Importing Instability
How the War Against Ukraine Makes Russia Less Secure

9 November 2023

Key Findings and Trends

ACLED data indicate that cross-border violence between Ukraine and Russia escalated in May-October 2023 in the wake of the ongoing Ukrainian counter-offensive.
- Conflict incidents inside Russia have become increasingly deadly for both civilians and the Russian military.
- Although the Russian government has attempted to hush up the impact of the war’s spillover, local authorities — especially those in the border regions — are struggling to fend off cross-border attacks.
Ukrainian drone attacks have surged since May 2023, reaching deeper into Russian territory and inflicting significant damage to Russia’s reputation, military, and infrastructure.
While the Wagner Group mutiny revealed the Russian state’s inability to control the internal situation, it may also have rallied the establishment around President Vladimir Putin.
Still, resistance to the invasion from individuals and armed groups within Russia shows no signs of abating, as attacks on military enlistment offices and rail infrastructure continue despite the government crackdown on opposition and protest.

Introduction

Since the beginning of its full-scale military invasion in Ukraine, Russian authorities have pursued a strategy that sought to preserve a sense of normalcy in Russian society and convince the population that the invasion would not have any repercussions on safety in the country. However, just as the Russian-Chechen wars ultimately resulted in militant attacks on Moscow and other cities in the early 2000s, Russia’s invasion of Ukraine has spilled over deep into Russian territory, undermining the government’s promises.

Russian authorities consistently attempted to domestically frame the invasion as a ‘special military operation’ – short and victorious. Two days after the start of the invasion, Russia’s censorship agency demanded that independent media outlets delete materials “that refer to an ongoing operation as an attack, invasion, or declaration of war.”¹ By July 2022, 95 media outlets were closed down, and at least 504 independent journalists left the country, fearing reprisals.² Yet, over 20 months into the invasion, its consequences for Russia’s domestic security situation prove to be multi-faceted and far-reaching. The spillover of the conflict has seen dozens of civilian casualties in Russia’s border regions due to cross-border shelling, incursions by armed groups made up of Russian anti-government fighters, and a mutiny attempt by the head of Russian state-sponsored private military company, the Wagner Group. There have also been other, less visible, effects that are likely to leave a long-lasting impact on security in Russia, including the mobilization of pro-Ukrainian partisan groups, easier access to lethal weapons, and the intensification of state violence against anti-war voices.

As international attention remains pinned on the plight of Ukraine fending off Russia’s aggression, Western and Russian observers have undertaken only sporadic analysis of the spillover of cross-border violence.³ This report strives to provide an overview of the consequences of the invasion upon Russia itself, including the rising levels of cross-border spillover violence in the border regions; drone attacks in different parts of Russia, mainly targeting oil and gas infrastructure; and destabilization of internal security. The significance and scale of these consequences demonstrate the extent to which the invasion in Ukraine has changed Russia’s own security landscape.

Struggling to Maintain Security at the Borders

On 4 June 2023, the Belgorod region’s Governor Vyacheslav Gladkov publicly called on the residents of the small border town of Shebekino to follow the instructions of authorities and evacuate from the area – despite having previously denied that such an order had been issued.⁴ His statement followed several weeks of intensifying shelling that targeted Russian villages and towns close to the Russia-Ukraine border, as well as a cross-border incursion of pro-Ukrainian Russian groups⁵ that led to a brief loss of control over Shebekino and neighboring settlements. The governor’s reaction serves as a rare high-level acknowledgment of the significance of the violence that has been recorded along the border throughout the full-scale military invasion.

Additionally, it led to Russian authorities admitting military personnel losses during armed clashes on its own territory. These events resulted in the deaths of at least 14 Russian servicemen, a border guard, and the head of the district territorial defense. It also marked the first (although brief) instance of loss of control over internationally recognized Russian territory since the Russian-Chechen wars. Similar but much more short-lived incursions also affected the Bryansk region in March and April. Despite the authorities’ claims that border security has been restored, a further seven military and police personnel fatalities, including two Federal Security Service (FSB) officers, were recorded in the border area of the Bryansk region in August and September during five further incursions, which the government claimed were carried out by Ukrainian “saboteurs.”⁶ Another brief incursion occurred in the Belgorod region in September.

