTRIA 

We have threatcasted three alternative future scenarios that Russia might consider to link up with Transnistria: 

  1. Landbridge from Crimea to Transnistria (via Kherson-Mykolaiv-Odesa). 
  2. Air assault on Tiraspol.
  3. Amphibious landing in Budjak. 

Disclaimer: Please note that the following scenarios are speculative and present a loose snapshot of possible war plans. This threatcast aims to consider some, but not all, of Russia’s possible actions in Transnistria – caveats apply.

LAND-BRIDGE (TRIED AND FAILED)

11. This scenario looks at a land corridor from Crimea to Transnistria, drawing from Russia’s tried-and-failed Southwestern OD. Such an objective would require an extensive, multi-stage offensive that would be costly and grinding for Russia. However, for the sake of this exercise, let us consider the conditional victories for Russian forces to “shake hands” with the OGRFT by land:

Scenario 1: Land Bridge via Odesa (T-Intelligence 2022)

a. Starting from Crimea-Kherson, Russia would need to isolate or capture Mykolaiv and cross the Bug river. Considering that Ukrainian forces would likely destroy the bridges to stall or stop the offensive, Russia would need to set up pontoon bridges in select areas while under fire from the opposite shore. 

b. Once across the Bug, Russian forces would need to cross the Tylihul. If successful here, the Russians would secure their LOCs and ensure a steady flow of logistics across the two rivers. 

c. Isolating or capturing Odesa would be the invading force’s next and most draining objective. Besieging Ukraine’s third-largest city – over 1 million people – would be a gargantuan effort in terms of time, resources, and manpower. From a humanitarian perspective,  the brutal two-month siege of Mariupol would be a cakewalk in comparison. 

d. The OGRFT could join the fight as a support element and link up with the Russian forces around Odesa in the process. However, a successful land bridge would depend on the long-term control of the Kherson-Odessa corridor. 

12. Russia has already pursued this blueprint and failed in the early stage of the Southwestern OD campaign – it cannot replicate it soon. Unable to capture Mykolaiv, Russia chose to (unsuccessfully) isolate the city and look for a gap in Ukrainian defenses up the Bug river valley. A small contingent of forces advanced to Voznesensk (March 3) in an attempt to take the city and cross the Bug. Fearing that a Russian victory in Voznesensk would greenlight the OGRFT to open the second front, Ukraine blew up the railway bridge over the Kuchurhan river on March 4. After days of fighting, Ukrainian defenders crushed the Russian advance between March 13-16 and launched a counter-attack. Ukrainian forces chased the Russians down to Mykolaiv and ultimately drove them back to Kherson, where the Russian Southern MD grouping remains today. Given the premature failure, the OGRFT was never called up to assist.

AIRBORNE ASSAULT ON TIRASPOL

13. Link-up with the OGRFT via airbridge is possible, although the operation would have a low-probability of success (LOS). The Russian Air Assault Force (Vozdushno-desantnye voyska Rossii/VDV) would spearhead the mission supported by rotary-wing units from the Russian Aerospace Forces (RuAF) to airlift troops and equipment such as BTRs, artillery, and rocket launchers. Airfields in Crimea and Kherson are possible embarkation points, while Tiraspol airfield is the projected end destination. Infiltration routes are of two categories – through denied airspace or around it – posing a wide array of issues and hazards. 

Scenario 2: Air Assault on Tiraspol

a. Pathway 1 (Direct Flight: Chernobayanka to Tiraspol, 230 km): Probably the most LOS route. VDV would launch from an airfield regularly hit by Ukrainian artillery, flying over a high-risk air defense area. There is likely a high density of Ukrainian-operated man-portable air defense systems (MANPADS) with operators on high alert and increased readiness in the Mykolaiv-Odesa area. MANPADS of various ranges and kinematic effects provide a diverse and overlapping low-altitude, short-range coverage. Russian helicopters would need to fly low to minimize exposure to the Odesa-based S-300 radars, which would bring them right into the engagement envelope of MANPADS. 

b. Pathway 2 (Avoid Odesa: Chernobayanka to Tiraspol, 340-360 km): This flight path significantly increases survivability by circumnavigating the large MANPADS concentration in the Odesa-Mykolaiv axis and S-300-controlled airspace. However, portable or mobile air defenses are likely also positioned west of Odesa, and increased flight time will limit the maximum take-off weight of the attack and transport helicopters. The longer the flight time, the higher the chances that NATO and Ukrainian sensors will detect the airborne assault from an early stage.   

c. Pathway 3a (Direct flight: Crimean airfields to Tiraspol, 350-400 km): Another low survivable flight path. Flying through the S-300 “bubble” requires significant electronic warfare (EW) and anti-radiation support. The RuAF will likely need to conduct suppression of enemy air defenses (SEAD) sorties to open up the airspace for the VDV flight to Tiraspol.  For example, the VDV’s assault on Hostomel airfield through Ukrainian air defenses was also enabled by a combination of electronic and missile attacks according to a RUSI report . However, the large density of MANPADS in Odesa poses a constant threat to low-altitude air operations., especially if the assault is not done under the cover of darkness. 

d. Pathway 3b (Avoid Odesa: Crimean airfields to Tiraspol, 350-500 km): Probably the most survivable flight path but also the longest, which restricts airlift capacity (troop number and equipment quantity) and exposes the operation the most to NATO and Ukrainian radars and ISR assets (intelligence, surveillance, and reconnaissance).

Note: The VDV is one of the most attrited Russian service branches in the war in Ukraine. Significant regeneration would be required before the VDV could hope to pull off such a stunt. 

AMPHIBIOUS ASSAULT ON BUDJAK

14. Following the forced closure of the ​​Pidyomnyy bridge, many have speculated that Moscow may be eyeing an amphibious assault on Ukraine’s Budjak region (southern Bessarabia) – Ismail, Bolhrad, and Bilhorod-Dnistrovsky raions in western Odesa province. Russia’s supposed bet is that the landing would be unopposed as Budjak is undermanned by the Ukrainian military and largely disconnected from the rest of the country. 

Scenario: Amphibious Landing in Budjak

15. An amphibious assault on Budjak is theoretically possible but technically difficult and of high risk. The Russian Navy would have to assemble an armada of amphibious vehicles, landing ships and craft, frigates, and other heavy warships, supported by air assets and likely surface to surface missiles. Preparations for such an operation would leave plenty of tell-tell signs that NATO could detect and forward to Ukraine. 

16. Ukraine has mined Odesa’s littoral waters and lined up its shores with anti-ship missiles (AshM), including Neptune (300 km range) and, in the future, truck-mounted Brimstones (range unknown, likely short) – as promised by British Prime Minister Boris Johnson. The Ukrainian Navy has also effectively posed a credible anti-ship threat, using Neptunes to sink the “Moskva” Slava-class cruiser and Bayraktar drones to destroy patrol boats near Snakes Island. 

17. Budjak’s shore is unideal for amphibious assaults. The coastline mainly consists of small and narrow beaches excavated below the street level with no connection to road networks. Most beaches are flat and lack cover or port facilities. The defender has a clear high-ground advantage. Other areas of the Budjak are dominated by lagoons where landing parties can easily become trapped. Negotiating the terrain is possible in some areas but would make for a sluggish escape from the “deathtraps” that are Budjak’s beaches.

18. Provided the landing is successful, the amphibious force would need to bolt towards Moldova’s Stefan Voda raion and link up with Transnistria. Russian troops would need to occupy Stefan Voida raion to ensure a land link to the OGRFT and deny the last LOC from Romania’s southeast (NATO) to Ukraine. The OGRFT could help by mimicking feint attacks from Bender (Tighina) towards Anenii Noi or Causeni and distract the Moldovan military. 

19. The operations’ success rests on whether the landing party could secure the Budjak bridgehead and sustain an incursion towards Transnistria at the same time. A successful Ukrainian counter-attack could split the invaders into two vulnerable pockets to be captured or annihilated. 

ENDNOTE

20. Since it further invaded Ukraine in late February, Russia has demonstrated a severe lack of risk aversion regarding military action. Moscow may continue to greenlight operations that are objectively “suicidal” or “likely to fail.” Russian military commanders might interpret the operational success probability differently and assess that the payoff would offset the costs. While these notional scenarios are purely an exercise in imagination, they could be options on the table for Russia. 


by HARM

editing by Gekco

Comments Off on Target Transnistria: Russia’s Maskirovka and Pathways to Escalation (Threatcast)

Russian Mass-Casualty Attack on Civilians at Kramatorsk Train Station

A Russian missile attack on Kramatorsk train station in eastern Ukraine has killed at least 50 people, likely only civilians, and wounded 100 others, on 8 April 2022. Kramatorsk hosts…

A Russian missile attack on Kramatorsk train station in eastern Ukraine has killed at least 50 people, likely only civilians, and wounded 100 others, on 8 April 2022. Kramatorsk hosts the headquarters of the Joint Force Operations (JFO), which is the Ukrainian military effort to counter the Russian occupation of Donetsk and Luhansk. After the Kremlin downsized its war aims, the JFO is bracing for a supercharged Russian offensive in eastern Ukraine. 

KEY JUDGEMENTS 

I. Russian forces used the Tochka-U short-range ballistic missile (SRBM), our analysis of the missile wreckage concludes. Russia still has some Tochka-Us in service despite claims to the contrary. Tochkas were filmed re-deploying from southern Belarus as early as 30 March 2022. In addition, Russia likely has a vast stockpile of combat-worthy Tochkas in reserve. 

II. Russia has announced that it attacked several railways nodes in eastern Ukraine on 8 April 2022, including Slavyantsk, but refused to claim the Kramatorsk missile strike. Instead, the Kremlin is pushing a false-flag disinformation campaign to shift the blame on Kyiv. 

III. The targeting of civilians might have been the sole objective of Russia’s missile strike, considering that the Kramatorsk train station is a well-known evacuation site. Violence against the enemy’s civilian population is a hallmark of Russian urban warfare. 


WEAPON USED: TOCHKA-U (SS-21 SCARAB)

1. Missile debris photographed near Kramatorsk train station is consistent with the booster section of a 9K79-1 Tochka-U (AFIC/NATO Reporting name: SS-21 Scarab) short-range ballistic missile (SRBM). Various online photos and 3D renderings can be used to compare and validate. The most notable identifiers are the lattice aerodynamic rudders on the tail section, the four fins, and the metal line.

Visual analysis based on comparison between debris photo and online 3D rendering of Tochka-U (T-Intelligence 2022)

2. The Tochka-U can carry various warheads – conventional, high explosive, fragmentation, chemical, and nuclear – with a maximum payload weight of 480 kg. With a circular error probability (CEP) of 15 meters, the Tochka-U was designed for area effect in locations where collateral damage is not a concern.

TARGET: KRAMATORSK TRAIN STATION

3. Geolocation confirms that the attack took place at Kramatorsk train station. Multiple independent comparisons of eyewitness multimedia material from the target site with online images of Kramatorsk train station provide irrefutable validation. 

Attack site cross-referenced with Google Maps imagery (T-Intelligence 2022)

4. A closer inspection of the target site shows that most of the destruction rained on the railway platform. The area includes an outdoor sitting area, where hundreds of civilians were waiting to evacuate by train.

TARGETING KEY EVAC CORRIDORS 

5. The targeting of civilians might have been the sole objective of Russia’s missile strike, considering that Kramatorsk train station is a key evacuation site. According to the city’s mayor, around 8,000 civilians have passed through Kramatorsk train station each day for the past weeks. The railway platform and outdoor seating area absorbed most of the damage; the railway remains functional. 

6. The high number of casualties and lack of a major impact crater is consistent with the damage caused by a fragmentation warhead. Tochka’s 9N123K fragmentation warhead contains 50 submunitions (type 9N24) that deploy thousands of metal shrapnel pieces in the target area. The use of fragmentation submunition would also explain the steady rise in the death toll – initial reports said 27 killed, but the estimate went up to over 50 in several hours. 

7. Targeting Kramatorks train station to reduce its logistical potential or destroy a military shipment might have been a secondary objective. If that was the case, the Russian military would have most likely fitted the Tochka-U with a conventional high explosive warhead and concentrated the strike on the railways. Even in the unlikely hypothesis that the infrastructure was the main target, the Russian Tochka-U units showed severe and inexcusable disregard for the heavy civilian presence at Kramatorsk train station attempting to evacuate. 

MISSILE LAUNCH SITE: RUSSIAN CONTROLLED TERRITORY 

8. Several videos are circulating on social media show missile launches that might be related to the Kramatorsk attack.

9. Preliminary geolocations put the approximate launch near Shakhatersk inside Russian-held territory. The distance from the estimated launch site to Kramatorks is 109 km, which falls within Tochka’s maximum engagement range.

