Putin’s Stealth Mobilization

In early April 2020, the United States government took an unprecedented action: the State Department sanctioned a violent White supremacist transnational extremist group as a terrorist organization. Known as the Russian Imperial Movement, or RIM in counterterrorism circles, the group was on the radar of U.S. law enforcement and intelligence agencies since at least 2014, when hundreds of paramilitary fighters who trained at RIM’s St. Petersburg headquarters began flowing to the frontlines of eastern Ukraine. RIM’s training program—called Partizan, the Russian word for guerilla—had a reputation for attracting violent far-right extremists from around the world among U.S. and European intelligence analysts and has been called a “conveyer belt” for training Russian fighters for insertion into foreign conflict.

The State Department move not only marked out the Russian extremist organization, it also signaled a paradigm shift for a country rocked by years of political controversy over the targeting of Muslim communities and the hard legacies left in the wake of America’s decades-long global war on terror. The U.S. action against RIM’s three leaders—Nikolay Truschalov, Stanislav Vorobyev, and Denis Gariyev—placed them on par with terrorist leaders like al-Qaeda’s Osama bin Laden and sent a stark warning to anyone who had dealings with RIM. But the Washington press conference that announced the action referred only glancingly to the dozens of Partizan-trained combatants that fought on Syria’s frontlines for the Wagner Group, a Kremlin-backed paramilitary also identified as a growing threat to American national security interests.

It was an odd omission. Strong evidence linked RIM to both Wagner and Task Force Rusich, another cadre of Partizan training center graduates. In January 2015, the Treasury Department had sanctioned Alexey Milchakov, commander of Rusich, and one month later the EU followed suit, naming Milchakov as the head of “an armed separatist group involved in fighting in Ukraine.” In June 2017, the Treasury Department’s Office of Foreign Asset Control sanctioned the Wagner Group on the same grounds, naming Dmitry Utkin as the “leader and founder” of the paramilitary. The leaders of all three groups—RIM, Rusich, and the Wagner Group—had trained or served in military units located in Russia’s Western Military district, which is headquartered in St. Petersburg. The dots appeared to join up, but it appeared few if any in the U.S. government could see the connections.

Yet in some ways the seeming disconnect in Washington policy circles made sense. The U.S. government had for years struggled to come to a consensus about how to deal with the Wagner Group, which seemed purpose built to elude easy categorization. Described universally as a private military company, the Wagner Group employed Partizan-trained fighters and seemed to recruit deeply from the ranks of fervent ultranationalists that RIM had generated since its founding in 2002. Rusich commander Milchakov and Wagner commander Utkin had both served in special forces units based in the town of Pskov. But the lines connecting the Wagner Group to RIM and Rusich were tangled rather than linear.

For years, these connections were clouded by confusion over how to categorize each group. The Wagner Group, RIM, and Rusich all defy traditional definitions of a paramilitary or terrorist organization. Their fighters are often described as mercenaries and their leaders often act more like mafia dons than disciplined military leaders. At the same time, Western government agencies have often cast the Wagner Group as being under the control of Russia’s military intelligence wing (the Main Intelligence Directorate or GRU) and the Kremlin. Few if any have been able to definitively describe the command structures that support the Wagner Group’s operations or to trace with any specificity the paramilitary cartel’s links to the Russian government, let alone describe the relationship between the Wagner Group, RIM, and Rusich. One reason for the fog is the widespread assumption that each of the three groups is a distinct, separate, and fully private entity that has at best only arm's length ties to the Russian government. Nothing could be further from the truth, and this failure of imagination has been costly for the U.S. and its allies, while giving Russia an edge in its covert mobilization forces.

While RIM, Rusich and the Wagner Group have distinct organizational structures, there is considerable synergy between the three, and each in its own way services the Kremlin’s geopolitical ambitions. What we have learned after sifting through over 800 gigabytes of user profile data on VKontakte, Russia’s version of Facebook, and other publicly available information over the last five years, is that the virtual and real world ties that bind together the core nexus of field commanders in RIM, Rusich, and the Wagner Group are so tight that it is almost impossible to disentangle them. The shared demographics and military background of their members as well as their common mission sets points to the reality that the field commanders at the heart of Wagner Group operations are not private mercenaries who are hired on ad hoc basis by private firms. Instead, they act in full harmony with mission objectives set out by the Russian state through its government agencies, including the Federal Security Service (FSB) and GRU. Furthermore, a core set of their members appear to share membership in branches of Russia’s elite special forces as well as the physical, psychological, and ideological conditioning that can unify an organized fighting force.

The irregular operatives associated with the Wagner Group, Rusich and RIM are, in effect, linked through state organizations governed by a presidential decree that designates the All-Russian Organization-Voluntary Society for Assistance to the Army, Aviation and Navy of Russia (Добровольное общество содействия армии, авиации и флоту/ДОСААФ) as a leading manager of recruitment for Russia’s military reserves. Known by its Russian acronym DOSAAF, the military management body is a vestige of WWII Soviet culture that, like Russia’s Young Army movement, cadet schools, and state subsidized sports clubs, replicates the command structures of the regular Russian army. This mirroring of organizational structures is evident in the social media data of Wagner Group, RIM, and Rusich. From their self-described military unit affiliations to the type of camouflage uniforms they sport and the specific weapons they carry, the pattern of signals available in the metadata of the user profiles of this unique cadre point to a hidden but active command structure linked to the Kremlin and Russian security agencies, a structure that only appears to be disaggregated and amorphous to the untrained eye.

