• Military current situation, assessment and outlook
• How Ukraine could look – an assessment of a possible evolving intent
• What sanctions are being imposed on Russia
• How stable is Russia – economics, information operations and geo-politics
• Cyber Operations

Headlines

• Kyiv almost certainly remains the main effort for Russian forces in Ukraine, and it is a realistic possibility that the isolation from the west will be complete within the next 7-10 days.
• Mariupol is highly likely to be the other immediate objective. It is a realistic possibility that Mariupol will fall and become occupied within the next 7-10 days, and the victory will be propagandised to legitimise the operation’s ‘Denazification’ objective.
• Russia is unlikely to have the capacity to support offensive manoeuvre on more than two axes concurrently.
• Regional capitals in the east are likely to remain besieged and bombarded in the short term, and capitals in the west are likely to be struck with long range munitions as high-value targets are identified.

Current situation

Military

This report will not cover the tactical detail of the incremental changes over the last fortnight, which are detailed in the Prevail Daily OSINTSUM. This report provides a campaign overview of the military situation so far in Ukraine and seeks to provide assessment out to 4 weeks.

In spite of a relatively low rate of advance and numerous issues with logistics, morale, and resupply, the Russian Federation Armed Forces (RFAF) continue to make gains in all major operational directions. Kherson is the only regional (Oblast) Capital which has successfully been seized by the RFAF, however other Oblast Capitals are besieged in Kyiv (also the national Capital), Chernihiv, Sumy, Kharkiv, Mariupol, Zaporizhzhia and Mykolaiv. Oblast capitals further west and outside of the current range of Russian ground forces’ rocket and tube artillery have nevertheless been struck by aircraft and missiles – these include Dnipro, Vinnytsia, Zhytomyr and Kryvyi Rih.

There was a likely operational pause for the majority of Russian axes which began around 11 Mar 22, highly likely in order to consolidate, repair and recuperate or realign logistics. At the time of publishing, there has been a minor resumption of offensive activity in the vicinity of north-west Kyiv however the north-eastern axis has not advanced, nor has the southern axis into Mykolaiv and towards Zaporizhzhia. The only territorial gains of note have occurred pushing west from Donetsk, north of Mariupol. Assaults into Mariupol from both the east and west reportedly occurred 15-16 Mar 22 in conjunction with ongoing bombardment. RFAF have made limited gains on the break-in, however the humanitarian situation in the city continues to deteriorate in spite of a limited evacuation of civilians finally taking place between 14 and 17 Mar 22.

Reporting indicates that Russia has begun to mobilise forces deployed abroad on operations, reportedly moving forces from South Ossetia and Armenia, as well as additional units from the Eastern Military District reportedly redeploying to Belarus. Other reporting indicates that units which were deployed and degraded in the first ten days of the operation are being reconstituted, forming new composite units in order to return to the front.

On 13 Mar 22, Russia reportedly struck the International Centre for Peacekeeping and Security (ICPS) near Yelnya. The site is west of Lviv and approximately 20km from the Ukraine-Poland border. It is reported that 30 air launched cruise missiles were launched by Russian Aerospace Forces (VKS) strategic bombers from over the Sea of Azov and Black Sea. Ukraine claims that 8 of the 30 missiles fired struck their target, and caused at least 35 deaths and 134 wounded, including foreign volunteers. Prior to the strikes, Russia announced that the ICPS was a valid military target as it was hoist to ‘foreign mercenaries’ as well as a logistics hub for western lethal aid. Prevail HUMINT has provided uncorroborated indications that Russia employed informants/insiders to direct these strikes.

On 15-16 Mar 22, the Russian Federation Navy (RFN) struck targets along the Odessan coast, reportedly hitting Lebedevka, Sanzheyka, Zatoka and Belenky in the vicinity of (IVO) the Dniester Estuary. Landing ships were also reportedly observed off the coast, however, there has been no attempt at an amphibious landing IVO Odessa at the time of writing.