Despite garnering significant media attention, these incidents represent a fraction of the total number of violent incidents recorded in the border regions over the past 18 months (see map below). Since Russia’s retreat from northern Ukraine in April 2022, the authorities of the Belgorod, Bryansk, and Kursk regions have all reported shelling and drone incidents in the border areas, with the Belgorod region being the most affected. Almost 2,000 shelling incidents have been recorded in the three regions since April 2022, of which over 1,600 have occurred in the Belgorod region. While initially most shelling incidents targeted border checkpoints on the Russia-Ukraine border, they have increasingly had a deadly impact on civilian populations – with nearly 70 reported civilian fatalities, in addition to nine civilian deaths resulting from mines and other explosives.

The high death toll from a relatively low number of reported events may point to under-reported incidence as well as inadequate protection of civilians in Russia’s border areas. The Ukrainian government has consistently denied responsibility for these attacks, while some observers have posited that some incidents may have resulted from trajectory deviations or munition-pointing errors by the Russian military firing artillery rounds in the direction of Ukraine from the Russian territory.⁷

Following early incidents of cross-border shelling in April 2022, the number of shelling incidents increased in October, coinciding with Russia’s retreats from northern and northeastern Ukraine (see graph below). Since then, the number of reported cross-border shelling incidents further surged at the end of May 2023, on the eve of the Ukrainian counter-offensive.⁸ The number of reported shelling incidents reached over 20 per day at the end of May and remained high throughout summer. These incidents have led to a rising number of civilian casualties – ACLED records over 30 civilian deaths between May and October 2023 – and prompted many residents to leave the area. Thus, Ukrainian battlefield successes have translated into deteriorating security in Russia’s border regions. Furthermore, they add fodder to Russia’s propaganda machine, which has been at pains to justify aggression against Ukraine as self-defense.

While these trends present a worrying assessment for Russian authorities, it is important to note that much of the scale of political violence in Russia’s border regions remains unclear. There are several substantial limitations related to the reporting of shelling incidents in border regions. First, some statements recently made by the regional authorities suggest that there has been a significant shift in the authorities’ approach to reporting, which might have contributed to the surge in the number of reported events. For instance, on 21 May, the Belgorod region’s Governor Gladkov started publishing reports on the security situation on a daily basis. Second, claims by authorities are difficult to verify given that most independent media have been forced out of Russia, and there is limited – if any – presence of independent reporters in the area. At the same time, tight information control results in underreporting of shelling incidents and fatalities and, consequently, a lack of media attention prompting government response. This perceived lack of response from the government has led to growing frustration among affected populations; for instance, at the beginning of June, the residents of the aforementioned Shebekino border town campaigned on a social media campaign under the hashtag ‘Shebekino is Russia,’ in an attempt to bring more attention to the security situation in this border town.⁹ It was subsequently evacuated.

Authorities have generally sought to downplay the scale of the war spillover by focusing on measures to support the population and avoiding any acknowledgment of its causes. However, the intensification of violence in the border regions and rising numbers of civilian fatalities have made it more difficult to ignore reality.¹⁰ Moreover, heightened insecurity levels in the Belgorod region are a distracting factor for Russia’s leadership as it attempts to arrest Ukraine’s ongoing offensive. Military personnel and equipment have been posted to the region since as early as 2015,¹¹ and its territory is routinely used to strike Ukraine’s bordering regions.¹² Therefore, the inability to contain the spillover of violence or minimize its effects on the civilian population throughout the conflict has become a reality check for Russia’s leadership, as it is clear that dealing with any further escalation at the borders will present a significant challenge.

From Belgorod to Moscow: Struggling to Protect the Skies

On 3 May 2023, two alleged Ukrainian drones flew over the Kremlin. The incident was framed by Russia’s propaganda as an attempt on the life of Russian President Vladimir Putin and garnered significant media attention,¹³ prompting Russian authorities to immediately and publicly accuse Ukraine of orchestrating the attack on the Russian capital. The prominence of this event has overshadowed the fact that it was far from the first reported drone attack inside Russia. Between April 2022 and October 2023, ACLED records over 440 drone attacks on Russian territory, and 250 more events in which drones were intercepted by air defense. The number of such reports has been steadily increasing since the end of May.