Because so much of the available metadata in social media and other digital sources contains and relies on geocoding, that command structure can be made visible through a comprehensive mining of large-scale digital datasets and cross-comparison of known and verifiable facts about location-specific incidents such as battle set pieces, precision strikes, mass casualties, property and infrastructure destruction, and atrocities. In other words, despite repeated Kremlin denials, there is a preponderance of evidence pointing to Russian state responsibility for the coordinated actions of the Wagner Group, Rusich, and RIM in Ukraine and other locations where Russian state-owned companies hold substantive interests.

The covert nature of the ties between the Wagner Group’s field commanders has made it difficult to pin down the outlines of the command structure of Russia’s irregular forces. The secrecy surrounding Wagner’s internal workings and how RIM and Rusich fit in with Russia’s irregular warfare missions has in turn frustrated attempts to establish the legal link between Russian paramilitaries and the Russian government agencies that hold state responsibility for the actions of covert paramilitary commanders. But Russia’s full-scale invasion of Ukraine has intensified the need to nail down the facts and to examine and expose the anatomy of Russia’s stealth mobilization of military cadres.

About a year after the State Department sanctioned RIM’s leaders, the risks posed by the U.S. government’s confusion over the connections between RIM, Rusich, and the Wagner Group became more apparent. In early January 2021, Rusich first signaled in a coded message posted on its Instagram account that it was preparing to infiltrate the eastern Ukrainian town of Kharkiv. It would take almost another year for U.S. intelligence agencies to reach consensus on the fact that Russia was planning to invade Ukraine. But according to field interviews we conducted in Ukraine, by early 2022 Rusich and hundreds of other RIM Partizan fighters linked to the Wagner Group had already quietly slipped over the border into Ukraine, preparing the way for Russia's offensive months in advance. As with al-Qaeda just before 9/11, the warning lights began blinking red months before Russia’s invasion of Ukraine, but it seemed few in Washington or Kyiv could see them very clearly when it came to the Wagner Group, RIM, and Rusich. Understandably, governments and the people who run them prefer to see direct causal links in order to justify action; however, especially in advance of a covert military or terrorist action, the reality can be perceived often only through the pattern of social markers that points to the kind of cohesive organizational structure required to perform lethal military tasks and missions.

The situation the U.S. faced in the years leading up to its decision to sanction RIM is not that dissimilar to the challenge the U.S. and its allies faced 25 years ago when only a handful of specialists seemed to have a clear understanding of the opaque cell-like structure of al-Qaeda. But a breakthrough came in the early days after the September 11, 2001, attacks by al-Qaeda on the United States, when Valdis Krebs, a pioneering American-Latvian social scientist, famously used social network analysis techniques to flesh out the leadership and command structure of those responsible for destroying the World Trade Center in New York.

It was with that 9/11 example in mind that New America set out with a team of experts in mathematics, computational social science, and area studies at Arizona State University to research the connections between Wagner Group fighters, the paramilitary group’s chief financier Yevgeny Prigozhin, and the Russian state. We started with a deceptively simple set of questions: What kind of people would be interested in joining up with an ill-reputed mercenary outfit accused of committing war crimes in multiple countries? Other than money and personal profit, what would motivate someone to join? From studying the demographics of Wagner Group fighters, what could we learn about the overlapping business and social ties between operatives and entities in Prigozhin’s employ? In other words, how “private” is Russia’s premier private military security company really? What evidence refutes or supports the repeated claims that the Wagner Group operates independently of the chain of command of Russia’s security agencies? What is the distinction between Russia’s army and a paramilitary staffed primarily by a group of graduates of government managed military auxiliaries and active reserves that draws heavily from Russia’s special forces? Is there a bright line between the command structure of the Russian army, the Wagner Group, and extremist paramilitary organizations like RIM and Rusich?

A day after a U.S. airstrike on a Wagner contingent, on February 8, 2018, the owner of a VKontakte account called the PMC Wagner-Military Review (ЧВК Вагнера – военное обозрение) uploaded a post headed with three words: “Who served where?” The post appeared alongside a statue of a Russian mercenary that has become an icon of the Wagner Group. “Looking for co-workers?” the post continued. “Tell us where you served – so it will be easier for your comrades to find like-minded people among this thread of discussions.”

Responses from more than 100 users appeared within a few hours, and at least 300 responded over the course of about six months. Several asked where they could sign up to fight as mercenaries. Other users directed them to call a number in St. Petersburg or travel to a Wagner Group base in the Russian military garrison town of Molkino—across from the GRU’s 10th Brigade headquarters, a convenient location for cross-training of units that belong to distinct detachment groups involved in supporting combined arms mission sets. Dozens more simply offered up the names or identification numbers for their current or former military units, the vast majority listing special forces detachments in Russia’s Airborne Assault (VDV) forces, the counterrorism wings of the Ministry of Internal Affairs (MVD) and the FSB, or the GRU, the Russian defense ministry’s equivalent of the U.S. Defense Intelligence Agency. Users named detachments that disproportionately represent motor rifle brigades composed of the most highly trained scout reconnaissance rangers, snipers, artillery specialists, and air defense troops, indicating that their purpose is to support offensive state-sponsored military action rather than defensive private protective services. Our findings chimed with what credible analysts like Columbia University’s Kimberley Marten already suspected about the Wagner Group—that it was a front for a quasi-governmental collective of active reservists in the Russian special forces operating covertly on contract outside of Russian territory.

With some 6,745 members subscribed to the PMC Wagner Group-Military Review VKontakte group in February 2019 and much of the data open to any member of the public, the Wagner-themed channel offered a rich target for sociological exploration, even more so when the number of subscribers nearly doubled to 12,508 by November 2019. The Wagner-themed channel showed an unusual amount of shared friendship ties between users and tight clusters of users who also shared membership in VKontakte channels associated with RIM and Rusich. Several of the most prolific commentators also subscribed to VKontakte channels that purported to be the official social media arms of Rusich and RIM. While we also observed significant overlap between members of those three channels and well-known transnational White supremacist organizations such as the Atomwaffen Division, a North American based neo-Nazi group, and Nordic Resistance, an extremist group originally based in Sweden, we decided to narrow our initial focus to Russia-based groups.

