The Code of the Underworld: Mafia-Like Conflict Hinders Russian War Effort

Discord among Russia's combat leadership reveals dysfunction in Putin's system of rule amid unpredictable events in China, Turkey and elsewhere.

May 17, 2023

As we hypothesized in our previous posting, Russia’s Victory Day saw several defeats (and some victories) for Putin’s government in the diplomatic and cyber realms. Continued conflicts among Russian fighting forces hint at deeper dysfunction in Putin’s mafia-like ruling system. In addition, ongoing developments involving Turkey, Belarus, China, and Africa may impact Russia’s war effort against Ukraine in unpredictable ways.

Losses and Wins for Russia

Victory Day Mostly a Washout

Vladimir Putin appeared to have little to celebrate on the May 9 Victory Day holiday.

The parade itself was more modest than in previous years, lasting only 40 minutes and featuring only one tank, which attracted derision from some commentators . Putin’s speech trotted out tired themes, saying the West had unleashed a real war against Russia. The leaders of seven former Soviet states—all five Central Asian states plus Armenia and Belarus--agreed, mostly at the last minute, to attend the parade along with President Putin. This suggests that Putin had to offer carrots or sticks to win their agreement. A May 6 assassination attempt against a nationalist Russian parliamentarian and social media influencer Zakhar Prilepin could hardly have improved Putin’s mood.

The ongoing strife among various groups of Russian fighters marred Victory Day itself. Putin’s speech listing groups of fighters for the motherland only briefly acknowledged various groups of volunteers, focusing mainly on the regular military and intelligence services. Wagner mercenary group chief Yevgeniy Prigozhin, as mentioned in our previous report, was not invited to bask in the pomp and circumstance of the parade; he released a video filmed in a drab room, denouncing the military leadership as traitors (more on this below).

Cyber Losses and Wins

On the cyber front, Russia faced several embarrassments on and around Victory Day

The US Justice Department announced that the FBI had breached and incapacitated a network of compromised computers that the so-called Turla hacker group, likely affiliated with Russia’s Federal Security Service, was using for espionage.
On May 15, cybersecurity researchers at Blackberry released a report assessing that “a group working for the Russian government” likely stood behind attacks on Ukraine using the so-called Cuba ransomware. They came to this conclusion based on the timing of ransomware attacks aligning with the timing of political events. Other analysts have also relied upon timing and target selection to identify political motives behind seemingly criminal operations: Accenture Cyber Threat Intelligence in 2019 and in 2022, as well as Booz Allen Hamilton in 2020 and Microsoft in 2022.
On May 16, a US court unsealed an indictment against Mikhail Matveev, the suspect in attacks using Babuk ransomware, whose targets included the Washington DC Police Department, as described in our previous post. The US Treasury Department also sanctioned Matveev, and the US State Department announced a $10 million award for information leading to his arrest or conviction.

On the other hand, some events in the cyber realm could be viewed as wins for Russia, in that they aligned with Russian strategic interest and undermined Ukraine and its allies—although it is not clear that these incidents were directly affiliated with the Russian government. These included the following:

A long-running ransomware incident crippling local government and emergency systems in the city of Dallas, Texas prevented police from quickly checking their records on the man who carried out a mass shooting in a Dallas mall on May 7. The so-called Royal ransomware group that attacked Dallas has also targeted health-care and other critical US infrastructure. It comprises former members of Conti, a well-organized Russia-based ransomware group, according to the late cybersecurity researcher Vitali Kremez. Conti leaders have cooperated with Russian intelligence services in the past, as we mentioned in a previous report. Russia-based extortion groups are aggressively pressuring their victims, such as by threatening to release sensitive student records or graphic photos of cancer patients, potentially eroding public trust in these essential services.
On the eve of Russia’s Victory Day, unknown actors obtained access to information assets at Dragos, a US-based industrial cybersecurity company, and reportedly stole intelligence reports and other data. “When Dragos did not respond to the extortion demands, the hackers began to target executives and their family members and others associated with the company.” Although the identity of the perpetrators is unknown, Russian cyber threat actors are among those who have an incentive to steal information from Dragos, which has repeatedly exposed Russian and other hackers in the past.
Also on the eve of Russia’s Victory Day, an apparent DDoS attack briefly disrupted access to the Japanese Justice Ministry and Immigration Services Agency websites. Threat actors claiming to be part of the Anonymous hacktivist movement claimed to have carried out the incident in retaliation for Japan’s immigration policy. Although the identity of the threat actors is unknown, sometimes state-linked hackers pose as idealistic hacktivists like Anonymous, and Russian hackers would have an incentive to carry out such an attack on Victory Day, as symbolic retaliation for Japan’s support of Ukraine and its stated intention to open a liaison office of the North Atlantic Treaty Organization (NATO) in Tokyo.