Similar to the aforementioned cross-border attacks, most of the drone attacks were reported by the authorities of the three Russian regions that share a border with Ukraine – Belgorod, Kursk, and Bryansk (see map below). While these regions together account for nearly 80% of all reported drone incidents, the remaining reports come from as many as 19 regions, with strikes reported as far away from the Ukraine border as the Moscow and Pskov regions. Such wide geography and long distance from the Russia-Ukraine border suggests that the groups or individuals behind the attacks could operate from within Russian territory. Some sources have claimed that Ukraine has provided home-produced drones to partisan groups based in Russian territory, enabling them to carry out at least some of these attacks from within.¹⁴

The wide geographical reach of these allegedly partisan groups or individuals scattered around Russia has enabled them to target various energy and military infrastructure objects. In nearly two-thirds of cases, the target of the strike is not clear from the source. Where this information is available, 10% of all drone attacks recorded by ACLED targeted oil and gas infrastructure, with another 5% targeting Russian military bases and airfields. While initially hitting mostly oil refineries to disrupt Russian logistics, by the end of summer 2023 suspected Ukrainian drones increasingly targeted Russian military sites, some as far afield as Pskov and Novgorod regions, resulting in a number of fighter jets and military transport aircraft damaged or destroyed. Further attacks were reported on production sites supposedly involved in manufacturing military equipment as well as the Russian naval base in Novorossiysk. Thus these attacks aim at the direct source of threat, as Russia continues pummeling cities in practically all Ukrainian regions, including from the air while still in Russia. Considering the growing frequency of these attacks and the inability of the Russian air defense system to shield strategic objects on such a large territory, they might be capable of causing more significant disruptions in the future, potentially undermining the infrastructure that enables Russia’s war effort.

Amongst these strikes, though, the presence of drones over the Kremlin in May stands out not only for its individual symbolic significance but also as a harbinger of an evolving state of drone activity in Russia. Attempted drone strikes affecting the wealthy neighborhoods on the outskirts of Moscow in late May further marked a shift from targeting solely oil and gas infrastructure and military bases to politically symbolic targets. This shift appears to be turning into a more significant pattern, with repeated drone strike attempts on the Moscow International Business Center buildings in July and August, albeit no drones reached the Russian capital in September and October amid escalating aerial war suggesting probable improved air defense around the city. These developments fall into a larger picture where even social and political elites might sense that their security is no longer guaranteed, despite the Kremlin’s promises to keep the war out of Russian territory.

Security Unraveling from Within

While failing to keep its citizens safe along its borders and intermittently succeeding in fending off the challenge from the skies, Russian authorities are also struggling to maintain universal popular support for the invasion, even among nominally loyal groups. The fragility of the internal security situation reached its peak at the end of June 2023, as fighters from the Wagner Group marched toward Moscow and threatened to take down Russia’s military leadership. This maneuver, though the most prominent to date example, illustrates how the war has radicalized the space for political negotiation in Russia. This change has been enabled by Russian leadership through a range of policy decisions, from eliminating any space for alternative discussion to appointing a criminal leader to head a part of its military operations. This radicalization of political space has manifested not only in the Wagner Group’s attempted mutiny but also, arguably, in the spike of partisan activities aimed at disrupting Russia’s war machine, with resistance acts ranging from setting enlistment offices ablaze to derailing trains carrying weapons and materiel to Ukraine.

Wagner Group Mutiny

The Wagner Group is a creation of the Russian Ministry of Defense (MoD), initially composed of former commando fighters to ensure the deniability of Russian covert military operations overseas. Its engagement in Russia’s aggression against Ukraine marked a break with persistent denials about its very existence. Yevgeny Prigozhin, the group’s late founder, quickly built a sizable media profile, also drawing on his own media assets.¹⁵ He has openly feuded with Russia’s Defense Minister Sergei Shoigu and Chief of General Staff Valery Gerasimov, especially since the MoD took over troop recruitment among Russia’s vast prison population in early 2023 – previously conducted by Wagner¹⁶ – and during the protracted battle for Bakhmut. Despite Wagner earning praise from Russian President Putin¹⁷ for capturing the largely obliterated town around 20 May,¹⁸ the MoD ordered that all “volunteer” formations submit to the Ministry’s command by 1 July 2023,¹⁹ which Prigozhin publicly resisted.

The conflict came to a head on 23 and 24 June. Prigozhin first lashed out at the MoD for its inept prosecution of the war in Ukraine,²⁰ then made a claim – most likely fake²¹ – that Russian regular forces targeted a Wagner camp at an unspecified location in Ukraine. This eventually led to a “march for justice” to dislodge Shoigu and Gerasimov.²² The rebellion included occupation of military sites in the Rostov and Voronezh regions and a drive toward Moscow, during which, allegedly beset by airstrikes, the rebels shot down six military helicopters and a command-and-control jet,²³ killing up to 13 personnel onboard (see figure below). By the evening of 24 June, a deal was announced and Wagner columns made a U-turn about 400 kilometers south of Moscow in exchange for amnesty. Albeit short-lived, the Wagner rebellion became the first armed challenge to the central Russian authority since the abortive putsch in Moscow in 1993 and two Chechen wars in the mid-1990s and early 2000s. It also revealed the extent to which the Russian state can control developments within its own borders.