By 2019, significant reporting had uncovered the real-world ties between RIM’s armed wing, Rusich, and the Wagner Group and their overlapping operations in theaters such as Ukraine, Syria, and Libya. For example, Rusich commander Aleksey Milchakov worked as a Wagner operator in Syria, and Rusich members trained at the same St. Petersburg shooting range as the RIM’s Partizan training program. All three organizations fielded units central to Russia’s military operations in Ukraine since 2014.

Each paramilitary had their own dedicated social media channels on VKontakte. When we drilled down into roughly 18,000 user profiles that belonged to at least one of the three groups, we found a tiny fraction—31 users—subscribed to all three, but they shared significant demographic attributes, including most importantly a demonstrable record of fighting in combat zones where the Wagner Group is known to operate and service in Russian military-security units designated as predominantly contract-based. Known in Russian military parlance as kontraktniki, members of these units can be deployed outside of Russia under special circumstances defined in Russian national law; they are not, therefore, mercenaries fighting for profit of their own personal volition or a private company, but rather are compelled by force of law to follow the orders of Russian government agencies and their representatives.

While the strong ties between Russia’s most virulent ultranationalist extremist factions and their transnational influence were to be expected, one of most surprising discoveries was the high degree of centrality of a small group of users whose social ties and group memberships span the Wagner Group, Rusich, and RIM. These 31 individuals represent the proverbial needles in the Wagner Group’s massive online haystacks. The majority appear to be veterans of Russia’s expeditionary wars in Chechnya, South Ossetia, and Abkhazia and served as active Wagner commanders in Ukraine and other global hotspots like Syria. Despite a Russian law prohibiting Russian soldiers from holding social media accounts, their posts on VKontakte—profile photos, text posts, and videos—indicate that many of these veterans continue to take part in combat operations in the current full-scale invasion of Ukraine, while others have shifted into training or logistical roles. Out of the 31 profiles, 15 are private, banned, or deleted, suggesting that they are minimizing their online footprint. Some user profiles indicate ties to prominent ultranationalist figures such as Igor Girkin; one user is friends with Girkin's VKontakte account, while another appears in a photo with him. We labeled them the Wagner Group Field Commanders Echelon, and when we took a deeper dive into their background we discovered that most began their combat leadership role in the earliest days of the Russia–Ukraine conflict in 2014–2015.

As a group, these 31 individuals whom we initially identified in 2019–2020 represent the very heart of the group of pro-Russian Donbas combatants that coalesced on the battlefield as the first Minsk Protocol ceasefire agreement between Russia and Ukraine (Minsk I) collapsed in January 2015. Many appear to be drawn from pro-Russian separatist units led by Donbas-based commanders who at the time strongly objected to Moscow’s attempts to strike a bargain with Kyiv. Several of the 31 appear to have joined Wagner forces known in Russian-controlled parts of Ukraine as The Cleaners, a small cadre of contract-based Russian fighters credited in Russian ultranationalist social media channels with assassinating the rogue separatist Donbas commanders in early 2015. While this possible chain of events needs further verification, it suggests that Prigozhin served as Kremlin enforcer from the start. This aligns well with what is known about Prigozhin’s criminal past and business ties with St. Petersburg’s leading organized crime crews. Twice convicted for a string of violent crimes in the late 1970s and early 1980s, Prigozhin has longstanding ties to St. Petersburg’s most fearsome Russian mafia gang, the Tambovskaya Bratva (Tambov Brotherhood).

In 2022, about six months after the start of the Russian invasion of Ukraine, we conducted the same data analysis exercise: we sifted through a newly collected set of user profiles from the same three accounts for Rusich, RIM and the Wagner Group, and identified 53 individuals with similar profiles who were members of all three groups. The surprise? Only a fraction of the 31 users identified in the first tranche of data from 2019 appeared in the second tranche from 2022. We believe that this lack of overlap reflects several significant shifts in the way the Wagner Group operates.

The first notable change is the growth in numbers of users who share membership in all three VKontakte groups for Wagner, Rusich and RIM: a 41 percent increase between the first cadre we identified in 2019 and the cadre identified in 2022. Second, many more users in the overall set of VKontakte users we examined switched their privacy settings, making less information available to those who come across their profiles on the platform. This likely reflects greater Russian government scrutiny of social media use by members of the military following the Russian parliament’s 2019 passage of a law banning soldiers from carrying any device recording and/or storing information and from sharing information on the internet. Known as the “anti-selfie soldiers law,” the legal prohibition against members of the military exposing information on the internet was prompted by the repeated exposure of sensitive details by open source researchers at organizations like Bellingcat.

This marked change in user behavior between 2019 and 2022 underscores the importance of secrecy for operational security and the need to adopt online habits designed to resist outside surveillance. However, although the names and habits had changed, the pattern of military affiliation remained the same. The majority of those who fell within the new group of the 53 field commanders we were able to identify shared affiliation with military units known to be contract-based and composed predominantly of special operatives.

