24 December 2024 brought a wild story: Russian shadow-fleet vessel URSA MAJOR that roughly translates at the “big dipper” — formerly the cargo ship Спарта III until 2021 and Russian-flagged since 2017 — sinks roughly 100 km off the Spanish coast. What initially sounds like a short news item has unfolded into a thriller-like chain of events — one that remains, to this day, largely shrouded in secrecy.

At around 21:00 UTC, the ship abruptly disappeared from AIS tracking. It must have just sunk. Cause: “an explosion” a day earlier, 23rd, roughly at midday local time. The company back then asserts at once a “targeted terrorist attack”, so France24.

“According to the crew, on December 23, 2024, at 13:50 (Moscow time), three consecutive explosions occurred from the starboard side in the aft area, after which the ship received a sharp roll to starboard to 25 degrees, which indicated the flow of water into the ship’s rooms” so the company press statement.

Open-source vessel data shows it had departed St. Petersburg and was en route to Vladivostok, a journey that already raised questions long before the signal went dark.

Open-source investigators digging deeper uncovered evidence of nuclear reactor components aboard the vessel, reportedly destined for North Korea. According to reporting by La Verdad, authorities identified the items as housings for VM-4SG nuclear reactors, sharply escalating the geopolitical significance of the sinking.

How the VM-4SG actually looks like is largely secret. But there is some open source intelligence shared by the media TV Zvezda, the footage is still online and shows the component. https://tvzvezda.ru/news/20231211222-NUAl4.html

And where it gets even more interesting: what initially appeared to be an accident began to look far less benign. Other open-source investigators identified apparent damage to the vessel’s hull, raising the possibility that the sinking was the result of an attack rather than a mishap.

According to AIS tracking platforms, the vessel disappeared at 36.458461, −0.881108 (location), where the seabed drops to roughly 2,644 meters, based on data from nautical mapping services such as C-Map and Global Fishing Watch tracking the vessel.

The news that followed was grim: two crew members — a motorman and a mechanic — were killed, while 14 others were rescued. The officially stated cause was an “explosion in the engine room.” Photographs later showed eight of the surviving crew members arriving safely at a Spanish port.

But already on Christmas Eve 2024, unconfirmed rumors began circulating on the Telegram channel «Морские новости от Crew Hunter». According to the post, there was speculation that the vessel had struck a mine or been hit directly: it claimed three holes in the engine room with inward-deformed metal, and three explosions, after which the ship reportedly began to list sharply. This I could however not observe in the video footage (Xpost) shared that day, so no clear judgement on that possible with OSINT.

The post also floated the possibility that explosive devices had been planted. A video shared later that morning appeared to show the vessel already heavily tilting.

What happened just before the explosion

The voyage had already drawn vocal criticism before the explosion. In the early hours of Christmas Eve, at 02:19 a.m., X user and OSINT blogger Oliver Alexander posted that the vessel was heading to Vladivostok, allegedly to support the evacuation of Tartus. The post went viral almost immediately, amassing nearly one million views within hours.

The vessel, he claimed while linking to a obl.ru url (the owner and operator of the vessel) would carry cranes — two 45-ton hatches for the construction of the new Project 10510 nuclear powered icebreaker.

In fact it was OBL website itself that proclaimed the use of the cranes. Here, on its press room website https://obl.ru/pressa/news/podnyat-600-tonn-legko/ it resents itself as a useful aid to State objectives as it says: “…Oboronlogistics’ largest vessel is once again being used to implement state objectives for the development of port infrastructure and the Northern Sea Route.” The webarchive entry is on the 20st of December.

But it gets wilder still. On 21 December, three days prior to the incident and shortly before crossing the Strait of Gibraltar — the vessel gets reportedly escorted by units of the Portuguese Navy and Air Force off Portugal’s continental coast. So, something was up.

Then, the day of the explosion arrives. 23 December. An OSINT defence blogger (EE_EspadaEscudo) reports that two massive port cranes from Liebherr — together weighing over 700 tonnes — had been loaded onto the vessel while it was docked at Ust-Luga between 2 and 9 December. Its a fine analysis.

The cranes were identified as part of Liebherr’s LHM — Liebherr Harbour Mobile range. Its a large famaly owned Swiss company, however maintaining a lot of business operations in Germany. The website Leave-Russia that tracks companies business after the start of the war suggested the firm has not taken any actions, and its company statement in March 2022 still says its too early to assess.

On 3 December 2024, Oboronlogistics LLC publicly complained about the difficulties caused by sanctions, specifically referencing restrictions affecting dealings with Liebherr.

In the context of sanctions restrictions, the maintenance and repair of cranes manufactured by Liebherr is becoming a major challenge. As part of the import substitution program, Oboronlogistics specialists, together with Russian manufacturers and foundry specialists, created technical conditions for the manufacture of analog spare parts for Ursa Major ship cranes, which made it possible to continue their operation and obtain all the necessary permits from the supervisory authorities. (link)

EE_EspadaEscudo’s OSINT post tracks the vessel until 13:50, roughly the moment the explosion, and a day before the sinking — noting that it appeared to be loitering off the Algerian coast before the trail goes quiet.

In the final hours before the sinking, the vessel reportedly lost speed before a distress call was received by Spanish coastguard units. A Russian warship — the Ivan Gren (IMO 4615619) arrived on scene and fired flares, allegedly to obscure satellite observation, although the effectiveness of such a tactic against modern sensors to me remains doubtful.

Questions also surround the ship’s operator, SC-South LLC, a subsidiary of Oboronlogistics LLC, which is a sanctioned contractor of the Russian Ministry of Defence. How exactly thecompany had received the heavy equipment prior to the voyage, remains not clear. The AIS records show the Ursa Major in Ust Luga port with the following tracks, matching the images posted by the OBL company. The blogger even found a timelapse video that shows how the russian defence contractor built the Liebherr cranes onto the vessel (here).

Timelapse in port:

Incidentally I found a ferry services in the Black Sea on behalf of the Ministry of Defence. The company is fairly open about such things being a “Military shipping and logistics” firm, perhaps one reason it was sanctioned since 2023 by the EU and the UK. There is also shreds of evidence that shows that the vessel with its old name Sparta III was 2018 already embedded in a complex offshore management structure.

By December 2024, the sequence of events — the explosion, the loss of speed, and the unanswered questions — had begun to draw serious attention. As the situation unfolded, multiple vessels converged on the scene. OSINT observers identified the Spanish Navy patrol vessel P-71, a Spanish tug, and another Russian cargo ship in the vicinity of Ursa Major (the Aleksandr Otrakovskiy was also part of the convoy). Notably, that vessel was named Sparta — itself sanctioned by the United States for the same reasons as Ursa Major, a detail first highlighted by a Urkainian account.

What is indeed interesting and gives some reasons to think is that the Main Directorate of Intelligence of Ukraine issued a statement on the 23rd of December, on that ship, the Sparta (I), saying that “the cargo ship Sparta, which Russia sent to remove its weapons and equipment from Syria, broke down off the coast of Portugal after a fuel pipe in the main engine failed. The Russian crew managed to repair the damage and continued sailing through the Strait of Gibraltar.”

The arrival of the russian spy vessel

The vessel ultimately sank — taking with it the suspected nuclear-reactor equipment. Then, roughly three weeks later, a highly suspicious development followed: the Yantar research vessel, previously linked to intelligence activity, appeared at the exact location of the sinking.

Observers widely doubt this was a coincidence. Operated by GUGI, a specialized unit of the Russian Ministry of Defence, Yantar is equipped to map the seabed and, if required, recover objects from extreme depths. It carries two deep-diving autonomous underwater vehicles, making it fully capable of surveying — or retrieving — material from the seafloor at the depth where the Ursa Major went down.

After the AIS signal dropped, the vessel must have drifted or traveled slightly farther southwest. Around 16 January 2025, Yantar was observed loitering for several hours at the exact location where the vessel sank, a detail that has only intensified scrutiny of the incident.

Last November, the British Defence Secretary publicly warned Russia that if the Yantar were to “travel south,” the UK was prepared to respond.

In fact — and this is perhaps the key point — the interaction between Yantar and the vessel that sank was not a first.

The incident and the AIS tracks further appears to confirm a recurring relationship between the Russian Ministry of Defence and the Port of Algiers, where the vessel Yantar had docked multiple times, including in late November 2024 and again in January 2025

Since Feb 2022

In the accompanying tracking visuals, blue indicates the movements of Yantar, while red traces the route of Sparta III / Ursa Major. Since the start of Russia’s full-scale invasion of Ukraine, operating so freely in European waters — and loitering in such sensitive locations — has become a notable and increasingly risky undertaking.

From AIS-dark warships to disguised research vessels, Russia’s maritime operations in the North and Baltic Seas are pushing the boundaries of hybrid warfare. This type of analysis shows how OSINT and SIGINT-inspired tools can expose hidden movements, uncover intent, and help journalists, investigators, and analysts stay one step ahead at sea.

It’s March, 2025. Just before dawn off Ireland’s misty northeast coast, an Irish Air Corps patrol aircraft, Air Corps CASA 295 appears on ADS Exchange flight radar. It spotted the Russian-linked cargo vessel silently drifting in international waters.

The ship — sailing under a Caribbean flag — was not broadcasting AIS and appeared on no maritime chart. Hours later, surveillance footage confirmed it had dropped anchor directly above a vital submarine communications cable, prompting Irish Defence Forces to contact the vessel and order it away. While officials stated there was no distress call or explanation, the deliberate anchoring over the cable speaks to a broader Russian tactic of undersea probing.

This was far from an isolated incident. A similar pattern has emerged across the North and Baltic Seas, with unmarked or “AIS-dark” ships — often disguised as research or cargo vessels — loitering near naval bases, wind farms, pipeline networks, and data arteries. Just last November, the Russian auxiliary research vessel Yantar was trailed out of Irish waters after hovering near key internet cables south-west of the Isle of Man.

Elsewhere, Baltic nations have reported anchor-drag events and quick cable faults traced to vessels like the Eagle S and Yi Peng 3, stirring suspicions of sabotage. Their AIS signals often vanish during these sweeps, concealing intent and raising the specter of a shadow maritime war, where the seabed itself becomes a strategic front. For many of us western journalists and investigators, that was a starting point to dig deeper.

Russia’s Hybrid Naval Playbook in the North and Baltic Seas

Russia is increasingly treating the North and Baltic Seas not merely as transit zones, but as active frontiers in a hybrid contest against NATO’s western flank. What may appear on the surface as civilian maritime activity often serves more strategic, and at times covert, military ends.

Journalists and investigators are now paying closer attention to Moscow’s use of commercial vessels, shadow fleet tankers — flagged as such by institutions like the Kyiv School of Economics — and auxiliary research ships. These vessels, while sailing under scientific or commercial pretences, are increasingly integrated into the Russian military apparatus. Their missions often include surveying critical infrastructure, mapping data cable routes, identifying weak points in offshore energy production — such as Germany’s North Sea wind farms — and feeding intelligence into what defence analysts refer to as Russia’s “kill chain”: a matrix of pre-identified targets intended to cripple Europe in the event of open conflict.

While much of this activity operates in the grey zone of plausible deniability, open-source intelligence (OSINT) offers a powerful set of tools to investigate it. In this post, we explore how satellite imagery, ship-spotter reports from places like Kaliningrad, livestream cameras in European ports, AIS tracking data from sources like Global Fishing Watch, and other open tools can illuminate Russia’s maritime footprint — and help clarify what’s unfolding beneath the waves.

The thing with AIS tracking signals

Let’s start simple. Most observers have heard of AIS — the Automatic Identification System transponder signal that vessels over 300 gross tonnage are required to broadcast when navigating international waters. In high-traffic zones like the rough, often fog-bound North Sea, this isn’t just protocol — it’s a matter of maritime safety. But AIS has its blind spots. There is the source itself. Experts sources in my work revealed that MarineTraffic data can show gaps where there should be none, due to business related merging — rendering it not a “gold standard”. But appart from that, some of the more pressing gaps in AIS tracking is by military vessels who are exempt from any of these IMO rules, and Russia makes full use of that loophole.

Take the case of the Russian spy ship or more fomally called Russian signals-intelligence ship Yuri Ivanov. The case that took place in May is one example of many russian military vessel appears suddenly and without AIS broadcasts near sensitive European sites, raising alarm across NATO states.

A striking example occurred in May 2025, when the Russian signals-intelligence ship Yuri Ivanov was tracked loitering off the coast of the Outer Hebrides shortly after NATO’s Formidable Shield exercise. With no AIS signal and no prior warning, the vessel’s presence prompted the British Royal Navy to deploy the destroyer HMS Dragon and a Merlin Mk2 helicopter to monitor its activities, both potentially revealing the position of the Yuri Ivanov, even if its AIS is off.

Designed for intercepting radar and communications traffic, Yuri Ivanov exemplifies how Russia leverages unannounced naval movements to surveil Western military exercises, test response times, and map vulnerabilities in allied defense systems. Russian warships routinely travel dark, escort disguised merchant vessels, and appear near critical sea lanes or cable routes, allowing to pull intel with strong receivers.

As mentioned, digital tools can be great for investigators. Platforms like MarineTraffic (despite its datagaps), VesselFinder, and Global Fishing Watch provide free — often near real-time — AIS tracking data that can reveal escort or shadowing vessels, indirectly exposing the movements of AIS-silent military ships. While NATO and national coast guards have far more sophisticated capabilities, their tracking efforts often leave a trail that open-source researchers can follow — especially when Russian military vessels stir concern in European waters.

Near or even in German EEZ (exclusive zone) waters, the coast guard vessel Bamberg is frequently involved in monitoring activity and chasing after vessels. OSINT ship spotters often cite Bamberg as an early warning sign of Russian auxiliary fleet movements.

A notable example occurred in 2023, when the Russian research vessel Professor Logachev was shadowed — its AIS was still active at the time, allowing observers to track its movements. Since then, however, Russian vessels have increasingly gone dark, switching off AIS. In parallel, patrol checks on civilian ships have intensified, partly in response to drone sightings — an issue we will revisit later.