Assessment

Russian forces are showing no signs of ending their operation in Ukraine, and it is likely that western information operations are demonstrating significant bias – predominantly reporting Russian losses and Russian successes. The slow yet steady progress of the RFAF on all axes over the past fortnight has not been without difficulty and it is highly likely that there was a Russian miscalculation prior to the 24 Feb 22 about the probable rate of advance. Russia continues to isolate regional capitals whilst focusing on shaping activity for a renewed attempt to encircle Kyiv and break into the city. The operation to isolate Kyiv is almost certain to remain the RFAF Main Effort in the ground campaign, with a sub-mission to kill or capture Zelensky and key Ukrainian senior leadership. Operations in Mariupol are also progressing, in spite of international condemnation and accusations of Russian war crimes. Mariupol is the home of the Azov Battalion – a force which Russia claims is made up of right-wing ‘Nazis’ and is therefore likely to be the most important axis of advance outside of the Ukrainian capital.

Oblast capitals are almost certainly being viewed by Russia as military objectives for this phase of the campaign. The Oblast capitals in eastern Ukraine contain the majority of the urbanised population as well as resources and Ground Lines of Communication (GLoCs), which make them Key Terrain (KT) for the defending UAF and Vital Ground (VG) for the advancing Russian forces. The lower number of strikes against Oblast Capitals in the west of the country is indicative of the intent to support ground forces whilst retaining the ability to strike deep into the Ukrainian rear against high priority targets such as logistic resupply, key military locations, and western lethal aid/volunteer forces.

The redeployment of overseas-based Russian units as well as the reformation of previously committed forces is highly likely an indicator that Russia is finding it difficult to amass sufficient combat power to make progress in line with operational timelines. The significant area of operations across multiple axes is a gargantuan undertaking for the RFAF and it is unlikely that the logistics, medical and repair chain can keep up with demand across the theatre – therefore it is likely that major offensive activity will only occur on a maximum of two axes concurrently.

These are currently assessed as the Mariupol operation and the north-western axis onto Kyiv. This assessed limitation of offensive manoeuvre is unlikely to significantly impact on use of Direct and Indirect Fires (IDF) against besieged cities. The IDF is likely striking military targets of opportunity as well as civilian infrastructure, industry, utilities, and residential areas to lower the morale of defenders and trapped civilians and force local governments to seek terms of surrender. Ammunition expenditure for these ‘harassing fires’ is considerably less than the amount required for supporting fires (assisting ground manoeuvre) and are likely to be enduring and sustainable. Reformed units and troops deploying at long distance from their garrisons will highly likely struggle to integrate effectively into existing ‘front’ commands as well as increasing the logistic burden. These forces may add combat mass to RFAF advances, but this will not necessarily manifest in tactical success in the short term.

Despite reported strikes along the coast IVO Odessa and the reported presence of Russian landing ships in the area, an unassisted and contested amphibious landing in the area is unlikely to occur before Russian ground elements secure an eastern approach to Odessa – which will require the capture of Mykolaiv (or at least isolation and securing of alternate river crossings) before it can occur.

Outlook – Short Term (Two to Four Weeks)

Russian progress has been slower than previously assessed and the operational pause has delayed progress on major axes across the fronts. It is a realistic possibility that the resumption of offensive activity around northwest Kyiv will succeed in driving south to cut off the E95/M05 and subsequently the H01 and P01 southbound within the next 7-10 days. This would cut the remaining MSR used for humanitarian evacuation out of the city and entry of supplies, reinforcements, and equipment. Concerted efforts (a division sized assault or higher) are unlikely to occur prior to the isolation of Kyiv from the west – with the supporting effort east of the Dnieper a desirable but non-essential precondition to this activity. The anticipated timelines are assessed to be: 7-10 days to cut off Kyiv from the West; and a further 2-4 weeks to seize key locations in the city.

It is highly likely that Mariupol will be the next Oblast capital to fall to the RFAF, with a realistic possibility this will also occur within the next 7-10 days. Once Mariupol is taken by the RFAF it is highly likely that a significant amount of propaganda material regarding the ‘Nazis’ of Azov Battalion will be published by the occupying forces in order to support President Putin’s justification for the operation in Ukraine. This will highly likely primarily be intended for domestic audiences and close allies (e.g Belarus), however it is also likely to provide a veneer of legitimacy which may dissuade China from further distancing itself from Russia on the world stage. China has amplified several Russian propaganda stories by providing them with international recognition – including the misinformation campaign referring to US ‘Bioweapon’ facilities in Ukraine and accusation of Ukrainian intent to use Chemical Weapons (CW) and blame Russia. CW use by either side would be considered massively escalatory and may force greater NATO involvement – there are currently no assessed tactical, operational or strategic advantages to CW use by either side. Doctrinally however, Russia does not rule out first-use of CW in defence of the homeland – therefore any Ukrainian offensive activity into Russia may predicate CW use with Presidential approval.