Our initial questions about the motivations and social ties of Wagner fighters had led us to a cadre of individuals who appeared to perform military tasks that were similar to that of Russian special forces field commanders. Moreover, the sheer volume of data they posted and the clues extant in both the content and the metadata of their posts in many cases allowed us to trace their movements in space and time in Ukraine and in some cases hotspots around the world. We decided, therefore, to focus on analyzing user profile information and demographics that might reveal more about the strength of network ties between the Wagner Group, Rusich, and RIM. With this in mind, we plunged into the task of collecting, cleaning, aggregating, and analyzing several dozen terabytes of publicly available user data from the three largest VKontakte groups for the three organizations: the PMC Wagner-Military Review (ЧВК Вагнера – военное обозрение) with 254,398 members as of September 2022, Russian Imperial Movement or RIM (Русское Имперское Движение) with 21,196 members, and DShRG Rusich (ДШРГ Русич) with 10,139 members. We had continually collected user profile information across all three groups from 2019 to 2022, and analyzed data samples culled on four separate occasions: November 2019, March 2020, January 2021, and September 2022, just as news broke that Russia’s president Vladimir Putin had called for a partial mobilization of 300,000 conscript troops. In 2019–2020, we were able to collect information on the full membership of all the groups; in September 2022, we were able to collect data on the full membership of the RIM and Rusich groups but only 9 percent of the PMC Wagner-Military Review group, which had changed their privacy settings in the lead up to and immediate weeks after the start of Russia’s invasion of Ukraine.

The user profile data is self-reported, with all the limitations that entails. We took for granted that some user profiles were probably entirely falsified. We were, nonetheless, able to eliminate duplicate accounts and verify the identities of hundreds of users by comparing their details with other datasets and triangulating self-reported profile information, geocoded image posts, the strength of network ties, and other open source records such as tax identification and corporate registry numbers. We discuss the details of our methods and their limitations, data wrangling challenges, and our further findings in the annex for this series of reports.

The self-reported demographic information paints a picture of a user base that skews largely male, middle-aged, well-educated, politically conservative, abstemious in personal habits, and based in Russia. The vast majority of users identified as male, with females less than 6 percent of the member base for Rusich, 10 percent for PMC Wagner-Military Review, and 18 percent for RIM.

Average and median ages for all three groups were in the 30s and just barely into the 40s; the Rusich group was the youngest with a median age of 31 and Wagner the oldest with a median age of 37. This common age marker could stem from the fact that most contract-based soldiers in Russia’s active military and most contract soldiers categorized as reservists would have had to serve for several more years after a first term as conscripts, which is compulsory for all Russian men once they reach the age of 18.

Within Russia, member locations broadly trace population concentrations with significant clusters near major urban centers such as Moscow, St. Petersburg, and Yekaterinburg, and far fewer members located in Siberia and Russia’s Far East region. Another concentration of members can be found along Russia’s southern border in the North Caucasus and Rostov Oblast, which borders Ukraine. Outside of Russia, the widespread distribution of members is striking, with 177 countries represented in the data.

Across the three groups, members reported large and roughly equivalent percentages (between 41 and 57 percent) in university and work, while very few listed themselves as in school. Few members provided their level of education, but those who did listed advanced degrees at higher rates than the Russian population as a whole, between 67 percent (Rusich) and 75 (PMC Wagner-Military Review), in comparison to 29 percent of Russians aged 25–64 in 2018.

Self-reported religious orientation was far more uniform than political orientation, with a very large Orthodox majority: about 77 percent (PMC Wagner-Military Review), 78 percent (Rusich), and 89 percent (RIM). The data on how those numbers stack up compared to the Russian population as a whole is inconsistent. Polling data from a variety of sources such as the Pew Research Center indicates that the number of Russians who identify as Christian Orthodox has risen over time from 1991 to 2014, with some 72 percent polled indicating allegiance to Russia’s main religious institution. All three groups also included several users who claimed to practice Rodnovery, a neo-pagan religion that overlaps with Slavic ethnonationalism. Politically, all three groups skewed to the conservative, ultraconservative, and monarchist side of the political spectrum, with nearly 50 percent of the Russian Imperial Movement group identifying as monarchist—unsurprising, given that RIM explicitly seeks to restore the Russian monarchy. Smaller percentages, between 3 and 16 percent, selected a hodgepodge of views—communist, socialist, apathetic, and liberal; libertarian was the least popular, with under 2 percent from each group. Of the three groups, PMC Wagner-Military Review had the highest percentage of users identifying as liberal or moderate.

In a country where, according World Health Organization estimates, one in five men dies from alcohol-related reasons, members of all three groups expressed negative views of alcohol: between 39 percent (Wagner) and 58 percent (Rusich) listed negative or very negative views; only 6–7 percent of group members claimed positive views. Similarly, group members took a dim view of smoking: 56 percent of PMC Wagner-Military Review members expressed a negative or very negative view and only 8 percent expressed positive views.

Although this data does not necessarily represent the group as a whole, the pattern that emerges is nonetheless striking. Taken together, the typical user of these VKontakte groups is a man in his mid-30s with Orthodox and conservative political views, who eschews smoking and drinking, who either studies at a university or works, and likely possesses a bachelor’s degree or higher. This does not evoke a mass of discontented, disorganized youth called to join a private security company that fights under contract in foreign lands for the highest bidder; it speaks more of a disciplined military fighting force, ready to perform missions that take them deep behind enemy lines and to operate covertly in territories that are not fully under Russian or allied control.

VKontakte allows users to list their military service, but the field is not standardized, so the information varies widely. Many leave this section blank, while others provide sarcastic descriptions such as “sofa troops” or fictional organizations from movies or video games. Those who list existing or historical military units often write the unique identification number rather than the name of their unit. To analyze patterns of military service, we standardized 2,037 inputs from members of the three groups, sorting units into existing, historical, or fictional categories, and identifying the full name and location of existing and historical units whenever possible. This resulted in a dataset of 956 unique entries for 1,547 individuals.