Shadowing vessels often become the key to detecting dark military activity — revealing the presence of AIS-silent warships through their own visible movements. German patrol ships such as the Potsdam (BP81), Bamberg (BP82), and Bad Düben (BP83), all built by the Fassmer Shipyard, are especially worth watching. As EU state-operated control vessels with active AIS, they can act as canaries in the coal mine — indirectly signaling the presence of Russian military assets in European waters.

Other such vessels to track are Bad Bramstedt-class (e.g., BP 24 Bad Bramstedt) that joined Danish and Swedish vessels in Kattegat to monitor Yi Peng 3, amid speculation of Russian involvement via hybrid operations, that followed suspected sabotage to the C‑Lion 1 cable between Finland and Germany, the German coast guard.

The Bramstedt was also involved after anchor-drag marks were found near the Estlink 2 cable and when Finnish authorities seized Eagle S. The Bad Bramstedt was among EU vessels monitoring follow-up operations. There are two more Bad Bramstedt-class vessels: the Bayreuth (BP 25), and Eschwege (BP 26) both are said to be regularly deployed near suspected undersea cable incidents, serving as the canary in the coal mine thanks to their visible AIS tracking and patrol capabilities.

While military vessels often travel dark, their escorts, supply ships, or past AIS logs can reveal indirect clues. Analysts also rely on ShipInfo, and open-access Copernicus Browser imagery to monitor movements and verify a ship’s last-known position.

Historical AIS data — even when partial — can expose patterns: loitering near infrastructure, shadowing other ships, or sudden, unexplained signal gaps.

As we spoke of shadowing vessels, the same applies to conspicious flight patterns of western military and patrol planes over baltic sea.

One examples occurred on 14 November 2024, when the French Navy’s maritime patrol aircraft Atlantique 2 (Br.1150 Atlantic) flew over the Baltic Sea, circling above a Neustrashimy-class Russian frigate returning from the Mediterranean.

The aircraft maintained sustained observation, relaying real-time intelligence to NATO forces and signaling that allied surveillance was fully aware of the vessel’s course and purpose. Were the platfroms such as adsbexchange to feature the signal of the Atlantique 2 (which I am rather sure it did), investigators can trail it, and find out roughtly the position of the freaking russian frigate.

In another incident recently, flight tracking platforms like ADS-B Exchange captured Western air assets responding as Russian Su-35S jets scrambled from Petrozavodsk to shield the shadow fleet tanker Jaguar, forcing Estonian forces to stand down just as they moved to seize the AIS-dark vessel in the Gulf of Finland.

Webcams and images taken of vessels

Port and Activity Monitoring

To verify the movements of vessels even when their AIS is turned off, port webcams — such as those in Kiel or Rostock (examples here or here )— can be surprisingly valuable.

For instance, the departure of the Russian Navy’s Admiral Gorshkov (Project 22350, hull number 454) from Cape Town, or the Admiral Golovko (456) and Steregushchiy-class corvette passing beneath Denmark’s Storebaelt Bridge, were all documented through screenshots from publicly accessible live webcams. These sources are not only useful for retrospective verification, but also offer investigators the chance to monitor key chokepoints in real time — if you’re quick and know what to watch for.

For everthing there is a facebook group. The Facebook channel Under Broen, translated as “under the bridge” shares webcam footage often on russian military vessels but also on russian submarines, what became a valuable tool for open source investigators.

Link to Facebook Group: https://www.facebook.com/groups/1525590020990772

Since we are frequently citing OSINT Twitter accounts, who often anonymiously push valuable evidence online, here are some of the most often cited accounts on this matter. Of something is up in north or baltic sea, these source will likely have picked up on it. Not always thought.

Vessel Spotters

In several investigations, I’ve found vessel spotters to be a valuable resource. With some luck, you can confirm the positions of suspicious Russian vessels — and more importantly, many of the images or videos they share are of such high quality that they offer real investigative value — for spotting what’s on the ship or what isnt, and later is or isnt.

Take the example of the HAV Dolphin: while no concrete evidence has linked it to espionage or other nefarious activity so far, the vessel illustrates how spotter footage can provide a deeper layer of insight into maritime behavior.

Before the vessel headed to the German coast — where it remained for more than eight days — it was docked in Kaliningrad. A ship spotter captured an image of it there on April 11, 2025. According to its owner, the vessel was undergoing repairs at the time, which aligns with the visible scaffolding on its bow. Afterward, it sailed to Latvia and then proceeded directly into Germany’s Exclusive Economic Zone.

Following its conspicuous stay near German waters, the HAV Dolphin transited through a German channel, where it was photographed again on May 10 by a ship spotter using a high-resolution DSLR camera. A direct comparison of the images revealed minor changes — nothing conclusive in this case, but potentially valuable if further investigation were warranted. While no drone equipment or suspicious modifications were observed, this kind of photographic evidence is worth collecting. Such images were shared across platforms like MarineTraffic, ShipSpotting.com, ship-spotting.de, and MyShipTracking.com, among others.

Spotting Suspicious Patterns in AIS Data

Did a vessel spoof its location — falsifying its position — or did its AIS signal appear in a place it physically couldn’t be?

To answer that, it helps to think outside the box. For instance, if AIS positions show up on land (unlikely for a 300-meter tanker) or indicate impossible speeds, something suspicious may be happening. One increasingly useful tool is an AI chatbot like ChatGPT, which can scan AIS data and flag unusual vessel behavior far faster than manual analysis — though any findings must still be cross-verified.

Take the already mentioned Jaguar (IMO: 9293002), a crude oil tanker flagged under Gabon and sanctioned by the UK’s Office of Financial Sanctions Implementation (OFSI).

When examined through platforms like MarineTraffic — or in this case, Windward — the ship displayed an abnormal AIS pattern: a near-perfect circle in open water that didn’t match known movement imagery, strongly suggesting spoofing or GPS manipulation.

To run an independent analysis, we can use data from Global Fishing Watch, which — despite its name — now includes AIS data for all vessel types, not just fishing ships.

Simply download AIS data for a specific period and vessel, then upload it to an LLM-powered chatbot ChatGPT4 with a targeted prompt like:

“Please fact-check the AIS locations of the shadow fleet tanker Jaguar and identify any inconsistencies or suspicious behavior.”

The chatbot will scan the CSV file line by line, calculating speed, time gaps, and positional anomalies to flag implausible patterns. In the case of the Jaguar, here’s what it found.

“Very short time intervals” of AIS pings and “geographic jumps” raise questions that later can be further investigated.

If you go a step further and feed the LLM not only AIS data but also the positions of European subsea cables — available, for example here, in CSV format from the Submarine Cable Map by TeleGeography — the model can compare defined loitering events (e.g., stationary positions longer than a few hours) with the proximity of known undersea infrastructure. This allows for automated analysis to flag potential espionage or sabotage behavior near critical cables.

With ChatGPT-4 and its Code Interpreter, you can upload AIS and subsea cable data, define loitering behavior, and automatically calculate and visualize overlaps — flagging suspicious activity near critical infrastructure — though precision is limited by simplified cable data, static input files, and dataset size constraints.

If you do that with the recent positions (2025) of the Jaguar and subsea cable maps from 2018, it suggests the vessel did not sail closer than 500m near the noted cable paths.

Here again another example. The infamous GUGI research vessel Yantar, its AIS signal overlayed and analysed over international submarine cable infrastructure.

Data for 2021 to 2025 shows multiple stopovers within 2 km of key submarine cable routes, notably near the Channel Islands (49.8°N, -2.9°E) and off the coast of Estonia near Tallinn (59.7°N, 24.3°E). These areas host critical Western communication infrastructure, suggesting Yantar may have been conducting cable surveillance or mapping activities under the guise of marine research (also mentioned here, here and here).

Russia understood decades ago that knowing, and in the event of need, disrupting or exploiting internet infrastructure could yield major strategic advantage.

Tracking russias electronic warfair signal interferences

Russia has installed powerful jamming systems along its Baltic Sea ports to defend against drone warfare and other aerial threats. However, these electronic countermeasures have an unintended side effect: they can interfere with AIS signals, disrupting the tracking of vessels.

A notable example offers again the HAV Dolphin, which sailed from Kaliningrad to Latvia in late April. During this transit, its AIS signal experienced a noticeable gap. An analysis of signal interference on that day (available via GPSJAM) confirmed elevated jamming activity along part of the route, likely contributing to the AIS disruption.

This kind of analysis helps determine whether a vessel intentionally disabled its transponder — an action far more significant for investigators — or whether it went dark due to external interference. In the case of the HAV Dolphin, the ship’s owner attributed the AIS gap to Russian jamming, which aligned with some of the recorded signal anomalies along the route.

A new russian playbook to turn off AIS transponders

But that this may not the case for other russian vessels or shadowfleet tankers, show talks with sources. One senior Finnish Coast Guard officer confirmed to me that Russian-linked vessels — particularly shadow fleet tankers — have increasingly exploited AIS signal gaps as a deliberate tactic since spring 2024, coinciding with the introduction of direct EU sanctions against these ships (something that was stressed before).

The officer reported up to ten such AIS blackouts per week, primarily occurring as vessels cross from the Russian Exclusive Economic Zone into Finland’s, creating significant navigational hazards in the shallow, congested sea lanes of the Baltic. Captains often respond to radio contact claiming they no longer know their exact location — despite continuing to navigate — and systematic Coast Guard measurements indicate these gaps typically last several hours, with AIS reactivated only once the vessels exit the Russian EEZ.

For him the jamming and spoofing isnt seperate, it’s compounding the risk, as GNSS spoofing and jamming — believed to be part of Russia’s electronic countermeasures against drone threats — caused ships to follow falsified navigation data while their AIS remains frozen.

While Finland and Estonia lack the authority to act against such vessels in international waters, this evolving playbook has already forced several near-accident interventions and highlights a broader strategy of obfuscation, evasion, and information denial at sea, he said.

Morse

Journalists and investigators can track Russian naval activity in the North and Baltic Seas also by monitoring high-frequency (HF) radio communications, particularly Morse code (CW) and STANAG signals still used by Russian vessels for long-range operations. If this doesnt tell you much, consider this. These are transmissions that often originate from military ships operating in remote or AIS-dark mode. They can provide indirect confirmation of presence, timing, and occasionally even intent.

Communities like the Utility DX Forum (UDXF) and Priyom.org document these patterns in real time, cataloging callsigns, frequencies, and signal types tied to specific naval units.

With a basic setup — such as a long-wire or magnetic loop antenna and software-defined radio (SDR) tools like SDR# or GQRX — even civilian investigators can intercept and decode these transmissions. These open networks act as passive surveillance layers, especially valuable in regions like the Baltic, where Russian communication habits remain rooted in traditional HF protocols.

How UDXF works

In December 2009, a UDXF contributor reported logging a Morse-mode naval command exchange between RMP (the Baltic Fleet HQ in Kaliningrad) and RFE76 — a Russian naval vessel — on the HF frequency 14,556 kHz. According to the logs, RMP signaled RFE76:

“RFE76 de RMP QTC 411 66 11 1607 411”

— likely relaying mission-specific instructions or scheduling signals. The detailed exchange was logged with timestamps and call-sign metadata, which helped operators at distant European listening stations — and later, OSINT analysts — pinpoint Baltic Fleet units operating in real time.

This was not an isolated case. Priyom.org documents that the Baltic Fleet’s station RMP (Kaliningrad) regularly transmits CW and digital signals to this day— including Monolith traffic — that have been consistently monitored across the Baltic region.

Through HF monitoring, skilled listeners can thus identify and track Russian naval operations long after a vessel’s AIS goes dark.

In fact, journalists from Süddeutsche Zeitung, NDR, WDR, and other international outlets used Morse signals in a 2024 analysis to track the movements of Russian auxiliary research vessels as part of a major cross-border investigation.

How does the decoding of the morse sigal work?

Russian tugboats can serve as valuable proxies for submarine activity — often revealing what stealthier vessels aim to conceal. Take the example of the Evgeniy Churov, a 70-meter-long Russian Navy tug with no active AIS signal.

While it may appear unremarkable on the surface, the Churov plays a key operational role: acting as the muscular escort and support unit for Russian submarines operating far from home waters. In at least one documented cases, it accompanied the submarine Krasnodar, a Kilo-class B-261 Novorossiysk, which had been stationed for several months in the Mediterranean Sea. With the submarine’s presence largely invisible to open-source tools, it was Churov’s radio trail that exposed the broader deployment and more specifically, its removal.

In particular, Morse code transmissions from the Evgeniy Churov — intercepted on 8345 kHz CW — have become a crucial data point for OSINT practitioners — though it disappeared briefly in February. A structured position and weather reports encoded in standard naval formats. One signal received at 0605 UTC and collected by X account te3ej reads:

RIW DE RMEV 01061 99555 10109 41497 71709 10153 40111 57018 70312 87?00 22252 20301 01013 BT AR RMEV K

Lets break down the most important parts, one by one.

RIW DE RMEV

• Translation: “RIW from RMEV”
• DE means “this is” in Morse.
• RMEV is the transmitting station’s callsign — in this case, the tug Evgeniy Churov.
• RIW is likely the receiving command station (Baltic Fleet HQ or regional naval command).

01061

• Date and time in military format
• 01 = day of the month (1st)
• 061 = time group, often read as 0601Z (UTC)

99555

• Standard filler or start of coded weather block (can sometimes indicate “no significant weather phenomena”)

10109: Latitude/Longitude

• 10 = code for 55°N
• 109 = 10.9°E
• (Together: 55.5°N, 10.9°E, location in the western Baltic Sea)

BT AR

• BT = Break Text (separator)
• AR = End of Message (common in Morse traffic)

RMEV K

• Repeats the sender call (RMEV), K = “Over” (waiting for response)

Most importantly is probably the part 10109. With 55.5°N, 10.9°E, we can place the vessel in the Baltic — despite its AIS silence — 18 km north of the Storebælt bridge.

With basic radio equipment, a long-wire antenna, and decoding tools like SDR# or Fldigi, journalists and investigators can monitor these transmissions from thousands of kilometers away.

