Russian Offensive Campaign Assessment, March 23, 2024

Click here to see ISW’s interactive map of the Russian invasion of Ukraine. This map is updated daily alongside the static maps present in this report.

Click here to see ISW’s 3D control of terrain topographic map of Ukraine. Use of a computer (not a mobile device) is strongly recommended for using this data-heavy tool.

Click here to access ISW’s archive of interactive time-lapse maps of the Russian invasion of Ukraine. These maps complement the static control-of-terrain map that ISW produces daily by showing a dynamic frontline. ISW will update this time-lapse map archive monthly.

Note: The data cut-off for this product was 1pm ET on March 23. ISW will cover subsequent reports in the March 24 Russian Offensive Campaign Assessment.

Russian authorities claimed to have arrested the four attackers and seven others involved in the March 22 “Crocus City Hall” concert venue attack, which Russian authorities reported killed at least 133 civilians. Russian sources claimed that the attackers entered the Crocus venue on March 22 and began firing machine guns at civilians at 19:55 Moscow time, reached the main auditorium by 20:03, and fled the scene in a car at 20:13 – conducting the entire attack and laying explosives that ignited the venue in only 18 minutes.[1] The Russian Investigative Committee and Moscow authorities reported that the attack killed at least 133 and injured at least 140 as of March 23, but this number may grow as Russian authorities find more casualties trapped under rubble in the concert hall.[2] The Russian Federal Security Service (FSB) reported that it detained four individuals it claims are the attackers in Bryansk Oblast on March 23 as well as seven others whose involvement is not yet specified.[3] Russian sources widely circulated geolocated footage of Russian security forces detaining four individuals alleged to be the attackers before they could flee near Kommuna, Bryansk Oblast (about 14km southwest of Bryansk City).[4] Russian authorities claimed that they detained two individuals in the vehicle that the four were driving and chased down two others who fled into the surrounding forest.[5] Russian sources also amplified footage of Russian security forces interrogating the individuals, all of whom either spoke little Russian or communicated with Russian personnel via translators.[6] Russian sources largely claimed that the attackers are all citizens of Tajikistan, and Russian Ministry of Internal Affairs (MVD) Spokesperson Iryna Volk claimed that none of the individuals whom Russian authorities claimed conducted the attack are Russian citizens.[7]  

ISW assesses that the Islamic State (IS) is very likely responsible for the Crocus City Hall attack. IS Amaq’s News Agency took responsibility for the attack on the night of March 22, claiming that IS fighters attacked a “large gathering of Christians” on the outskirts of Moscow, “killing and wounding hundreds and causing great destruction...before they [the attackers] withdrew to their bases safely.”[8] The Amaq News Agency later posted a blurred-out image of the four fighters who it claimed conducted its “fiercest attack in years” standing in front of an IS flag.[9] The Amaq News Agency announcement is consistent in terms of style, branding, and language with previous Amaq claims for other attacks. IS media organs make deceptive or false claims only ”infrequently” and carefully and try to maintain “high credibility” in their communiques in order to define clear ideological objectives and maintain fundraising streams.[10] IS propaganda enables the group to fundraise and disseminate its guidance to lower-level commanders and supporters--IS risks discrediting itself within the competitive Salafi-jihadi community by falsely taking credit for very high-profile attacks. The conduct of the attack itself is also consistent with previous IS attacks, including the 2015 Paris terror attacks.[11] The IS fighters in the Crocus City Hall and some of those involved in the 2015 Paris attacks exfiltrated the target and subsequently evaded security forces for a time.[12]