While this sample is extremely small, it is fascinating because it shows exactly what we would expect in terms of the distribution of military units for a rapid reaction military force designed for insertion into foreign conflict. It reveals a potential pattern of recruitment that prioritizes specialized areas of military expertise such as air defense, artillery operations, communications, sabotage, or reconnaissance. Each military unit also carries with it a distinct culture and history, and each unit also, of course, has a command structure that is well documented. The location of the self-reported military units listed also points to the type of equipment that potential and actual Wagner Group operatives have trained on, and how their training and military experience fit into the overall Russian order of battle.

While the war in Ukraine has done much to expose some of the previously hidden contours of the Wagner Group’s structure and role, the additional sources of data we have analyzed—such as user profile information and metadata culled from social media platforms and mobile devices used by Wagner Group fighters—paint a much clearer picture of potential and actual points of coordination between Russia’s regular forces and irregulars like the Wagner Group on everything from logistics to targeting and missile launches. The small size of the data sample has limitations, as we discuss further in the annex of this series, and self-reported membership in a particular military unit is not proof of command structure. But the table of organization and equipment (TOE) associated with each military unit listed comes with its own distinct signature, and when viewed in aggregate and cross-referenced with other sources of information about real-time battlefield maneuvers, mobilization orders, and even more obscure data points such as casualty reports, business interests, and the placement of weapons platforms that can be identified by remote sensing tools like satellite imagery, a picture emerges of the military experience of Wagner Group soldiers and fans that can deliver unique insights into Russia’s strategy.

Group members claimed service in a wide variety of units both within and outside the Russian Federation. However, the overall dataset showed higher concentrations among Russia’s Airborne Assault Forces; special operations or spetsnaz units, particularly those associated with the GRU (Russia’s Main Intelligence Directorate); motorized rifle units; internal troops of Russia’s Ministry of Internal Affairs (MVD) and the National Guard (Rosgvardia); and missile and artillery units. This pattern points to the “tip of the spear” role of irregular forces that fall under the Wagner Group banner.

Many of the spetsnaz units listed by users in our dataset have historically fought deep behind enemy lines in other conflicts. They have a tradition of employing deception techniques to sow confusion and to draw enemy attention away from the primary military objectives of a campaign. Much like U.S. army’s special forces Green Berets, Russia’s spetsnaz forces are highly revered in both military and civilian life for their warrior spirit, stealth, and unconventional way of operating. As a result, over the years spetsnaz operatives serve a kind of cultural touchstone for Russian patriotism, and they have periodically been glorified in movies and TV series. Since Russia’s annexation of Crimea, spetsnaz have enjoyed a kind of cultural revival, which has only grown along with the rising profile of the Wagner Group. The high prevalence of such units in the data suggests at minimum a measure of symbiosis between the Wagner Group brand and Russia’s real world special operatives.

Several units identified in the dataset were linked to atrocities committed in Ukraine since February 24, 2022. For example, a December 2022 report by the Office of the High Commissioner for Human Rights identified several Russian military units that operated in Bucha in March 2022, when Russian forces massacred hundreds of Ukrainian civilians and prisoners of war. The report names six military units that appear in our dataset: the 104th, 234th, 137th, and 331st VDV regiments and the 45th and 14th Special Purpose Brigades of the GRU. A December 2022 article in the New York Times specifically identified paratroopers from the 234th VDV regiment as killing dozens of civilians in Bucha.

Ukrainian prosecutors also named Wagner Group fighters as committing war crimes in the rural town of Motyzhyn, not far from Bucha and about a 45 minute drive west of Kyiv. Three of the Russian paramilitary fighters charged reportedly served in the 37th Separate Motor Rifle Brigade and fought in first wave of clashes in Donbas starting in 2014 before going on to fight in Syria and then returning as part of the first wave of Russian troops to invade the Kyiv region in 2022. Witnesses we spoke with in Ukraine described the extrajudicial killings of several local villagers, including the town mayor and her family; they also described several of the perpetrators as Buryat, an ethnic group that is predominant in the brigade, whose headquarters is located in Siberia. One user in our dataset listed the 37th Separate Motor Rifle Brigade in his profile information.

When we focused on the most frequently cited units, what appeared in our dataset was a short list of the most elite expeditionary units in the Russian military. Six of the top 10 most frequently cited units belonged to Russia’s Airborne Forces, or VDV, most commonly the 104th Guards Airborne Assault Regiment, part of the 76th Guards Air Assault Division, based in Pskov, and the 45th Separate Guards Special Purpose Brigade, a VDV reconnaissance and special forces unit garrisoned near Moscow that reports operationally to the GRU and was implicated in atrocities in Ukraine. Overall, 92 group members listed service in the VDV, or 5.9 percent of the total that we were able to collect and analyze.

Rounding out the top 10 were two GRU special forces units and two motor rifle brigades. Nearly every known special forces unit under the command of the GRU appears in the dataset, including the 16th Separate Special Purpose Brigade (6 members), the 12th Separate Special Purpose Brigade (5), and the 10th Separate Special Purpose Brigade (3), which occupies a garrison adjacent to the Wagner Group’s primary training facility in the town of Molkino. Altogether, 28 group members (1.8 percent) listed military service in a GRU spetsnaz unit. Most of the GRU units listed in this group served on the frontlines of Russia’s expeditionary or peacekeeping operations in Chechnya, Tajikistan, Kosovo, and disputed territories in Georgia, and have frequently been called on to operate in high-tempo situations.

Motorized rifle troops appeared in the dataset at the highest rate with 126 occurrences, or 8.1 percent of the total. The most commonly mentioned motorized rifle unit was the 136th Separate Guards Motor Rifle Brigade, which is garrisoned in Buynaksk, Dagestan, followed by the 138th Separate Guards Motor Rifle Brigade, garrisoned in Kamenka, Leningrad Oblast.

