After a week of high-stakes diplomacy, the U.S. on Friday accused Russia of "fabricating a pretext" to invade its neighbor Ukraine.
It's another sign that the "drumbeats of war" are getting louder, in the words of one U.S. ambassador, after three key meetings this week to defuse tensions raised by Russia massing approximately 100,000 troops on its borders with Ukraine.
But whether Russian President Vladimir Putin will act on a long-held desire to consume Ukraine, or whether his posturing is a bluff to strengthen Moscow's hand and therefore its influence, is still an open question, according to senior U.S. officials.
A "massive" cyberattack against Ukrainian government sites on Friday sparked new fears that the very kind of sabotage plot that U.S. officials have described could already be underway.
"Russia is laying the groundwork to have the option of fabricating a pretext for invasion, including through sabotage activities and information operations, by accusing Ukraine of preparing an imminent attack against Russian forces in eastern Ukraine," a U.S. official said Friday.
U.S. intelligence has "information that indicates Russia has already prepositioned a group of operatives to conduct a false-flag operation in eastern Ukraine," the official added, saying the group was trained in urban warfare and the use of explosives.
The alleged plot would begin several weeks before Russia's invasion of Ukraine, which he attacked in 2014 by annexing Crimea and fomenting a war in its eastern provinces known as Donbas. That conflict has killed as many as 14,000 people in the last eight years, with artillery and sniper fire still exchanged weekly between Ukrainian government forces and Russian-led separatists.
Not long after, White House press secretary Jen Psaki spelled out the U.S. accusations in public.
"We are concerned that the Russian government is preparing for an invasion in Ukraine that may result in widespread human rights violations and war crimes, should diplomacy fail to meet their objectives," Psaki told reporters at her daily briefing. "As part of its plans, Russia is laying the groundwork to have the option of fabricating a pretext for invasion, and we've seen this before.
She repeated the U.S. official's assertion that Russian action could occur sometime between the middle of this month and mid-February.
"We have information that indicates Russia has already pre-positioned a group of operatives to conduct a false flag operation in eastern Ukraine," Psaki continued. "The operatives are trained in urban warfare and in using explosives to carry out acts of sabotage against Russia's own proxy forces. Our information also indicates that Russian influence actors are already starting to fabricate Ukrainian provocations in state and social media to justify a Russian intervention and sew divisions in Ukraine."
The Kremlin dismissed the accusations, saying no proof has been presented.
"All these statements still have just the character of hearsay and haven't been confirmed by anything," spokesman Dmitry Peskov told the state news agency TASS.
The buildup since last fall of nearly 100,000 Russian forces, with potential plans for as many as 175,000, according to U.S. officials, has heightened fears of a full-scale invasion or new attack. In addition to the troops, Russia has stationed artillery systems and electronic warfare systems, according to U.S. ambassador to the OSCE, Michael Carpenter.
"The drumbeat of war is sounding loud, and the rhetoric has gotten rather shrill," Carpenter said Thursday after the third and last round of talks with Russia. "We have to prepare for the eventuality that there could be an escalation."
That rhetoric - accusing Ukraine of abusing human rights and increasing belligerence - has dominated on Russia-language social media, according to the U.S. official. In December, it increased roughly 200 percent to nearly 3,500 posts per day, they said, in order "to justify a Russian intervention and sow divisions in Ukraine."
That appeared to include a "massive" cyberattack against Ukrainian government sites on Friday. Ukraine's Foreign Ministry said theirs and other sites were temporarily down, with a message posted on the site by the attackers, address to "Ukrainians!"
"All your information will become public, be afraid and expect the worst. This is for your past, present and future," it said in part.
Andrei Yermark, a top adviser to Ukrainian President Volodymyr Zelenskiy, said later Friday that approximately 90 percent of sites have been restored and that critical infrastructure was not affected.
No one has claimed responsibility for the attack, and Yermak said the country's security service was investigating now.
"Of course, we have some thoughts," he added, saying this kind of attack was "one of the potential parts of the destabilization" that officials have warned about.
With partners like the U.S. and the U.K., "We will be ready to answer to this attack and continue to work with our partners to protect," he said.
Psaki said President Joe Biden was briefed about the cyberattack against Ukrainian government sites, but held back from naming who might be behind it.
"We don't have attribution at this time, and I can't point to any more specifics … I would just note that we will take necessary and proper steps, of course, to defend our allies, support our partners, and support the Ukrainian people, but we're still assessing that at this point in time," she said.
ABC News' Justin Gomez and Patrick Reevell contributed to this report.