Feb 16, 2018
#PutinAtWar: The Final Ride of the Valkyries
How information about a Russian mercenary attack and U.S. counterattack in Syria spread
Strikes on Syrian forces by the United States dominated the western news cycle on February 7, but the story on Russian social media was different. In the days following the event, Russian social media was abuzz with rumors of a crushing defeat, in which hundreds of Russians for the Private Military Contractor (PMC) Wagner perished. While there is not yet any conclusive footage depicting Russian mercenaries in the attack, there is no shortage of information, rumors, and disinformation surrounding the events.
The verified facts were murky and disinformation spread, but the event was a significant escalation in a complicated and confusing conflict zone rife with proxy forces. While Russia’s use of mercenaries allows plausible deniability of some kinetic actions in Syria, as it has in Ukraine, their command structure back to Russia is clear.
Official Statements
On February 13, U.S. Department of Defense released a briefing transcript explaining the incident. Lieutenant General Jeffrey Harrigian, commander, U.S. Air Forces Central Command stated:
"For a quick recap, on the evening of February 7th, the coalition acted in self-defense where coalition advisers were present to support SDF from a hostile force launching an unprovoked, coordinated attack across the Euphrates River against an established SDF position."
Lt. Gen. Harrigian explained that hostile force initiated an attack by firing artillery and tank rounds at the SDF position, followed by a dismounted battalion-sized formation. A base housing U.S. and Syrian opposition forces was attacked, and the U.S. retaliated killing approximately 100 assailants. U.S. military officials stated that they have no information whether Russian mercenaries were among the casualties.
On February 14, Kremlin spokesman Dmitry Peskov claimed he had no detailed information to conclude whether Russian contract soldiers were killed in the attack. Peskov did not deny the possibility that Russian citizens might have been among the dead, but he insisted that they were not connected to the armed forces of the Russian Federation.
A video began to circulate on February 13, which allegedly showed drone video footage from the attack. An armored vehicle bearing close resemblance to a T-72M1 tank and several militants were shown to be destroyed by a aerial attack. The video was 17 seconds long and a reverse image search suggested that the video was not recycled from a previous engagement — an important detail due to false videos that arose around the event described later in this report.
The location in the video appeared to be near the town of Deir ez-Zor, in the village of Khsham. The location was near the south-eastern bank of the Euphrates River.
Here is the location pinpointed on the map:
Both the location and the presence of armored vehicles correlated with Lt. Gen. Harrigian's statement. Even though the supposed drone video was not confirmed at the time of this report, it is highly likely to depict the U.S. military retaliation on February 7.
Identification of Mercenaries
The first rumors that Russian mercenaries were killed appeared on the internet the same day of the attack. Investigative teams, such as Conflict Intelligence Team (CITeam), were some of the first to identify the dead mercenaries. The identification process differs with every single case, nonetheless most information surfaced in VKontakte (VK or ВКонтакте) profiles and groups.
On February 10, a few audio recordings of the alleged surviving Wagner soldiers appeared on VK. Even though the audio files remain unconfirmed, they correlate with much that is known about the event and revealed further details about the attack itself. According to the soldier in the audio, almost all of the 5th Wagner company was wiped out, the 2nd Wagner company was basically untouched. The soldier also mentioned that 177 men were killed and the remainder of the troops retreated.
On February 12, photos of the Monument of Soldiers-Internationalists (Памятник воинам-интернационалистам) in Kolpingo, Saint Petersburg appeared to confirm these claims. On the side of the monument a sign in the snow was written: “5ШО” (5-й Штурмовой Отряд) or 5th Assault team. These photos signify that the 5th Assault team did suffer casualties.
Most of the currently identified mercenaries seem to have served in Donbas fighting Ukrainian Government forces before being deployed to Syria.
While we don’t expect any official acknowledgement of the dead from Wagner or their Russian government clients, we do expect to learn the identities of more of the dead mercenaries as family and friends mourn. The exact number of those killed in action remains unverified, but we have no reason to doubt the approximations.
More on the verification of the identities of the dead is included at the bottom of this report.
Online rumors and disinformation
Russian online image boards were some of the first among the public to catch wind of this story. The first recorded instance was a user on a popular military image board who shared a blog post on February 8, which claimed a minimum of 30–35 Russian losses. Moderators later banned the user who shared the blog post, along with other users posting about Russian losses near Deir ez-Zor. It wasn’t until February 10, however, that the story truly gained traction.
Russian internet users often refer to Wagner fighters as Musicians, a nod to the famous German composer Wilhelm Richard Wagner.