Logged by open communities as the already mentioned Priyom.org and UDXF, they offer rare insight into the movement of Russian naval assets, especially when submarines themselves remain out of view.

Other means to identify dark vessels

Other means to find traces of vessels where there are no records are with slick tracking. One Slick Tracking website uses AI to record traces of slick on the water surface. This is great to spot polution but also to expose areas affected by age old russian tankers that sail though europe and have their AIS off.

In one instance, the tracing of oil slicks detected via satellite, fellow journalist investigators were able to link AIS-dark Russian shadow fleet tankers — like the Innova — to illegal crude shipments and environmental damage, revealing how physical pollution trails can unmask vessels deliberately hiding their location to evade sanctions.

Drones from vessels

OSINT techniques can reveal much about potential hybrid threats at sea, where as easily a drone can be flown as it was for the Ukrainian special units to get drones in conatiners close to russian air bases, attacking them with the opeation spiderweb.

One vessel, we dont say the name here, serverd here as a test case, which could, whose movements in spring 2025 warrant closer scrutiny. According to AIS tracking, the vessel departed the Latvian port of Liepāja on April 29 and sailed directly to the Bay of Kiel. Over 49 hours and 27 minutes, it covered 377.6 nautical miles at an average speed of only 7.6 knots.

This behavior suggests loitering. Officially it was “waiting”. What made for the authorities the the cargo vessel voyage suspicious was where it stopped. For over eight days, between May 1 and May 10, the vessel loitered in a maritime traffic zone just outside Germany’s 12-nautical-mile boundary, near 54.5288°N, 10.2569°E. This location lies close to Eckernförde, home to the German Navy’s submarine base and special operations forces. The vessel’s track showed tight circles and erratic maneuvers — a virtual holding pattern in an area not designated for anchoring.

By combining AIS data with maritime density maps from MarineTraffic, investigators confirmed that this loitering location is atypical: neither cargo ships nor transit traffic regularly stop there.

Using Overpass Turbo, we queried the closest German military installations within 40–50 kilometers of the loitering spot — the maximum range for standard commercial drones. The Marinefunkempfangsstelle Schwedeneck-Stohl (14km), Marinestützpunkt Eckernförde, and Kaserne Belvedere were all within drone flight range.

Had the vessel launched a drone toward critical infrastructure during its anchorage. We visualized these findings via interactive maps and verified the sensitive locations with Google Maps.

While nothing confirms an inspection or drone activity, OSINT methods — including AIS data analysis, Overpass Turbo queries, satellite verification, and vessel behavior tracking — allow to raise meaningful questions about hybrid naval threats. In combination, these tools illustrate how loitering vessels near military sites can become proxies for intelligence-gathering operations.

I got interested in further drone sighting cases across europe. ACLED did an exptensive study of Drone related cases. So we searched for those encoded in their database. Here are the results.

Since late 2022, European security services have documented a sharp increase in suspected Russian reconnaissance and sabotage activity via unidentified drones — often targeting critical infrastructure and military facilities across the continent.

The pattern intensified in 2024–2025, with drone sightings over strategic German sites like naval bases in Wilhelmshaven and Nordholz, gas facilities in Jemgum, and the port of Bremerhaven all in a single night (27 February 2025). Similar incursions were reported over Finland’s gunpowder factories, Sweden’s power plants, and Romanian military installations.

Notably, the NATO air base in Geilenkirchen entered high alert in January 2025 following foreign intelligence about a potential Russian drone-based sabotage plot. Overflight incidents over offshore oil platforms and gas fields — from Norway’s Sleipner and Melkøya to Denmark’s Roar field — suggest a coordinated campaign. While direct attribution remains difficult, Western intelligence agencies increasingly link these drone incursions to Russia’s evolving hybrid warfare strategy targeting European resilience.

And now it’s your turn!

From satellite secrets to silent airfields — Russia is quietly transforming Murmansk into a strategic fortress on NATO’s doorstep.

Putin sees Murmansk as a key asset because it anchors Russia’s Arctic military presence while enabling large-scale energy and infrastructure expansion. Its strategic location near NATO borders makes it essential for both defense posturing and asserting control over the Northern Sea Route and Arctic resources.

Since February 2022, Putin made at least two publicly reported visits to the Murmansk region and in its recent one end of March he timely launched a new nuclear-powered submarine called “Perm” —equipped with hypersonic Zircon missiles, with the destructiv power so vast that even NATO recognised it.

In addition to Perm, Putin re-established the Leningrad Military District to include Murmansk as a response to NATO’s expansion.

More recently, Putin specifically approved a list of instructions aimed at bolstering the region’s infrastructure and energy capabilities. Key initiatives include the construction of the Volkhov–Murmansk gas pipeline by 2030 and decisions regarding the development of nuclear icebreakers by 2026 — a plan that is crucial for maintaining year-round navigation along the Northern Sea Route, which is vital for both economic and military purposes.

Murmansk is undeniably central to Putin’s long-term Arctic doctrine, linking energy, military infrastructure, and great-power signaling in a zone bordering NATO.

According the Kremlin’s Telegram News channel, Putin has repeatedly met with Murmansk Governor Andrei Chibis to discuss socioeconomic development and has endorsed initiatives like the “Clean Arctic” project, which mobilizes volunteers to rehabilitate remote northern territories.

Do the people want that? The riddle here: Russians want both. A majority support Arctic development in a poll, with 86% favoring environmental protection and 68% backing Putin’s mining plans — revealing a contradictory yet broadly optimistic view driven more by ideals than informed understanding.

Putin also inaugurated and promoted massive infrastructure and LNG energy projects in the region — especially the Arctic LNG-2 project by NOVATEK — aimed at boosting Russia’s foothold in global energy markets. This is where Russia still earns its money, propping the defence industry. Hence an understandable endevour.

His visits and videoconferences have focused on master planning for Arctic settlements, housing renovations, even a “healthcare reform”, and support for families, veterans, and participants of the war in Ukraine, tying Murmansk’s development tightly to both domestic welfare narratives and geopolitical strategy in the Far North. Putin sees here the next frontier of trading and if needed, fighting.

Murmansk and the military: NEW military defences in 2025

One powerful way to monitor a vast region like Murmansk for signs of military fortification is through synthetic aperture radar (SAR) interference. Enter Bellingcat’s SAR interference-tracker.

This tool uses SAR satellite data to detect and visualize historical Radio Frequency Interference (RFI) on a map — typically caused by military radars — allowing users to pinpoint, analyze, and download radar activity over time by clicking on specific locations and interacting with time-aggregated graphs.

The image for May 2025 indicates the presence of strong, localized electromagnetic emissions, often linked to military radar systems. The fact that these stripes are repeating and sharply defined suggests rotating or pulsed radar installations, likely tied to air defense or missile warning systems. Where the lines meet, there is, among other stuff, the “Military commissariat of the Murmansk region Monchegorsk city”.

Notably, the interference only began in February 2025; there had been no such activity since the start of the war in February 2022, according to the agregated SAR interference records.

Bright circular areas (e.g., around Olenegorsk, Afrikanda, Apatity) are persistent RFI hotspots. Olenegorsk, in particular, is known for hosting Russian early-warning radar systems (such as the Daryal or Voronezh types). These facilities emit powerful signals, which show up clearly on SAR data as consistent interference.

Military bases

It’s worth breaking down the bases, its assets such as subs and planes to filter a signal for analysis, hidden just kilometers from Finland’s border — also with a bit of help from AI.

Murmansk has become a key region to watch, revealing how Russia is steadily building up troops and military infrastructure along the NATO frontier. Since February 2022, several military sites in the area have shown signs of upgrades.

To identify all known military installations across Murmansk Oblast along the finnish border— at least those recorded by OpenStreetMap, thanks to contributions from the open source community — we can write a quick OverpassTurbo query to map them and build a clearer picture of the region’s military footprint.

https://overpass-turbo.eu/: Go to Overpass Turbo. Paste the query above into the left-hand code panel. In the map window, zoom in manually to Murmansk Oblast (Northwest Russia — north of the Arctic Circle, close to Norway/Finland). Click “Run” (top left) to execute the query for that bounding box.

We can alter the query and only see the russian bases in Murmansks. Extract the results and alternatively run a query in your Terminal window to turn results into Excelsheet for analysis.

After downloading and importing the satellite data into Google Earth Pro, Monchegorsk Air Base stands out clearly on the Kola Peninsula. Since February 2022, Russia has accelerated upgrades to key military sites across Murmansk Oblast, strengthening its Arctic posture in response to NATO’s growing presence in the north.

Monchegorsk, one of the region’s most strategically important air bases, has seen notable developments. It hosts the 98th Guards Composite Aviation Regiment, equipped with Su-24M strike aircraft, Su-24MR reconnaissance jets, and MiG-31BM interceptors — critical assets for Russia’s Arctic air defense and rapid response capabilities.

According to the The Barents Observer the nearby settlement, “27 km,” housing military personnel, was designated a “courageous air force settlement” in 2025, reflecting its heightened role. Infrastructure improvements, including a new clinic and a renovated school, further suggest long-term investment in sustaining operations at the base.

Similarly, Olenya Air Base (68.1446, 33.4637) now hosts long-range bombers used in Ukraine, with satellite images confirming heightened aircraft activity.

Since 2022, Olenya Air Base on Russia’s Kola Peninsula has undergone significant militarization, transforming into a central hub for strategic aviation operations. Satellite imagery from 2024 and May 2025 reveals a heavily utilized tarmac, with a marked increase in stationed aircraft, including Tu-95MS and Tu-22M3 bombers, as well as updates to missile silos west of the runway.

Since 2022, Olenya Air Base on Russia’s Kola Peninsula has grown into a key strategic hub, with satellite images from August 2024 showing 39 Tu-22M3 bombers and 11 Tu-95MS bombers on-site — nearly all parking areas occupied. There was also a new white silo, hiding essential equipment, not meant to be spotted from space.

To counter Ukrainian drone strikes, Russia has placed up to 25 tires per wing on aircraft to disrupt image-based drone targeting and covered 13 rows of fuel tanks with protective mesh. Air defenses nearby include six S-300, S-400, or Buk-M3 launchers in ready position, supported by three electronic warfare antennas and a GPS jamming unit, underscoring the base’s elevated threat posture near NATO borders. From here, Russia flies nasty attack operations into Ukraine.

A GPS jamming system is also visible, and so is the air defence. These measures signal Moscow’s concern: the base, located just 150 kilometers from Finland and 200 kilometers from Norway, has become a high-value target as Ukrainian drone capabilities extend deep into Russian territory.

And Severomorsk (1-2–3). Once believed to have been permanently closed in 1998, Severomorsk-2 airbase on Russia’s Kola Peninsula is now firmly back on the radar. Its runway not far from Murmansk City, is visibly in disrepair, and is undergoing refurbishment under direct orders from the highest levels of Russia’s military command, with full modernization planned by 2030.

According to Northern Fleet commander Admiral Alexander Moiseyev, the base is part of a broader Arctic infrastructure overhaul, which includes the reconstruction of seven airstrips — among them Severomorsk-1, Severomorsk-2, and Severomorsk-3 — and the construction of two new airstrips at Nagurskoye and Temp, designed to accommodate all types of long-range, transport, and naval aviation, so the russian news agency TASS, from early June 2022.

These developments, paired with visible upgrades to other Arctic military facilities, reflect a clear intent by Moscow to re-militarize the High North and secure its logistics and deterrence posture amid growing NATO presence near its borders.

“We plan to build two airstrips and reconstruct seven, including Severomorsk-2, by 2030,” said Admiral Alexander Moiseyev, commander of Russia’s Northern Fleet, in 2022.

Many of these upgrades at the Murmansks Airstrip may therefore appear unrelated to Ukraine or Finland’s NATO membership — but in reality, they could offer the Kremlin added flexibility to obscure conflict-related military changes in Murmansk under the guise of long-term Arctic development.

The military analyst Emil Kastehelmi documented how Russia is quietly revitalizing its northern air infrastructure in Murmansk Oblast — home to five key airbases: Severomorsk-1, -2, -3, Monchegorsk, and Olenya. Severomorsk-2, reactivated in 2022 as a helicopter base, while Severomorsk-3 saw new protective fighter shelters built in 2024, likely in response to the rising Ukrainian drone threat.

At Olenya, strategic bombers like the Tu-95 and Tu-22M3 — used in long-range strikes against Ukraine — have been concentrated for added security, with at least one Ukrainian drone attack reportedly damaging a bomber in July 2024. Meanwhile, Severomorsk-1 has had fighter shelters repaired, and Monchegorsk remains unchanged.

A norwegian Olygarch in Murmansks that can help build airstrips

For Mumansk to flourish and to be valuable militarily it needs airbases. And who could build them better than companies from abroad.

Atle Berge is a Norwegian businessman who established a significant presence in Murmansk, Russia, through his company Ølen Betong Murmansk AS, a subsidiary of the Norwegian concrete firm Ølen Betong. He initiated operations in Murmansk in 2007, capitalizing on the region’s construction boom, particularly in infrastructure and energy sectors.

In 2016, Berge was expelled from Russia on vague accusations of espionage, allegedly for collecting information for Norwegian intelligence services. This expulsion barred him from entering Russia for ten years. However, in 2022, he returned to Murmansk after obtaining a new visa and work permit, resuming his role at the concrete production plant.

Upon his return, he reported securing contracts worth 500 million rubles (or 5.7 Million Euro) and mentioned working on a larger project, indicating ongoing involvement in substantial construction endeavors in the region.

There it is important what Berge’s firm really does. One key area are so called road slaps and more specifically, air field slaps. With Ølen Betong Murmansk precast concrete slabs, as advertised on the website (Link), he could become a important supplier to the military government in the region.

These slaps are indeed suitable for military-grade surfaces, and with proper engineering, they could be used to construct temporary airstrips or support areas in regions like Murmansk. This aligns with the kind of dual-use infrastructure often developed in militarized Arctic zones.