Internal troops of the MVD and its successor the National Guard, are listed by 52 group members (3.4 percent). In 2016, internal troops were separated from the MVD to form the National Guard, or Rosgvardia, units of which have fought in Ukraine since the earliest days of the 2022 invasion. Both are domestic security forces with a wide range of capabilities, including special forces units.

Another concentration of units consisted of missile and artillery troops, with 104 members or 6.7 percent of the total. Units with multiple members included the 54th Guards Order of Kutuzov Rocket Division, the 721st Training Center of the Main Rocket and Artillery Directorate, and the 90th Interspecific Regional Training Center of the Strategic Missile Forces, which are known for training officers, warrant officers, sergeants, and specialist soldiers, as well as training units and subunits in mastering new equipment such as satellite-linked weapons platforms and networked communications capabilities.

Special forces units appeared frequently in the dataset, most prominently special forces units of the VDV and GRU, followed by special forces units across the Russian military and National Guard, including the National Guard’s Vyatich detachment, a special forces unit formed in 1998 and active in the Second Chechen War. In addition, several non-Russian special forces units appeared such as Belarus’s 5th Separate Special Purpose Brigade.

Russia’s armed forces are divided administratively into five geographic districts, which authorities have periodically restructured since independence in 1991. In 2010, Russia reduced its military districts to four, the Western, Central, Southern, and Eastern Military Districts; in 2021, Russia added the Northern Military District. At 48 percent, the plurality of Russian units in our dataset were located within Russia’s Western Military District. The other four districts in order of size were Southern (17 percent), Central (14 percent), Eastern (13 percent), and Northern (8 percent).

While the majority of military units were within Russia, a significant number were outside, especially in former Soviet nations, including Soviet units that were either disbanded or transferred to post-Soviet states, for example, the 103rd Separate Guards Airborne Brigade, a formerly Soviet unit that transferred to Belarusian control in 1992. The top non-Russian countries were Ukraine (30 percent of units based outside of Russia), Germany (11 percent), and Belarus (10 percent).

Many units were also located in frozen conflict zones, where competing claims of sovereignty, self-determination, and allegiance with Russia have stalemated, and in overseas Russian bases or in territories that Moscow has illegally annexed. Many of the units are in Crimea or the Donbas region, territories that Russia claims, and several other units were in Russia-backed unrecognized states such as Abkhazia and South Ossetia, which most nations consider part of Georgia.

Outside of Russia, Germany claimed the second-highest number of military units listed by users after Ukraine, but most were historical units under either Soviet or Nazi control during WWII, likely as an expression of neo-Nazi beliefs and a coded reference to the Wagner Group’s thinly disguised emulation of Nazi Germany’s Einsatzgruppen death squad paramilitary forces, led by General Eduard Wagner. The references may be a coded sign of loyalty, since Prigozhin notoriously plays the role of go-between for the Kremlin with frontline irregulars, as Eduard Wagner did for Hitler. Harkening back to the glory days of World War II on both the Soviet and Nazi sides of the conflict is a regular feature of member profiles in all three VKontakte groups.

Four members named existing units in the United States, two in the 75th Ranger Regiment Special Troops Battalion, one in the 3rd Battalion of the 5th Special Forces Group, and one at Marine Corps Base Camp Pendleton. This last user appeared to be an active duty member of the Marine Corps; the other three posted content that contained Russian and American military jargon and references, but we were unable to verify the full details of their backgrounds before the release of this publication. Still, the presence of American service members in our dataset, and the clear links between these users and RIM specifically is a worrying sign of the appeal that White supremacist extremist organizations hold for young fighting age men and women who are thousands of miles away from Russia. Much like al-Qaeda or the Islamic State of Iraq and Syria (ISIS), RIM seems to be following a similar path of building an online recruitment mechanism in parts of the world where their influence is not well monitored or understood by law enforcement agencies. This is visible from the concentration of users who listed the names of military units based in locations outside of Russia.

As long as the Kremlin maintains the ability to mask its relationships with paramilitaries like the Wagner Group, our vision of them will be fogged, incomplete, and often based on anecdotal evidence. This has dangerous implications for the ability of U.S. and allied forces to cope with the element of strategic surprise that comes packaged with Russia’s use of irregular paramilitary formations. It also could complicate future efforts to bring Russia to account for atrocities committed in Ukraine and other conflict zones where the Wagner Group and comparable Russian paramilitaries operate.

For nearly a year after hundreds of masked men wearing green army uniforms with no insignia stormed the Parliament building in Crimea in February 2014, Russian government officials insisted that the mysterious cadres bore no official connection with Russia’s military. The phrase ikh tam nyet—Russian for “they’re not there”—was repeated so often by Russian state media outlets that it became one of the most popular hashtags among Russian and Ukrainian speakers on social media. The Russian government’s insistence on maintaining plausible deniability for the actions of Russian paramilitaries made it difficult to attribute actions to actors; in particular, it obscured who was in the Wagner Group and who was simply a “volunteer” drawn from cadres deployed by RIM and Rusich.