The Islamic State’s Afghan branch IS-Khorasan (IS-K) may have conducted the Crocus City Hall attack. This branch has conducted at least four high-profile attacks outside of central Asia in the last 18 months.[13] US Central Command Commanding General Michael Kurilla notably stated in March 2023 that IS-K would be able to conduct “external operations against US or Western interests abroad in under six months,” meaning that Western intelligence had already assessed that IS and IS-K would be able to field the capabilities for such external attacks by September 2023.[14] US intelligence most recently confirmed that IS-K was responsible for a bombing attack in Kerman, Iran as recently as January 2024, further highlighting IS external attack capabilities.[15] Allegations that the Crocus City Hall attack was a false flag operation are inconsistent with the evidence ISW has observed from the attack itself correlated with other reports of previous IS external attacks that ISW and CTP have covered since the emergence of the Islamic State, as well as the IS claim pattern following the attack.[16] It is also highly unlikely that IS would have conducted the attack on the orders of Ukrainian special services, which several Russian sources have alleged. Amaq News Agency is IS’s central media arm. IS would not falsely claim an attack that may have been conducted by one Christian state against another (or by the Kremlin against Russia’s own people in some sort of false-flag operation), because the implications of IS conducting an attack at the behest of a predominantly Christian country would damage IS credentials within the Salafi-Jihadi community.

The Kremlin nevertheless and without evidence quickly attempted to tie Ukrainian actors to the Crocus City Hall attack but has yet to formally accuse Ukraine of involvement in the attack. Russian President Vladimir Putin addressed the Russian public on March 23 and claimed that the attackers’ “contacts” had prepared a “window” for the attackers’ exfiltration across the international border into Ukraine (without mentioning how the attackers were supposed to get through the defenses the Russians have established along the border).[17] The Russian Federal Security Service (FSB) claimed that it apprehended the four attackers as they were attempting to reach their alleged contacts on the Ukrainian side of the border.[18] Russian Ministry of Foreign Affairs (MFA) Spokesperson Maria Zakharova falsely asserted that Ukraine has been spreading terrorism for the past ten years at the behest of the West and that this is why the attackers attempted to flee to Ukraine.[19] The Russians describe Ukrainian military strikes against legitimate targets in Russia as terrorism.[20] Russian State Duma Defense Committee Head Andrey Kartapolov claimed that Ukraine and its allies are the main “stakeholders” in the attack at the Crocus City Hall.[21] Kremlin officials likely aim to indirectly tie Ukraine to the attack to set conditions for information operations that seek to attribute the attack to Ukraine without having to issue an immediate official accusation. Russian opposition outlet Meduza reported that an employee at an unidentified Russian state-owned media organization stated that state-owned media received instructions from the Kremlin to emphasize the alleged “Ukrainian trace” in the Crocus City Hall attack.[22] Russian ultranationalists responded to these indirect accusations and explicitly claimed that Ukrainian and Western special services orchestrated the Crocus City Hall attack.[23] The Kremlin likely hopes that perceptions about Ukrainian involvement in the attack will increase Russian domestic support for the war in Ukraine, and the Kremlin may still issue an official accusation to this end if it believes that indirect accusations are insufficient to generate the domestic response it likely desires.

Russian ultranationalists responded to the attack by reiterating typically xenophobic calls for anti-migrant policies, reflecting the growing tension in Russian society over the mistreatment of migrants and the impacts migrant disenfranchisement could have on expanding a viable recruitment base in Russia for Salafi-Jihadi groups. Russian ultranationalists widely connected the attack to what they consider unfettered migration to Russia and the development of diaspora communities within Russia that they claim act as parallel societies.[24] Russian ultranationalists denied that their calls for stricter migration policies and the end of diaspora communities were ethnically motivated, and instead accused Ukraine and the West of selecting Tajik attackers specifically to foment further ethnic conflict within Russia.[25] The Russian ultranationalist community has made xenophobia and insecurities about Russia’s ethnic composition some of its key ideological principles and has increasingly used incidents involving migrants and non-ethnic Russian groups to express growing hostility towards non-ethnic Russians in Russia.[26] The ultranationalists’ attempts to frame the attack as a migration issue while warning against alleged Western attempts to foment ethnic tension are likely indicative of some awareness that further ethnic animosity could increase disenfranchisement and drive migrants towards various Salafi-Jihadi groups. Russia is currently conducting a force generation campaign that is alienating large numbers of migrants from economic and social life in Russia and making military service one of the few avenues for remaining in the country.[27] Russian force generation efforts and anti-migrant policies, an increasingly prominent ultranationalist movement that espouses xenophobic rhetoric, and an increasingly ultranationalist Kremlin that stresses the importance of Russian Orthodoxy in public life are likely further disenfranchising migrant communities and generating animosities that Salafi-Jihadi groups can exploit in recruitment efforts.