Long-range strikes against high value targets in western Ukraine will highly likely occur as and when targetable information is received. This includes GLoCs and infrastructure in administrative capitals as well as targets of military significance such as training bases, ammunition/fuel storage, and Command and Control nodes/Headquarters.

The sporadic nature of strikes to date is indicative that Russia is unlikely to have pervasive and persistent Unmanned Aerial Vehicle (UAV) coverage of western Ukraine, which provides opportunity for UAF military activity to continue as long as forces are disciplined and adhere to established military Tactics, Techniques and Procedures (TTPs) for camouflage and dispersal. It is likely that foreign volunteers practicing poor communication security (COMSEC) and operational security (OPSEC) can be identified and located by Russian technical means, and Russian rules of engagement allow for the striking of targets based off electronic/communications intelligence only – without confirmation by Full Motion Video (FMV). It is likely that this is one of the primary targeting methodologies for Russian strikes, possibly with human intelligence reports supporting (due to the high likelihood of infiltration by

Russian sympathisers/agents). Poor COMSEC and OPSEC within Ukrainian (international) volunteer units is likely to endure in the short term, providing further targeting opportunities for the RFAF. Targeting of units through electronic intelligence collection was a prolific TTP of the RFAF in Donbass and Luhansk in 2014/2015.

How Ukraine Could Look Post-Conflict – A Possible Course of Action

As noted in the Prevail Daily OSINTSUM 008, dated 14 Mar 22, there have been unconfirmed reports that Russian occupiers in Kherson are planning a referendum on the declaration of Kherson as a ‘Peoples’ Republic’. Ukrainian Foreign Minister Kuleba responded to the news in a tweet on 12 Mar 22 that this attempt was illegal and greater sanctions must be imposed on Russia if it seeks to carry this action out. He reiterated there is zero support for this among the population and that it would be “complete fiction”. Although unconfirmed, this reporting may be indicative of Russian longer-term plans to break up Ukraine into multiple Peoples’ Republics after the conventional operation is complete, based on a similar model to Donetsk and Luhansk in 2014.

Ukraine is broken up into 24 Administrative Regions, or Oblasts. It is a realistic possibility that one possible Russian Course of Action (CoA) for Ukraine involves breaking the country down into a series of ‘People’s Republics’ based on Oblasts to make administration easier. It is impractical, expensive, and complicated for Russia to assist with forming 24 new Republics, therefore it is likely that this is not envisioned for the entire country. Comparison of Russophone/ethnic-Russian areas and previous election results (Russia claims the 2014 Ukrainian election was fraudulent and is likely to refer to the 2010 and 2004 results instead) shows likely regions which would be considered for establishing new republics, with the remainder of Ukraine being left whole but damaged and under new governance. It is likely that the removal of President Zelensky and his government is a primary objective for Russia. The 10 Oblasts below, if you exclude Sumy in the north, resemble previously published maps of ‘Novorossiya’ (figure 2.), with references going back beyond 2015.

The assessed MLCoA has an objective of isolating Ukrainian ATO troops currently The area covered by these 10 Oblasts is approximately 38% of the total area of Ukraine, however the population would be split approximately 50/50 between Ukraine and the ‘Eastern Republics’. Economically however, the east would fair much better with its more urbanised populations and industrialised economy, versus the sparse agriculture-based economy in the west pre-conflict. The primary economic forces in the country were Kyiv-based, however this is likely to be significantly degraded during the siege and subsequent capture of the city. Eastern Ukraine’s industrial base also requires significant hydrocarbon resource, and Russia would likely sell gas to the new regimes in order to boost economic output and possibly see some return some money to partially offset the significant cost of invasion and reconstruction of destroyed infrastructure.