Despite some believing that the mutiny was staged,²⁴ authorities’ response to it belies confusion. President Putin went from first accusing rebels of treason and vowing retribution²⁵ to offering those unwilling to succumb to MoD authority a choice to either quit or re-deploy to Belarus, with all charges dropped. While the events were in flux, his loyalists scrambled to reassert their allegiance, and some rushed out of Russia. After the rebellion, Prigozhin was ridiculed by the Russian state media but appeared to enjoy freedom in both Belarus and Russia, raising questions of whether getting away with the murder of Russian military pilots is the new norm. Two months after the mutiny, the apparent assassination of Prigozhin and his acolytes – in a symbolic plane crash – put an end to speculation that President Putin was weakening. The secretive purge of high-ranking real and perceived Prigozhin sympathizers in the Russian army suggests an effort to reassert control over the armed forces while preserving a semblance of normality amidst the ongoing war.²⁶

As if refusing to draw lessons from the proliferation of armed groups outside the remit of the centralized military authority, though, Russian legislators recently allowed the creation of regional paramilitary “enterprises,” ostensibly in order to tackle drone attacks and incursions from across the border.²⁷ Earlier, the Russian Guard – internal troops akin to the Italian carabinieri – was promised heavy weapons for unspecified tasks.²⁸ Both developments denote a wish to avoid the concentration of power in the regular army. Both may lead to further outbreaks of violence as more arms are in circulation. Despite undermining common perceptions of Moscow’s iron grip on power, the Wagner mutiny could also have conversely rallied the establishment around President Putin.²⁹ There is a trail of evidence that large Russian businesses and individual tycoons have been bankrolling recruitment for the war against Ukraine,³⁰ exposing a chronic shortage of volunteers to hold the long frontline in Ukraine and leading to a further proliferation of paramilitary formations within Russia – potentially bringing about further volatility.

Meanwhile, the return of thousands of Wagner fighters, no longer engaged in military actions in Ukraine, may lead to rising levels of violent crimes in the near future. As of June 2023, as many as 32,000 former Wagner fighters recruited from Russian prisons have returned home after serving as volunteers with the mercenary group in Ukraine.³¹

Internal Resistance

Despite authorities’ attempts to paint the ‘special military operation’ as enjoying the all-in support of the Russian public, ACLED data show that at least some Russian citizens refuse to toe the government line. In addition to probable complicity in directing and even operating Ukrainian drones toward targets deep within Russia, other forms of internal partisan resistance have emerged, presenting additional challenges for Russian authorities. In contrast to the safe distance from which drone strikes or hacking attempts are staged against the behemoth security apparatus, setting enlistment offices on fire and disrupting the heavy railway traffic that enables the war requires physical presence. Authorities’ response is met with evolving tactics and does not seem to completely dissuade active resistance.

First recorded in late February 2022,³² arson attacks became more frequent across Russia in September and October 2022, in response to the beginning of the so-called ‘partial’ mobilization announced on 21 September. A third of the total of about 70 attempts were recorded during that two-month period. The number of arson attacks declined in the subsequent months as authorities imposed heightened security measures. The measures included deploying the National Guard in several cities and additional patrols all over the country to guard military enlistment offices against potential attacks³³ and handing down heavy sentences under terrorism charges.³⁴ Another spike occurred in late July – early August 2023 when the Russian Parliament hastily passed amendments allowing the military to draft more people and retain serving personnel for longer. Most of about a dozen attempts during this latest spike have been attributed to senior citizens tricked into throwing explosives by phone scammers, presumably linked to Ukrainian intelligence services.

While setting enlistment offices on fire may not necessarily reflect opposition to war but rather an unwillingness to go to trenches, sabotage is an obvious expression of dissent. It has been visible since the first months of the invasion and has taken the form of train derailments and, more recently, arson attacks on relay cabinets along the rail tracks. The railway is the chief mode of transport for the movement of fuel, heavy military equipment, and munitions across Russia’s vast territory. Since April 2022, ACLED records nearly 65 attempts to disrupt railway infrastructure crisscrossing Russia, in both its European part closer to the frontline and beyond the Ural mountains in Siberia and the Far East (see map below). Notably, there was a perceptible uptick in the number of incidents in June coinciding with the beginning of Ukraine’s counter-offensive.