Russian sources accused Ukrainian actors of reportedly conducting a successful drone strike against a Russian oil refinery in Samara Oblast on the night of March 22 to 23. Footage published on March 23 shows a large fire and a smoke plume rising from the Kuibyshev Oil Refinery in Samara Oblast.[28] Russian sources claimed that Ukrainian forces successfully struck the Kuibyshev refinery and unsuccessfully attempted to strike the nearby Novokuibyshevsky refinery.[29] BBC Russian Service, citing sources within Ukrainian security forces, reported that Ukraine is implementing a “detailed strategy to reduce” Russia’s economic potential and that Ukrainian strikes on Russian oil infrastructure are part of this strategy.[30] Former US Army in Europe Commander Lieutenant General Ben Hodges stated on March 22 that Ukrainian strikes on Russian oil refineries have significantly impacted Russia’s ability to pay for its war effort and supply fuel to the Russian military.[31]

Russia is reportedly delaying the delivery of two S-400 air defense systems to India, likely due to limitations in Russia’s production of S-400 systems, an increased need for air defense systems to protect cities and strategic enterprises in Russia from Ukrainian drone strikes, and a reported souring of Russian relations with India. The Economic Times reported on March 20, citing unspecified defense sources, that Russian officials informed India that Russia will deliver two remaining squadrons of S-400 air defense systems by August 2026 after delivering three of the five squadrons that Russia reportedly agreed to deliver by the end of 2024.[32] The Economic Times stated that Russian officials claimed that they are unable to supply the S-400 systems on time due to the “developing situation” and “requirements” of Russia’s invasion of Ukraine. Ukrainian drone strikes against targets in Russia may be constraining Russian air defense systems and prompting the Russian military command to reallocate air defense systems to better defend Russian cities and strategic facilities.[33] Russia likely also has a limited number of air defense systems allocated for export and may be choosing to delay deliveries to India in favor of supplying more steadfast allies following India’s recent decisions to turn away Russian oil tankers over concerns about Western sanctions.[34]

Key Takeaways:

• Russian authorities claimed to have arrested the four attackers and seven others involved in the March 22 “Crocus City Hall” concert venue attack, which Russian authorities reported killed at least 133 civilians.
• ISW assesses that the Islamic State (IS) is very likely responsible for the Crocus City Hall attack.
• The Kremlin nevertheless and without evidence quickly attempted to tie Ukrainian actors to the Crocus City Hall attack but has yet to formally accuse Ukraine of involvement in the attack.
• Russian ultranationalists responded to the attack by reiterating typically xenophobic calls for anti-migrant policies, reflecting the growing tension in Russian society over the mistreatment of migrants and the impacts migrant disenfranchisement could have on expanding a viable recruitment base in Russia for Salafi-Jihadi groups.
• Russian sources accused Ukrainian actors of reportedly conducting a successful drone strike against a Russian oil refinery in Samara Oblast on the night of March 22 to 23.
• Russia is reportedly delaying the delivery of two S-400 air defense systems to India, likely due to limitations in Russia’s production of S-400 systems, an increased need for air defense systems to protect cities and strategic enterprises in Russia from Ukrainian drone strikes, and a reported souring of Russian relations with India.
• Russian forces made confirmed advances near Avdiivka and Donetsk City and in western Zaporizhia Oblast.
• Russian President Vladimir Putin signed a law on March 23 that will release individuals from criminal liability if they are called up for mobilization or sign military service contracts.