Murmansk Naval Bases

Russia’s region on the Kola Peninsula, has actually several major naval bases and acts more than ever as a linchpin of Putin’s 2025 naval power. The dense network of strategic locations for submarines and vessels underpin its military posture in the Arctic and against NATO’s northern flank.

Severomorsk (69.0769°N, 33.4178°E) serves as the headquarters of the Northern Fleet, coordinating surface and submarine operations across the Barents Sea. In Severomorsk, the russia’s Project 22350 amred frigate Admiral Gorshkov is also stationed.

Noticable, as in late 2024, the Admiral Gorshkov returned to Severomorsk after a historic 226-day deployment — the first by a Northern Fleet vessel armed with hypersonic missiles, including Zircon and Kalibr, across the Atlantic and Mediterranean.

Whether a vessel is in port or not can — though not always — be a telling indicator of heightened naval, and infact waring activity. In April 2022, shortly after the invasion began, OSINT analyst Thord Are Iversen (@The_Lookout_N) noted that the frigate Admiral Gorshkov had disappeared from Severomorsk.

Sentinel-2 imagery from April 19 confirmed it had departed sometime after the 15th, with a submarine now occupying its berth — previously documented on Google Earth in 2020. When comparing Planet satellite images of the naval base from February 22 and April 24, 2022, the shift is striking: multiple vessels, including Gorshkov, had deployed to sea, reflecting a rapid operational response.

It started out from here in November 2024, then visited Alexandria, the English channel, and entered with it a long term deployment in the mediteranien sea, highly explosive territory. Now in May 2025 (6. of May), the Admiral Gorshkov returned back to this strategic naval location, and its capitain received turkey (photo).

Though there is no public records that this vessel was involved in Ukraine. But in November 2024, it did conduct naval drills in the Atlantic Ocean and the English Channel, and there simulated responses to both air and sea drone attacks, according to the Russian Ministry of Defense.

Severomorsk itself does not house many submarines, but it is indispensable to Russia’s submarine operations in the Arctic, acting as the operational command center for the entire Northern Fleet — home to the country’s largest and most capable submarine arsenal.

A shot from 2020, a 151 m long, Russian nuclear-powered attack submarine, most likely from the Oscar-II class (Project 949A Antey) which are frequently operated out of Severomorsk or possibly an Akula-class (Project 971) — both of which are common in the Northern Fleet

In recent months, many of the vessels have returned to that location. Whether this signals a broader buildup of strategic assets remains unclear and would be premature to interpret.

At the Polyarny (69.1989°N, 33.4472°E), several war vessels have their port in Yekaterininskaya, Murmansk. It functions as a vital repair and maintenance hub, ensuring fleet readiness. The base and its shipyards is so important that in April 2022, the U.S. Department of the Treasury imposed sanctions on Shipyard №10, located in Polyarny, due to its involvement in supporting Russia’s military activities, including the war against Ukraine. Right left to it war vessel base is the Polyarny submarine base.

Satellite images show that submarines occasionally appeared in port in 2021 and earlier. In 2023, @MT_Anderson identified several naval assets at the site, including four Kilo-class submarines (possibly one Lada-class), as well as various anti-submarine and mine countermeasure vessels.

Can we infer anything from the absence of submarines? Their absence at key bases in Murmansk, such as Polyarny or Gadzhiyevo, can signal heightened operational activity, including strategic patrols, dispersal to avoid detection or attack, or increased readiness in response to NATO movements or conflict developments.

While not definitive on its own, such absence — especially if observed across multiple sites — may reflect a broader shift in Russia’s naval posture. But should never be analyzed alone but alongside other indicators like support vessel movements, logistics buildup, and regional military exercises. We see subs stationed in various years since March 2022.

Olenya Bay (69.2050°N, 33.4470°E) supports special mission submarines under the Main Directorate of Deep-Sea Research (GUGI), reflecting Russia’s focus on undersea intelligence and sabotage operations.

Collectively, these naval installations for the norther fleet that fortify Russia’s strategic depth in the High North, enabling power projection, securing the Northern Sea Route, and serving as a counterbalance to NATO’s presence in the region — can be counted (thanks to spotting of OSINTers like MT Anderson).

Grand Total: 13 submarines spottable since 2022 on open source satellite images

Many of the submarines are either on a mission or are moored under some sort of structure. Because only a fraction are visible. As of early 2024, russian sources suggest that the entire Russia’s submarine Northern Fleet fields at least 36 submarines distributed across Zaozersk, Gadzhiyevo, Vidyaevo, Polyarny, and Olenya Guba, underscoring the Kola Peninsula’s continued role as the nuclear and covert nerve center of the Russian Navy.

At Gadzhiyevo Naval Base (69.26°N, 33.32°E), the presence of four Delta IV-class SSBNs, one Borei-class SSBN, and two Akula-class SSNs suggests a near-complete concentration of Russia’s sea-based nuclear deterrent, potentially during a maintenance or rearmament cycle. At Olenya Guba (69.21°N, 33.36°E), both Podmoskovye (BS-64) and Orenburg (BS-136) — modified Delta-class subs used for deep-sea and special operations — were docked, while the intelligence-gathering ship Yantar was notably absent, indicating potential deployment. Meanwhile, Polyarny Naval Base (69.20°N, 33.47°E) hosted four Kilo-class submarines (possibly including a Lada-class) alongside several mine warfare and anti-submarine vessels, underscoring its role in coastal defense and patrol.

On December 5, 2024, U.S. company Capella Space released a detailed SAR satellite image of Russia’s Gadzhiyevo naval base, clearly showing submarines like the K-157 Vepr and a 667BDRM-class SSBN — imagery made possible by radar tech capable of peering through clouds and darkness.

Gadzhiyevo’s assets forming a critical component of its nuclear deterrent. Its Naval Base (69.2552, 33.3373) shows ongoing construction and frequent deployments. Interestingly, in 2020, Vladimir Putin gave the Northern Fleet its own command — an unmistakable nod to its growing importance in the Arctic. But in a quiet shift in March 2024, that autonomy was scrapped. Now folded back into the Leningrad Military District, the move signals a strategic pivot: Moscow is centralizing control as it hardens its military posture along NATO’s northern edge.

More bases

Vidyaevo (69.3158°N, 33.2781°E) supports attack submarines, enhancing Russia’s undersea warfare capabilities. Zapadnaya Litsa (69.4811°N, 32.3511°E), located approximately 60 kilometers from Norway’s border, has seen increased activity with the deployment of advanced Yasen-M class submarines, such as the Arkhangelsk, bolstering Russia’s long-range strike potential.

Nearby Olenya Bay (69.2473, 33.3355) — a base for deep-sea intelligence submarines under the GUGI unit — has seen notable infrastructure growth.

Severomorsk-1 Air Base (69.0561, 33.4186), the main hub for naval aviation, has expanded both its aircraft fleet and facilities, while Severomorsk-2 (69.0636, 33.4743) is being reactivated for anti-submarine helicopter operations.

Monchegorsk Air Base (67.9081, 32.8329) plays a growing role in Arctic air patrols, with increased fighter and bomber movements observed.

Meanwhile, Kamenka Base (67.8748, 30.0905), close to the Finnish border, has expanded rapidly with new troop housing and visible deployments — all signaling a sharpened Russian military posture in the High North, as the New York Times reported.

LLM for Satellite observation

Lets have another look at Russia’s Olenya Air Base the Kremlin where Russia uses strategic bombers to carry out flights targeting Ukrainian positions, according to Ukrainian sources.

Large language models like ChatGPT claim to be increasingly capable of assisting with satellite image analysis, particularly in open-source investigations. I put it to the test and provided two clear satellite images of the same location — Russia’s Olenya Air Base — to compare structures, count visible aircraft or vehicles, detect land-use changes, and identify signs of military expansion or reactivation.

ChatGPT failed horribly. It counted 46 for the image in June 2021 and 116 for the one taken in August 2024. In reality, there were 34 plus 6 Helicopters were visible for 2021 and three years later 46 plus 6 helicopters — mostly so fighter jets. Not great — When I asked to pinpoint the changes and the planes on the original input images, it gave me completely wrong assessments. But the idea is there any image analysis is improving at vast speed.

Interpreting visual patterns with contextual military knowledge and open-source reporting hasn’t revealed clear signs of aggression — but it’s proven useful in identifying what’s worth watching. For example, noticing an uptick in strategic bombers like the Tu-95MS and Tu-22M3 signals increased offensive potential. To investigate further, I asked how these aircraft appear in satellite imagery: the Tu-95MS stands out with its massive 50-meter wingspan, long straight wings, four turboprop engines casting spiky shadows, and a twin-fin tail forming a distinctive “plus” shape from above. In contrast, the Tu-22M3 is shorter (about 34 meters), with a sharp, needle-like nose and a single, prominent fin — easy to spot if you know what to look for.

So we can „fingerprint“ those planes. And indeed those planes were present on May 19, 2025, on the base (Xpost). According X account @avivector 5 Tu-95MS (Bear-H), 5 An-12 (Cub) and 38 Tu-22M3 (Backfire-C)

All of these have different functions. There is Luostari Airfield in Murmansk Oblast, that has received minimal attention in 2025. Actually in 2019 believed to have been closed down for good, since 2022 satellite images showed signs of construction of a Rezonans-N radar station nearby, designed to detect stealth aircraft like the F-35. In 2022 still under construction on a hill near the site, latest Planet images suggest it could be finalized now.

Airspace violations for Murmansk

Airspace violations remain a critical indicator of regional tension. Several high-profile incidents have been recorded, including one on June 10, 2024, when four Russian military aircraft reportedly breached Finnish airspace near Loviisa, penetrating 2.5 kilometers into the country. Experts point to the proximity of Murmansk Oblast — home to multiple key Russian airbases — as a likely launch region for these aircraft.

But also Ukraine reaches for Murmansk, as its strategic importance is known. In 2024, Ukrainian drones reportedly struck Olenya Air Base in Russia’s Murmansk region — located roughly 1,800 km from the Ukrainian border — damaging at least two Tu-22M3 strategic bombers. Russian Telegram channels and flight tracking data indicated that Murmansk Airport was temporarily closed due to the drone threat, marking the deepest known Ukrainian UAV penetration into Russian territory to date. On September 11, 2024, Russian sources claimed that drones targeting Olenya Airfield in the Murmansk region may have approached from Norway and Arkhangelsk, though it could never have been verified.

Conclusion

The upgrades, the increased personal, attention, investment and also seemingly strategic changes in the military and business related assets visible here in the analysis for Murmansk, are not new. Already in 2017 did analysts and investigators notice upgrades, such as by DFRLab. “Not only did the fleet receive new S-400 Triumph SAM systems, but these systems are of high combat-readiness — having been sent straight from their previously deployment in Syria”, so Lukas Andriukaitis.

The latest push however — in after February 2022 but also particularly for Feb 2025, the results reflect worries for findinds from other parts of the finnish border.

Last week, satellite images published by The New York Times — and confirmed by NATO sources — revealed a sharp increase in Russian military infrastructure along the 1,300-kilometer border with Finland, including new troop camps, vehicle depots, and air facilities. Notably, over 130 tents capable of housing 2,000 soldiers have been set up in Kamenka, while the Severomorsk-2 airbase in the Arctic is being reactivated as part of the broader buildup.

In November 2024, reports surfaced alleging that Chinese companies were supplying Russia with drones and related components for use in Ukraine. The European Union proposed sanctions against several Chinese firms accused of aiding Russian drone development. The United States also imposed sanctions on Chinese entities involved in manufacturing drone parts for Russia. There is clearly growing concerns over China’s role in supporting Russia’s military capabilities amid the ongoing conflict.

Politically, these developments have strained China’s relations with Western nations. China has so far largely denied supplying military drones to Russia, criticizing the EU’s proposed sanctions as “double standards.” German officials have warned of “consequences” if China’s support for Russia’s military is confirmed. It highlights the complex geopolitical landscape, with China balancing its strategic partnership with Russia against the risk of further alienating Western countries.

Searching for a Smoking Gun: Chinese Companies Supplying War Drones to Russia

During a recent visit to a trade fair in China, my colleague encountered two companies openly claiming to sell military drones to Russia. One of these companies, Hangchen, shares videos of drone tests conducted abroad. One particular video raises significant concern — it appears to have been filmed in Russia, showcasing a loitering drone allegedly tested for use in Russia’s war against Ukraine.

The evidence becomes more compelling on the company’s website. Multiple drones, including those advertised as “suicide drones,” are prominently displayed. Notably, an image of the loitering drone featured on the site appears to be exclusive to this platform, suggesting that this product is uniquely associated with Hangchen and is indeed being marketed and potentially sold for such purposes.

The video that should bring the final proof for the supply of drones, and which I analyzed shows multiple indicators supporting its authenticity. The six-second recording captures a drone in flight towards its target. The interface resembles a desktop computer display and includes overlayed measurement data, similar to other drone videos our newsroom has analyzed from social media.

During the flight, dynamically updated coordinates are displayed, suggesting the use of a live system controlling the drone in real time. Translations of the on-screen elements reinforce this impression. The bottom-left corner of the screen shows the label “OSM” (On Screen Display), a feature for toggling the local display. In the background, a map with labels in Cyrillic and English provides geographic context.

Change over time: Paved Area Constructed Between September 2021 and November 2021, months before the war started against Ukraine.

The area cannot be located using Google Earth images, which raises the possibility that commercial satellite companies are either restricted from publishing them or their imaging efforts were interfered with by Russia. The exact reason remains unclear.

I was able to geolocate the scene to a 1.5 square kilometer area near a farm and motocross track. Exact coordinates (56.121799911479194, 35.02824123821889) point to a region where current Google Maps imagery is unavailable. Planet Labs satellite imagery shows a paved area visible in October 2024, which first appeared between September and November 2021.

Brief Background Window Display Before Impact

In the sixth second, just before impact at the target — a white and blue-marked cross between hay bales — a brief popup window appears in the background. This suggests synchronization between the map display and the drone’s live tracking.

Another notable feature is the presence of yellow lines, which visualize the drone’s flight path heading east. My research confirms that these lines match real-world satellite imagery, verifying the drone’s trajectory from west to east.