Assessment

It is likely that this CoA was originally the intended end-state of the conflict prior to its commencement. Working from the assessment that Russia believed the conflict would be swift, with the removal of the Zelensky Government and the rapid capture and temporary occupation of Administrative Capitals across eastern and southern Ukraine, this CoA would have provided Russia with the result it likely desired. It is highly likely that the current protracted nature of the invasion has significantly degraded the positive aspects and reduced the feasibility of the CoA. Prior to the invasion it is a realistic possibility that Putin was told what he wanted to hear (e.g. that lots of Ukrainians were pro-Russian and would be willing to rise up against the government when enabled and emboldened by the Russian invasion) by his intelligence services - likely out of nepotism or fear.

International repercussions, lack of recognition on the word stage, and the economic impact of advising, assisting, funding, and enabling of multiple new governments all indicate that this CoA is no longer viable. It is however a realistic possibility that the strategic planning has been inflexible and unable to adapt at pace to the changing situation on the ground. It is probable that the reported planned referendum in Kherson had been pre-planned, however an alternate CoA (or instruction to pause this one) was not received by the commanders on the ground. It is almost certain that the local nationals in the east of Ukraine would form resistance groups, likely enabled by NATO member-states, which would require significant internal security forces to control, if this was possible at all. It is unlikely that there are sufficient Russian National Guard (Rosgvardia) available to control another 230,000km2 of territory in addition to their existing remit. This, among other factors (primarily the cost and lack of popular support in the region), renders this CoA to be assessed as unlikely.

What sanctions are being imposed on Russia?

The UK

Prime Minister Boris Johnson announced an asset freeze against all major Russian banks, including an immediate freeze on VTB, Russia’s second largest bank. An asset freeze on Russian Direct Investment Fund and bans on Russia’s Central Bank, the Ministry of Finance and the National Wealth Fund from accessing UK financial services have also been imposed. The UK was one of the main drivers for the ban on Russian banks using SWIFT (Society for Worldwide Interbank Financial Telecommunication) - the global financial messaging artery that allows the smooth and rapid transfer of money across borders. There have also been sanctions imposed upon Russia’s largest bank, Sberbank, as well as Rossiya, IS Bank, General Bank, Promsvyazbank and the Black Sea Bank - banning them from clearing sterling payments through the UK’s financial system. Under the current banking restrictions all Russians are banned from having significant savings in UK bank accounts - there’s a limit of 50,000 pounds on deposits by Russian nationals in UK banks. Legislative steps have been taken to stop all major Russian companies from raising finance on UK markets, and also to prohibit the Russian State from raising sovereign debt on UK markets. The UK Government also accelerated the passage of its Economic Crime Bill to target illicit Russian money in London. Moreover, Boris Johnson’s Government has applied sanctions on more than 100 individuals, including President Putin and Russian Foreign Minister Sergei Lavrov; entities and their subsidiaries, like Russia’s biggest defence company Rostec. Russian maritime, aviation and space companies have been blocked from the UK insurance market and from using facilities such as ports. Additionally, the UK has seen an immediate ban on all exports of goods that could have military use.

The US

President Joe Biden’s Administration has banned US people and companies from doing business with the Central Bank of Russia (CBR), the Russian National Wealth Fund and the Ministry of Finance, immobilising nearly half of Russian foreign currency reserves. Washington banned major Russian banks from SWIFT; and imposed the banning of all US imports of Russian fossil fuels including oil. The Biden Administration also issued full blocking sanctions on Russian legislators, billionaires, bankers and their family members. The US also sanctioned seven Russian entities that control media outlets, as well as 26 individuals who work at those outlets, in an effort, it said, to halt Russian disinformation campaigns related to the invasion of Ukraine. Additionally, the US Treasury sanctioned Putin, Foreign Minister Sergei Lavrov and the members of the Russian Security Council. The Treasury also sanctioned Belarusian officials, such as Belarus President Alexander Lukashenko, re-designating him as a penalty for public corruption, his wife and state-owned banks. Moreover, the US Justice Department has unveiled a new “KleptoCapture” task force that will enforce sanctions and export restrictions as well as seize luxury assets belonging to Russia’s wealthiest citizens.