We do not report in detail on Russian war crimes because these activities are well-covered in Western media and do not directly affect the military operations we are assessing and forecasting. We will continue to evaluate and report on the effects of these criminal activities on the Ukrainian military and the Ukrainian population and specifically on combat in Ukrainian urban areas. We utterly condemn Russian violations of the laws of armed conflict and the Geneva Conventions and crimes against humanity even though we do not describe them in these reports.    

• Russian Main Effort – Eastern Ukraine (comprised of two subordinate main efforts)
• Russian Subordinate Main Effort #1 – Capture the remainder of Luhansk Oblast and push westward into eastern Kharkiv Oblast and encircle northern Donetsk Oblast
• Russian Subordinate Main Effort #2 – Capture the entirety of Donetsk Oblast
• Russian Supporting Effort – Southern Axis
• Russian Air, Missile, and Drone Campaign
• Russian Mobilization and Force Generation Efforts
• Russian Technological Adaptations
• Activities in Russian-occupied areas
• Ukrainian Defense Industrial Base Efforts
• Russian Information Operations and Narratives
• Significant Activity in Belarus

Russian Main Effort – Eastern Ukraine

Russian Subordinate Main Effort #1 – Luhansk Oblast (Russian objective: Capture the remainder of Luhansk Oblast and push westward into eastern Kharkiv Oblast and northern Donetsk Oblast)

Positional fighting continued along the Kupyansk-Svatove-Kreminna line on March 23, but there were no confirmed changes to the frontline. Positional fighting continued northeast of Kupyansk near Synkivka; northwest of Svatove near Tabaivka and Berestove; west of Kreminna near Terny and Yampolivka; and south of Kreminna near Bilohorivka.[35] A Ukrainian platoon commander operating in the Lyman direction reported that Russian forces in the area are conducting infantry-led “meat assaults” with small infantry groups and significant artillery, drone, and anti-aircraft support and conduct such assaults daily. The Ukrainian platoon commander noted that Russian forces occasionally conduct armored assaults in the Lyman direction and that Russian forces conducted a mechanized assault a few days ago with 10 armored vehicles, six of which Ukrainian forces destroyed.[36] Ukrainian military observer Kostyantyn Mashovets reported that Russian forces are attacking both Yampolivka and Terny with roughly a division’s worth of forces per settlement, including the 252nd Motorized Rifle Regiment (3rd Motorized Rifle Division, 20th Combined Arms Army [CAA], newly formed Moscow Military District [MMD]) and 254th and 488th motorized rifle regiments (both of the 144th Motorized Rifle Division, 20th CAA, MMD) in the Terny direction; and the 19th Tank Regiment (reportedly of the 67th Motorized Rifle Division, 25th CAA, either Central or Eastern Military District), 31st Motorized Rifle Regiment (25th CAA) and 272nd Motorized Rifle Regiment (47th Tank Division, 1st Guards Tank Army [GTA], either CMD or EMD) in the Yampolivka direction.[37]

Russian Subordinate Main Effort #2 – Donetsk Oblast (Russian objective: Capture the entirety of Donetsk Oblast, the claimed territory of Russia’s proxies in Donbas)