To further validate the video, I analyzed satellite images from Planet Labs. The paved area visible in the footage aligns with images captured in October 2024. An anonymous expert confirmed the video’s authenticity.

The video was not found online during extensive research, suggesting it may have been created directly by the Chinese manufacturer or commissioned. However, the exact origin remains unverified.

Find our investigation here: https://www.sueddeutsche.de/projekte/artikel/politik/drohnen-russland-china-ruestungsexport-e188105/

The Intelligence community was actively warning Americans, be prepared for a disinformation storm. This is how US media framed it at the beginning of November, when at least two fake videos appeared on the internet, that wanted to divide, decept and spread anger. After careful analysis, the videos were found to be created by russian actors. Its these and other examples that will remain with us, in this review of OSINT cases on the 2024 US presidential election.

Not long before the election, a Homeland Security bulletin warned that domestic extremist groups could plan on sabotaging election infrastructure including ballot drop boxes, so-called soft targets. Back then, a little more than two weeks away, there was a federal intelligence alert warned that domestic violent extremists consider election equipment such soft targets.

In the run-up

A leak on the 2022 Midderns featured Telegram chats of known members trying to convince others how to work the field to intimidate voters. In the DDos Leak called “Paramilitary Election Interferences”, that covers leaked chat logs and files detailing alleged efforts by U.S. paramilitary and far-right groups to disrupt elections, a peak behind right-wing extremists groups in the US shows how plans were cast to affect the 2022 midterms. In general, it’s about the American Patriots Three Percent militia group (AP3 or APIII).

American Patriots Three Percent: AP3 or APIII

American Patriots Three Percent (AP3), a far-right militia group aligned with the Three Percenters movement, has actively used social media platforms like Facebook for recruitment. A 2021 leak from a right-wing website exposed the identities of numerous members, shedding light on the group’s network. Founded by Scot Seddon during Barack Obama’s first presidential term, AP3 continued to grow, with Seddon turning to TikTok in July 2024 to recruit new members after an assassination attempt on Donald Trump.

Jesse Eisinger, Propublica Editor, called Seddon in August “one of the most dangerous men in America”. He features in the files and we can search for him and his details.

In the roughly 200GB of data from DDos Secrets, a search for the key members of the right-wing group America First Precinct Project (on a system called Aleph), highlights the group’s practical motivation to election interference.

Sweet talking Carolyn

In one message, Carolyn S., one of the key influencers, who, when asked “How to get started,” wrote, “…I imagine there are drop boxes in rural areas as well to help those who cannot or don’t want to drive to the city to get the ballots in.”

In another exchange, when asked if the strategy is illegal, Carolyn S. replies: “There is a boundary line to the boxes, and it is documenting and recording those attempting to drop ballots after ballots in the boxes. States are also training Americans to work the polls and be poll watchers. That’s what we will be doing. Nothing illegal about that…”

The bottom line

Turns out that this freely available data is quite the goldmine for exposing right-wing voters’ fraud. Several investigations used it to show the data confirms organized, far-right movements weaponized voter intimidation and election fraud myths to manipulate and undermine election outcomes. It’s not just rhetoric — it’s documented plans, coordinated efforts, and detailed evidence of action.

Let us dig into the data in Aleph. Let us open Hunter, DDos Secrets data sharing platform. “Hunter” is similar to the interface OCCRP is providing its users. The Aleph data interface is a powerful platform designed to help investigative journalists search, analyze, and cross-reference large datasets of leaked documents, public records, and structured information. It allows journalists to uncover hidden connections between people, companies, and assets by linking entities across various sources, such as leaked emails, corporate registries, and sanctions lists. Journalists use Aleph to streamline complex investigations, identify leads, and expose corruption, organized crime, and financial mismanagement.

Website to do OSINT searches: https://hunter.ddosecrets.com/

The content

Let us speak about the big issue: Voter suppression efforts. The data shows detailed plans to monitor polling stations with the intent of intimidating specific voter groups, including but not limited to minorities, immigrant communities, and marginalized populations. Leaked documents showed direct calls for armed presence at ballot drop boxes to deter voters.

Moreover, visual evidence show photographs from these communications show individuals in tactical gear near polling sites.

The Data shows Disinformation campaigns and evidence of false narratives about election fraud spread in targeted communities. Coordinated sharing of templates for social media posts and flyers designed to mislead voters about voting dates, locations, or eligibility requirements.

The logs also reveal internal group communications. Logs detailing step-by-step strategies to execute voter intimidation, by wearing uniforms to look official, filming voters to scare them. Chat discussions encouraging members to focus on precincts with high turnout from opposing demographics.

There was also evidence of Election System Infiltration. Documents outlining efforts to take over local election boards or influence precinct-level operations, leveraging Steve Bannon’s “precinct strategy.” There were Names of individuals who were tasked to infiltrate and disrupt election certification processes. We used this in the search process to find more data on those actors.

Strong evidence on media influence is shown in the chat logs. A coordination with right-wing media outlets was to amplify conspiracies, framing the interference as “patriotic” election oversight. The Groups also used media narratives to recruit members for their election interference operations.

Violent rhetoric is also visible in the data. Explicit discussions about using intimidation tactics or even violence to “secure elections.” Threats directed at election officials, volunteers, and journalists who opposed their views.

The research is accompanied by videos, wants to recruit people to the AP3 Group:

In a lengthy monologue, Scott Seddon details his reasons for founding AP3 and describes how he formed an intelligence team to counter the fallout from the 2021 membership leak. Following the exposure, members of the group were contacted by the media, with some being publicly “doxxed.”

Seddon assured his followers, stating, “Anyone who has an issue with someone contacting them, AP3 has your back.” This declaration extended to journalists who reported on Seddon or his team, implying potential retaliation.

Election Fraud Videos

Shortly before election day, a video emerged on social media platforms, including X and Telegram, featuring an anonymous individual alleging large-scale voter fraud in Arizona. The video claimed that election officials were involved in a coordinated effort to manipulate votes against Donald Trump. This content quickly gained traction among conspiracy theorists and influencers.

U.S. federal agencies, including the FBI and the Cybersecurity and Infrastructure Security Agency (CISA), identified this video as part of a Russian disinformation campaign aimed at undermining public confidence in the electoral process.

The Arizona Secretary of State’s office refuted the video’s claims, confirming them as false.

The video surfaced on social media, allegedly showing an anonymous whistleblower claiming large-scale voter fraud in Arizona.

It quickly gained traction on platforms like X (formerly Twitter) and Telegram, where it was amplified by conspiracy theorists and influencers.

The video suggested election officials were involved in a coordinated effort to “steal votes” from Trump supporters.

The Indictment read that “the investigation has revealed that Doppelganger purchased numerous social media advertisements targeting U.S. politicians and relied on artificial intelligence to generate the content”. In the focus here since 2022, Sergei Kiriyenko, the First Deputy Chief of Staff of the Presidential Administration of Russia.

Abover all, one person was named in the indictment documents: Sergei Vladilenovich Kiriyenk. 33 times he appeared in the 277 page long document. According to the in London living researcher Kamil Galeev Sergey Kirienko born Sergey Israitel in a mixed Russian-Jewish family - rose from modest beginnings in subtropical Sochi to become a pivotal figure in Russian politics. Galeev written an excellent X thread on the figure Kirienko.

After adopting his mother’s Slavic surname, likely to improve career prospects in the USSR, he began his bureaucratic path as a Komsomol leader, benefiting from the organization’s influence during the Soviet-to-post-Soviet transition.

A shipbuilding graduate and former army officer, Kirienko leveraged his connections in Nizhny Novgorod’s political and business circles, including Boris Nemtsov, to secure key roles in Moscow. Appointed Prime Minister at just 35, his tenure faced economic catastrophe during the 1998 default, but his career revived under Vladimir Putin’s technocratic governance. Known for his pragmatism and adaptability, Kirienko remains a central figure in Russia’s managerial elite. Since 2022 did the US impose sanctions on Kiriyenko, along with his son Vladimir for their connections to the Russian government.

Another fake video, and another

“The FBI said it is “aware” of two fake videos claiming to be from the agency and related to the 2024 election”, so the report by several US media early November. The FBI has then issued warnings about two fake videos circulating online, part of a larger Russian disinformation campaign targeting the 2024 U.S. presidential election.

The videos, flagged for spreading false claims about ballot fraud and Vice President Kamala Harris’ husband, Doug Emhoff, are part of a sophisticated network producing hundreds of similar fakes this year.

A video featuring a Haitian immigrant claiming he is planning to vote multiple times in Georgia has been viewed more than half a million times. It hit where it was heard. For instance, by Amy Kremer, a republican politician, who used it to question the democratic process.

The video featuring a supposed Haitian immigrant claiming intentions to vote multiple times in Georgia has amassed over half a million views and became a talking point for Republican politician Amy Kremer, who used it to cast doubt on the integrity of the U.S. democratic process. However, OSINT investigations have revealed the video as part of a larger Russian disinformation operation designed to destabilize trust in the electoral system.

On November 1st, the the Office of the Director of National Intelligence (ODNI), the FBI, and Cybersecurity and Infrastructure Security Agency (CISA) announced on Twitter it can link the videos to Russian influence actors, who “manufactured a recent video that falsely depicted individuals claiming to be from Haiti and voting illegally in multiple counties in Georgia”.

OSINT Analysis

A week ago, I caught up with an old friend about the US election. He mentioned watching a stream on the conservative platform Rumble and confidently asserted, “It’s all rigged anyway.” I reassured him that the U.S. election system is widely regarded as secure, with multiple studies, reports, and expert evaluations supporting its resilience against large-scale fraud.

This backdrop makes a recent CNN report all the more concerning a pro-Trump influencer from Massachusetts, using the X handle @AlphaFox78, was reportedly paid by Russian propagandists to circulate misleading videos promoting election fraud narratives. One video, widely debunked now, featured a supposed Haitian immigrant claiming “he planned to vote twice in Georgia for Vice President Kamala Harris”.

SimeonBoikov, aka ‘Aussie Cossack’, a Russian propagandist podcaster who was granted Russian citizenship, according to a decree signed by President Vladimir Putin last year, has allegedly offered the 650,000 X Follower strong AlphaFox78 $100 to post the fake video.

I scanned the account @AlphaFox78 for details. The website in the X Bio is completely redacted, so no real news there. The account maintains an online shop with questionable merch, and its X and YouTube account show no signs of intel on the person behind it. More telling, is leak data. It unearthed the name of “Josh K.”, and an email that leads to two email addresses (one for a gaming account) and one to East Longmeadow and a prominent Cash App, an account at the conservative streaming platform Rumble (AlphaFox1978), 24 items sold on eBay, and interestingly, a now-private “Bible” account, as well as Google images from a remote lake in Maine.

In at least one occasion, AlphaFox used a false ID/persona, under the name “Bob M.”. Additionally, and perhaps telling, K. owns an Adobe account, which might be used for creating family images but might also be used to create videos — and possibly not merely “sharing videos” as claimed, but potentially producing videos himself for the purpose to mislead and misinform.

For Simeon’s publicly shared email account, I came across some stiff-lipped Russian thumbnails featuring Russian buildings and uniforms (see above). On his Google Review account, one review read (redacted for privacy):

“Really nice girl works at XXX shoes (a shoes store in Austr.) who is very polite and beautiful. She is very knowledgeable and helpful. I will definitely buying my next pair of Orthopedic shoes from XXX. P.S. I promise not to be jealous when the other customers come to buy shoes from her”.

Network of russian disinfo videos link to new fakes videos for US election

To link it to Russia, analysts need to compare it to other material. Such material exists. In the form of 300 Video found by online research firm Logically. The video, that even featured the FBI logo, matched a certain video style of those videos. Foremost, the type of “convincing graphics and text to look like content from US government agencies as well as more than 50 news organizations” convinced the OSINT researchers.

CheckFirst, the Finland-based analytics company, independently investigated the network behind the videos and traced their origins to a Russian marketing agency and a Russian-associated IP address.

In a report from September (PDF), a identifying feature was the following: “…Content amalgamation, or the blending of different content formats to create multi-layered stories, remains a key tactic of the campaign”.

“CheckFirst found that the style, messages and themes of the videos align with other operations connected to the Kremlin, an assessment backed up by BBC Verify research.” BBC Reporting

Among the targeted organizations of the so-called “Operation Overload” back then was interestingly also the German media, among it, Süddeutsche Zeitung, according to CheckFirst:

Firstcheck speaks of another clue that links the videos to Russia: “The other source of evidence is a data set we got access to that proves that one of the machines that was used to send emails [by the group] was located in Russia”, says Guillaume Kuster from CheckFirst.

But how? Professional tactics suggest this can be done by using metadata revealed the email’s point of origin, the use of WHOIS data that tied domains to a Russian agency or a network analysis linked the IP address to Russian-controlled infrastructure. Here is a tool set for this:

Metadata Analysis of Emails: MXToolbox Email Header Analyzer (By analyzing the email headers, investigators can trace the email’s journey and identify the originating server’s IP address, which can then be geolocated to determine its origin)

WHOIS Lookup for Domain Registration: ICANN WHOIS Lookup (Investigators can uncover the ownership and registration details of domains used in disinformation campaigns, potentially linking them to known entities or regions)

Reverse DNS and IP Address Tracing: Shodan (By inputting an IP address, investigators can discover associated domains, services running on the IP, and other connected devices, helping to map the infrastructure behind a disinformation campaign.)

Network Traffic and Botnet Analysis: Maltego (Investigators can map relationships between domains, IP addresses, email addresses, and other entities to identify patterns indicative of coordinated disinformation efforts.)