RUSSIA ANNOUNCED ATTACKS ON TRAIN STATIONS IN EASTERN UKRAINE

10. On the morning of 8 April 2022, the Russian Ministry of Defense (MoD) announced on Telegram that it had conducted missile strikes that “destroyed weapons and military equipment of the Ukrainian military reserves arriving in Donbass at Pokrovsk, Slavyansk and Barvenkovo railway stations.” Interestingly, the strike on Kramatorsk, the sister city of Slovyansk, was omitted. 

ANNA NEWS CONFIRMED THE KRAMATORSK TRAIN STATION ATTACK (THEN DELETED IT)

11. ANNA News, a known Russian disinformation outlet, quickly confirmed the Kramatorsk missile attack on Telegram, and claimed based on “verified information” that a Ukrainian military train was the intended target.  After news broke out that dozens of civilians died in the attack, ANNA News deleted the Telegram announcement. Luckily enough, many users managed to screenshot the post before it disappeared. 

DON’T CALL IT A COMEBACK: TOCHKA-Us STILL IN SERVICE WITH RUSSIAN MILITARY

12. Despite official denials by Moscow, the Russian military still uses Tochka-U SRBMs. Some Tochkas probably never left service, while others were re-operationalized to preserve the Iskander SRBM stockpiles. 

SPOTTED IN BELARUS

13. On 30 March 2022, footage posted on social media showed Tochka-U tractor erector launchers (TELs) with the Russian identification marking “V” on railcars stopped at a train station in Voevoda village, Belarus. The Voevoda rail stop is 20 km southeast of Gomel and 30 km from the Ukrainian border. Geolocation confirms the event and puts the train at 52°18’31.5″N 31°12’32.0″E. The original source, TikTok user “@_taiger_Z”, uploaded the video on 30 March 2022 (archived).

a frame collage showing Tochka-Us on railcars in southern Belarus (T-Intelligence)

14. According to Conflict Intelligence Team (CIT), who checked railcar databases, the Tochka-Us were rushed to Belgorod in Russia (40 km from Kharkiv, Ukraine). The end destination suggests a likely redeployment amidst Russia’s planned focus on eastern Ukraine as part of its downsized war plans. 

15. Before 31 March, a V-marked convoy, including eight vehicles consistent with Tochka-U TELs and transloaders, was filmed moving along the M10 highway from Rechitsa to Gomel. Defense blog also featured this video in an article marking the return of Tochka-Us to active service with the Russian military. The exact date of this video could not be established, but it is possible that it was filmed on the morning of 30 March, as the uploader claims. 

16. Historical weather data indicates that it snowed in Gomel between 08:30 and 10:30 on 30 March, with temperatures between -1 and 3 Celsius. In Rechitsa, the temperature was lower, ranging from -2 to -4 degrees. Optical satellite imagery could not be obtained for verification due to cloud cover. It is also possible that the video was filmed in late February, during or after the Russian-Belarussian exercises that Moscow used as cover for its deployment north of Kyiv. 

Historical weather forecast for Gomel and Rechitsa (Belarus) on 30 March 2022

47th MISSILE BRIGADE LIKELY STILL USES TOCHKAS

17. Russia’s 47th Missile Brigade (Southern Military District/MD), based in Korenovsk, was still using Tochkas in 2021, according to CIT. The 47th has only received Iskander SRBMs in January 2022, and as the CIT analysts argue, the unit likely continues to field Tochkas as a stopgap measure until full operational capability of the Iskanders is achieved. The Donbas is the Southern MD’s area of responsibility. 


18. Hundreds of Russian Tochka-U SRBMs are likely kept in reserve and can be swiftly re-operationalized. The vast majority of Russian missile brigades retired their Tochka-U systems between 2010 and 2019 when they received the new generation of operational-tactical Iskander missiles. This means that most Tochkas have not been disabled and remain functional – most militaries allow for several years to pass until they start destroying retired equipment. 


by HARM

editing by Gecko

Comments Off on Russian Mass-Casualty Attack on Civilians at Kramatorsk Train Station

Defeated in Kyiv, Russia Downsizes War Aims to Donbas and Southern Ukraine

Key Judgements I. Defeated by Ukrainian maneuver defenses and counter-attacks, Russian forces have withdrawn from northwest Kyiv, and are reducing their presence in Chernihiv province. Returned to their launch points…

Key Judgements

I. Defeated by Ukrainian maneuver defenses and counter-attacks, Russian forces have withdrawn from northwest Kyiv, and are reducing their presence in Chernihiv province. Returned to their launch points in Belarus, the Russian military formations that are still operational or can be regenerated will most likely be redeployed to supercharge Russia’s offensive against the Ukrainian Joint Force Operation (JFO) in Donbas. 

II. Downsizing the campaign to focus on Donbas is a logical adjustment following Russia’s failure to take Kyiv or any other operational-strategic objective of this war. Defaulting back to Donetsk and Luhansk enables Russia to save face by pretending it was “about Donbas all along” (as already framed by the Russian Ministry of Defense). 

III. The campaign for Donbas will decide if and how Russia will continue prosecuting the invasion of Ukraine. If successful and with forces to spare, Moscow will most likely re-escalate its ambitions: capture more territory in the east, resume the Odesa campaign, or return to Kyiv. Southern Ukraine will remain an active front despite the focus on Donbas. 

RUSSIAN FORCES RETREAT FROM KYIV AND CHERNIHIV

NORTHWEST KYIV

1. Echelons of the 29th, 35th, and 36th Combined Arms Armies (CAA) – part of the Eastern Military District (MD) – and the 76th Guards Air Assault Division (West MD) have indeed withdrawn from NEW Kyiv to Belarus between 31 March and 1 April. Ukrainian forces have moved to secure Hostomel (31 March), Borodyanka (31 March), Dymer, Bucha, and Ivankiv (1 April). By withdrawing from Ivankiv, a strategic road junction linking Kyiv to Belarus via the Chernobyl Exclusion Zone (CEZ), the Russian military forfeits its main axis of attack on Ukraine’s capital. 

2. Russian forces in NW-Kyiv were in a state of combat ineffectiveness since 15-16 March, and withdrew to escape a likely encirclement by the Ukrainian military. The last major offensive launched by Russian forces in this area took place on March 9. In contrast, Ukraine launched a counteroffensive in the past ten days that cleared the Zhytomyr-Kyiv highway of Russian units, recaptured Irpin (28 March), and pressured Borodoyanka (western flank of the Bucha pocket). The high tempo and effectiveness of Ukrainian maneuver defense, counter-logistics operations, and anti-armor attacks have obliterated Russia’s main axis of attack and denied Moscow the strategic objective of its invasion: seizing Kyiv.  

BUCHA MASSACRE

3. Russian forces left behind a massacre in Bucha, videos circulating on social media show. Upon arrival, Ukrainian forces found mass graves, and scores of civilians’ corpses strewn throughout Bucha. Close inspection of footage shows that many of the victims were military-aged males and died of headshot wounds while having their hands and feet tied together – suggesting a likely execution by Russian troops. Women are also among the dead, and many have reportedly been raped – an increasingly widespread practice in Russian-occupied territories. Over 300 civilians are estimated to have been killed in Bucha.

NORTHEAST KYIV AND CHERNIHIV

4. Preliminary information indicate that the 41st CAA (Central MD) has mostly withdrawn from Chernihiv province. It is however unclear if all forces have withdrawn as of 4 April. Ukrainian counterattacks have lifted the siege of Chernihiv and re-established the lines of communications (LOCs) to Kyiv, as of 31 March. Clearance operation towards the Belarussian border are underway. 

5. Ukrainian gains have also been noted on the H07 segment between Brovary and Nova Basan, an area vacated by the 2nd CAA (Central MD) on 1 April. Elements of the 90th Guards Tank Army (Central MD) have also pulled back from the surrounding area. For reference, Russian forces never had effective territorial control of this AO. Instead, they attempted to secure the main roads towards Kyiv and push forces towards the capital’s eastern flank. Russian LOCs were regularly ambushed by Ukrainian forces, resulting in heavy losses and supply problems for the 2nd CAA. 

6. The 1st Guards Tank Army/TGA (Western MD) maintains positions around Sumy, although no significant Russian offensives have been noticed recently. On the contrary, on 27 March, the Ukrainian military splintered the connection between the 1st TGA and the 4th Guards Tank Division (Western MD) operating northwest of Kharkiv. Early signs indicate that some Western MD formations on the Sumy front are also pulling back to Russia. 

RUSSIA WILL FOCUS ON DONBAS

7. The Eastern and Central MD formations as well as the Air Assault units pulled out of the Kyiv-Chernihiv line and are still operational or can be regenerated will most likely be redeployed to supercharge Russia’s offensive against the Ukrainian Joint Force Operation (JFO) in Donbas. There are also indications that fresh battalion tactical groups (BTGs), which have not participated in the war, will also be committed to the Donbas front. Freshly enlisted conscripts might also be deployed to bolster Russia’s force density in Donbas. 

8. With the war entering its second stage, Russian forces will focus on conquering the rest of the Donetsk and Luhansk provinces (Russia currently controls 93% of Luhansk and 54% of Donetsk), as the Russian MoD signaled on 25 March. Downsizing the campaign to focus on Donbas is a logical adjustment following Russia’s failure to take Kyiv or any other operational-strategic objective of this campaign. Defaulting back to Donbas also allows the Russian leadership to save face and pretend it was about “Donetsk and Luhansk” all along, sweeping the disaster in Kyiv-Chernihiv under the rug. 

9. Donbas is the only area where Russian forces have managed to sustain a steady, uninterrupted advance in Ukrainian territory since the invasion began. Elements of the 1st Guards Tank Army and 144th Motorized Rifle Division (Western MD) recently captured Izium, a key city in the Donetsk river valley. From Izium, the Russian military could pursue a link-up with the Southern MD units that have captured nearly all of Luhansk province. Together, the two groupings can attempt to envelope Ukrainian positions on two axes: Sievierodonetsk-Lysychansk and Sloviansk-Kramatorks-Horlivka. Support is also expected from the Southern MD units that have stagnated in Zaporizhzhia province.

10. Mariupol remains the current key effort in Russia’s Donbas campaign. Attacked by Chechen formations, naval infantry from the 58th CAA, and a motorized regiment from the 102nd Motorized Rifle Division (Southern MD), Mariupol will likely fall in the next weeks. Although local resistance has been incredible, the heavy attrition imposed by indiscriminate Russian air and artillery strikes will most likely bring success for the invading force. The fall of Mariupol will complete Russia’s conquest of the Azov coastline. 

11. The campaign for Donbas will decide if and how Russia will continue prosecuting the invasion of Ukraine. If successful and with forces to spare, Moscow will most likely re-escalate its ambitions: capture more territory in the east, resume the Odesa campaign, or return to Kyiv. More territory under Russian control will increase President Putin’s leverage over Kyiv. Since Russia failed to seize Kyiv and control the country directly, it must now seek to coerce Ukraine by amputating parts of its and threatening to take more. 

SOUTHERN UKRAINE REMAINS A TARGET

12. Southern Ukraine will remain an active front despite Moscow’s newfound focus on Donbas. Russian forces from Crimea have captured nearly 90 percent of Kherson province, including the city, and more than half of Zaporizhzhia province. However, Russian forces failed to cross the Bug river and advance towards Odesa (they were crushed at Voznesensk), and their assault on Mykolaiv was repelled by Ukrainian forces. As of 22 March, the Ukrainians pushed the fight back to Kherson.

13. Russian forces in Kherson and Zaporizhzhia provinces will likely be allocated new objectives supporting or aligning with the Donbas campaign. Their new posture could include securing Kherson, probing attacks on Mykolaiv, or pursuing other goals. A renewed push towards Odesa is unlikely at this point in time. However, we assess the Odesa campaign has been terminated for good but only snoozed. Should the tide swing back on Russia’s side, the Kremlin will likely seek to landlock Ukraine.


by HARM

*cover image: cropped area of the Wikipedia “Russian invasion of Ukraine” map (credits: Viewsridge)

Comments Off on Defeated in Kyiv, Russia Downsizes War Aims to Donbas and Southern Ukraine

Russia Bombs Maternity Ward & Children’s Hospital in Mariupol As Part of Siege

A medical complex in the southern city of Mariupol, Ukraine, has been destroyed in a reported airstrike on 9 March 2022, social media videos show. It is virtually certain that…

A medical complex in the southern city of Mariupol, Ukraine, has been destroyed in a reported airstrike on 9 March 2022, social media videos show. It is virtually certain that Russia has conducted the attack. Russian forces have encircled the city since 1 March, uniting advancing forces from Crimea with those in Donetsk oblast, and enjoy local air superiority. Since the pincer move was completed, Russian troops have resorted to unrestricted, punitive strikes to force the Ukrainian soldiers and population in Mariupol to surrender.