In other seeming wins for Russia, despite South African officials’ previous statements about having to arrest Putin due to an International Criminal Court warrant, South Africa’s top army general met in Moscow on May 15 to discuss military cooperation, and South African president Cyril Ramaphosa denied reports that South Africa had sent arms to Russia and implied that Putin would, after all, visit South Africa for a summit in August. Ramaphosa also offered to negotiate a peace plan between Russia and Ukraine.

The Front: Small Gains for Ukraine, Major Drama in Russia

Ukrainian cities withstood multiple Russian missile attacks in May. The fronts themselves have moved marginally, as Ukrainian forces made some small gains in the outskirts of Bakhmut while Wagner troops continued to grind their way across the city.

Disarray in the pro-Russian military forces continued in the days before and after Victory Day.

On May 5 mercenary chief Yevgeniy Prigozhin, citing poor support from Russia’s Defense Ministry, threatened to withdraw his Wagner forces from around Bakhmut on May 10.
In response, Ramzan Kadyrov, dictator of Russia’s Chechnya region, released a video pleading with Prigozhin to reconcile with the military—Kadyrov figuratively groveled by calling himself a “little brother” to Prigozhin--and he also offered to replace Wagner with Kadyrov’s own paramilitary forces.

On May 7, Kadyrov recorded another video, this time criticizing Prigozhin for arrogating credit for various victories in Ukraine. This video was less obsequious: Kadyrov referred to Prigozhin as “Zhenya,” the diminutive form of Prigozhin’s first name. According to Ukrainian media, Kadyrov said of Prigozhin, "I am sorry that my brother behaves like this....He, I and all of us were whipped into shape by one person — Vladimir Vladimirovich Putin, so we owe him our lives…Zhenya, you will be on the defense until we reach the positions. And when we start attacking, only then will we determine where you should go next. I am telling you by the code of the underworld....”
Also on May 7, Prigozhin eventually agreed to keep his troops fighting in Bakhmut, saying the military had promised to supply him with weapons.

On May 9 Prigozhin said Russia’s Defense Ministry had threatened to charge him with treason charges if he withdrew his troops from Bakhmut.
In the abovementioned Victory Day video, delivered from a drab room, Prigozhin denounced the bemedaled officers in the parade viewing stands on Red Square as traitors. He said, “Our soldiers are getting killed and the happy grandpa thinks he’s doing well....What will our country do… if it turns out the grandpa is a complete jackass?” Commentators suspected that he was criticizing Vladimir Putin himself, whom many people refer to as “Grandfather.” (Prigozhin later denied that had Putin in mind when he used this term). Since then, Ukrainian forces have made small gains in the region which nevertheless threaten to encircle the Wagner forces fighting in the city.

Prigozhin’s Power Grabs?

On May 14 the Washington Post, citing allegedly leaked US government documents, reported that that Prigozhin had reached out to Ukraine’s military intelligence agency in January and had offered to leak information on Russian troop locations to them in return for Ukrainian troops’ withdrawing from Bakhmut. According to the alleged documents, Ukrainian officials rejected this offer, which would have broken the spell of the rallying cry “Bakhmut holds!” If this account is accurate, it would show Prigozhin betraying the Russian state for which he claims to be fighting and arrogating to himself the power to negotiate with the enemy.