Data Set Correlation and Infrastructure Analysis: VirusTotal (By submitting suspicious files or URLs, investigators can determine if they are part of known malicious campaigns and identify commonalities in infrastructure used across different disinformation efforts)

Efforts to fight disinfo

Much cant be done, once a video is shared millions of times. For the US government, it then becomes a matter of damage control. That means, according to officials, flooding the scene with counter material, footage and information that outperform the fake stuff. One of such initiatives is CICA’s following campaign:

Cica is fighting disinformation during the election period with a website called Rumor-vs-reality. It is supposed to answer false suspicions such as “A malicious actor can easily defraud an election by printing and sending in extra mail-in ballots”, by responding with: “Committing fraud through photocopied or home-printed ballots would be highly difficult to do successfully…. (by applying) information checks, barcodes, watermarks, and precise paper weights.”

The thing with AI

Research from the Institute for Strategic Dialogue found interesting evidence that not the AI-generated content is a problem. Much more, the fact that opposition voters will double the authenticity of content online. Most often of content, that was authentic.

The found that during the U.S. election, the primary issue was not the prevalence of AI-generated content, but rather the widespread misidentification of authentic material as AI-fabricated. ISD’s analysis found that users misidentified content in 52% of cases, often claiming authentic content was AI-generated and justifying their assessments with flawed OSINT strategies or unreliable online tools. (ISD Global) This trend underscores a growing skepticism among voters, leading to doubts about the authenticity of genuine information and highlighting the need for improved digital literacy and critical evaluation skills.

I collected a number of OSINT tools to spot false or AI generated content.

Since a friend asked me recently about verifying the authenticity of images or videos — especially in the age of AI-generated content — here are 6 free tools/platforms for forensic image analysis:

Forensically: online suite offering tools like clone detection, error level analysis, and metadata extraction to analyze digital images. https://lnkd.in/dnm3HBBY

VideoCleaner: A free, open-source forensic video enhancement software used by law enforcement and investigators to detect tampering and enhance video quality. https://lnkd.in/d8zfJhYH

Ghiro: An open-source digital image forensic analysis tool that automates the process of analyzing image files and extracting metadata.
(Image Forensic) https://lnkd.in/dXBND5x6

Sherloq: An open-source image forensic toolset designed to analyze and detect anomalies in digital images, including potential manipulations. (GitHub) https://lnkd.in/dqZn_hX7

PhotoRec: A free, open-source utility for recovering lost files, including images and videos, from various storage media. It can be useful in forensic investigations to retrieve deleted media. PhotoRec: https://lnkd.in/d6W7ZUC9

InVID-WeVerify: A browser extension that assists in verifying the authenticity of images and videos shared online by providing tools for reverse image search, keyframe extraction, and metadata analysis. https://lnkd.in/diqsrMVH

Verdict is: Not so greatly effective. While direct data on user engagement is lacking, the “Rumor vs. Reality” webpage serves as a vital component of CISA’s strategy to counter election disinformation, providing reliable information to both the public and election officials.

The Russian embassy, as expected, dismissed the allegations of fake videos linked to Russian actors as “baseless” and “slander.”

However, the impact of these videos was minimal. They garnered only a few thousand views and were primarily spread by likely bot accounts with negligible influence on the platforms mentioned.

On the other hand, the recognition that Russian actors are trying to meddle with US democratic process, may be even more important. Just check out the post by Scripps News national correspondent Elizabeth Landers, former Vice reporter when she announced the video of ballots cast for Trump allegedly being ripped up in Bucks County was manufactured and disseminated by Russia: almost 3 million impressions online. As if Russian hopes to be recognised as being a disruptive factor.

The final verdict: If Russia intends to influence a U.S. election of this magnitude, it must deploy far more sophisticated strategies than poorly crafted fake videos mimicking legitimate media reporting. Even with AI-generated content, such efforts fail to make a significant impact.

However, these seemingly small attempts send a loud and troubling message: that democracy is under attack by Russia. This signal, though subtle, carries dangerous implications that should not be underestimated diplomatically.

On a positive note, many of these videos were swiftly removed from the internet — a notable achievement for tech companies like X and YouTube, which have historically struggled with such enforcement. In this instance, they acted decisively, aligning closely with the directives of election and intelligence authorities.

TJ

As tensions mount in the Russia-Ukraine conflict, new intelligence points to North Korea’s increasing role in supplying Russia with much-needed munitions. Through OSINT (Open Source Intelligence) methods, we can trace the secretive routes these weapon shipments take, uncovering the networks of ships, rail transport, and storage depots. This post dives into what we know about these covert operations, examining satellite imagery, vessel tracking data, and trade analysis to shed light on the illicit arms trade fueling Russia’s war efforts.

In October 2023, White House officials presented satellite images showing stacks of covered goods at a rail station on the Russia-North Korea border, believed to be weapons shipments from North Korea to Russia. Kim Jong Un’s regime has been accused of sending arms to Russia in exchange for food and fuel, a practice dating back to 2022, when the Ukraine war began. The New York Times previously reported on this trade, which has been condemned by the U.S. government. Now South Korea alleges that food and fuel is not anymore the central factor. North Korea wants satellites and updates on its old military tech. Russia will bring change and take the shells, vehicles and troops in the meanwhile for a crippling war it leads.

Recently, the situation has escalated with reports of so-called ‘ghost ships’ covertly transporting military supplies to Russia since late 2023. This raises pressing questions about where and how these exchanges are taking place, and why international actors have yet to intervene.

The volume of North Korean munitions flowing to Russia, particularly after Kim Jong Un’s visit last year, likely surpasses the military aid Ukraine has received from Western allies such as the U.S. and EU at various points in the conflict. This highlights North Korea’s increasingly pivotal role in propping up Russia’s war effort, especially as Moscow grapples with critical ammunition shortages.

Deliveries are primarily conducted by sea, involving several shipments of munitions and possibly other military hardware. These transfers are substantial, suggesting a significant boost to Russia’s military capabilities. While precise figures remain elusive, the shipments reportedly include large quantities of artillery shells, rockets, and potentially other military supplies.

The use of ‘dark vessels’ — ships that disable their AIS tracking systems to evade detection — has become a key tactic in these operations. This method, also observed in Russian ship-to-ship transfers to circumvent sanctions, enables the clandestine transport of arms.

Supply chain

Key ports facilitating this trade are Najin (Rajin) in North Korea and Vostochny and Dunay in Russia. A significant number of vessels involved in these operations have been observed turning off their AIS tracking systems to evade detection, a tactic recorded in at least 19 instances since late 2023.

Once the munitions arrive at Russian ports, they are often transported by rail to strategic storage facilities like Tikhoretsk, which supports Russian operations closer to the Ukrainian front. Shipments include artillery shells, rockets, and potentially other military equipment, according to analysts. The scale of these transfers has grown since Kim Jong Un’s 2023 visit to Russia, with an estimated 7,000 containers of munitions delivered, underscoring North Korea’s critical role in sustaining Russia’s war effort amid its ammunition shortages.

CSIS analysis from February on these dark vessels, suggest at least 25 different visits or yoyages — which later increased to at least 32 trips — , and 19 dark vessels, could involved some 2.5 million rounds of artillery shells.

A report by the Japanese Ministry of Justice outlines the trade routes, mentioning the key ports of Rajin, Dunai, and Vostochny, as well as the critical train station at Tumangang/Khasan (Tumenjiang).

The train station is also highlighted on the CSIS Felt map, marking it as a key connection hub between North Korea and Russia. In addition to being a weapons transport hub, ChinaHansaTravel amusingly includes it on a scenic route for tourists. CSIS reportedly observed a significant increase in rail car traffic at the station between October 2023 and early 2024, compared to pre-COVID periods and the years between 2019 and 2023. For OSINT weapons traffic experts at CSIS, this activity strongly indicates North Korea’s ongoing supply of arms and munitions to Russia, as well as reciprocal trade from Russia to North Korea.

We have only a handful of images of this train terminal from Google Earth Pro, but they already show noticeable changes over time, indicating it has become much busier. When examining time-lapse images from Sentinel, the transformation is even more apparent. A comparison reveals that just months before the war, the station underwent a significant upgrade. While this could be coincidental, it may also be unrelated to any dealings with Russia.

The timelapse provides a more detailed view of the ongoing expansion of the cargo train hub.​

The changes observed between March 2024 and October 2024, based on higher resolution satellite images, further confirm the CSIS findings that cargo turnover at the station remains consistently high. These results were verified using Planet Labs satellite imagery during the analysis.

Ships involved in the arms trade

As mentioned, analysts have reported that several Russian cargo ships are regularly traveling between North Korea and Russia. According to authorities, these vessels have been switching off their Automatic Identification System (AIS) to conceal their routes and destinations, as confirmed by satellite imagery. The vessels in question have been identified as part of a broader effort to evade detection, and satellite images corroborate these movements, further supporting claims of illicit activities between the two nations.​

MARIA, General Cargo (IMO: 8517839, now called LEV YASHIN)

MAIA 1, General Cargo, IMO: 9358010

ANGARA (or ro-ro Angara), a Ro-Ro/Container Carrier, IMO: 9179842: The ANGARA has been previously involved in weapons shipments to conflict zones like Syria and Sudan.

The Angara almost always operates with its AIS (Automatic Identification System) turned off, though not entirely without exceptions. Between February and April 2024, the vessel was tracked at a port in China. In May 2024, it transferred to Vladivostok. After departing Vladivostok at the end of May, Angara has not appeared on AIS and remains untraceable via standard satellite tracking systems since then.​

Exclusive research by newsmedia revealed the China angle. Satellite images show that China is playing a role in harboring a the cargo ship, implicated in arms transfers. In April, they found the ship has been in the Chinese shipyard since February 2024, following at least 11 deliveries of munitions between North Korean and Russian ports. A sign of China’s tacit support for Russia, complicating U.S. efforts to curtail military cooperation between the two nations.

Ownerships investigation

According to Lloyds list, a data provider and market intelligence company, the vessel Angara is owned by NB Shipping Company, with Marine Trans Shipping LLCin Russia serving as its ISM manager since August 2020. The registered owner is M Leasing LLC, a company also incorporated in Russia. Both NB Shipping and M Leasing are sanctioned entities. International experts could have anticipated the dubious nature of the Angara, as pointed out in a report by RUSI.

Previously sailing under the name Ocean Energy, the vessel was owned by the Kaalbye Group, a company accused of transporting Russian arms to Syria and South Sudan. During this period, arms trafficking observers, including @steffanwatkins identified the Ocean Energy as delivering Russian T-90 tanks from Russia to Iraq. This history underscores the vessel’s repeated involvement in illicit arms transport.

Spinning a web of sanctioned entities

Three vessels, confirmed by CSIC, are subject to sanctions by the U.S. Department of the Treasury and are also listed in the EU sanctions announced in June 2024. Among them is the Lady R, which, like the other vessels, is linked to MG-Flot LLC, also known as TRANSMORFLOT LLC SHIPPING COMPANY, a Russian shipping company that provides logistical support to the Russian Ministry of Defence. The company, headquartered at House 18 D (address), Premise 1, Lenina Street, in the Republic of Dagestan, owns vessels identified in arms shipments from Iran, aimed at supporting Russia’s full-scale invasion of Ukraine.”

In April, reports surfaced that the vessel Angara, which is under U.S. sanctions for transporting weapons, had been docked in Zhoushan, China, raising concerns about China’s indirect support for Russia’s war efforts. This support, including the Angara’s alleged role in transporting North Korean weapons to Russian ports, is expected to be a focal point in the upcoming discussions between U.S. Secretary of State Antony Blinken and Chinese officials in Beijing.

Meanwhile, the voyages of MAIA 1 have continued into the summer of 2024. After being untraceable between October 2023 and April 1, the vessel was spotted in Slavyanka Bay, Russia, before heading to Vladivostok. By June, it appeared in Vanino, and by early September, it was located near the North Korean border in Nakhodka Bay. However, the AIS signals from MAIA 1 show signs of being spoofed, suggesting the vessel’s actual whereabouts could have been elsewhere — however hard to confirm. The timelabs shows a vessel of the size anchoring at roughly that spot.

Since the beginning of September, a vessel resembling the MAIA-1 has been visible in the bay. It maintains its AIS signal while anchored, allowing it to be tracked during its stay.​

One key takeaway is the power of visualization. The team at CSIS effectively used a Felt map to illustrate the entire delivery chain of weapons — from a port near North Korea to the frontlines of the conflict. The map, enhanced with satellite imagery intelligence, captured key locations and provided interactive annotations, allowing viewers to grasp the complexity of the arms transfers in one clear view.

For those unfamiliar, Felt is a relatively new platform for creating interactive maps, which has quickly become a popular tool in OSINT (Open Source Intelligence) research. I used it in a previous journalism project to build detailed, collaborative maps without requiring coding skills. Felt excels at making OSINT evidence user-friendly and visually engaging, outperforming traditional platforms like Google Maps in terms of flexibility and capacity for handling large datasets. This makes it ideal for mapping complex information such as troop movements or supply chains.

The focus on key ports like Najin Port in North Korea and Dunay Port in Russia illustrates their critical roles in the weapons trade. Dunay, near Vladivostok, serves as a receiving hub for shipments from North Korea, while Najin, located in the Rason Special Economic Zone, is a known departure point for illicit goods. Satellite imagery, along with increased activity from North Korean military vessels, supports the theory that these ports are central to a coordinated supply chain funneling arms to Russia amid international sanctions.

At Najin, the presence of warehouses, loading docks, and cargo vessels tied to sanctioned goods raises further red flags. While satellite images provide visual evidence of arms storage and shipping preparations on vessels like the ANGARA, the most compelling confirmation came from the U.S. Mission to the UN, which released intelligence in mid-October, corroborating these weapons transfers (link).

The researchers then looked at the port a few and months weeks later, and found no upending of the heightened activity of the trade of countless of shipping containers, here well to be seein in dark blue.

If we compare Planet satellite images between Juni 2023 and October 2024 for the location of the three peers of Najin/Rajin Port, we spot on the 78 images hightened activities.

In total, I observed approximately 32 different vessels moored and loading cargo based on the available satellite images. This suggests the actual number may be higher, as cargo movements are visible even in images where no vessels are present.

When comparing the port’s usage from 2020 to the onset of the war, we see that the middle pier, which was primarily used for commodities such as coal, has been converted into a dedicated cargo-loading pier. Notably, the only appearance of traditional cargo vessels in Google Earth imagery occurred in 2023, marking a significant shift in the port’s operations.