THE ATTACK 

Eyewitnesses report that the strike was carried out by aircraft. The blast carved a giant crater in the middle of the medical complex, which the New York Times estimates to be 10 feet deep. If the attack was air-launched, Russia likely employed a FAB-series air-dropped bomb, likely FAB 500 (the numbers indicate its mass in kilograms). Russia has already used FAB 500 bombs in Chernihiv, including against residential areas. The possibility of a surface to surface attack also exists, however, one single artillery shell is unlikely to have caused this impact mark. No weapon debris has been documented so far. 


A regional official told Ukrainian media that 17 people were injured, including staff and patients. No deaths have been reported so far, according to Pavlo Kyrylenko, the head of the Donetsk regional administration, as quoted by Interfax

FACILITY AND LOCATION

Geolocation confirms that the building complex seen in the footage is indeed a medical facility, appearing as Dytyacha Konsul’tatyvno-DIahnostychna Poliklinika (translates in Children’s Consulting and Diagnostic Polyclinic) on Google Maps, located in Mariupol. As photos and open source information indicate, a maternity ward is also part of the medical complex. 

It is possible that Russia deliberately targeted this facility as part of its siege tactics. As extensively seen during Russia’s siege operations in Syria, Russian forces purposely target medical facilities to deprive the local population and defenders of healthcare and other key services. Such attacks also serve a psychological purpose: to terrorize the population into submission. Thrown into a humanitarian disaster, an attrited population and defending force are less capable of combat and more likely to surrender. 

MARIUPOL UNDER SIEGE

The hospital attack is just one of the many strikes that Russia has conducted on Mariupol on 9 March, as it tries to seize the city. Maxar’s very high-resolution satellite imagery reveals the extent of damage caused by Russian shelling in the past 24 hours. As the photos show, residential homes, apartment complexes, and shopping centers have been badly damaged and destroyed. The deliberate targeting of shopping centers that include hypermarkets and other large grocery stores aims to create a food shortage. This is another siege tactic that the Russian military uses to deteriorate living conditions and force a surrender.

Imagery from Maxar Technologies shows the extent of damage in Mariupol as of 9 March 2022 (compilation by T-Intelligence)

Mariupol was under a limited ceasefire negotiated between Ukraine and Russia on Sunday to allow evacuations. However, Russia has breached the ceasefire by shelling the humanitarian corridors, stalling the evacuation in the process. 

The collapse of Mariupol will enable Russia to link Crimea with the separatist territories in Donbas by land, which has likely been a Russian aim since the 2014 Donbas offensive. Back in 2014-2015, Mariupol represented the maximum point of advance of the Russian military during the Donbas offensive. Ukrainian forces managed to stop the Russian advance and keep Mariupol. 

Russian control of Mariupol will also leave Ukraine without access to the Azov Sea, as Russia has already captured 99% of the coastline.  


 

Comments Off on Russia Bombs Maternity Ward & Children’s Hospital in Mariupol As Part of Siege

Ukraine Repels Russia’s Initial Blitz (What’s Next?)

Russia has failed to break through Ukrainian defenses in Kiyv and Kharkiv, despite successive airborne and armored assaults backed by artillery, since 24 February 2022. The Ukrainian military has significantly…

Russia has failed to break through Ukrainian defenses in Kiyv and Kharkiv, despite successive airborne and armored assaults backed by artillery, since 24 February 2022. The Ukrainian military has significantly decelerated Russia’s offensive and brought it to a near standstill on most fronts. What Vladimir Putin expected to be a blitz is turning into a slow grind for the Russian military. Ukraine’s defenses prove robust, and the military’s willingness to fight is unshattered. 

Military aid from NATO will provide much-needed replenishment for anti-tank, surface-to-air, and air-to-air missiles ahead of a likely beefed-up Russian assault. 

Russia will likely also escalate violence, relax the rules of engagement, and increase the use of heavy artillery like thermobaric munition, cluster submunition, and ultimately, ballistic missiles. The objective will be to break the Ukrainian military’s and population’s will to resist.

FOUR DAYS OF WAR, ONE FAILED BLITZ 

1. The past 100 hours have shown that Russia’s campaign has been governed by overconfidence that Russian forces would move fast and seize key objectives, including Kiyv, and a severe underestimation of the Ukrainian military’s ability and will to fight. Moscow’s buoyancy racked up a hefty bill, which includes thousands of Russian soldiers killed in action and loss of military hardware such as aircraft, artillery, and armored vehicles. Grave symptoms of Russia’s misguided optimism are: 

INABILITY TO ACCEPT FIERCE UKRAINIAN RESISTANCE 

2. Russia’s biggest miscalculation was to doubt Ukraine’s ability and willingness to fight. Russian commanders have likely forecasted an immediate collapse of the Ukrainian military or a chain-surrendering of the units posted on the frontline, similar to Crimea in 2014, facilitating a quick advance on Kiyv. Besieging Kiyv, forcing the Zelensky administration out of office (even through assassination), and installing a pro-Russian government is undoubtedly the main objective of the Russian invasion. 

3. Most Russian war plans seem to have been based on the assumption of weak resistance, which led to poor logistical planning, a “restrained” offensive counter-air (OCA), incomplete suppression of enemy air defense (SEAD), the inability to establish complete air superiority, and ultimately, failure to reach key objectives. 

FAILURE TO SEIZE KIYV AND MAJOR POPULATION CENTERS

4. Four days into the invasion, Russia has not managed to seize and control any of Ukraine’s major population centers, including Kiyv.

KIYV: Ukrainian forces have heroically repelled multiple Russian charges on Kiyv. The Ukrainians fought off at least three major airborne assaults (two on Hostomel airfield, which was ultimately captured, and one on Vasylkiv airbase) and three to five mechanized and/or motorized operations. Russia’s assaults on Kiyv have exclusively come from the northwest as Russian troops have failed to surround the capital thus far. Ukraine’s victories resulted in tactical defeats and massive casualties for Russia’s tip-of-the-spear units, the special operations forces (SOFs), and airborne assault troopers.

Ukraine has also managed to hit deep beyond Russian lines, including with a Bayraktar TB2 and anti-tank ambushes.


CHERNIHIV: Despite several attempts, Russia did not manage to break through Ukrainian defenses at Chernihiv.

KHARKIV: Despite several attempts to encircle Ukraine’s second latest city, Russian forces have failed to besiege or establish a foothold in Kharkiv. Ukrainian defenses repelled all attacks and resisted multiple artillery strikes from across the border. The 1st Guards Tank Army (Western Military District), Russia’s most capable armored formation, is spearheading the Kharkiv operation.

The failed “thunder run” towards downtown Kharkiv by Russian light infantry on 27 February showcased a lack of imagination and quick solutions for breaking Ukraine’s local defenses.

KHERSON: Russian forces were unable to fully control and hold Kherson despite a small incursion. 

RUSSIA DOES NOT HAVE AIR SUPERIORITY

5. Russia has failed to establish complete air superiority over Ukraine. Multiple social media videos from the past days have shown Ukrainian Su-25 attack aircraft, MiG-29 and Su-27 fighter jets, and Mi-24 utility helicopters engaged in operations against Russian forces. The Ukrainian Armed Forces recently released footage showing three separate strikes on Russian positions using Bayraktar TB-2 combat drones. News that NATO (likely Poland) has resupplied Ukraine with air-to-air missiles indicates that more Ukrainian fighter aircraft survived Russia’s pre-assault Offensive Counter Air (OCA) strike. 

Insufficient OCA: While we are still reviewing satellite imagery, our preliminary assessment is that the vast majority of Ukrainian Air Force (UkAF) bases are still operational. As most runways are intact, flight operations can take place. 

Craters and impact points are only visible on tarmacs, indicating that Russia’s missile strikes have damaged and disabled some aircraft. The strikes also destroyed fuel and ammunition storage facilities in annex sites. 

Russia likely planned this outcome. As many analysts have pointed out, Russia probably expected to seize the airfields and use them immediately. Instead of destroying the runways, Russia preferred to render the UkAF fighter jets ineffective by leaving them without fuel and ammunition. 

Nevertheless, this “restrained” OCA has boomeranged on the advancing forces who continue to face aerial bombardments from Ukrainian attack aircraft, helicopters, and drones. 

Unsuccessful Suppression of Air Defenses: Amid continued reports of Ukrainian air defense activity, including the S-300 and Buk-M1, it is highly likely that Russia did not manage to suppress or destroy Ukraine’s defenses completely. These systems are highly mobile. Ukraine probably moved some systems to hideouts to survive “the first day of war.” It is also likely that Ukraine baited Russian missiles with dummy targets, even radar-emission-rich, to improve the survivability of its air defenses. 

POOR LOGISTICAL PLANNING

6. Another key symptom of Russia’s overconfidence is the derelict logistical situation of its troops in Ukraine. There are reports that Russian soldiers lack fuel and food and therefore have to source resources locally. This does not come as a surprise, as the Ukrainian military has scored big hits on Russian supply lines, destroying scores of fuel trucks and utility vehicles lagging behind assault troops. In “blitz” offensives, the infantry pushes forward towards the objective, leaving the logistical units behind in a highly vulnerable position. If the logistical support units are destroyed, the assault becomes unsustainable despite significant territorial gains of the advancing force.

One iconic video shows a conversation between the crew of a stranded Russian armored personnel carrier that ran out of fuel and a Ukrainian citizen. 

Another video shows Russian soldiers looting a convenience store in Kharkiv. 

Expecting a “blitz” offensive with a quick victory, Russian commanders possibly ignored the need to ensure a steady stream of supplies. 

FRUSTRATION & ESCALATION: WHAT TO WATCH OUT FOR

NORTH-EAST AXIS OF ATTACK COULD SPELL DOOM FOR KIYV

7. A Russian breakthrough on the Chernihiv-Hulkhiv-Sumy frontline could mark the beginning of the end for Kiyv. If these forces are freed up and reach the capital, the Russian military could surround Kiyv. Thus far, the Ukrainian army has managed to keep the Russian advance from southeastern Belarus, Yelnya and Kursk, in check. However, this is an area of operations that require close attention 

AVOID CITIES, RACE FOR KIYV

8. There are reports that Russian forces have been ordered to bypass regional cities and race towards Kiyv. A rush for Kiyv would leave the flanks and rear of the Russian columns extremely exposed to Ukrainian attacks, but the pay-off would be huge. A multi-axis convergence on the capital would very likely break the capital’s defenses. The presence of Russian troops beyond cities that they have not captured, such as Chernihiv and Kharkiv, are clear indicators of a rush for Kiyv. 

COUNTER-LOGISTICS OPERATIONS IN WESTERN UKRAINE

9. Stopping the flow of ATGMs and MANPADs from NATO to Ukraine will become a priority for the Russian military in the coming days. Small teams of Russian Special Operations Forces (SOFs) will likely infiltrate to interdict Ukraine’s supply lines from Poland. They will recon Ukraine’s supply routes and storage and distribution hubs and pass on intelligence for air or artillery strikes. Russian SOFs could also provide terminal guidance for RuAF strikes, especially in the case of precision-guided munitions. It is also possible that Russian SOFs could take matters into their own hands and seek to destroy munition transports. 

Renewed Russian missile attacks on Ukraine’s western airfields, or even attempts to shoot down cargo jets are likely also on the table, as a way to disrupt Ukraine’s logistical connection with NATO. 

TROOP & VIOLENCE ESCALATION

10. As Russia becomes frustrated with the Ukrainian resistance, it will likely ease rules of engagements (ROE) and phase in more heavy artillery strikes on populated centers. In such a calculus, we would see widespread use of ballistic missiles (BMs), including the Iskander systems, which have been forward-positioned along Ukraine’s borders for weeks. Mounting evidence suggests that Russia has already launched BMs from Belarus, some of them impacting Zhytomyr airfield and Chernihiv. 

11. Russia will likely allocate more forces to the offensive. Currently, only 50 to 70 percent of the troops amassed around Ukraine are engaged in the offensive. As more Russian troops from staging grounds in southern Belarus, Yelnya, Kursk, Voronezh-Belgorod, and Crimea cross the border, Russia will need to rebuild its reserve force. An indicator of this will come in the form of eyewitness videos from Russia showing new troop movements or mobilizations, as we have recently seen with the Chechens. A higher troop count (over 200,000 soldiers) combined with overwhelming artillery and missile strikes is likely Putin’s ultimate bet to break Ukraine’s will to fight.


by HARM

editing by Gecko

Comments Off on Ukraine Repels Russia’s Initial Blitz (What’s Next?)