Mafia-Style Dysfunction

Prigozhin’s alleged dealing with the Ukrainian government, as well as his well-documented rivalry with Russia’s military, resembles a scene out of the mafia movie “The Godfather” rather than a state protecting its people. Prigozhin seemed prepared to make deals with Ukraine’s government as a mob boss might make a deal with another crime clan. Numerous analysts have characterized Russia’s ruling system as made up of “clans” or factions that use all available tools of power, including the judicial system, to compete for power and access to resources at the expense of Russian taxpayers. As stated in our first report, “Putin: The Spy as Hero,” Putin has been able to retain his power through a “protection racket” that keeps these subordinate clans at each other’s throats and reliant on him. This “overtly medieval system of mutual denouncement and competition,” in the words of Russian security analysts Andrei Soldatov and Irina Borogan, fulfills the role that the separation of powers and the system of checks and balances fulfill in other countries, as Russian political analyst Yuliya Latynina pointed out in 2010.

In the midst of a war, especially, this system is dysfunctional. As security analyst Mark Galeotti summed it up, “A culture of mutual suspicion, cannibalistic competition and opportunistic self-interest has kept Putin in power for more than two decades. . .In war, though, the need is for unity, discipline and mutual support – something the Ukrainians are displaying and the Russians clearly lack.” As of May 17, Putin’s press secretary has dismissed the reports of Prigozhin’s alleged treachery as falsehoods. Putin’s tolerance for Prigozhin, unpopular with other Russian elites, could turn into a fatal weakness, Galeotti noted.

Unsettling World Events

Russia’s domestic and foreign political battles do not take place in a vacuum. Events in other countries, such as Africa, Belarus, Turkey, and China, also could affect Putin’s government in unpredictable ways.

Central African Republic: Murder Mystery

A New York Times article from May 15 drew attention to the unsolved murder of nine Chinese employees of a Chinese-owned gold mine in the Central African republic. It cast suspicion of responsibility for the murders on Prigozhin’s Wagner mercenary group, as that organization has an extensive armed presence and military influence in the CAR. For its part, the CAR government cast blame on a local rebel group, but the New York Times noted that the execution-style killing is uncharacteristic of those rebels. The reports said the murders appeared intended as a statement and occurred on the eve of Chinese president Xi Jinping‘s visit to Moscow. A variety of entities might have an incentive to send a message discrediting Wagner, Russia as a whole, China, or political forces in the CAR or its neighborhood.

Though it does not prove the motive and perpetrators of this incident, the New York Times report does provide insight into Prigozhin’s political ambitions. A photograph in the article depicts demonstrators in the CAR in March with a banner that says in French,"Russia is Wagner. We love Russia and we love Wagner!" Given the broad reach of Prigozhin’s military and informational presence in this and other African countries, this banner likely reflects messaging he has been promoting there. This suggests that Prigozhin has cultivated an image of himself as a representative of the Russian state.

Analyses of Wagner’s activities in various African countries, such as guarding mines and providing protection and influence to local political factions, portray Wagner as receiving support from Kremlin-connected businesses. The recent hostilities between Prigozhin and Russian defense officials, however, raise questions over whether Prigozhin can use the political and financial resources he has amassed in Africa to pursue his own political power struggles within Russia. On the context and potential for power struggles in Russia to turn violent, see our “After Putin” report.

Belarus: Lukashenka’s Apparent Illness

Alexander Lukashenka (Lukashenko), the dictator of Belarus, appeared at the May 9 Victory Day parade looking very ill and sporting a bandage on his hand, leading to speculation that he was hiding an intravenous medicine drip. If Lukashenka were to die or become incapacitated, chaos could ensue with unpredictable consequences for Belarus and for Putin’s Ukraine war. Lukashenka faced massive opposition demonstrations in 2020 and was forced to accept Putin’s help in crushing them. Since then, Lukashenka has facilitated Russian troop movements against Ukraine but without committing Belarusian troops. He has resisted further integration of Belarus with Russia beyond the already-tight bonds of their so-called Union State. It is unclear whether Lukashenka has groomed one of his supporters as a successor. His potential incapacitation could set off a succession struggle, possibly involving the return from exile of Belarus’ main opposition leader, Svetlana Tikhanovskaya.