Exact locaitons of the sanctioned vessels transporting equipment and weapons to Russia:

From the RUSI report illustrations we can pull all relevant coordinates of the five shipments between August and October 2023.

ANGARA AT RAJIN, NORTH KOREA, Geo: 42.227, 130.284

THE ANGARA AND MARIA AT DUNAI, RUSSIA, Geo: 42.866, 132.364

DUNAI MILITARY FACILITY, RUSSIA, Geo: 42.886, 132.363

While we now know that the two ships, the Angara and the Maria, were loading cargo at Rajin port, other vessels involved remain unmentioned, including one significant ship. After taking a screenshot of the coordinates in Rajin, we used Google Images to search for exact matches. A Vox article described it as “a suspected Russian ship about 120 meters long”. But what is this vessel that appeared on October 7th?

According to the Royal United Services Institute (RUSI), the vessel is likely the Lady R — the same ship referenced by Russian Foreign Minister Sergei Lavrov and linked by an American diplomat to a controversial incident.

This incident involved an alleged arms shipment (weapons) from South Africa to Russia during a mysterious and clandestine port call in December 2022, which ignited a political uproar. The Lady R has also been spotted in North Korea and China, in addition to making multiple transits through the Bosphorus on its way into and out of the Black Sea.

Ro-Ro Cargo Ship, IMO 9161003

Satellite images have captured vessels traveling between Russia and North Korea at Dunai Port in Russia, with a particular focus on cargo ships docking in areas not typically used for regular commercial trade. Unusual crane activity and container movements, especially in isolated or restricted sections of the port, suggest that these locations may be handling materials discreetly, avoiding public scrutiny.

The use of smaller vessels frequently traveling between Russia and North Korea further indicates an attempt to obscure the nature of the trade, likely to evade detection by international monitoring bodies. This behavior aligns with patterns seen in arms smuggling operations, where minimizing visibility is key.

At Najin Port, a 101-meter-long vessel has been observed docked since October 2020, without having moved. This vessel was spotted again in October 2023, during the peak of suspected weapons smuggling activities. It is believed to be a general cargo ship, possibly used for transporting a variety of goods, including munitions or military supplies. The presence of smaller boats on its deck suggests it could be used for logistical tasks, such as deploying smaller craft for cargo handling or covert operations.

Another notable observation is a 64-meter-long vessel, which ChatGPT identifies as either a general cargo ship or possibly a smaller bulk carrier. The exact type remains uncertain, but based on its dimensions and structure, it likely fits into one of these categories. Further analysis or verification from maritime tracking tools would be necessary to confirm its specific classification.​

Given its size, the vessel in question is likely designed for transporting various goods, possibly in containers or bulk, but on a smaller scale compared to larger cargo or container ships. These types of vessels are commonly used for short sea shipping or regional maritime transport routes.

Noteworthy vessels connected to North Korean ports, particularly in relation to weapons, munitions, and military supplies, include:

1. MAIA 1 (IMO: 9358010)— This general cargo ship has been implicated in arms transfers and other illicit cargo exchanges between North Korea and Russia. It has been observed making voyages between North Korean ports, such as Najin, and Russian destinations, often with its AIS turned off to avoid detection. The MAIA 1 sailed under a German flag until 2017. It was recorded at Vostochny Port, Russia, on February 5, 2024, and a few days later at Najin, North Korea, the same location where the *Lady R* was seen loading cargo.

2. VYACHESLAV ANISIMOV (IMO: 9004463) — Another Russian cargo ship involved in North Korea-Russia trade, particularly suspected of transporting military supplies. Similar to other vessels in this network, it is believed to turn off its tracking systems during voyages to evade scrutiny.

Both vessels are part of a larger pattern of covert arms shipments between North Korea and Russia, with efforts to conceal these activities through AIS manipulation.

All roads lead to MG-FLOT

MG-FLOT is one of seven companies sanctioned by the U.S. Treasury in May 2022 in response to the ongoing war in Ukraine. The company’s entire fleet, consisting of 16 vessels (and more as shown below), including the Lady R, was blacklisted as part of these sanctions. Additional vessels associated with MG-FLOT were also targeted. The details of the fleet can be verified through platforms like Opensanctions, which tracks entities involved in international sanctions lists.​

I inquired which of these vessels had been near North Korea and was not on our radar. The LADY D (formerly known as MALIY B.S.) is a general cargo ship with a gross tonnage of 9,611 GRT, now registered under the Russian flag (though it previously sailed under the German flag). Over the past year, the vessel has been highly active across Europe, including in the Gulf of Finland and St. Petersburg in June and July. It is one of the most active vessels under the Russian flag, operated by the MG-FLOT company (Sanction authorities)

Sanctions authorities have flagged the vessel for allegedly transporting Russian weapons exports to India via the Bosphorus Strait and for instances of AIS (Automatic Identification System) shutdowns. Despite this, the vessel has docked in at least a dozen ports in the past year. Notably, it was observed in the Bay of Nakhodka, near where the Angara was spotted at Vostochny Port, before making a trip to North Korea’s Rason Port in 2023, according to NK News.

Pundits like the X account @Auonsson speculated in August 2023 that a vessel might have picked up arms in India (Link), as it showed a different draft reading at the end of June, indicating it had collected cargo.

“…She left reporting 5.6m, returned reporting 6.7m, suggesting more cargo on the return trip” (Thread). Such observations wouldn’t be possible without accounts like @YorukIsik, who capture reliable photos and videos at key maritime chokepoints, such as the Bosporus. While Russia is purchasing weapons from North Korea, India frequently buys arms from Russia, further intertwining these global arms trades.

The Russian military must store North Korean-supplied artillery shells somewhere, and experts believed that one of these locations is the Tikhoretsk Munitions Storage Facility. In September 2024, this facility was heavily damaged by Ukrainian drone strikes, with reports indicating significant destruction. link

The Tikhoretsk site, located in the northern Caucasus, is believed to be one of the destinations for the long supply chain of North Korean munitions. On September 21, 2024, Urkainian drones targeted this major ammunition depot, among other sites. According to reports from UK-based defense think tank RUSI, this facility was housing weapons supplied by North Korea to support Russia’s war effort.

Experts believe that Russia is storing North Korean-supplied artillery shells, in part, at the Tikhoretsk Munitions Storage Facility. As of now, shipments from North Korea have slowed, not due to sanctions enforcement, but likely because of production or logistical challenges within North Korea, according to reports from NKPro.

In June, South Korean Defense Minister Shin Wonsik confirmed that over 10,000 shipping containers, possibly containing up to 5 million artillery shells, had been sent from North Korea to Russia. Alongside artillery, North Korea has also reportedly supplied dozens of ballistic missiles, signifying the deepening military cooperation between the two nations.

In exchange, Russia is believed to be providing North Korea with advanced technology to bolster its satellite development, along with military hardware, including tanks and aircraft, to support North Korea’s aging military infrastructure.

North Korea’s involvement in Russia’s war in Ukraine is raising alarms among experts. In June, Pyongyang announced plans to send an engineering unit, and recent reports suggest North Korean military personnel may already be on the ground. In October, reports indicated North Korean generals were killed in Donetsk (ground reporting), confirming the presence of troops and signaling an expansion of their involvement in the conflict.

This escalation hints at future shipments potentially including more personnel, strengthening North Korea’s alignment with Russia. The presence of North Korean soldiers marks a significant shift in the conflict, raising concerns about regional stability. Furthermore, OSINT evidence from drone footage showed Ukraine’s forces destroying a North Korean Bulsae-4 anti-tank missile alongside a British AS-90 self-propelled artillery, further highlighting the diverse military hardware involved.

Conclusion:

A few days ago, Ukraines President Zelensky said that “North Korea has in fact joined the Russian war on Ukraine”. This is already not just about transferring weapons. This is actually about transferring people from North Korea to the military forces of the occupier, Zelenskyy said. Some even say that without the equipment supplied by the DPRK to Russia in 2023 and 2024, it would not be able to think about an offensive operation which is going now.

The organized weapons trade between North Korea and Russia has shown a an ongoing pattern, with vessels turning off their Automatic Identification System (AIS) and frequently commuting between the two countries, often carrying heavy cargo. This behavior raises red flags in OSINT circles, as it follows a familiar track record of Russian-owned vessels engaging in sanctioned or covert activities. Initially, the trade involved smaller shipments such as artillery shells, but it has since escalated to include larger military equipment and soldiers — soon possible whole troops of DPRK soldiers.

This progression, from ammunition to full-scale military support, to China helping along the way, reveals the potential for a new phase in their relationship, likely driven by Russia’s ongoing conflict needs and North Korea’s strategic interests.

I’m not one to claim credit for someone else’s achievements, but what the young YouTuber GeoRainbolt showcases in his videos is worthy of a more serious examination within the OSINT community. Sure, there’s an element of showmanship in his content — an understandable flair for the dramatic — but beneath the surface lies a set of surprisingly advanced geolocation techniques that merit a closer look from those of us in the field.

Let’s begin with a detail that often goes unnoticed: the poles. We’re looking at the unassuming telecommunication and utility poles that frequently appear in his videos. These poles, with their unique shapes, materials, and configurations, serve as subtle yet powerful indicators of location. Consider, for example, one of his recent videos where he deftly distinguishes between countries based solely on the design and structure of these poles. It’s a technique that seems simple at first glance but requires a trained eye and a deep understanding of local infrastructure differences — a skill that any serious OSINT investigator should be eager to master.

It might seem practical to memorize every utility pole variation across the globe, but that’s not GeoRainbolt’s game. While he might occasionally lean on such knowledge in his rapid-fire “quick guess” videos, most OSINT professionals aren’t going to commit the shapes of infrastructure to memory. A more practical approach? Tap into the wealth of databases available on the web, where meticulous details about such infrastructure are cataloged.

That said, the challenges GeoRainbolt tackles aren’t always in line with the typical scenarios faced by OSINT researchers. When analyzing video footage, for example, there’s usually some context already established — a rough idea of the region or country where the footage originates. But here’s where GeoRainbolt offers invaluable lessons: his method starts from a place of complete neutrality. He treats every piece of visual material without preconceived notions, allowing the evidence to guide him to the conclusion. It’s a mindset that can be incredibly useful, reminding us to approach every investigation with a clean slate.

10 examples where GeoBolt uses his sharp observational skills to master difficult locations, and where AI can support (for those less sharp):

Let us pick ten examples of how GeoBolt masters difficult geo identifications in geoguessr using local features like posts, dirt, trees, and whatever else, really, that is available.

GeoBolt has made a name for himself through his incredible ability to pinpoint even the most challenging locations on the world map. He does this by leveraging local features such as street signs, posts, vegetation, soil types, and other minute details to determine the exact location. Here we picked out the most challenging ones.

1. Telephone Poles in the Pampas: Argentina or Uruguay

A gamer raised this particular issue, saying he always loses his country streaks to a 50/50 between Argentina and Uruguay: “… are there any common or anything really that could help me separate them, especially in rural landscapes”.

GeoBolt notices the distinctive concrete telephone poles that are typical of Argentina. Comparing them to the slightly different poles in Uruguay, he reaches the correct conclusion: rural Argentina.

AI Support allows to help with feature distinctive details that allows to distinguish the two countries in forensic investigations or just at a geoguesser turnament:

• Material: Argentina uses more concrete poles with a tapered design, while Uruguay primarily uses wooden poles.
• Insulators and Crossarms: Argentine poles have more complex insulator setups with crossarms; Uruguayan poles have simpler insulator arrangements.
• Pole Top Arrangements: More cluttered and reinforced in Argentina, simpler in Uruguay.
• Base Features: Argentina’s poles often have reinforced bases; Uruguay’s wooden poles are more straightforward.
• Contextual Clues: The poles in each country may also be surrounded by unique features that can provide additional context.

The telephone pole shown in this image is made of metal, which is a common feature in Uruguay, especially in urban and suburban areas. Unlike the concrete poles seen in Argentina, metal poles are more straightforward in their construction. The metal pole in the image is straight and uniform in diameter, lacking the tapering seen in many Argentine concrete poles. It also appears to have a curved metal arm at the top that supports a street light, a common style in Uruguay.

The pole’s structure is relatively minimalistic, and it lacks the multiple crossarms or the complex setups often found on Argentine poles. The base of the pole appears to be simple and directly planted in the ground, without any additional concrete reinforcements or foundational pads. This is consistent with how metal utility poles are installed in Uruguay.

2. Red Soil and Acacia Trees: Botswana or Namibia?

• On an unpaved road in Africa, GeoBolt recognizes the deep red soil and specific types of acacia trees. Combined with the road markings and gravel, this helps him identify Botswana instead of Namibia.

We can replay this, by feeding openAI’s image analysis algorythm with an Google Streetview image from the desert.

Soil Characteristics (1): The soil in the image appears to be very light and sandy, with a whitish or pale color. This is a notable characteristic of Kalahari sands, which are prevalent in Botswana. The soil is composed of fine, loose sand that forms light-colored dirt roads typical of many rural areas in Botswana. The road itself is an unpaved dirt road with a powdery surface, common in the more arid and semi-arid regions of southern Africa, particularly in Botswana, where such roads are widespread.

Vegetation and Trees: The vegetation includes a mix of thorny bushes and small to medium-sized trees, such as acacia species, which are commonly found in the Kalahari Desert and semi-desert regions. The sparse distribution of bushes and trees is consistent with Botswana’s arid landscape. These types of trees, with their distinctive umbrella-like shapes and sparse leaf coverage, are often seen in areas with a savanna or semi-desert environment, which is typical of Botswana.

Absence of Red Soil: The colour could obviously have been manipulated, and colour just removed. Therefore watch out! But generally, Namibia is known for having regions with reddish soil, especially in areas like the Namib Desert and parts of the Kalahari in Namibia. The lack of this distinct red or orange soil in the image further suggests that the location is not in Namibia but rather in Botswana.