Russia Invades Ukraine: First Day of War Through OSINT

In the early hours of 24 February 2022, Russia commenced a series of pre-assault operations to soften Ukrainian defenses ahead of an all-out, multi-axis invasion, which is now in progress….

In the early hours of 24 February 2022, Russia commenced a series of pre-assault operations to soften Ukrainian defenses ahead of an all-out, multi-axis invasion, which is now in progress.

This course of events was extensively threatcasted by the OSINT community weeks in advance, including us. Those familiar with our estimates from January 2022, see here, would have expected a Russian invasion and the subsequent operational and tactical developments. 

DAWNBREAKER: PRE-ASSAULT OPERATIONS

Cyber attacks & Electronic Warfare (EW): 

1. The opening salvos of Russia’s invasion were cybernetic and electronic and were initiated on 23 February 2022. Russia launched Distributed Denial of Service (DDos) attacks on the Ukrainian government, jammed military communications, and psychological operations against Ukrainian troops.

2. One notable EW attack was conducted by a Leer-3 which spammed Ukrainian troops with SMS calling them to surrender or be killed.

Suppression/Destruction of Enemy Air Defences (S/DEAD)

3. In the dead of night, Russia launched land-attack cruise missiles (LACMs) and anti-radiation missiles (ARMs) at Ukrainian integrated air and missile defenses. They likely disabled several early warning, tracking, and engagement radars, rendering Ukraine’s sensors and SAM systems ineffective (S-300, Buk M-1). However, some might still be functional or serviceable. 

Debris is consistent with Kh-31PD anti-radiation variant

Offensive Counter Air (OCA)

4. Russia launched massive strikes against airbases to ground the Ukrainian Air Force (UkAF). Damaged runways prevent Ukrainian aircraft from taking off and landing. Follow-up salvos disabled the grounded aircraft and cleared facilities for occupation by airborne troops. 

5. Visual evidence suggests that Russia fired ballistic missiles, likely Iskanders (SS-26 Stone), at airbases to cause structural damage – a textbook use of BMs for anti-runway operations. 

6. Latest satellite imagery of Chuhuiv Air Base near Harkhiv shows that Russia did not crater the runways of all airports, instead it destroyed fuel depots and munition storage. 

7. One Ukrainian Su-27 flew into Romanian airspace where it was intercepted by Romanian F-16s and forced to ground at Bacau Air Base. As per Romanian government accounts, the pilot’s homebase was destroyed and had nowhere else to land. 

Counter-C3

8. Russian LACMs also leveled command, control, and communication nodes (C3). These attacks aimed to separate the higher echelons from battlefield units, behead the leadership, and throw the military in disarray. This was another textbook pre-invasion tactic.

Counter-Logistics

9. Many videos emerged online showing LACMs pounding ammunition depots and warehouses, resulting in massive secondary explosions. Attacks to bleed Ukraine’s logistical supply lines have occurred nationwide, including Lviv (near Poland), Ivano-Frankivsk (close to Romania), Melitopol, and Odesa. 

10. Our previous T-Intelligence analysis anticipated this tactic to diminish Ukraine’s growing ATGM stockpile.

MIDDAY RUMBLE

11. Shortly after the crack of dawn, the Russia commenced a multi-axis ground offensive, moving tanks and armored vehicles along select axis of attack. 

Russian operational directions and screengrabs from select videos showing military attacks in Ukraine

Air superiority

12. As OCA was largely successful and grounded most of the UkAF’s extensive fighter fleet, the Russian Aerospace Forces (RuAF) could establish air superiority. Otherwise, we would not have seen a major helicopter assault on Kiyv and nearby airports. However, a video emerged showing a UkAF MiG-29 buzzing the skies of Kiyv and allegedly dogfighting an alleged Russian Su-35, which means that not all fighters are grounded or destroyed (update: a re-examination of the video concludes that both aircraft are Ukrainian).

Manoeuvre

13. Russian battalion tactical groups (BTGs) have advanced from nearly all operational directions:

  • Belarus (to Kiyv, the Pripyat area, Chernihiv)

14. Russian forces in Belarus crossed the border towards Chernihiv, seized the Chernobyl exclusion zone following a heavy armored battle with Ukrainian forces, and deployed a massive airborne assault on Kiyv. 

  • Voronezh (to Kharkiv and Sumy)

15. Under the cover of rocket artillery, tank columns crossed into Ukraine and rapidly approached the country’s second-largest city, Kharkiv. The battle for Kharkiv is still raging on, with Russia facing losses. Intrusions have reportedly also occurred further north on the frontier near Sumy. 

  • Don (further into Donbas)

16. Recently reinforced by Russian troops, Luhansk and Donetsk separatists have launched a tandem assault across the demilitarized zone. Operational objectives are to capture Kramatorsk and Severodonetsk, and secure the rest of Donetsk and Luhansk regions. Splinter groups will likely then follow up to hit Ukrainian positions in Kharkiv from the rear, and separately, besiege Mariupol.  

  • Crimea (to Kherson & Melitopol)

17. Russia made significant territorial gains north of Crimea, towards Kherson city and most adjacent areas. A separate line of the assault went eastwards and arrived at Melitopol. Beyond Melitopol, Russian forces aim to encircle Mariupol with Donbas formations.

  • *Black Sea Fleet

18. An amphibious assault on Odesa is still expected but would likely come later to complete the pincer movement with troops advancing from Kherson. 

Close Air Support (CAS)

19. Ka-52 attack helicopters, Su-25 attack aircraft, and a myriad of ground-based artillery provide overwhelming fires to the advancing columns. Russia’s successful OCA and subsequent air superiority enabled aerial CAS platforms. Without a permissive aerial environment, Su-25s and attack helicopters would have been easy targets for Ukrainian fighter jets. 

Airborne assault

20. Russian Airborne Forces aboard Mii-8 helicopters and escorted by attack helicopters have assaulted key areas around Kiyv. Russian paratroopers achieved a breakthrough at Hostomel airfield/Antonov International Airport, but lost three helicopters to ground to air fire in the process. Russia’s airborne assault seemed rushed, albeit speed is key to maintaining the initiative, and faced heavy resistance. 

Securing these facilities is key to airlift tanks, personnel, and the necessary equipment to besiege Kiyv.

NIGHTFALL: OFFENSIVE OPERATIONS CONTINUE

Tactical defeat

21. Russian airborne units have lost Hostomel airfield after a strong counterattack from the Ukrainian military. If sustainable, the loss of Hostomel is a significant blow to Russia’s plans to quickly amass and encircle Kiyv before Ukrainian forces establish better defenses. 

EPILOGUE

For reasons of operation security, we will not comment on Ukraine’s military movements. We urge OSINT analysts not to share videos or images of the Ukrainian Armed Forces.


by HARM 

Comments Off on Russia Invades Ukraine: First Day of War Through OSINT

Mother of All Bear Scares: Russia Amasses Forces for a Multi-Axis Attack on Ukraine

KEY JUDGEMENTS I. The Russian military build-up around Ukraine is designed for combat operations and not a show of force (“bear scare”). Our estimates are based on the unprecedented scale…

KEY JUDGEMENTS

I. The Russian military build-up around Ukraine is designed for combat operations and not a show of force (“bear scare”). Our estimates are based on the unprecedented scale of Russia’s military build-up, the force composition in terms of capabilities, credible logistics, and increased operations security. 

II. President Putin’s intentions remain unclear, but a military operation against Ukraine is moderately likely. The hypothetical campaign will likely be punitive, target Kyiv or Kharkiv, and seek to install or facilitate the emergence of a Russian-friendly “salvation” government. 

III. Moscow’s diplomatic campaign around the build-up serves the informational offensive against NATO. Russia does not seek a political settlement to the current tensions and is well aware that its maximalist demands are non-starters for the West. However, these political talking points serve to shift the blame for the current tensions on the so-called “NATO expansion.” 

IV. Only the threat of massive economic sanctions can alter Russia’s war plans. Ironically, NATO’s most unreliable member, Germany, holds the biggest financial leverage against Russia. Ukraine’s growing stockpile of ATGMs will be critical to slow down an armored assault and impose costs on an aggressor but have no strategic value.


READY FOR COMBAT

UNPRECEDENTED BUILD-UP

1. Russia has amassed around 100,000 troops, organized in 50 to 60 Battalion Tactical Groups (BTGs*), in five areas bordering Ukraine. The mobilized force represents roughly 30% of Russia’s 168 BTGs. This is the largest Russian build-up in modern history, far exceeding the number of BTGs deployed to annex Crimea (approx. four) and subsequent offensives in Donbas (five to eight). 

A substantial part of the BTGs deployed around Ukraine consist of equipment without personnel. However, Russian General Staff can deploy forces to man the equipment at a moment’s notice, especially using airlift capabilities (as recently demonstrated in Kazakhstan). In addition, a large portion of the troops has been permanently based near the Ukrainian border since 2021 or earlier. 

*BTGs are temporary operational formations of infantry battalions and attached artillery, air defense, engineering, and logistics support units for combat operations, as part of motor rifle and tank brigades. Air assault units, special operations forces, and other echelons can also be attached to a BTG. 

*Estimates on BTG posture: Ukrainian military intelligence estimates of 40 BTGs from late-November 2021 serve as a baseline layer (now dated and exceeded), followed by personal approximations in January, and most importantly, taking into account more precise calculations from Rochan Consulting (54 on 17 January 2022) and Michael Kofman, director of Russia Studies at CNA (55-60 on 15 January 2022).

Overview of Russian military build around Ukraine. Note that the map is slightly outdated and does not show the units recently amassed in southern Belarus. (source: New York Times)

2. Four out of five Russian military districts have provided units for the build-up, including four field armies from the Eastern Military District (EMD), which are heading towards Belarus for the first time. The level and scope of cross-theater deployments are out of the ordinary and represent a significant logistical strain on the Russian military.

3. Russia’s build-up continues to escalate in scope and complexity. Ongoing troop movements to reinforce established positions, deployments of advanced weapons capabilities like Iskander short-range ballistic missiles (SRBM), and opening a new front in southern Belarus underscores the continuity of the operation. US intelligence estimates that the Russian build-up will ultimately amount to 175,000 troops/100 BTGs.


LOGISTICAL PREPARATIONS

4. The flow of logistical units and equipment to Ukraine’s border is the clearest indicator of a build-up with the intention of combat, apart from the unprecedented manpower involved. Eyewitness footage on social media has documented the westward movement of Russian fuel tankers, bridging/pontoon equipment, recovery truckstransloaders, and other utility vehicles on railcars from late October to mid-December 2021.  

5. Logistical movements have re-intensified between January 15-20, 2022, despite a slowdown in the previous month. Railcars now mostly service routes from Siberia, delivering EMD hardware and personnel, to southern Belarus. These transports can be subject to delays caused by bad weather, mechanical issues, or other obstacles that arise on long-term deployments.  

6. Russia’s logistical capacity around Ukraine is difficult to estimate at this point. The most recent authoritative estimate comes from a U.S. government source (quoted by CNN on 3 December 2021): “current levels of equipment stationed in the area could supply frontline forces for seven to 10 days and other support units for as long as a month.” Russia’s current logistical capacity is now likely more extensive than in December. 

7. Russia’s logistical build-up is likely incomplete and will certainly continue at least until February 10-20, when joint exercises will take place in Belarus. With no “Z-Day” in sight, troop movements and supplies will probably continue beyond February – if not to boost to sustain the Russian military capacity. A CITEAM social media analysis found that most soldiers are expected to be deployed for two to seven or even nine months. 

While unnecessary for a show of force, logistics are a prerequisite for military operations. Tanks cannot move without fuel from tankers; soldiers cannot receive food and ammunition without utility trucks supplying the frontline; combat injuries must be treated in field hospitals. 

EFFORTS TO CONCEAL

8. Unlike during previous “bear scares,” Russia has made significant efforts to conceal the troop movements and boost operations security (OPSEC). Countermeasures include nighttime movements, blacking out unit markings, covering equipment, disrupting online tracking methods (such as railcar databases), and dispersing staging areas in smaller formations. This behavior starkly contrasts the build-up in March and April 2021, when the Russian posturing was overt and demonstrative.


FIVE OPERATIONAL DIRECTIONS (OD)

9. Russia has positioned its forces along five axes of attacks, or operational directions (OD)*, around Ukraine: Belarus, Yelnya, Orlov-Voronezh, Don, and Crimea. The following is a short account** of Russian troop dispositions in the five ODs, their relevance, and possible objectives. 

Map shows the Ukraine military intelligence assessment of possible Russian attacks paths (source: Ukrainian military/Military Times)

*axis of attack launched from a given staging area, as seen in a Ukrainian Military Intelligence map released in a Military Times interview November 2021. 