From the outset of Russia’s first incursion in Ukraine, it was commonly assumed and widely reported that many Wagner Group soldiers were either retired veterans or active military reservists recruited from the upper echelons of Russia’s spetsnaz special forces units; the group’s titular field commander Dmitry Utkin reportedly served as an officer with a unit in the GRU. The connection between Wagner and Russia's secretive special forces was further buttressed by a combination of insider and eye-witness field accounts and intercepted calls between Utkin, Prigozhin, Wagner Group commanders, and GRU officers. Evidence suggested that many who joined the Wagner Group came from rust belt towns in Russia where economic prospects were limited, but most of the available evidence was largely anecdotal. At no small risk to their safety, Russian, Ukrainian, European, and American journalists and independent investigators have surfaced substantial evidence pointing to the profit motives of those who finance paramilitary operations and those who join the Wagner Group’s ranks. For several years after the Wagner Group appeared on the scene, it was widely reported that most who agreed to fight were common mercenaries and that many were seasoned Russian military veterans who operated under the singular supervision of Dmitry Utkin, long touted as the titular commander of the Wagner Group. Yet little was specifically known about Utkin’s management remit or how Prigozhin, a caterer turned billionaire entrepreneur, was able to recruit and mobilize the thousands of contract soldiers reportedly in his employ. As tantalizing as these clues were, they only provided a partial and mostly anecdotal glimpse into the inner workings of the Wagner Group. When it came to tracing the command structures of Prigozhin’s paramilitary, much was left to the imagination or in rare cases pure speculation without hard evidence.

Our information will likely always be incomplete, but it need not be anecdotal. What we’ve learned from a systematic analysis of publicly available data is that there are indeed patterns of attributes that point to a command structure and an intentionality behind the recruitment and mobilization of irregular forces that are likely under the overall control of Russian security agencies and the Kremlin. This finding could have important implications for future efforts to bring Wagner Group and Prigozhin to account for atrocities committed in Ukraine and elsewhere. But it is only a beginning and more information will come to light as details about the Wagner Group, Rusich, and RIM’s efforts to fundraise and to spur equipment donations begin to spill into public view.

It is well documented that the Russian government has invested heavily in the expansion of its information warfare capabilities over the last decade. During that time Yevgeny Prigozhin, the Kremlin’s top propagandist, has often played the role of the generalissimo of spin. His success in selling the world on the Russian way of war is as much a measure of his advertising skills as it is of the strength of Putin’s militarist revival. What the data tells us is that despite Prigozhin and the Kremlin’s best efforts to mask the connections between Russia’s military and shadowy paramilitaries like the Wagner Group, patterns are discernible and distinct. Seeing through the shadows and tracing the Wagner Group’s networks is far from a straightforward or easy exercise, but it is a necessary step for containing the threat they pose.

Motivations

The Wagner Group represents one of many methods that Russia has deployed to influence the perception and behavior of the United States and its European allies in NATO. Since the Russian annexation of Crimea in 2014, a considerable amount of ink has been spilled on cyber operations and influence campaigns. In Russian military doctrine, informatsionnaya voyna, or information warfare, is cast as a set of operations conducted in both times of armed conflict and peace. As Russia scholar Keir Giles has pointed out in numerous publications on the subject, information warfare covers a range of activities, including stealing, planting, interdicting, manipulating, distorting and destroying information. Venues for information operations include all manner of networked technologies, including computers, mobile phones, tablets, television, and derivative applications such as social media platforms, text messages, encrypted chat applications. In military strategy, the foremost goal of information warfare in all of its forms is to influence the behavior of rivals and to induce misperceptions of facts and circumstances that in turn lead the target of an information operation to make decisions that are disadvantageous to achieving victory in a conflict or competition scenario.

The war in Ukraine is a tragic illustration of the costs of the international community’s failure to meet the moment when it comes to addressing the harms precipitated by the deployment of irregular proxy forces and the lack of global cooperation on governance of digital technology. Russia has proven itself to be very adept at exploiting weak cyber security standards and the poor platform management of U.S. and internationally based companies while Washington and Brussels have consistently struggled to come up with an effective response. Meanwhile, Russia’s insertion of irregular forces in the pay of Kremlin-connected oligarchs into the embattled Ukrainian region of Donbas during both phases of its incursions in 2014 and 2022 has tested the limits of European Union resolve and shaken NATO to its core.

Moreover, as recently documented by the U.K. Parliament and the U.S. Senate, online disinformation campaigns run by the Internet Research Agency, a St. Petersburg based company managed by the Wagner Group’s chief financier Yevgeny Prigozhin have undercut public faith in democratic institutions in countries around the world. In Syria, Libya, Sudan, and the Central African Republic, firms and individuals linked to Prigozhin and under contract with Russia’s security ministries have sown discord and actively participated in battle. Russia’s active measures online and off have also fueled deep political fissures within a range of European, African, Middle Eastern, and Latin American countries where the U.S. has a strong interest in maintaining political stability.

Researchers like Renee DiResta and Ben Nimmo, have documented Russia’s exploitation of racial divisions in America in its online influence campaigns during the 2016 U.S. presidential elections and 2018 Congressional elections. A good deal of published analysis has focused on Russia’s targeting of the Black community in America through online platforms such as Facebook and Twitter. Yet, despite substantial evidence of linkages between Russia’s information warfare campaign and the global rise of ethno-centric authoritarianism there has been very little study of how the alt-tech movement in North America connects with racially and ethnically motivated transnational social movements like the Russian Imperial Movement and paramilitaries like Rusich and the Wagner Group. There is also little data driven research on the transnational online flow of ideas, tactics, influences, and social ties that crisscross White supremacist nationalist movements that today spans several continents. Our Uncovering the Wagner Group series is an attempt to address that gap, and our work in this vein is ongoing.

Methods

Until recently, the breadth and depth of Russia’s active measures campaigns have often been difficult to track. But advances in digital forensic investigation, machine learning, and applied social science methods makes it possible today to shift from the merely anecdotal to the empirical. Information collected over the last five years as part of a joint research enterprise between New America and its partners at Arizona State University, includes several terabytes of social media data gathered from accounts of individuals affiliated with Wagner Group fan clubs, adherents of the Russian Imperial Movement, Rusich and related identitarian paramilitary groups such as the Nordic Resistance Movement, Atomwaffen Division as well as White supremacist internet platforms like Iron March and Fascist Forge.