February 10 was the day that most social media claims of extraordinary casualty counts of Musicians began to surface. Igor “Strelkov” Girkin, for example, wrote a blog post, which claimed losses were in the hundreds, but shedding doubt on reports of losses as high as 600. Girkin’s reporting corroborated with consistent reporting among other social media sources that claimed a longstanding relation to Wagner. These sources formed consensus that the 5th Assault Team was destroyed and that casualties were around 200.
Posts from social media pages such as Project Partizan, Soldier of Fortune, and Nezygar mentioned incredible losses by PMC Wagner. The pages even fueled online humor about the incident, as users struggled to believe the news. Some jokes included crude military humor, copy and pasted in internet vernacular. Other humorous stories inlcuded misleading footage, which would later spread across the internet.
Moderators on a popular Russian image board even deleted posts on the site’s 565th Syria thread, but the posts were previously archived Wayback Machine. The posts were not deleted at random, but were removed in an attempt to conceal the site’s role in distributing disinformation — perhaps to keep the content from spreading further. While the intentions of the moderators may have been good, obscuring the original source of false information is problematic.
For instance on February 10, an anonymous user posted a reply to a message on the popular Telegram channel WarGonzo, which purported to describe the event from the perspective of a Wagner fighter. The reply featured an image depicting the results of a Russian artillery strike in Ukraine attached and read:
“A photo of this epic massacre.”
Users on the site found the image unconvincing and concluded that the image needed alterations to make it appear more authentic. The image was then flipped, recolored, and the white stripes on the trucks were removed to conceal the fact that they were Ukrainian.
Other users — joining in on the joke — suggested photoshopping in sand to make the image look more like it originated from the area near Deir ez-Zor. Ten minutes later, an anonymous user posted the following result.
Although the image spread quickly to different forums, users virtually everywhere pointed out that it was, in fact, a photoshop combining imagery from Ukraine with a picture taken by a Mars rover.
In one instance, a user posted the image to the Russian forum WarOnline. Again, other users were quick to point out the fake. This is in part because a reverse image search of the doctored image will yield results from the Mars mission.
YouTube
YouTube user Military-Political Review (Военно-Политическое Обозрение) posted a video titled “US Air Force strike on the column of PMC Wagner. FOX NEWS” (Удар ВВС США по колонне ЧВК Вагнер. Репортаж FOX NEWS). The video did show a real fox news segment, but there was no mention of the attack being on Wagner or Russia. The video was also shared in this thread and claimed that CNN reported that the U.S. initiated the fight.
A native English speaker might have easily understand that the footage in the video is labeled as stock and that the video does not mention any Russian PMC. The average Russian, however, might place more confidence in their ability to understand the title in their native language versus the English-language video. At the time of this report, the video had 56,898 views with an overwhelmingly negative “dislike” ratio. In the comments, a few users understood that the video did not mention Wagner, but instead expressed anger at the U.S. or called the footage fake.
Another video claiming to depict the mercenary attack and subsequent retaliation was familiar to @DFRLab. Since at least February 11, the same video footage has circulated on YouTube and in articles on Russian losses in Syria. The footage is from a video game, but, in this instance of its deployment, it was purported to depict U.S. gunships engaging Russian mercenaries in Syria.
Some might recall seeing this video imagery in the past, when the Russian Ministry of Defense claimed the very same footage was the Russian military striking an ISIS convoy. President Vladimir Putin also showed the same footage to filmmaker Oliver Stone. Again, this footage originated from a video game.
However, in the case of U.S. retaliation against Wagner, the video game footage has been one of the most successful pieces of intentionally misleading information so far. The video was even shared by the widow of killed Wagner fighter Stanislav Matveev, who was featured at the end of this report. In an interview with the publication Znak, she showed the footage on her phone; the journalist was either ignorant to the fake or intentionally misleading the audience.
A side-by-side comparison between the original video and the one shown in the interview matched with certainty.
Every YouTube video @DFRLab discovered that featured the video game footage as an attack on Russian troops also featured several comments berating the uploader for spreading disinformation. Yet, the video spread. The most viewed version had nearly 500,000 views at the time of this report — a testament to how quickly even false information can spread.
Conclusion
Russian mercenaries were killed in the airstrikes defending U.S. forces in Syria on February 7. There is a clear connection between the deceased members of Wagner and contemporary Russian military institutions. The fighters featured at the bottom of this report have a demonstrable connection to either the cossacks, the war in the Donbas, have served in the Russian military and sometimes all the above.
The remaining question is the extent of the casualties, and what degree of truth is in the rumors pushed by sources claiming a connection to Wagner PMC. The casualties reported by these sources were uncharacteristically high and sewed skepticism in communities watching the conflict.
At the time of this report, the identities of deceased Wagner fighters have slowly been creeping into public view and some are featured below. More identities of the deceased will become public. Falsified information present a risk to verifying the events that transpired during the mercenary attack, but the escalation in the Syrian conflict already confused by proxies remains crystal clear.