Turkey: Elections

Meanwhile, in Turkey’s May 14 first-round presidential vote, neither incumbent president Erdogan, nor his main rival, Kemal Kilicdaroglu, earned over 50% of the vote in the presidential race, making a runoff ballot on May 28 all but certain. (Reports of irregularities and violence at some voting precincts could raise questions about the initial vote totals).

Russia has a strong interest in the election. Erdogan has a mixed record on support for Ukraine. Although a member of NATO, Turkey has helped Russia evade sanctions and has cooperated with Russia in the gas and nuclear energy fields. However,Turkey has also played the role of an intermediary, such as by negotiating deals to allow the export of Ukrainian grain through the Turkish-controlled Straits. Putin therefore has a motive to support Erdogan; indeed, some Turkish media have claimed that Russia attempted to sway previous elections in Erdogan’s favor. On May 11, 2023, Kilicdaroglu accused Russia of interfering in this election with “montages, conspiracies, deep fakes and tapes,” apparently referring to a compromising video that had forced a third candidate, Muharrem Ince, to drop out of the race. (Ince himself blamed a different group for the smears. Several Turkish opposition media outlets also reported that unnamed actors carried out cyber attacks on their websites—presumably referring to distributed denial-of-service (DDoS) attacks--on election day.

A fourth Turkish candidate, Sinon Ogan, earned about 5% of the vote in the first round. It will be his followers whom Erdogan and Kilicdaroglu must win over by May 28, and he thus could serve as a kingmaker. Ogan knows the former Soviet region well; he was born in Azerbaijan and attended school in Russia. Whichever candidate wins in the runoff election., Turkey’s policy could well continue to triangulate between Russia and the West. Kilicdaroglu, although he promises to be a less dictatorial president than Erdogan is, has also said he will maintain trade ties with Russia. His tweet denouncing the alleged Russian deepfake campaign captured this ambivalence; he said, “Dear Russian friends....If you want our friendship after May 15, get your hands off the Turkish state. We are still in favor of cooperation and friendship.”

China: Peace Plan and Central Asia Summit

When a top Chinese diplomat met with US national security adviser Jake Sullivan in Vienna on May 10-11, they discussed at length the prospects for a settlement of Russia’s war on Ukraine. A Chinese envoy is in Kyiv and Moscow the week of May 15 to discuss peacemaking. According to Washington Post columnist David Ignatius, "U.S. officials expect that China’s role won’t be as a mediator but a check on Russia’s actions. If Xi decides it’s time for this war to end, Putin has few alternatives. That’s why the Kremlin is said to have viewed last week’s Sino-American engagement with dread." Chinese officials have reportedly weighed the pros and cons of continued war in Ukraine, and the argument that the war “strengthens America’s alliances in Europe and Asia and creates long-term trouble for China... is gaining force in Beijing," Ignatius says.

In another sign of China seeking a greater regional role, potentially at the expense of Russia, the leaders of the Central Asian countries, fresh from their last-minute attendance at the Victory Day parade in Moscow, plan to attend a summit in China on May 19-20. This suggests a desire to straddle both powerful neighbors in the region. The summit coincides with the meeting of the Group of 7 (G-7) meeting of industrialized countries that Japan hosts on May 19.

Conclusion

As Ukrainian President Zelensky tours European capitals, receives new pledges of support, and promises a military counteroffensive, Vladimir Putin has faced numerous setbacks in his war effort. Nevertheless, Russia’s defeat or collapse are by no means certain. Russia has been through long wars before and has “sources of resilience and continuity,” in the words of analyst Andrew Weiss, and Putin likely hopes to outlast the political will of Western countries to support Ukraine, as we have described previously. That resilience is being tested, and the mafia-style state that he runs may not be up to the task.

August 8: Slight edits were made in the text to clarify sourcing.