The US has alleged Russia has already positioned saboteurs in Ukraine to carry out a “false flag” operation to use as a pretext for a Russian attack, which Washington says could begin in the coming month.
The allegations came on the same day as a large-scale cyber-attack on Ukrainian government websites, and amid new reports of Russian military hardware on the move from the far east heading westwards.
They follow a week of failed diplomacy with abortive talks in Geneva, Brussels and Vienna, which did nothing to defuse the crisis provoked by Russia’s massing of more than 100,000 troops near Ukraine’s borders. Moscow has persistently portrayed the crisis as a military threat from Ukraine against Russia, without providing any evidence.
“We have information that indicates Russia has already pre-positioned a group of operatives to conduct a false flag operation in eastern Ukraine,” Jen Psaki, the White House spokeswoman, said. “The operatives are trained in urban warfare and using explosives to carry out acts of sabotage against Russia’s own proxy forces.”
The allegation was echoed by the Pentagon spokesman, John Kirby, who said that Russia was preparing “an operation designed to look like an attack on ... Russian-speaking people in Ukraine, again as an excuse to go in.”
A US official claimed that social media disinformation had been stepped up well in advance, saying: “The Russian military plans to begin these activities several weeks before a military invasion, which could begin between mid-January and mid-February.”
Russian-language posts on social media accusing Ukraine and its western backers of planning attacks appeared at the rate of 3,500 a day in December, a 200% increase from the daily average in November, the official said.
Ukrainian officials had claimed that the provocation could take the form of a violent incident at the Russian embassy or consulate, which Moscow could then blame on far-right Ukrainian extremists.
The presidential spokesman in Moscow, Dmitry Peskov, rejected the claims as “unfounded and completely unconfirmed”.
On the same day as the allegations, Ukraine was hit by a “massive” cyber-attack, with the websites of several government departments including the ministry of foreign affairs and the education ministry knocked out.
The hackers left a message on the foreign ministry website, according to reports. It said: “Ukrainians! … All information about you has become public. Be afraid and expect worse. It’s your past, present and future.”
Andriy Yermak, the head of the presidential office in Kyiv said, “practically 90%” of the affected websites were back online by mid-afternoon.
“The most strategic infrastructure in Ukraine was not be destroyed by this attack. This is a very [well] protected,” Yermak told a meeting of the Atlantic Council thinktank from Kyiv. He said Ukraine was working with the US and the UK to confirm who was behind the assault.
Foreign ministry spokesperson Oleg Nikolenko said that initial investigations suggested that “hacker groups associated with the Russian secret services” were responsible. The White House, however, could not immediately confirm that.
“We don’t have an attribution at this time,” a US official told reporters. “While we continue to assess the impact with the Ukrainians, it seems limited so far, with websites coming back online. We will consult with allies and partners including Ukraine.”
In a message to the Guardian, the foreign ministry’s spokesperson, Oleg Nikolenko, said: “As a result of a massive cyber-attack, the website of the ministry of foreign affairs and other government agencies are temporarily down.”
He added: “Our specialists have already started restoring the work of IT systems and the cyber-police has opened an investigation.”
Nato’s secretary general, Jens Stoltenberg, and Josep Borrell, the EU’s top diplomat, condemned the attacks. Borrell said the EU’s political and security committee and cyber units would meet to decide how to respond and to support Kyiv.
“We are going to mobilise all our resources to help Ukraine to tackle this. Sadly, we knew it could happen,” he said. He added: “It’s difficult to say [who is behind it]. I can’t blame anybody as I have no proof. But we can imagine.”
Stoltenberg said Nato and Ukraine would in the coming days sign an agreement on enhanced cyber cooperation. Kyiv would get access to Nato’s malware information sharing platform, he said.
Sweden’s foreign minister, Ann Linde, said the west must stand up to any Russian aggression. “We have to be very firm in our messages to Russia, that if there are attacks against Ukraine, we will be very harsh and very strong and robust in our response,” she said. Sweden stood in solidarity with Kyiv, she added.
On Friday, there was more confirmation of Russian forces being moved towards Ukraine from across the country. The Atlantic Council’s Digital Forensic Research Lab analysed pictures posted on TikTok and other social media this month, which it said showed Iskander mobile short-range missiles and T-72 tanks being transported westwards from the far east.
The Kremlin has demanded an assurance Ukraine and Georgia will never join Nato. It wants Nato to remove troops and equipment from its member states in eastern Europe, and to return deployment to 1997 levels, before Nato expanded.
On Friday Russia’s foreign minister, Sergei Lavrov, said Moscow would not wait indefinitely for a response. “We have run out of patience,” he said at a news conference. “The west has been driven by hubris and has exacerbated tensions in violation of its obligations and common sense.”
Meanwhile, Moscow said it had carried out a special operation against the ransomware group REvil following a request from the US. The FSB spy agency which Vladimir Putin used to run said it had detained and charged the group’s members.
In Washington, a US official praised the arrests, saying that one suspect was behind the disruptive hack of the Colonial Pipeline, but separated the issue from tensions on Ukraine, according to Agence France-Presse. “I want to be very clear – in our mind, this is not related to what’s happening with Russia and Ukraine. I don’t speak for the Kremlin’s motives, but we’re pleased with these initial actions.” AFP did not name the official.
The US embassy in Moscow had no immediate comment. But the move appears to be part of carrot and stick operation following the latest cyber-attack on Ukraine, designed to wrong-foot the Americans. Thus far, the Kremlin has made little effort to curb hacks on western targets by Russia-based cyber-criminals.
Yermak said that the Ukrainian president, Volodymyr Zelenskiy, had proposed a three-way summit with Joe Biden and Vladimir Putin in an effort to end the crisis.
“We’re still waiting for the reaction to this from the Russian side, but our American partners take our proposal with some interest,” Yermak said, warning of the potential cost of failure to prevent a war.
“If it’s happened, it will be a big tragedy and you understand it will be big war because … most citizens of the Ukraine will fight against aggressors,” Yermak said.