Again, while we don’t expect any official acknowledgement of the dead from Wagner or their Russian government clients, we do expect to learn the identities of more of the dead mercenaries as relatives and friends mourn.
Here’s how the identities of the fallen mercenaries were found using open source data.
The first three soldiers identified were confirmed by RBC.ru.
Alexey Ladygin (Leha Hmuryj) — Алексей Владимирович Ладыгин «Леха Хмурый»
He was born on May 31, 1992, and he lived in the city of Ryazan (Рязань). Before joining Wagner, he served in Russian special forces — Spetsnaz GRU, judging by the uniform. Alexey was considered to be a participant of the Russian occupation of Crimea and to have fought in the Donbas.
His VK profile was active until his death, which can be confirmed by regular commemorative posts by VK friends. Last activity on his profile was on January 10, 2018.
Stanislav Matveev “Matvey” — Матвеев Станислав “Матвей”
He was born on June 15, 1979, and he lived in the city of Asbest (Асбест). He served as a mercenary for Wagner, and he fought in the Donbas in 2016 for seven months. Stanislav achieved Master Sergeant (Прапорщик) rank and was awarded the Cross of St George. According to his wife, he got bored and joined Wagner again in September 2017.
Stanislav’s story was investigated by journalists from ZNAK.com, an online publication in Russia. It is important to note that the photos in the article confirmed Stanislav's identity.
Stanislav’s VK profile was active up until very recently, even though it holds no significant information. Last time Stanislav logged in to VK was February 6, 2018.
Vladimir Nikolaevich Loginov — Логинов Владимир Николаевич
He was born on March 5, 1966, and he lived in the city of Kaliningrad. He served as a mercenary for Wagner and also fought in the Donbas. Photos of him online in traditional Cossack uniform suggest that he was an ethnic Cossack. He also served in the Russian military as Senior Lieutenant.
Vladimir did not possess a social media account, nonetheless news about his death appeared on Regnum.ru and a local military Cossack organization’s website. The website listed his achievements and stated that Vladimir died heroically, defending the homeland from the invasion of barbarians.
A person of similar appearance to Vladimir also appeared in a post by @IvanSidorenko1 on February 11. Some groups, including Syrian government troops, some Kurdish forces that fight in the regions controlled by ISIS call themselves “ISIS hunting groups”. The posted selfie below feature one such ISIS hunting group with two men in Russian uniform, of which one was Vladimir.
Three more mercenaries were thought to be killed during the February 7 clash.
Kiril Borisovych Ananyev “Moscow” — (Кирилл Борисович Ананьев “Москва”)
He was born January 31, 1985, and he lived in the city of Moscow. Kiril served as an artillery officer in the so-called Donetsk People’s Republic. Photos of him in uniform were found online in what appeared to be Syria. Ample information about Kiril remains available online.
Kiril’s VK profile was also active up until recently and his death was confirmed by commemorative posts by friends on VK.
Igor Nikolayevich Kosoturov “Kosotur” — Косотуров Игорь Николаевич “Косотур”
He was born on December 30, 1972, and he lived in the city of Asbest (Асбест). Not a lot of info was available on Igor, and he did not appear to be an active social media user. Nonetheless, photos of him in uniform, which match uniforms of Russian soldiers stationed in Syria, were available. Before joining Wagner, he served in Russia’s Glavnoye Razvedyvatel’noye Upravleniye or Main Intelligence Directorate (GRU) with Captain's rank, and he fought for the “DNR” according to a separatist commander.
Aleksey Shihov “Kadet” — Шихов Алексей “Кадет”
He was born on October 13, 1991, and he lived in the city of Nizhnyi Novgorod (Нижний Новгород). Judging by Aleksey’s photos in uniform available online, he served in the Russian military and in so-called Luhansk People’s Republic — mechanized Brigade ‘Prizrak’ (Ghost).
The news of his death circulated among VK groups of Russian-led separatists in the Donbas.
Alexey’s VK profile was recently active, and his last log in was on December 27, 2017.
On February 15, The Associated Press identified the 37-year old Ruslan Gavrilov as being among the killed in the air strikes. Ruslan was believed to be one of seven men in his small Central Russian village to have joined Wagner.
While the exact number of those killed in action remains unverified, we have no reason to doubt the approximations corroborated by associates and comrades.
Lukas Andriukaitis is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
Michael Sheldon is an Editorial Intern at the @DFRLab.
Follow along for more in-depth analysis from our #DigitalSherlocks.
Update: Changes were made to the description of Girkin’s social media post, to better characterize his message. Naginov was changed to the correct transliteration, Loginov.