**For an extensive and detailed overview of the Russian order of battle in these areas, please refer to Rochan Consulting’s Tracker, from which most of this data is drawn. 

BELARUS OD

a. The latest and most important piece of the jigsaw puzzle assembled around Ukraine. OD Belarus brings Kiyv within striking distance of Iskander-M SRBMs. Due to its proximity to the capital (150-200 km), OD Belarus can serve as a springboard for an offensive on Kiyv. 

b. Currently, there are seven to ten BTGs in Belarus, mainly from the EMD, according to Rochan Consulting. Russian infantry and mechanized units have been documented arriving in large numbers in Mazyr, Recyca, Gomel, Yelsk (18 km from UKR border), and the surroundings. 

c. Troop movements towards Belarus began sometime in early January and are escalating. A Su-35 squadron has left its homebase inKomsomolsk-on-Amur (near the Sea of Japan), and will soon touch down in Belarus.  Two S-400 surface-to-air missile (SAM) systems will follow shortly. Iskander SRBMs are also reportedly joining the party.

YELNIA OD

 a. The forces headquartered and amassed around Yelnya could support OD Belarus and OD Orlov-Voronezh with reinforcements or open a new axis of attack to stretch UKR forces thin in the north. Around four to eight BTGs are based in OD Yelnya, with many units assuming positions close to the tri-border with Belarus and Ukraine at Klintsy. With the influx of an Iskander battalion (approx. 24 missiles) from the 119th Missile Brigade, and various multiple rocket launcher systems (MRLS), OD Yelnya also packs firepower with range to strike Kiyv. 

Russian military presence at a staging ground near Yelnya. Image captured on 19 January 2022 by Maxar Technologies.

ORLOV-VORONEZH OD

b. Established during the initial build-up in March and April 2021, these forces pose a direct threat to Ukraine’s second-largest city, Kharkiv, and the adjacent areas. There are likely at least twelve BTGs concentrated between Orlov and Voronezh, and these forces have been kept at high readiness through drills simulating nighttime assault and artillery support. 

Pogonovo training ground. Imagery captured on 16 January 2022 by Maxar Technologies

c. Pogonovo and Krynitsa training grounds are the epicenters of the manpower concentration in this OD. Since last year’s “bear scare,” Pogonovo has been exceptionally well documented via satellite imagery (see our analysis) and remains an area of primary concern (see Rochan Consulting’s GEOINT analysis). The forces and equipment at the two staging grounds augment the formidable 20th Combined Arms Army (CAA) headquartered in Voronezh. 

d. In the past weeks, units in this OD have inched increasingly closer to Ukraine’s border. Satellite imagery from December 2021 shows an increase in military hardware in Valyuki/Soloti, just 15 km from the Ukrainian border. Similar activities have been noted in Baguchar (80 km), amounting to a worrying trend. 

DON OD

a. Over 15 BTGs inhabit the areas between Rostov-on-Don and Ndvocherkassk. Their potential role will be to rendezvous with Russian forces stationed in eastern Ukraine to strengthen local defenses or help mount an offensive in depth. Hypothetical offensive operations will likely seek a breakthrough in Mariupol followed by a march along the Azov coastline. Don OD could also eye the Dnieper river valley, especially in a joint operation with splinter formations from Orlov-Voronezh OD. 

CRIMEAN OD

a. This OD could open no less than three axes of attacks on Ukraine’s coastline. An amphibious assault launched from Crimea’s western coast would target Odessa and the adjacent littoral. Once ashore, these forces could link up with the Operational Group of Russian Forces (OGRF) from the Transdnister breakaway republic coming from the west. The lower section of the Dnieper valley (North Crimean canal) is another realistic, although overstated, target. Together with Don OD, Crimea-based forces would likely also attempt a pincer movement on the Melitopol-Mariupol axis. 

b. Russia has simulated almost all of these attack scenarios during the military build-up in March and April 2021, during which new BTGs assumed permanent stations in Crimea, bringing the total count to at least 12 BTGs. Back then, the main event was a major amphibious assault on the Opuk training range, which we documented in this analysis. Air and infantry assaults around Dzankhoi and other areas in northern Crimea were also noteworthy. 

c. Naval movements are also underway, with a task force comprising of Baltic Fleet and North Fleet vessels (including three Ropucha-class landing ships) heading towards the Mediterranean Sea to link up with Pacific Fleet ships for joint exercises. There are fears that at least a part of the maritime task force will enter the Black Sea. 


INTENTIONS & AIMS

10. Russia’s intentions remain unclear, but we judge the likelihood of direct action high with a 55 to 60% confidence level. Our estimates are based on the build-up’s unprecedented scope and credible composition, including the multi-axis posturing and the unachievable, maximalist political demands of Russian diplomacy. 

11. It is unknown how the hypothetical military operation will look. While the Russian military is positioned for a multi-axis assault, it will not necessarily follow the apparent blueprint. Russia might seek to activate only one OD, such as Belarus or Voronezh, a combination of them, or all. Attacks could be simultaneous or gradual and will fluctuate based on the situation on the ground. 

12. The hypothetical campaign will likely be punitive, target Kyiv or Kharkiv, and seek to install or facilitate the emergence of a Russian-friendly “salvation” government. Such an operation would be akin to the 2008 Georgian campaign, where Russia did not seek to annex territory but to force the government into submission. Rob Lee put forward a similar hypothesis in an extensive article here

13. There is also a high possibility (40 to 45%) that no military operation will occur, yet heightened tensions will persist. The build-up could proceed and even escalate, but hold out for months. As a result, more units will permanently or semi-permanently entrench near Ukraine, waiting to achieve strategic surprise later. The payoff could come even seven months into the future. Alternatively, a significant amount of forces could pack up and return to their home base at any given moment. 

14. Russian President Vladimir Putin will make the final decision. While “Kremlinologists” have long tried to interpret the thoughts of Kremlin leadership, nobody knows Putin’s calculus. He has likely committed to one or several courses of action, hence the comprehensive preparation, but the final order has not been signed and issued. 


RUSSIAN MOTIVATIONS

FEARS OF IMPENDING UKRAINIAN OFFENSIVES IN DONBAS

15. The key driver of this build-up is the perceived threat of a Ukrainian offensive to recapture Donetsk and Luhansk and the increased anti-Russian narratives of the Zelensky administration. Past events (see below) might have forced Russia to consider that the current democratic order will not generate a pro-Russian government in Kiyv. Recapturing Donbas and pursuing NATO membership will remain a top priority of all upcoming cabinets.

a. THE DRONE STRIKE: On 26 October 2021, a Ukrainian Bayraktar TB-2 drone bombed a Russian artillery position in Luhansk. The artillery system had passed the withdrawal line of the Minsk agreement and shelled Ukrainian positions. This was the first Ukrainian airstrike on a Russian position and arguably Kiyv’s most hawkish action in years. Russia reacted by resuming and escalating the build-up of March to April 2021, leading to what we see today. 

b. THE PERCEIVED UKRAINIAN BUILD UP: Between late 2020 and early 2021, a string of videos online apparently showed Ukrainian tanks on railcars rushing towards eastern Ukraine. Whether this was a build-up or just a rotation of the forces stationed near the frontline remains unclear. However, Russia decried the troop movements as preparation for an offensive in Donbas. In retaliation, Russia escalated the conflict in Donbas and initiated the build-up of March and April 2021. 

c. ZELENSKY TURNS HAWKISH: Ukrainian President Zelensky initially adopted a de-escalatory agenda regarding Donbas and pursued peace talks with Russia. By 2020, it became apparent that Russia had no interest in entering negotiations with Ukraine until non-starter demands, such as Ukraine renouncing NATO membership and sovereignty over Donbas, were met. As Zelensky’s dovish strategy failed to bear fruit, his public approval started plummeting. As a result, he adopted a more hawkish demeanour, taking action against Russian-backed opposition, seeking to re-energize ties with NATO, and invigorating Ukrainian aspirations in Donbas. Russia took note of the change of tone and started viewing Zelensky as a problem. 

SECONDARY CONSIDERATIONS

16. Modernization and growing capabilities of the Ukrainian Armed Forces render Kyiv an increasingly potent adversary. Tactical assets like the Bayraktar drones and Javelin anti-tank guided missiles (ATGMs) cannot generate strategic advantages, but ballistic missiles and cruise missiles can – if stockpiled in high enough numbers. Ukraine is currently developing the Hrim SRBM (with covert funding from Saudi Arabia) and Neptune anti-ship cruise missiles. These two assets can pose a credible threat to Russian critical infrastructure, command and control centers, and population centers, raising the cost of aggression for Moscow. Other programs such as unit reform or NATO training and standardization will also improve Ukrainian combat effectiveness. 

17. NATO Reconnaissance sorties over Ukraine keeping a watchful eye on nefarious Russian activity. Russian officials have publicly decried the constant sorties of NATO reconnaissance aircraft tracking their movements in Donbas and the Black Sea. American Global Hawk drones, P-8A Poseidons, various RC-135s and various other ISR aircraft patrol the region daily and could provide early warning of a Russian invasion and expose the movements. 

18. Growing defense ties between Ukraine and individual NATO members. Similarly, Russia is unhappy with the maturing defense ties between Ukraine and various NATO members, especially the United Kingdom. Ukraine and the United Kingdom have signed a defense agreement in mid-2021, which was followed by a significant incident at sea involving the HMS Defender and a Russian naval task force (see our analysis on the topic). While Ukrainian NATO membership remains impossible at this point, Russia is taking note that individual NATO members are coming to Kiyv’s aid. 


DIPLOMACY: THE INFORMATIONAL COMPONENT

19. Moscow’s diplomatic campaign around the build-up serves the informational offensive against NATO. Leveraging nonmilitary means, namely political and information warfare, is a tenet of the Russian General Staff’s approach to “new generation warfare.” Russia’s official demands include guarantees that Ukraine will never join NATO, the withdrawal of NATO troops from Romania and Bulgaria, the decommissioning of the Ballistic Missile Defense system in Deveselu (Romania), and others. Russia does not seek a political settlement to the current tensions and is well aware that its maximalist demands are non-starters for the West. However, these political talking points serve to shift the blame for the current tensions on the so-called “NATO expansion.” 

20. Western interactions with Russia’s false demands played into the Kremlin’s hands. Imprisoned opposition leader Alexey Navalny has perhaps captured the situation best in a TIME interview: “Instead of ignoring this nonsense, the U.S. accepts Putin’s agenda and runs to organize some meetings. Just like a frightened schoolboy who’s been bullied by an upperclassman.” Western diplomats should have rejected this rhetoric and brought the conversation back to the reality on the ground – the 100,000 Russian troops positioned to swallow Ukraine. 


MEASURES TO DISCOURAGE ATTACKS & PALLIATIVES FOR THE DAY AFTER

21. Only the threat of massive economic sanctions can alter Russia’s war plans. Ironically, NATO’s most unreliable member, Germany, holds the biggest financial leverage against Russia. Nothing would deter a Russian invasion more than a credible threat from Berlin to terminate the North Stream 2 project. Perhaps equally important would be a concerted effort to disconnect Russia from the SWIFT payment system. American and EU targeted sanctions on Russian oligarchs will not affect military plans. 

22. Wholesale transfers of tactical military equipment to the Ukrainian Armed Forces are necessary palliatives but do not deter a Russian invasion. Ukraine received over 1,000 NLAW ATGMs from the United Kingdom in the past few days. The British NLAWs will significantly boost Ukraine’s ATGM inventory, consisting of around 400 Javelins received from the United States, first under Trump (2017; 2018), then Biden (2020; 2021). Estonia will also deliver an unknown number of Javelins while Latvia and and Lithuania will donated Stinger man-portable surface-to-air missile systems (MANPADs) to Ukraine, in the next days. 

Ukraine’s growing stockpile of ATGMs will be critical to slow down an armored assault and impose costs on an aggressor but have no strategic value. Russia has likely already devised tactics to mitigate the ATGM threat using long-range fires, drone-directed artillery, and airstrikes, drawing from lessons learned in Syria. Alternatively, sabotage behind enemy lines is another course of action that Russia could take – and has likely already taken – to compromise ammunition depots.

NATO states should continue delivering military aid to Ukraine. The care packages should consist exclusively of easy-to-use equipment which can be quickly absorbed by the Ukrainian military and not require extensive training or high maintenance. 


by HARM 

editing by Gecko

This assessment was made using Open-Source Intelligence (OSINT) techniques and resources. Visit Knowmad OSINT to learn more about our online OSINT training. 