The Russian Ministry of Defense (MoD) claimed on March 23 that Russian forces captured Ivanivske (west of Bakhmut) as positional fighting continued near Bakhmut.[38] A prominent Russian milblogger amplified the Russian MoD’s claim and added the claim that Russian forces are still clearing Ivanivske and advanced west along the O0506 Khromove-Chasiv Yar highway and into the northeastern part of the Stupki-Holubivske-2 nature reserve northwest of Ivanivske.[39] ISW has not observed visual confirmation of the Russian seizure of Ivanivske or advances west of Ivanivske. Positional fighting continued northwest of Bakhmut near Bohdanivka; west of Bakhmut near Ivanivske; southwest of Bakhmut near Klishchiivka and Andriivka; and south of Bakhmut near Niu York.[40] Positional fighting also continued in the Siversk area northeast of Bakhmut near Rozdolivka, Vesele, and Spirne.[41] A Ukrainian battalion commander operating in the Bakhmut direction stated that Russian forces are conducting assaults using mechanized vehicles for fire cover and to transport infantry to the front line but noted that Ukrainian forces are able to inflict significant manpower and equipment losses on Russian troops.[42] The Ukrainian battalion commander reported that Ukrainian forces currently disable 60 to 70 percent of vehicles that Russian forces field in assaults near Bakhmut. Ukrainian military observer Kostyantyn Mashovets reported that elements of the Russian 98th Airborne (VDV) Division, 11th VDV Brigade, 102nd Motorized Rifle Regiment (150th Motorized Rifle Division, 8th Combined Arms Army [CAA], Southern Military District [SMD]), and a ”smattering” of Russian territorial forces are attacking in the Chasiv Yar direction and that elements of the 3rd Army Corps (AC) and former Wagner Group forces subordinated to the Russian 7th Volunteer Reconnaissance and Assault Brigade (Russian Volunteer Corps) are attacking near Klishchiivka and Andriivka.[43] Elements of the Russian 88th Motorized Rifle Brigade (2nd Luhansk People’s Republic [LNR] AC) continue operating near Klishchiivka.[44]

Russian forces recently marginally advanced west of Avdiivka amid continued fighting in the area on March 23. Geolocated footage published on March 23 shows that Russian forces marginally advanced to a windbreak south of Berdychi (northwest of Avdiivka) and in a field west of Tonenke (west of Avdiivka).[45] Russian milbloggers claimed that Russian forces also advanced northwest of Tonenke and north of Orlivka (west of Avdiivka), but ISW has not yet observed visual evidence of these claims.[46] Fighting continued northwest of Avdiivka near Berdychi; west of Avdiivka near Tonenke, Semenivka, and Orlivka; and southwest of Avdiivka near Pervomaiske and Nevelske.[47] Elements of the Russian 1st “Slovyansk” Brigade (1st Donetsk People’s Republic [DNR] AC) are reportedly fighting near Tonenke.[48]

Russian forces previously marginally advanced southwest of Donetsk City amid continued positional engagements west and southwest of Donetsk City on March 23. Footage published on March 11 and geolocated on March 23 indicates that Russian forces marginally advanced north of Novomykhailivka (southwest of Donetsk City), although these advances are likely not recent.[49] A Russian milblogger claimed that Russian forces advanced in the direction of Krasnohorivka (west of Donetsk City), although ISW has not observed evidence of this claim.[50] The Ukrainian General Staff reported that Ukrainian forces repelled Russian attacks west of Donetsk City near Krasnohorivka and Heorhiivka and southwest of Donetsk City near Novomykhailivka and Kostyantynivka.[51] Elements of the Russian 238th Artillery Brigade (8th CAA, SMD) are reportedly operating near Krasnohorivka.[52]

Positional engagements continued in the Donetsk-Zaporizhia Oblast border area on March 23, but there were no confirmed changes to the frontline. Positional engagements continued south of Novodarivka (southeast of Velyka Novosilka), near Urozhaine and Staromayorske (south of Velyka Novosilka), and Vodyane (southwest of Velyka Novosilka).[53] Elements of the Russian 37th Motorized Rifle Brigade (36th CAA, Eastern Military District [EMD]) are reportedly operating in the Shakhtarske direction (Donetsk-Zaporizhia Oblast border area).[54]

Russian Supporting Effort – Southern Axis (Russian objective: Maintain frontline positions and secure rear areas against Ukrainian strikes)