Recording train derailments, however, presents a particular challenge, as reports of incidents do not always indicate whether they happened due to a sabotage act or a technical issue. Among anti-war partisan groups in Russia, Ostanovi Vagony (‘Stop the Wagons’), has claimed responsibility for several train derailments. Arson attacks on relay cabinets have become more frequent, apparently due to lower risks of apprehension as rail track infrastructure is more difficult to guard because of its size and geographic spread.

The authorities frequently report arrests of individuals accused of carrying out such acts. Alleged perpetrators face 12 to 20 years in prison for sabotage under a new article of the Russian criminal code.³⁵ Two people were killed by police and the Russian security service while in detention in the Republic of Kabardino-Balkaria on 1 October 2022. The brutal suppression of such acts combined with the complete absence of any legal forms of resistance may backfire, forcing partisan movements to carry on and possibly turn to more violent tactics. Despite the crackdown, 45 railway incidents occurred in January-October 2023, versus a total of about 20 in 2022. As rail tracks are used for both military and civilian needs, disruptions are likely to affect military logistics and ordinary passengers, with the latter potentially running a greater risk of being caught up in derails, explosions, or crossfire.

No More Business as Usual

While exploiting security incidents to further justify aggression against Ukraine, Russian authorities have simultaneously tried to downplay the consequences of such incidents to avoid appearing weak in the eyes of the population. This strategy is backfiring – pro-Ukrainian insurgents have crossed the border into Russia with little to no resistance, drones are flying in larger numbers and farther afield, and cross-border shelling is only intensifying as Russia shows no signs of giving up on bombing Ukraine into submission.

The incursions have shed light on the severe limitations of Russia’s ostensibly watertight border security as all the guns have gone to Ukraine. Cross-border raids are unlikely to stop thanks to additional dispatches of troops to the border. Rather, there could be fewer of those as providers of Western arms are likely wary of watering Russia’s propaganda mill. Ever-fixated on fighting neo-Nazism, lately it has become increasingly assured that the country is at war with the entire NATO in Ukraine.

Regular drone attacks on strategic objects inside the Russian territory, and most recently near its ports, are likely to continue given the apparent limited capacity of the authorities to completely shield strategic objects. Even though most drones allegedly cause only minor damage, the constant risk of such attacks requires investing significant effort and resources to prevent them. As in the case of cross-border incursions, attempted drone strikes are embarrassing for the authorities bent on lulling the population into believing that the ‘special military operation’ is going according to plan and does not require additional effort on their part – save for the partial mobilization of reservists should the army run out of troops. These mostly symbolic strikes may also pursue double-edged publicity purpose: the Russian monopoly on targeting practically any civilian area in Ukraine at will is broken, thus boosting the morale of the defenders, while increasingly disturbing incidents ram home that Russia is at war not only in frenzied state propaganda but in earnest, for a population largely either endorsing the regime, hunkering down under (the threat of) state repression, or mostly preferring to wait out the war.³⁶ Whether the ever-present threat from the skies jolts Russians to demand an end to aggression against neighbors or demand even more of it is far from clear.

Shelling incidents will likely continue to affect the Belgorod and, to a lesser extent, Kursk and Bryansk regions, considering their proximity to the border and logistical involvement in enabling Russia’s war against Ukraine. This will further affect the population of the frontline settlements in the Belgorod region, who are currently unable to return to their homes as new civilian casualties continue to be reported weekly in areas close to the border.

Having failed to quickly conquer Ukraine and led by a president accused of war crimes in the Hague, Russia shows no signs of relenting. Contrary to expectations, its economy did not collapse, and technology used to bomb Ukraine still finds its way to the country via fellow pariah or non-aligned states, and even Western companies keen to continue profiting from their relations with Russia. Generous payouts cushion the outrage due to the sheer number of combat fatalities now exceeding those seen in the two decades of wars in Afghanistan and Chechnya. Dissenting voices have been eased out of the country or silenced, and indoctrination is in full swing at schools,³⁷ pointing to a willingness to test Ukraine’s mostly Western backers’ resolve to stand by it in the long run.

Despite government efforts to hush the spillover of its war to Russia’s internationally recognized territory, ordinary Russians can no longer ignore it. The threat emanates not only from Ukraine but also from within, as Wagner’s march to Moscow amply showed. With the mutiny quelled and now even Russia’s very own warmongers muzzled,³⁸ security has not been restored. Thousands of surviving Wagner fighters, including many ex-convicts, are back in Russia and re-offending. The traffic of arms and explosives combined with the government’s apparent willingness to hand out more weapons to regional authorities with the aim of creating Chechen-style militias may be a prelude to a further rise in violence in Russia. Even if the war were to end abruptly for one reason or another, it may be no more business as usual for years to come.