Comments Off on Mother of All Bear Scares: Russia Amasses Forces for a Multi-Axis Attack on Ukraine

T-Intell’s OSINT Training Marks One Year Anniversary

On 15 November 2021, T-Intelligence’s sister branch and training service, Knowmad OSINT, marked one year since its inception. Around 100 people went through the Knowmad OSINT training to acquire or…

On 15 November 2021, T-Intelligence’s sister branch and training service, Knowmad OSINT, marked one year since its inception. Around 100 people went through the Knowmad OSINT training to acquire or enhance their OSINT skills during the past year. Students, career starters, seasoned professionals, and hobbyists took up our course. Various Individuals, private companies, and government-sector agencies entrusted us with OSINT training, including one of the world’s leading postgraduate programs in Security, Intelligence, and Strategic Studies

 


When planning started for the course, seeing the increased interest on the civilian job market for OSINT skills, we based our training design on three main pillars:

  1. OSINT for all: we wanted our course to be accessible to beginners and bring value to established professionals. In addition, our content and lessons would be exclusively based on openly and freely available resources so that participants do not stumble across paywalls or other barriers. 
  2. INT back into OSINT: First and foremost, OSINT is an intelligence practice at its core. Our training underscores this aspect and takes an interdisciplinary and analytical approach to OSINT.
  3. More than just an INT: While honouring OSINT’s original mission in national security and defense, we choose to take an innovative approach to the field. We wanted our course to embody Mark Lowenthal’s idea from the late 1990s, namely that OSINT is slowly becoming a facet of the other collection disciplines. As a result, our course covers the open-source applications of IMINT, GEOINT, SIGINT, and HUMINT/SOCMINT.

We’re happy to report that our training helped people break into the intelligence field, climb the job ladder or find their calling as early career-starters. We want to thank everyone, not only our Knowmads but also our T-Intelligence readers, for tuning in for our periodical articles and engaging with us on social media. It’s been a blast! 

Moving forward into Year Two, Knowmad OSINT will continue to grow and proliferate OSINT expertise to both the public and clandestine communities. T-Intelligence will continue to provide the OSINT action it has done for the past five years. 

If you or your organization is interested in developing OSINT skills, send us a message! 

The T-Intelligence & Knowmad OSINT team

Comments Off on T-Intell’s OSINT Training Marks One Year Anniversary

No Time To Dispute: Russia’s A2/AD in the South Kurils

Remote and derelict, riddled with active volcanoes and disputed between Russia and Japan, the South Kurils make the perfect secret lair for any self-respecting evil genius. It’s no wonder the…

Remote and derelict, riddled with active volcanoes and disputed between Russia and Japan, the South Kurils make the perfect secret lair for any self-respecting evil genius. It’s no wonder the writers behind No Time to Die, the latest Bond film, chose the South Kurils as the setting for the film’s final act. While not directly named, the South Kurils are clearly referenced by Q’s description of Safin’s island – “part of a chain disputed between Russia and Japan.”

A closer inspection of the Russian military presence in the archipelago suggests [spoilers] that Q’s “donut” flight over the island could have ended poorly. Likewise, the Royal Navy’s HMS Dragoon would have probably faced immediate retaliation for its missile strike on Safin’s bioweapons facility. As for Bond, he didn’t just break our hearts, he also broke into Russia’s A2/AD bubble.


KEY JUDGEMENTS

I. Together with the rest of the archipelago, the southern Kurils form a natural barrier, protecting the Russian Pacific Fleet’s naval bastion in the Sea of Okhotsk from threats in the Pacific

II. Russia has significantly enhanced its posture in the South Kurils by deploying advanced air defense systems including the S-300VM4, several Su-35 air superiority aircraft, and coastal missile systems in the past decade. By establishing an anti-access/area denial (A2AD) zone in the South Kurils, Moscow signals to Japan that it will never forfeit its easternmost territory. 

III. Russia’s militarization of the South Kurils will continue in the coming years and focus on the archipelago’s largest islands. Plans for further investment suggest that the South Kurils will no longer be a semi-dormant military outpost but could “go active” for Russian operations in the West Pacific. 

FLASHPOINT: NORTHERN TERRITORIES OR SOUTH KURILS?

1. Disputed between Russia and Japan, the southern Kurils are the southernmost islands in the chain that separates the Sea of Okhotsk and the Pacific Ocean. More specifically, the southern Kurils consist of Iturup (Etorofu in Japanese), Kunashir (Kunashiri), Shibotan (Shikotan), and the Habomai islets. 

copyright Australian National University

2. Russia exercises de facto control over the islands, but Japan has a historical claim to them. The ongoing Russo-Japanese dispute prevents the two countries from signing a formal peace accord to end World War 2 and foster closer economic ties. The rest of the Kuril island chain is internationally recognized as Russian territory. 

  • RUSSIA: Russia calls the archipelago the “South Kurils” and administers it as a district (Yuzhno-Kurilsky) in the Sakhalin oblast. Over 7,000 km from Moscow and only 20 km from Japan, the South Kurils district is Russia’s easternmost territory. Russian control of the southern Kurils can be traced back to 1945 when the Soviet Union seized the archipelago from Imperial Japan. The Soviets planned to use the islands as a springboard to invade mainland Japan in competition with the US. 
  • JAPAN: Japan refers to the southern Kurils as “Northern Territories” and considers them part of Hokkaido prefecture. The Japanese settled and administered the southern Kurils centuries ago and have a series of bilateral treaties with Russia that recognizes Japan’s sovereignty over the islands. 

3. It is virtually certain that Russia will never concede the southern Kurils to Japan, despite the recent detente in bilateral relations. Moscow fears that conceding even a part of the Kurils could create a dangerous precedent for its territorial disputes in Eastern Europe and the Caucasus. While not at the top of the agenda, Tokyo is unlikely to shelve the southern Kurils dispute without significant concessions, such as free movement of Japanese fishers and/or demilitarization. However, there is a possibility, albeit low, that Russia might concede the Habomai islets and/or Shikotan islands to Japan as promised in an unratified 1956 Soviet-Japanese peace proposal.

SOUTHERN KURILS: BARRIER, GATEWAY, AND MINERAL DEPOSIT

4. BASTION BARRIER: While not strategic by themselves, the southern Kurils are critical components of the greater island chain, which serves as a natural barrier for Russia’s naval “bastion” in the Sea of Okhotsk. As a whole, the Kuril reef holds great military value from both defensive and offensive standpoints. 

  • DEFENSE: The Kurils can be flooded with air defense and coastal defense batteries combined with long-range artillery to keep adversaries at range. Invaders must adopt a costly leapfrogging strategy, contesting each island, if they wish to move surface vessels in the Russian Pacific Fleet’s Okhotsk bastion. 
  • OFFENSE: The USSR seized the South Kurils exclusively for offensive purposes in 1945. While military action against Japan is unlikely today (except retaliatory), the southern Kurils, particularly the Habomai islets, are valuable to monitor the US presence in Japan. 

5. GATEWAY TO PACIFIC: Russian naval movements indicate that the straits towards the southern Kurils are the Pacific Fleet’s most used passageways into the West Pacific. Even naval units based in Vladivostok and the Sea of Japan prefer to sail through the Kuril straits, via the Soya strait, over alternate routes (Tshushima and Tsugaru straits). The main reason is that the Kurils offer a more direct route to Alaska and the US mainland. Freedom of movement through the myriad of Kuril  straits is also important to diversify’s the fleet’s routes to and from the Pacific. Although some of the straits between South Kuril islands are difficult to navigate during winter due to ice formation.

6. RHENIUM: While underdeveloped, the south Kurils have always had some economic value. During the Cold War, it was fishing. Nowadays, rethium is the islands’ treasure – a rare earth element crucial for rocketry, aircraft production and the high-tech industry. Rhenium is widespread in the Kuril Islands, especially in the Kudryavyi volcano on Iturup. Given decades of underinvestment and poor infrastructure, Russia has barely tapped the islands’ mineral potential. 

GEOINT: RUSSIA’S A2/AD BUBBLE  IN THE SOUTH KURILS

South Kurils A2/AD (T-Intelligence)

7. Russia established an anti-access/area denial (A2/AD) in the southern Kurils throughout the past decade. The purpose of A2/AD is to deny adversaries freedom of action in a given theater and keep them at range. A combination of multi-layered air defenses and long-range strike platforms is the most common form of A2/AD composition, and the Kurils make no exception. 

  • AIR DEFENSE: By parrying a long-range S300VM4 with two short range systems (deployed in 2020), the Buk-M1 (d. 2012) and Tor M2 (d.?)Russia achieves a multi-layered air defense network that can monitor and threaten enemy aircraft. A variety of general surveillance and coastal radars are also likely based in the South Kurils. 
  • STRIKE PLATFORMS: Russia amassed the Bal and Bastion surface-to-surface missile systems (SSMs) to the Kurils in 2016. The Bal system (in Kunashir), and Bastion-P, (in Iturup), are capable of engaging both land and seaborn targets, and can be upgraded to accommodate newer missiles as they become available. 

ITURUP/ETORUFU

Overview: Locations of interest on Iturup/Etorufu Island (T-Intelligence)

Measuring 1,210 square miles (sq. m.), Iturup is by far the largest and most militarized island in the southern Kurils. Iturup absorbed the bulk of Russia’s military investment in the South Kurils with regard to hardware and infrastructure. Two airfields, a major infantry base, and several training grounds exist on Iturup. In the past decade, they have been modernized and expanded. Harbours and naval facilities have also improved over the years, but there is still no major naval base on Iturup. 

Russian forces have been sluggish in exploiting Iturup’s (dramatic) high ground for radar surveillance. There is also no visible progress on overhauling the islands’ WW2-era littoral defenses. Iturup’s fixed beach fortifications are overwhelmingly derelict. 

  • Burevestnik air base

Burevestnik Air Base on Iturup (T-Intelligence)

Built during WW2, then named “Tennet airfield,” Burevestnik is one of the largest airfields in the whole Kuril chain. The airfield hosted over 100 aircraft at the height of the Cold War. In 1965, the airstrip was extended to a length of 2,4 km, according to a declassified CIA assessment.  

In recent history, Burevestnik AB saw a significant all-around modernization. Nowadays, the airfield mainly hosts rotary-wing aircraft. The most notable improvement is the construction of an air defense site [44°55’7.77 “N 147°38’31.61 “E] dedicated to the S-300V4 systems (NATO reporting name: SA-23 Gladiator) that the Russia Eastern Military District deployed to Iturup in December 2020. Geolocation of the S-300’s first readiness exercise in Iturup to this location suggests that the air defense site was designed to host advanced hardware like the S-300. 

Geolocation of S-300 exercise in December 2020 to Burevestnik Air Base (T-Intelligence)

The air defense site and subsequent warehouse were built sometime between September 2012 and November 2015. Due to lack of open-source satellite imagery coverage before 2012, we could not pinpoint the exact timeframe. 

  • 18th Machine Gun Artillery Division [45° 2’3.68 “N 147°45’19.18 “E]

Temporal analysis of the 18th Machine Gun Artillery Division camp in Iturup shows significant infrastructure enhancement between 2005 and 2019 (T-Intelligence)

In the past, the base was a typical case of Soviet-era ghost military base. Still, imagery from August 2019 shows an explosive expansion and modernization of the military camp, especially compared to the previously available imagery from Google Earth from September 2005. The old and decayed buildings in the base’s midsection have been demolished and replaced with new, modern facilities. The base expanded eastwards, where a warehouse of interest, among other structures, emerged. A review of Planet’s RapidEye satellite imagery suggests that the warehouse was built in the second half of 2016. 

A GEOINT assessment conducted by Israeli company ImageSatIntl in July 2019 named the warehouse as a deployment site for coastal missile defense systems and identified two Rubezh systems (SSC-3) parked on the cement pad nearby. The newly deployed Bal (SSC-6) or Bastion (SSC-5) systems have likely replaced and retired the ageing Rubezh systems.  

  • Iturup Airport [45°15’28.50″N 147°57’16.53″E]:

Su-35 presence at Iturup airfield (T-Intelligence)

Built in 2014, Iturup airport (also known as Yasny) is a rare case of an entirely new facility constructed in the South Kurils. Iturup airport is also the first airfield to be built from scratch in post-Soviet Russia. With a 2,4 km airstrip and modern facilities, Iturup Airport is a dual-use airfield serving both civilian and military flights. In August 2018, Russia deployed three Su-35 air superiority (Flanker-E) aircraft to Iturup airfield. 

Image shows the three Su-35s on the Iturup airport’s apron in May 2020. Photo credits: Vera Bykova

  • Naval areas 

While the island does not host a military naval base, there are several noteworthy ports or small wharves that small vessels of the Russian Border Security Force (BSF) – Coast Guard or Russian Navy can use. Iturup’s coastline contrasts from flat beaches to sharp cliffs. Therefore artificial docking facilities, like wharves, are needed to accommodate vessels. 