Russian forces recently advanced in western Zaporizhia Oblast amid continued positional fighting near Robotyne and Verbove (east of Robotyne) on March 23.[55]  Geolocated footage published on March 23 indicates that Russian forces recently made a marginal gain west of Verbove.[56] The spokesperson for a Ukrainian brigade operating in the Zaporizhia direction stated that Russian forces have not conducted any assaults in this area with significant armored vehicle support in the past four days and that Russian assault groups have recently started storming Ukrainian positions at dawn.[57] The Ukrainian spokesperson stated that Russian forces are increasingly using first-person view (FPV) drones at night and that several unspecified “elite” Russian units in the area primarily focus on conducting FPV drone operations at night.[58] The spokesperson reported that Russian forces have significant electronic warfare (EW) capabilities in the area that are forcing Ukrainian forces to routinely switch the frequencies that Ukrainian drones operate on.[59] The spokesperson added that Russian forces drop tear gas from drones in the area and that the tear gas has previously temporarily incapacitated Ukrainian artillery and infantry groups.[60] Russian forces have reportedly increased their use of chlorobenzylidenemalononitrile (CS) gas or chloropicrin (PS) along the front, which are riot control agents (RCAs) prohibited by the Chemical Weapons Convention (CWC), to which Russia is a signatory.[61] 

Ukrainian sources reported that Ukrainian forces repelled two Russian assaults in east (left) bank Kherson Oblast, including near Krynky, on March 23.[62]

Russian Air, Missile, and Drone Campaign (Russian Objective: Target Ukrainian military and civilian infrastructure in the rear and on the frontline)

Russian forces conducted a limited series of missile and drone strikes against targets in Ukraine on the night of March 22 to 23. Ukrainian officials reported that Russian forces launched four S-300 missiles at Donetsk Oblast and 34 Shahed-136/131 drones from Kursk Oblast and occupied Caped Chauda, Crimea on the night of March 22 to 23.[63] Ukrainian officials reported that Ukrainian forces shot down 31 Shahed drones over Poltava, Mykolaiv, Dnipropetrovsk, Zaporizhia, and Kherson oblasts.[64] Ukraine’s Southern Operational Command reported that Russian forces struck Odesa Oblast with an Iskander-M missile on the evening of March 22 and struck near Zaporizhzhia City with a Kh-59 cruise missile on March 23.[65] Ukraine’s Southern Operational Command reported that Russian forces launched an unspecified ballistic missile at Odesa Oblast on March 23 and that the missile struck open territory in Bilhorod-Dnistrovskyi Raion.[66]

Russian Mobilization and Force Generation Efforts (Russian objective: Expand combat power without conducting general mobilization)

Russian President Vladimir Putin signed a law on March 23 that will release individuals from criminal liability if they are called up for mobilization or sign military service contracts.[67] The law exempts servicemen from criminal prosecution for any crimes committed in Russia and crimes committed in occupied Donetsk, Luhansk, Zaporizhia, and Kherson oblasts before September 2022, when Russia illegally annexed the oblasts.[68] The provisions reportedly only apply to people who have committed minor or “medium gravity” crimes and do not apply to people accused of terrorism, sexual crimes, or violations of public safety.[69] ISW previously assessed that the law will likely allow Russia to expand its recruiting base outside of existing convict recruitment schemes.[70]

Russian Technological Adaptations (Russian objective: Introduce technological innovations to optimize systems for use in Ukraine)  

Nothing significant to report.

Ukrainian Defense Industrial Efforts (Ukrainian objective: Develop its defense industrial base to become more self-sufficient in cooperation with US, European, and international partners)

ISW is not publishing coverage of Ukrainian defense industrial efforts today.

Activities in Russian-occupied areas (Russian objective: Consolidate administrative control of annexed areas; forcibly integrate Ukrainian citizens into Russian sociocultural, economic, military, and governance systems)

ISW is not publishing coverage of activities in Russian-occupied areas today.

Russian Information Operations and Narratives

See topline text.

Significant activity in Belarus (Russian efforts to increase its military presence in Belarus and further integrate Belarus into Russian-favorable frameworks and Wagner Group activity in Belarus)

Nothing significant to report.

Note: ISW does not receive any classified material from any source, uses only publicly available information, and draws extensively on Russian, Ukrainian, and Western reporting and social media as well as commercially available satellite imagery and other geospatial data as the basis for these reports. References to all sources used are provided in the endnotes of each update.