The complex social networks underlying Russian identitarian and militarist social movements represent an increasingly common organizational form that challenges previous theory and methods for understanding social movements and their communication behaviors. On the surface, they appear to lack the administrative hierarchies of traditional organizations. Online social networks likewise frequently reflect the “flat” nature of these social movements. Almost by definition online social networks also typically defy real-world geographic boundaries. Where natural boundaries do exist, it is often most evident in the cross-platform and/or cross-site propagation of ideas in the form of narratives, messages, and memes. This is why we chose to first focus on Vkontakte, one of Europe’s largest social network platforms, as one of the first vectors of our research. We have deployed Geographic Information Systems (GIS) tools, large-scale text and metadata analysis, ethnographic methods, and open-source verification techniques to unearth our findings.

Our research methods reflect the interdisciplinary nature of our team. With the aid of students and faculty at ASU’s Data Mining and Machine Learning Lab and the Center on the Future of War we initially employed a variety of scripts and tools to mine, clean, and classify data into different categories. Collaboration with faculty and students at ASU’s School for Complex Adaptive Systems and School of Social and Behavioral Sciences has been crucial for advancing our understanding of how social network analysis methods can deliver insights into connections between real and virtual social movements. Support from the Melikian Center for Russian, Eurasian, and Eastern European Studies and the Howard Center for Investigative Journalism at ASU has been invaluable for project leads at New America.

Data Sources

Our primary sources of data for this series and our prior research on war crimes committed by the Wagner Group consist of three VKontakte groups associated with real-world Russian units that have been involved in Russian-Ukraine hostilities since 2014. The first of these, PMC Wagner-Military Review, was created on January 15, 2018, and is one of the oldest and largest VKontakte groups associated with the Wagner Group. The second, Russian Imperial Movement, is its namesake’s official home on VKontakte and was created on October 17, 2010. The third, DShRG Rusich, was created on November 7, 2022.

Beginning in late 2018, Future Frontlines began monitoring and collecting user data from the above groups, as well as a significant number of associated VKontakte groups. The months of the four largest collections were November 2019, March 2020, January 2021, and September 2022. During the 2019-21 period (“Wave 1”), we were able to collect the complete member base of each group, yielding a total of 18,021 user profiles collected with some overlaps due to individual users belonging to multiple groups.

It is important to mention a few caveats and limitations up front. The reliability of social media user profile information and associated content as a barometer of real world phenomenon is and will continue to be hotly debated. Self-reported user profile data can easily be faked and content can be spoofed. The shape of that debate over reliability is also in part informed by platform design features and content management standards that are often made intentionally opaque by the companies that run social media sites. Scholars of the Russian internet, or RuNet, and Russian media studies, have written extensively about the reliability of VKontakte, but few have ever openly questioned whether platform design quirks that leave VKontakte users especially vulnerable and visible might serve a secondary purpose in an information environment as restrictive as Russia’s.

Some VKontakte users seem to be aware of these deficiencies, however. For instance, the group account we drew on for Rusich is only the latest home on VKontakte. The group periodically abandons or deletes social media properties, then designates a backup account as their new home. Rusich’s current VKontakte group page uses the same URL and name as its former iteration, but as of February 2023 has fewer members than the former group did in October 2022. In addition to the current open DShRG Group, Rusich maintains on VKontakte a backup group and a closed “reserve” group. At least one of Rusich’s abandoned VKontakte groups remains online, albeit with all its content deleted.

During our September 2022 collection (“Wave 2”), we found that the PMC Wagner-Military Review group had changed its privacy settings, limiting the number of member profiles we were able to collect. We were ultimately able to collect 23,181, or about 9 percent, of the group’s then 254,398 members. However, we were still able to collect the complete membership of the Rusich and Russian Imperial Movement groups. Our final September 2022 collection yielded a total of 54,516 profiles collected across the three groups, again with some duplicates. A new phenomenon we encountered in the 2022 collection was a large number of private or deleted accounts, a sign that group members were taking steps to limit their exposure online.

Collected profiles varied widely in terms of available information. For example, only a minority of accounts—2,037, or 1,547 without duplicates—provided an entry for their military service record, equating to 3.7 percent of the 54,516 total. By contrast, 32,264 accounts listed at least a country for their location, 59 percent of the total. In most cases, we were only able to collect public profiles, not the growing number of profiles set to private. Therefore, it is highly likely that a larger percentage of our total collection did list their military service, but that information remains inaccessible.

In Wave 1, we noted 31 VKontakte users at the center of all three groups. In Wave 2, we found 53. However, we found no overlap between the two groups. This can be explained by two factors. First, as noted, we were only able to collect 9 percent of the PMC Wagner-Military Review group during our Wave 2 collection. Second, Rusich’s periodic deletions and reshuffling of their VKontakte groups means that the group’s membership base is constantly changing.

VKontakte user data was all self-reported and served as a starting point for further research, structuring, and verification. This posed a particular challenge for military unit service, as this field was not standardized, resulting in tremendous data variance. Many users simply listed their unit’s unique identification number; others referred to its garrison or nickname. To clean and structure the data, we employed a team of Russian-speaking researchers who used open source techniques to identify the full, formal name of units, whether they were existing, historical, or fictional, and their location. One limitation was the paucity of information available for some units, particularly historical units dating to the 90s or Soviet period.

For all the above and other reasons, we have been careful throughout to triangulate user profile data and content with other sources such as tax identification, corporate registration information, open source maps tools, internet archives, and local media sources.