The EU and other countries

The 27-nation bloc imposed two sets of sanctions against Russia, and is preparing further measures that will also include Belarus, according to official statements. The most significant of the existing and proposed measures include: a ban on all transactions with the Russian Central Bank and freezing its assets; stopping financial inflows from Russia into the EU by imposing limits on bank deposits and barring Russians from investing in EU securities. The EU shut down EU airspace to all Russian planes, and mirrored sanctions Putin, Lavrov and some of Russia’s wealthiest tycoons, as well as top officials in state companies and media. President Ignazio Cassis of Switzerland said the country would adopt the bloc’s sanctions on Russia, including asset freezes. Canada has matched US and European sanctions on major Russian banks and key Russian individuals, including on Putin himself and his inner circle. Japan has joined many of the US and European economic actions. Other Asian nations, including South Korea and Singapore, have indicated they will take some steps designed to deter Putin from continuing Russia’s assault on Ukraine.

How stable is Russia – economics, information operations and geo-politics

The speed and size of the sanctions imposed on are unprecedented. With time the effect of the conflict will permeate in to Russian public consciousness. Russia’s biggest ally may be China but they have not yet given unfiltered support to the invasion. Which leads us to ask how stable is Russia and what is the impact these factors are having upon the sustainability of the Russian Campaign?

Determining the true effect of sanctions is difficult due to the Kremlin’s misinformation tactics. It is thought that for the sanctions to have the desired effect, it is essential that there is a perception in Russia, that the bans won’t be permanent and that they can be lifted as soon as Putin decides to cease offensive military operations in Ukraine. However, it is currently hard to assess whether the association between the poor economic outlook and Russian activity in Ukraine.

Undoubtedly, the West’s economic blockade and sanctions are having an effect: with Russian financial institutions being blocked from the global payments system, major global companies such as PayPal, Visa, and Mastercard no longer working in the country and the severe import and export bans, Central Bank of Russia (CBR) is struggling to support the spiralling ruble, trade from and to Russia have been extremely reduced and Russian markets are suffocating.

The CBR traditionally regulates the ruble exchange rate. The freezing of the CBR’s assets and accounts in the G7 and EU countries paralyzed about half the Russian central bank’s $630 billion worth of foreign currency and gold reserves. The Central Bank foreign currency reserves totalled a record $12.83 trillion late last year - a rise of $11 trillion over the past 20 years. This money is held mostly in US and European government bills and bonds - with the US dollar still accounting for almost 60% of that and the euro about 20%. Another significant aspect of the sanctions is the ban on the access of Russian banks and companies to Western capital markets. As a result, there will be a substantial outflow of foreign investors from Russia; predictions by experts range from $30bn to $50bn of investments lost in a year.

Given that Russia is one of the world’s largest raw materials suppliers, and a significant importer of consumer goods, technology and investment equipment, disconnecting strategic Russian banks from the SWIFT (Society for Worldwide Interbank Financial Telecommunication) system will disrupt the flow of goods, accumulate a consumer market deficit and accelerate inflation. The average Russian citizen will see their household incomes shrink.

The fact that the Russian financial system is highly integrated into the global system, especially the globalisation of private Russian capital, is one the West’s major challenges. In the UK, for example, many London-based financial giants have for years invested British funds, including pensions, in Kremlin-controlled companies and privately-owned enterprises run by oligarchs. While this has been great for shareholders – until the recent collapse of the ruble – it has also meant, amongst other events, the growth in size, value, and influence of international Russian companies like Gazprom, Lukoil, and Rosneft, and thus the economic growth of the Russian state. While attention has rightly focused on Russian oligarchs, more attention needs to be paid to the financial industry that has benefitted from light regulation and the globalization of capital, while feeding Putin’s Russia, inadvertently.

Russia’s remaining foreign exchange reserves after sanctions are in gold and Chinese yuan. The asset freezes and withdrawals of international companies are, leaving Moscow with only one potential ally powerful enough to rely on: China. If China decided to support Russia, accepting rubles as payment for anything it needed to buy — including crucial imports like technology parts and semiconductors that Moscow has been cut off from in the latest rounds of sanctions — China could fill in most of the gaps in Russia’s economy caused by the sanctions. Noticeably, although China’s government has expressed “concern” over the conflict in Ukraine, it has refused to call it an invasion or condemn Russia, largely pushing Moscow’s narrative of the war on its state news outlets. It has been widely suggested that China may try to “quietly maintain existing channels of economic engagement with Russia while minimizing the exposure of its financial institutions to Western sanctions”.