  • Kurilsk Harbor [45°15’24.7 “N 147°52’55.9 “E]- Iturup’s largest port has seen significant modernization in the past years, which undoubtedly expanded Kurilisk’s military potential. 
  • LLC Fish processing plant and wharf [45°06’12.2 “N 147°41’53.0 “E]
  • “Autumn” fishing village [45°00’34.4″N 147°31’11.2″E]

KUNASHIR/KUNASHIRI

Overview of Kunashir island (T-Intelligence)

Kunashir is the second-largest island in the South Kurils (580 square miles). The island hosts a major airport (civilian) and a massive infantry base. Kunashir used to host a large naval Soviet presence in the Cold War, and was the assembly point for the Japanese Imperial surface group that attacked Pearl Harbor, according to a declassified CIA assessment. 

  • Yuzhno-Kurilsk Mendeleyevo Airport [43°57’42.17 “N 145°41’13.23 “E]

Mendeleyevo Airport in July 2021 via Google Earth (imagery: Maxar Technologies and CNES/Airbus)

With a 2,2 km airstrip and modest facilities, Mendelyevo has remained relatively unchanged in the past decade. The airport has seen limited modernization of auxiliary facilities but not expansion. Mendelyvo does not have a declared military role; however, if needed, it could support a limited number of fighter aircraft and helicopters for a short amount of time. Aeroflot subsidiary Aurora Airlines is the only commercial airline that flies to Mendelyevo. Aurora’s only route to Yuzhno-Kurilsk Mendeleyevo Airport is from Yuzhno-Sakhalinsk, and is mainly serviced by the company’s De Havilland Canada Dash 8-400 aircraft.

  • Seaport Yuzhno-Kurilsk 44°01’19.6 “N 145°51’15.7” E

Yuzhno-Kurilsk Seaport in April 2020 via Google Earth (image: Maxar Technologies and TerraMetrics)

Although mainly for civilian-commercial use, the Yuzhno-Kurilsk seaport has military significance. The wharf and docking facilities have likely once formed a “major Soviet naval base” as referenced in a declassified CIA report from 1955. While the coordinates provided in the CIA report are “broken,” pointing to an offshore location (happens to the best of us), Yuzhno-Kurilsk seaport is the island’s only naval facility and it is “near” the local airfield. A direct road links the two sites.

The seaport also hosts a fish processing plant and an offsite fuel storage facility, which are vital to the island’s economy and inhabitants. 

  • 46th Machine Gun-Artillery Regiment 44°03’19.3″N 145°47’06.2″E 

46th Machine Gun Artillery Regiment camp (T-Intelligence)

This Soviet-era installation bloomed starting in 2010 and nearly doubled after May 2017. New housing facilities, warehouses, and a host of small and medium-sized structures appeared during this timeframe. The constructors have also prepared approximately 120 square meters of parking areas, indicating an increase in troop and supply transportation vehicles.

A large, white hangar also emerged southeast of the parking lot for hosting advanced weapons capabilities (AWC), as the geolocation of the Bal systems in storage photo suggests. The image in question was obtained by a Japanese newspaper, Sankei, from a source on the ground. 

Leveraging the local high ground, two air defense sites exist north of the base. The first site, within the base’s limits, was built between 2015 and mid-2018. The layout is identical with the air defense site prepared at Burevestnik air base on Iturup, where the S-300VM4 resides. Google Earth’s latest imagery, dated April 2020, shows a probable surface to surface missile (SSM) system – either Bal or Bastion – positioned in the revetments, suggesting that the site is not exclusively for air defense. The second presumed air defense site (“high ground SAM site”) predates the recent modernization and has not hosted SAM activity in the past years, based on our review of available satellite imagery. 

A warehouse is also visible to the southeast, with vehicle marks suggesting pre-established routes to the nearby woodland – a possible shoot-and-scoot path. The warehouse and auxiliary areas were built between May 2017 and June 2018. As ImageSat International was the first to assess, the warehouse facility is identical with the one constructed at the 18th Machine Gun Artillery Division. This suggests a similar use, namely hosting advanced weapons capabilities (AWC). 


SHIBOTAN/SHIKOTAN

Overview Shikotan island (T-Intelligence)

Two noteworthy naval facilities exist on the archipelago’s third-largest island. While under civilian authority, Shibotan’s ports regularly – or permanently host – Russian Coast Guard vessels. No airfield exists on Shibotan. However, at least one helipad is visible at Malokurilskaya Bay [43°51’59 “N 146°49’39” E], and the island offers a host of adequate landing zones for helicopters. Infantry troops and likely an artillery unit are also based on the island. Declassified CIA reports from the 1950s claim that Shibotan hosted a Soviet frontier naval division, suggesting that this island played a crucial role in Moscow’s posture vis-a-vis Japan. 

  • Malokurilskaya Bay [43°52’29.5″N 146°49’23.5″E]

Geolocation of Russian Coast Guard vessels docked in Kunashir (T-Intelligence)

Geolocation of images posted on Russian forums underscores the Russian Coast Guard’s presence at Malokurilskaya Bay. The images suggest that the local Coast Guard unit (likely unit 2264 based on unverified crowdsourced information) is using the bay’s northern wharf as “home port” [43°52’25 “N 146°49’19” E].  

  • Trench line (derelict) [43°51’23″N 146°49’25″E]

Covering the hilly southern approach to Malokurilskaya Bay is a WW2-era trench fortification system accompanied by a slate of abandoned T-34, IS-2, and IS-3 tanks. If needed, the trench line could be revived as a stop-gap defensive measure, if overhauled, and reinforced with modern armored units. 

  • Krabovaya Bay [43°49’35″N 146°44’55″E]

This smaller port exclusively serves fishing activities, but its new, large wharfs make it adequate for small patrol craft to a certain extent. Large tonnage vessels are unable to reach due to shallow waters. Krabovaya Bay boomed after a private company built a new fish processing and storage plant and expanded the port docking facilities in 2019. 


HABOMAI ISLETS

Overview of the Habomai islets (T-Intelligence)

The closest to Japan’s Hokkaido province and the smallest landforms in the southern Kuril chain (39 square miles – combined), the Habomai are of little significance to Russia’s military posture. The islets’ rich waters are sought after by Japanese fishers, and Tokyo still hopes that it can recover the Habomai or establish a joint fishing zone in Habomai’s waters. The return of the Habomai (and Shikotan) to Japan was promised in the 1956 Soviet-Japan Joint Declaration, but the two parties failed to ratify the peace agreement. 

Except for two border outposts* and several defunct barracks and derelict fortifications, there are no noteworthy Russian installations or forces on the Habomai islets. Small boats and fast patrol craft of the Coast Guard regularly patrol the Habomai’s waters and arrest Japanese fishers. 

*Border post – Zelenoe Yuzhnokurilskiy [43 ° 30’9 “N 146 ° 5’23” E] 

*Border post – Muravyovka [43 ° 25’5 “N 145 ° 54’2” E]


OUTLOOK

8. Russia will further its force build-up by expanding the military infrastructure on Iturup and Kunashir, Russian Prime Minister Mishushtin announced in August 2021. Moscow said that it will build “51 more pieces of military infrastructure” in the Kurils, without detailing what kind of infrastructure this will be. We assess that most investments will likely upscale the logistics facilities and amenities of local units. Modern radars, point air defenses, and new naval facilities would greatly improve Russia’s local posture and are therefore strong candidates for the Kremlin’s upcoming investment plan. 

9. The growing A2/AD bubble in the South Kurils solidifies Russia’s grip on the disputed territories. It also dramatically reduces the likelihood of the islands, or parts of them, returning to Japan. Plans for further investment suggest that the South Kurils will no longer be a dormant military outpost but could “go active” and increase the pace of Russian operations in the West Pacific.


by HARM

Afterword: this strategic analysis (SA) does not encompass all *possibly* military-related sites and objects on the South Kurils as it prioritzed high value locations and advanced hardware. The SA’s purpose is to provide a succinct overview of the archipelago’s most noteworthy locations and highlight objects of interest. 

This assessment was made using Open-Source Intelligence (OSINT) techniques and resources. Visit Knowmad OSINT to learn more about our online OSINT training. 

Comments Off on No Time To Dispute: Russia’s A2/AD in the South Kurils

Putin’s Mercenaries on Tour: Mapping the Wagner Group’s Global Activities

Key Judgements Since its inception in 2014-2015, the Wagner group has expanded from a frontline contractor in Eastern Ukraine, to spearheading Russia’s foreign policy and private business objectives in Syria,…

Key Judgements

  1. Since its inception in 2014-2015, the Wagner group has expanded from a frontline contractor in Eastern Ukraine, to spearheading Russia’s foreign policy and private business objectives in Syria, Libya, the Central African Republic, and many other states. As Wagner’s reach is constantly expanding, our mapping project aims to filter through speculation and leverage open-source intelligence (OSINT) to track Wagner’s presence and activity worldwide.
  2. The Wagner group, such as it is, does not exist as a traditional PMC but as an interconnected network of mercenary groups, semi-state forces, and corporations with links to the Kremlin. As a result, Wagner’s activities are very difficult to track and categorize.
  3. If left unchecked, the Wagner group will very likely remain an effective and transient tool of the Russian security apparatus, combining aspects of state forces, private military companies, and paramilitaries. Wagner activities will likely continue to be equally focused on supporting Russian private business interests as foreign policy objectives.

DENIED AND DENIABLE: WAGNER GROUP

“Wagner Group” is an umbrella term that refers to the network of mercenary groups with ties to the Kremlin and controlled by Russian oligarch Yevgeny Prigozhin. The Wagner Group is used to advance Russia’s foreign policy objectives with a modicum of plausible deniability, as no such group formally exists and is denied by Russian officials. 

Utilized in everything from disinformation to site protection and offensive combat operations, the Wagner Group escapes conventional definitions of Private Military Companies (PMC) and has become increasingly active globally. 

Wagner PMC is known to operate under different names and structures, often related to mining, or military training, further obscuring the group’s activities. Existing literature focuses on the debates over Wagner’s functionality, goals, history, and even its very existence. However, limited attention has been directed towards the breadth of the network’s global activities. Herein we identify the locations of Wagner activity worldwide based on open-source reporting and assess the likelihood that Wagner is indeed active in each country.

A few things to understand before discussing the so-called Wagner group’s activities worldwide:

  • Due to the vague nature of the Wagner network and often imprecise and conflicting online reporting, much of the group’s activity cannot be identified with 100% certainty. Here we have opted to categorize Wagner activity as: Confirmed, Likely, Possible, and Unlikely.
  • It is important to note that beyond PMC Wagner, several other Russian PMCs remain active. It is possible to misidentify these PMCs as Wagner, especially with vague and unverified reports.

ACTIVITY LOG: TRACKING WAGNER’S GLOBAL REACH

Russia/At Home:

Like any PMC or military entity, Wagner trains its contractors before departing on missions. Supported by Russian military and intelligence personnel, Wagner conducts training at two locations attached to the 10th Special Mission Brigade of GRU Spetsnaz in Mol’kino, Krasnodar region, Russia. These facilities feature airborne training and obstacle courses, weapons and munitions storage buildings, and barracks, among others. 

Area view of military facilities near Mol’kino as first identified by CSIS (base imagery: Maxar Technologies)

Presumed Wagner training facility as first identified by CSIS (base image: Maxar Technologies)


Ukraine:

Russia’s invasion of Ukraine provided the impetus for the creation of the Wagner group. Wagner mercenaries were instrumental in numerous battles throughout the conflict, notably in Crimea and later the Donbas region. Donbas war veterans formed the foundation of Wagner’s ranks, and the group continues to recruit from Russian-occupied eastern Ukraine.  

Estimates put the number of Wagner operators in Ukraine anywhere from 2,500 to 5,000 at their peak, operating in support, intelligence, and direct combat roles. Wagner mercenaries were pivotal in the battles for Luhansk airport and in the seizure of the strategic town of Debaltseve in Donetsk oblast.

Activity Status: Confirmed – Limited continued presence


Syria:

Wagner has been active in the Syrian civil war in support of President Al-Assad’s government since October 2015. Taking part in numerous battles in key roles, Wagner has been able to win a stake in the country’s energy industry for companies linked to Prigozhin and the Kremlin. 

Estimates place the number of Wagner operatives as high as 2000 at different points in the Syrian civil war. Wagner also involved in the training of various Syrian millitias groups loyal to Bashar al-Assad, and Palestinian militias. By 2017, Wagner had already played a key role in recapturing parts of Deir ez-Zor province. In February 2018, Wagner contractors alongside Iranian-backed militias and Syria army units, attempted to capture an oil field from the U.S-backed Syrian Democratic Forces (SDF). Swift U.S. airstrikes obliterated the Wagner attack, resulting in massive casualties for the Russian mercenaries (some estimate over 100 Wagner KIA). 

Wagner maintains a presence at the strategically important Tiyas airfield (T-4) and in central and eastern Syria. In addition to supporting Russian foreign policy goals, Syria served as an important proving ground for the use of Wagner, leading to the PMC’s global deployment. 

Activity Status: Confirmed – Limited continued presence.


Libya:

Numbering in the thousands, Wagner mercenaries have been omnipresent in the Libyan conflict since 2015. Wagner operatives served in critical frontline roles supporting General Haftar’s Libyan National Army (LNA) against the UN-recognized Government of National Accord. 

Wagner contractors trained LNA forces, engaged in combat operations, including the assault on Tripoli, and secured the LNA’s critical infrastructure (oil refineries and the ports of Tobruk, Derna, Benghazi, and Sirte). Wagner is also notorious for executing prisoners and placing mines and booby-traps in civilian areas

Presumed Wagner contractors in Libya

Wagner affiliated personnel also pilot Russian fighter aircraft (e.g. Su-24 “Fencer”) and operate advanced air defense systems (Patnsir S-1/SA-22) on behalf of the LNA. Wagner infantry in Libya are equipped with utility trucks mine-resistant, ambush protected vehicles.The east Libyan al-Kahdim airfield is likely Wagner’s headquarters in the country.

US AFRICOM GEOINT shows Wagner aircraft and anti-air systems displayed at Al-Khadim airfield in eastern Libya

USAFRICOM GEOINT shows Wagner infantry near Sirte

The group continues to be engaged in the Libyan Civil War despite ceasefire agreements necessitating the removal of foreign fighters. 

Activity status: Confirmed – Limited continued presence.


Mozambique:

Two years into the bloody ISIS-linked insurgency in Mozambique’s northern region of Cabo Delgado, the government reached an agreement with Wagner to combat the insurgents in exchange for a stake in the country’s natural resource industries. Wagner commenced combat operations in Mozambique in October 2019. After initial success Wagner hit a wall and sustained notable casualties, leading to Wagner deciding to pull out of the agreement. Wagner was later replaced by Dyck Advisory Group (DAG).

Activity status: Confirmed – No longer present.


Central African Republic:

In early 2018 reports highlighted that Russia had sent Wagner trainers to the CAR to assist in the government’s fight against rebel elements. Despite the fact that the Wagner operatives were brought in for training, SOCMINT evidence suggests that the contractors have been involved in combat and human rights abuses. Wagner group affiliates/fronts “Lobaye Invest” and “Sewa Security” have secured a stake in the country’s diamond and gold mining industries in exchange for kinetic services. 

Satellite imagery shows increased use of the group’s reported base of operations, Berengo Palace. Located southwest of the capital of Bangui, satellite imagery highlights increased traffic and what appears to be the use of an airstrip. 

GEOINT: Vagner PMC barracks near Bangui (Analysis by T-Intelligence; imagery courtesy of Planet Inc.)

Operating under the “SEWA Security” banner or with no markings at all, Wagner has also provided VIP protection to CAR President Touadera.

A member of the close protection unit for Central African republic President Touadera, composed by Russian private security company operatives from Sewa Security, are seen in Berengo on August 4, 2018.(Photo by FLORENT VERGNES / AFP via Getty Images)

To learn more about Wagner activities in CAR, read our early report on Wagner’s growing presence, and our analysis of Russia’s troop surge ahead of 2021 CAR presidential elections. 

Activity status: Confirmed – Growing presence.


Sudan:

Reports from 2017 indicate that Wagner mercenaries had been redeployed from Ukraine and Syria to support President Omar al-Bashir’s military with training and aid in suppressing demonstrations. Wagner-affiliated companies “Meroe Gold” and “M Invest” search for gold in the country with permission from al-Bashir’s government. Wagner’s presence in Sudan also reinforces Russia’s geopolitical position with a significant presence along the coast of the Red Sea and provides a supply line to the group’s operations in CAR. The Kremlin confirmed in 2019 that “Russian companies” are training the Sudanese army. 

Activity status: Confirmed – Continued presence.


Madagascar:

Wagner provided security detail to the political strategists hired by Prigozhin to assist the Madagascarian presidential election in 2018. Prigozhin received a contract to run an existing chromite mine in Madagascar in exchange for electoral assistance and interference. In April of the same year, reports suggest that these same Wagner contractors are being used to protect Prigozhin’s exploitation projects. 

Activity status: Confirmed – Very limited continued presence.


Venezuela:

Wagner contractors were brought in to assist embattled President Maduro in the face of political and social opposition in 2019. Reports suggest that Wagner contractors assisted in providing security for Maduro and his administration, as well as local Russian business interests. In 2019 there were reportedly 400 Russian mercenaries in Venezuela. 

Wagner’s tasks beyond simple security roles included recruiting informants and helping to train Maduro-backed militias. Wagner’s presence is heavily tied to Russian geopolitical and economic interests in the country. In 2020, Rosneft, the largest Russian oil company in Venezuela, sold all its assets to an unnamed company owned by the Russian government, further solidifying Moscow’s interests.

Activity status: Confirmed – Limited continued presence.


Nigeria:

Pre-Wagner affiliate Moran Security Group was known to be active in security roles in the shipping industry. Moran contractors were arrested at the port of Lagos in October 2012 for trafficking weapons. However, after Moscow’s involvement, the men were released.  

Moran Security Group created the Slavonic Corps to branch away from its traditional security roles, which later morphed into the first iteration of the Wagner Group. 

Recently reports have emerged that Prigozhin has been spotted in Lagos meeting with the Nigerian government and military officials, including with Nigerian Army Chief of Staff Farouk Yaha, in 2021. Prigozhin’s alleged meeting in Lagos coincides with a Gulfstream G550 flight to Nigera, namely P4-BAR – an aircraft associated with Wagner. 

The meetings are likely connected with the fight against ISIS-affiliate Boko Haram in northern Nigeria. 

Activity status: Possible – Discussions about bringing in the Wagner group appear to be underway, although Nigeria has made noted use of more traditional PMCs.


Chad:

Wagner’s well-documented activity in CAR and Libya has led to speculation that Russian mercenaries have also penetrated neighboring Chad. Further reports suggest that Wagner has assisted in arming and training rebel groups in northern Chad in 2016. Rebel incursions lead to the death of Chadian President Idriss Deby Into.

Wagner-linked activities in Chad will likely intensify due to the group’s heavy presence in Libya and Russia’s growing interest in Africa. 

Activity status: Likely – Contemporary reports of Wagner indirect influence coupled with Russian interest in the region suggest likely further activity in Chad.


Cuba:

Amid the political upheaval in Cuba, OSINT enthusiasts have tracked flights and a freighter previously associated with the Wagner group to the country. Given Moscow’s traditional relationship with Cuba, the state of upheaval, and Wagner’s noted presence in Venezuela, we may see Wagner’s arrival in the coming weeks or months.

Activity status: Likely – Though not currently active, Wagner personnel will likely arrive in the country.


Mali:

While there are unverified reports of Wagner operatives arriving in Mali to fight the ISIS-linked insurgency, recent reports highlight ongoing negotiations for Wagner involvement in Mali. Russian foreign minister Sergei Lavrov further corroborates these reports by stating that Mali’s government has asked for “Russian PMC” assistance – a clear nod to Wagner. 

Activity status: Likely – discussions are ongoing.


United Arab Emirates 

The US intelligence community received reports in the summer of 2020 that provided links between the UAE and Wagner mercenaries active in Libya. As the UAE makes noted use of foreign fighters it is unsurprising to see the UAE turning to foreign mercenaries for foreign policy objectives. This provides an interesting precedent for both the UAE and Wagner.

Activity Status: Likely – Indirectly, evidence suggests the UAE is involved financially with the Wagner network.


Equatorial Guinea:

Sightings of Prigozhin-associated flights and multiple news reports indicate a nascent Wagner presence in the country. Furthermore, a report suggests that some 200 Wagner operatives protect Russian intelligence officials at the Pico Basile Island spy base.

Latest information indicate that Equatorial Guinea had planned to involve Wagner in providing security in the country, but failed to reach a deal as it also wanted possible assistance in a coup against the incumbent President. 

Activity status: Possible – Numerous unverified reports naming Guinea as a state where Wagner has influence. However, the lack of evidence or corroborating reports makes it unclear. 


Nicaragua:

A Russian training center exists in Nicaragua since 2013, hundreds of Russian military personnel were sent to the country for “joint military exercises,” “humanitarian and military operations training,” and “anti-drug trafficking.” However, reports suggest that these “instructors” played a significant role in cracking down on anti-government protests. 

The Russian military personnel are not thought to be affiliated directly with the Wagner group at this time. However, as Russia continues to rely on relationships with Venezuela, Cuba, and Nicaragua for a geopolitical foothold in the region, the Kremlin might insert Wagner in the country, if not already. 

Activity status: Unconfirmed but possible – No explicit link identified, but numerous linkages have been highlighted. Nicaragua’s operational environment is optimal for Wagner activity.


Iraq:

No direct involvement of Wagner or Wagner affiliates has been noted in Iraq at this time. The Wagner group has previously been highly active in eastern Syria near key Iraq border crossings but there is no indication that Wagner undertook operations across the frontier. 

Other Russian PMCs, including the Antiterror-Orel Group and the Moran group, linked to Wagner’s emergence, had previously operated in Iraq.  

Activity status: Unlikely – Wagner might emerge in Iraq if the operational environment becomes more permissive due to a US/NATO withdrawal. 


Nagorno-Karabakh Region (NKR):

Chatter emerged from forums and social media accounts associated with Wagner contractors insinuating that the group was operating in the conflict, these claims were eventually disproven by Bellingcat. 

Displeased with Armenian PM Pashynian, Russia has been unusually detached from the flare-up in NKR, and only stepped in after the formal conclusion of hostilities in December 2020. If secretly deployed, it is possible that Wagner mercenaries only entered NKR as part of Russia’s “peacekeeping force.” 

Activity status: Unknown


Belarus:

In July 2020, before the country’s presidential election, Belarussian authorities arrested 33 Wagner-linked contractors on suspicion of plotting terrorist attacks to destabilize the elections. Reports later came to light that the men were members of a PMC lured to Belarus through a joint operation by Ukrainian and US intelligence services intended to arrest members of the Wagner group active in the war in eastern Ukraine – former Ukrainian president Petro Poroshenko seemingly confirms the information. 

Activity status: Unlikely – Wagner is extremely unlikely to be active in Belarus, more likely to be in transit to Libya, Sudan, CAR or elsewhere.


Tanzania:

Russia and Tanzania signed an agreement in 2016 for joint military training at Russian facilities. While Wagner often fills these roles for the Kremlin, no evidence suggests they are active in Tanzania at this time. Previous activity along Tanzania’s southern border with Mozambique is not thought to have spilled over into the country.

Activity Status: Unlikely – Russian military activity does not always translate to Wagner presence, especially when overt agreements are made between the state. 


South Africa:

There is no evidence to suggest a Wagner presence in South Africa; however Prigozhin-linked political strategists have assisted parties involved in the 2019 presidential election. 

Activity status: Unlikely –The presence of numerous South African-based PMCs means mercenary activity is unlikely. Though Prigozhin-linked political strategists are very likely to maintain a presence.


Inconclusive Reports of Wagner Activity:

The following highlights inconclusive reports of Wagner activity, due to lack of evidence or corroborating reports.

  • Eswatini: Unverified reports suggest Wagner maintains a presence in the country and has trained Ewatini’s troops on new weapons systems.
  • Rwanda: Rwandan troops fought against Rebels in  CAR as part of a bilateral agreement alongside Wagner elements.
  • Yemen: Rumors and social media reports indicate that a “Russian PMC” is active in the Yemeni Civil War. However, there is no credible report naming Wagner. Wagner-trained Sudanese militias have, however, deployed and fought in Yemen. 
  • Zimbabwe: Nondescript reports have claimed that Wagner maintains an office in the country. Additionally, there have been claims that President Emmerson Mnangagwa’s 2018 election campaign was assisted by Russian political advisors associated with Wagner.

END NOTE: This tracker will be periodically updated as new open-source information emerge relating to Wagner activity. 

by Matt Sutherland 

This assessment was made using Open-Source Intelligence (OSINT) techniques and resources. Visit Knowmad OSINT to learn more about our online OSINT training. 

Comments Off on Putin’s Mercenaries on Tour: Mapping the Wagner Group’s Global Activities

Type on the field below and hit Enter/Return to search