The main question is whether the impact of the sanctions will pressure Vladimir Putin enough to withdraw the Russian military from Ukraine. Our current assessment is that this won’t happen in the short term as Putin will have anticipated the hardship imposed on his country. Another element that will determine the success of the sanctions against Russia will be the capacity of the West and its allies to stay away from policies and bans premised on the idea that bad governments and their people are one. It is essential that there is a perception, especially on the part of Russia and within Russia, that the sanctions won’t be permanent and that they can be lifted as soon as Putin decides to cease offensive military operations in Ukraine. Otherwise, instead of leading to the rise of everyday Russians against their political leaders, the sanctions could be fatal to Russia’s already weakened domestic opposition. In the mid-term the economic war waged against Russia is likely to increase including against private capital and may be a driving factor in determining either cessation of hostilities or the future of Ukraine. However, the longer the campaign takes, which is already assessed to have been significantly slower than planned the greater the impact of sanctions on campaign sustainability and domestic stability. .

Cyber operations

As military activity continues there has been a notable lack headline grabbing Cyber activity. There are a few reasons for this: Russian priorities in the Cyber field, which are not fully understood but may have been concentrated on defensive or disinformation action thus far; Ukrainian Cyber capability and international Cyber support; and careful consideration of where Western red lines may be. The Russian framework of information confrontation allows for constant competition which must be curtailed at times. This short overview will overview some of the capabilities and activities of Cyber actors involved in the conflict.

The expectation that huge debilitating Cyber-attacks would occur is due to Russia’s previous strategies in attacking Ukraine. In 2015 they attacked the power grid to assist with the annexation of Crimea and in 2017 deployed the NotPetya virus, a destructive malware which spread globally. Non-state Cyber actors have also been used to conduct a wave of smaller disruptive attacks in Ukraine these are assessed to follow an intent from Moscow but with the freedom to find weaknesses and attack them as they see fit, this has so far included the denial of government websites including the Ministry of Foreign Affairs and the Education Ministry as well as mutilating over 50 public websites. The current Russian capabilities sit within three major groups, with associated groupings and Advanced Persistent Threat actors such as APT28, which are commonly referred to as Fancy Bear.

The array of Cyber responses is vast and is currently more visible than Russian information confrontation, ranging from increasing State capability which has improved drastically since 2015 to employment of non-state Cyber actors, which similar to their adversary are deniable harder to target and use a broad intent to guide their operations, and lastly to international sanctions. Russia for example faces a data storage crisis, as Western cloud providers were forced to pull out of the country, reportedly leaving Russia with only two months of storage capacity. Without enough internal data centres both offensive activity and long-term projects such as smart cities are at risk. One potential avenue for support for Russia is Huawei, but there are some competing agendas at play. China has not yet given Russia it’s full support but with sanctions against the Huawei in the EU and US then the business may be hard to turn down.

Ukrainian proxy actors and self-start Cyber activists have been very prominent in actively targeting Russia and RFAF. This includes denial of services, interrupting military communications and disrupting Russia control of information. The attacks are contributing to the gradual increase of awareness the Russian public have of the conflict. These activities are being supported by both Western State actors and supporting public Cyber organisations. A number of the public entities are openly funded which allows for a greater output. Although the Russian State does not need to pay its proxy forces, availability of funds and resource to operate is likely hampered by sanctions, although the extent of this is unknown and likely limited.

The long-term impact of these Cyber operations a far reaching. Digital sovereignty (tsifrovoi suverenitet) is considered a key aspect of Russian foreign policy and is translated as the right and capability of a government to determine its fate within its own information space. Russia will increase Cyber activity despite the challenges, these are most likely to be conducted by deniable sources but not exclusively as Putin will calculate that these aspects are part of military operations and will not cross a red line. That said the effect on Russia post conflict, where strategic goals such as the security of RuNet (Russian closed internet) and smart cities will have to endure long term sanctions and ultimately reduce Russian digital sovereignty.