Geographical Context: The flat terrain with scattered low vegetation aligns with the Makgadikgadi Pan or other arid regions in Botswana, where the landscape is characterized by vast expanses of sandy soil and scrubby vegetation.

3. Minor Differences in Traffic Signs: Portugal vs. Spain

GeoBolt sees a stop sign and recognizes by the thickness of the border that it’s a Portuguese sign. A small but decisive detail that guides him from Spain to Portugal.

What the influencer applies can be applied outsider the game, too. In Portugal, the border of the stop sign is typically thicker than in Spain. Portuguese stop signs have a wider white border surrounding the red octagon, which makes them visually distinct. This thicker border is a consistent feature across most Portuguese stop signs. In Spain, the border around the stop sign is thinner, and the overall design of the stop sign might appear slightly more compact.

Font and Signage Standards are also different. The font and text size of the “STOP” lettering on the signs may also differ slightly due to different regulatory standards in each country. However, the thickness of the border is the most noticeable distinguishing feature. Road context and sign placement is to heed, too. Portuguese stop signs are often positioned with a more pronounced border that is intended to be highly visible even from a distance, particularly in rural or suburban areas. The way these signs are integrated with local road infrastructure (height, placement, proximity to other signs) can also provide context clues for determining the country.”

4. Deciduous Trees and Shadows: Norway or Sweden

In a wooded area, GeoBolt uses the type of deciduous trees, the prevalence of pines, and the position of the sun to distinguish between Norway and Sweden. He finally decides on Sweden and is correct.

In Sweden, forests often feature a mix of deciduous trees and pines, while Norway’s forests lean more heavily on pure conifer stands. The varied canopy in Sweden is a key indicator. Additionally, the sun’s position differs slightly between the countries; in southern Sweden, the winter sun is lower, creating unique lighting effects. Combining these clues — tree types, forest composition, and sun position — he demonstrates the importance of nuanced observations in geolocation.

5. Fences and Livestock Farming: Australia or New Zealand

• GeoBolt identifies the difference in the type of livestock fences and the grass growth. The wire-bound wooden posts and broader vegetation coverage suggest Australia.

In Australia, livestock fences often feature wire-bound wooden posts that are robust and widely spaced. These fences are designed to cover vast expanses and are built to withstand the harsh Australian climate and the pressures of livestock farming on large properties.
Grass Growth and Vegetation Coverage is another indicator. The grass growth in Australia is generally more sparse and less lush compared to New Zealand due to its drier climate. In contrast, New Zealand’s grass is often thicker and greener, reflecting its wetter and more temperate conditions. The broader vegetation coverage in Australia, with its more open, bush-like landscape, contrasts with the more uniform, dense green pastures typical in New Zealand.

6. Road Markings: Japan vs. South Korea

Based on how the roads are marked in yellow and the format of the white edge markings, GeoBolt identifies that he is in Japan and not South Korea.

Here some AI trickery suggests that analyzing shape and language is worth your time: The distinctive inverted triangular “STOP” sign in Japan can be a quick visual clue. The presence of kanji (Chinese characters used in Japanese writing) or the specific Japanese style of hiragana and katakana scripts can immediately suggest Japan.
Reading Fonts and Styles: Close observation of the font styles and signage formats can help differentiate between the two countries. South Korea’s bolder, more squared fonts on road signs can indicate the country, while the thinner, rounded fonts suggest Japan.
Examining Highway Signs: The shape of the highway shields and the presence of bilingual text on expressways can also provide hints. A rounded triangular expressway shield points to Japan, while a rectangular shield is likely South Korean.
Context Clues from Bilingual Signage: The balance between English and local language on street signs can also help. If English appears prominently and consistently, it might suggest South Korea. If Japanese script dominates with smaller English translations, it’s likely Japan.

7. Sand Colors and Building Structure: Tunisia or Morocco

In a desert town, GeoBolt compares the color of the buildings, the sand, and the roof designs. The beige hue and the type of overhead cables lead him to believe he is in Tunisia, which turns out to be correct.

Following advice warrants heeding when analysing footage: analyze architecture and building details and look at the color, style, and materials used in buildings. Earth tones, zellige tiles, and riads point to Morocco, while whitewashed buildings and blue doors suggest Tunisia.
Inspect road signs and language use: Observe street signs for language (look for Berber script in Morocco) and design style. Consider the placement and format of these signs.

Examine License Plates and Traffic Signs: Identify the color scheme and format of license plates to narrow down the country. Observe traffic signs for unique local symbols. Also use the type of vegetation, mountains, and overall terrain as clues. Mountains often suggest Morocco, while flatter, Mediterranean coastal landscapes suggest Tunisia. Additionally, check for the color and texture of the soil. Deep red hues often indicate Moroccan terrain, while lighter sandy colors are more typical of Tunisia.
Look for market setups, colors, and traditional crafts that are unique to each country.

8. Street Dust and Air Conditioners: Thailand or Vietnam

• GeoBolt pays attention to the amount of red dust on the streets and the positioning of air conditioners on the houses. This, along with the overhead power lines, leads him to Vietnam.

Worth noting, in Thailand, air conditioners (AC units) are often mounted on the side walls of buildings and are more uniformly installed. They tend to be positioned higher up, close to the roofs, or on the upper stories of buildings, reflecting a standardized approach to urban cooling solutions.In rural Thai homes and buildings, AC units are generally newer.

The general AI advice goes as far as look closely at the road surfaces, nearby soil, and how dust appears on buildings and vehicles. Reddish dust is a strong indicator of Vietnam, especially in rural or less developed areas. In contrast, cleaner roads with lighter dust suggest Thailand.
Observe how AC units are placed on buildings. Uniformly placed and orderly units higher up on walls tend to indicate Thailand, while cluttered or varied positioning at different heights on the same building, especially with multiple units stacked or placed randomly, suggests Vietnam.

These indicators should be used in combination with other OSINT clues, such as signage, architectural styles, vegetation, and local infrastructure. The combination of red street dust and haphazard AC placements makes a strong case for Vietnam, while cleaner streets and orderly AC units lean towards Thailand.

9. Street Paving and Fire Hydrants: USA vs. Canada

• In an urban setting, GeoBolt uses the color and shape of fire hydrants and the material of the street paving to identify the location as a city in the USA rather than Canada.

In the U.S., fire hydrants often have distinct colors that vary by city or state regulations, with common shapes and styles differing from those in Canada. Meanwhile, the type of street paving, such as the texture and layout of asphalt or concrete, can provide additional context.

10. Road Markings and Posts: Poland or Lithuania?

GeoBolt recognizes that the white posts with reflective red and white markings are typical for Poland, while the posts in Lithuania are designed differently. This detail, along with the style of road markings, leads him to correctly identify Poland.

These differences matter in OSINT geolocation insofar as the understanding these distinctions is crucial for OSINT investigators trying to geolocate an image or video accurately. The design and color of roadside posts are determined by national regulations and standards, which vary between countries. Therefore, these posts serve as country-specific markers that can help identify a location, especially in regions where other more obvious clues (like language or road signs) may not be visible.

When analyzing imagery where road signs or distinct architecture are missing, these posts can provide a quick and reliable indication of the country. Combining the recognition of roadside posts with other OSINT clues, such as vegetation, road types, or local signage, can greatly increase the accuracy of geolocation assessments.

For more precise geolocation, it’s crucial to understand that even within a country, there might be slight regional variations. The red and white reflective pattern is a strong and consistent identifier for Poland, foir instance.

The practical application for OSINT Investigators you have seen above. Geoguesser may serves as training and awareness practice. OSINT professionals should familiarize themselves with the roadside infrastructure standards of different countries. This involves not just recognizing the posts but understanding what these markers signify in terms of location and safety regulations. We have seen how AI can help in this regard.

Generally seems true: Modern AI and machine learning tools can be trained to recognize these subtle differences in roadside posts, streamlining the geolocation process and improving the speed and accuracy of identifying a location.

When possible, cross-reference observations with reliable datasets, such as Google Street View or national road authority databases, which often provide comprehensive visual references for road infrastructure in different countries.

291 KB groß war die Datei. Ein Bild, das eine Quelle, die schwer bewaffnet nun im Dschungel Myanmars sitzt, an Journalisten vermittelte. Ein Bild einer Szene aus einem grell beleuchteten Konferenzraum. Im Hintergrund eine koreanische Flagge. Ein langer Holztisch und schwarze Lederstühle stehen herum. Am Tischende sitzt ein weißhaariger Mann, kantiges Gesicht, aus Westeuropa, ungefähr Mitte 50. Die Augenbrauen tief angespitzt. Er ist konzentriert. Vor ihm liegt ein dicker Ordner. Er blättert, kümmert sich jedoch nicht darum auf die Seiten zu schauen. Seine Augen, vertieft ins Gespräch, sind auf einen der sieben asiatischen Männer gerichtet, die auch am Tisch sitzen.

Sie tragen gelbe Warnwesten. Ihren Ohren sind gespitzt. Sie hören gespannt zu, was der Europäer zu erzählen hat. Die asiatischen Männer sind Ingenieure. Schiffsingenieure der Marine Myanmars. Der Meetingraum ist in Südkorea. Die Männer lauschen einer Einweisung eines neuen Schiffes, das einige Experten heute als Kriegsschiff bezeichnen und eine entscheidende Kampfkraft der Militärjunta darstellt. In dem Schiff sind deutsche Motoren verbaut. Das Schiff wird gerade an den Kunden geliefert.

Der Europäer kennt sich mit den aus Europa entwickelten Motoren exzellent aus. Die Männer gehören dem Militär an, der damaligen burmesischen Regierung. Aber seit dem Coup ist alles anders. Seit 2021 will die Quellen nicht mehr Teil des Junta-Apparates sein. Myanmar ist jetzt Embargoland, nachdem die Militärregierung Tausende Regimekritiker tötete oder Protestanten in Gefängnisse wirft. Myanmar fällt in einen Bürgerkrieg mit Widerständlern der nationalen Einheitsregierung Myanmars. Bis heute dauert der Konflikt an. Das Meeting findet einige Jahre vor dem Coup statt. Die Quelle aus dem Dschungel war dabei. Leider weiß er nicht mehr, wie der Europäer im weißen Overall heißt. Eine spannende Suche im Internet beginnt.

Der Mann könnte entscheidend sein. Ermittlern könnte er zum Beispiel erzählen, ob die Burmesischen Marine damals schon plante das Schiff im Krieg als Kriegsschiff verwenden zu wollen.

Ihn zu finden, stellt sich als schwieriger heraus als gedacht. Das Bild ist zu unscharf für eine weiterführende Suche mit Facial Rekognition System, PimEyes oder Ähnlichem. Die Suche startet im Netz, auf professionellen Social-Media-Plattformen wie LinkedIn. Man nimmt an, dass der Mann als Ingenieur der deutschen Firma ein Profil führt. Mit gezielten Suchbegriffen lässt sich ein möglicher Kandidat finden. Sein Profilbild zeigt einen weißhaarigen Herrn der auf einem überdimensionierten Rohr sitzt. Die Füße sind nach links und rechts ausgestreckt. Grinsend. “Eine Art Witz, wie eine Peniskanone“, sagt ein Kollege und lacht als er das Bild sieht.

Mit Leakdaten eines amerikanischen Telekommunikationsanbieters lässt sich dem Namen des Profils eine E-Mail-Adresse zuordnen. Die E-Mail hängt an einer amerikanischen Telefonnummer dran. Die Nummer hängt wiederum an mehreren Online-Profilen, darunter auch ein Microsoft-Konto, mit Bild von Kindern beim Halloween feiern. In den USA aufgenommen. Seine Frau wahrscheinlich. Sein Standort ist Houston, Texas. Das passt mit dem LinkedIn-Profil überein. Eigentlich ist der Ingenieur aber Däne. Er war oft und lange in seiner Karriere im Ausland stationiert. Seit einigen Jahren ist er hier in Houston. Das Leben der dänischen Frau hat sich auch angepasst. Eine weitere Verbindung zu der Telefonnummer zeigt ihr LinkedIn-Profil. Sie arbeitet in einer Führungsposition in Texas. Im dänischen Generalkonsulat. Ob sie weiß, dass ihr Partner half, ein Kriegsschiff an eine brutale Militärregierung zu verkaufen? Wir kontaktieren den Mann. Aus mehreren Anfragen reagiert er jedoch nicht.

Es ist nur ein Beispiel aus vielen, wie sogenannte Leak oder Breachdaten — also Datensätze von personenbezogenen Daten aus dem Internet — in weiterführenden Rechercheschritten helfen weiterzukommen. In diesem Post werden wir uns einige dieser Techniken genauer anschauen.

Russland und Leakdaten

Wer professionell zu Russland recherchiert, kennt die Macht von Leak und Breachdaten. Spätestens mit einigen Russland bezogenen Bellingcat Geschichten wurde vielen klar: Professionelle Recherchen stützen sich immer häufiger auf personenbezogenen Datenleaks. Zwar bleiben große konzernbezogene Leaks wie die Panama Paper immer noch relevant. Immer öfter liefern jedoch Leakdaten Kontaktinfos für Quellen, um eine Smoking Gun, als den unmissverständlichen Beweis einer Tat, zu recherchieren. Hinweise zu Bewegungen und Personendetail, werden immer zentraler für wer am Ende eine Geschichte recherchieren kann und den zentralen Hinweis bekommt.

Immer prominenter werden Leakdaten-Bots auf Telegram. Sie versprechen eine Antwort auf einen Input, der unter anderem aus einem VK-Profil, einem Bild oder einem Namen und Geburtsdatum bestehen kann. Sie spuken das aus, was in aggregierten Leakdaten hergeben oder wofür ein Algorithmus einen Output ermittelt. Manche Bots kosten ein paar Euro in Krypto, andere sind umsonst. Ein Output sind dann oft personenbezogene Daten und Links für Social Media Seiten der Personen, die möglicherweise die Recherche befeuern kann. Wie Betreiber der Bots an diese Daten kommen, will man oft nicht wissen. Unklar oft auch: Wer steckt hinter dem Angebot und nutzt man es gegen die Person und effektiv für Russland?

Ein simples Beispiel ist der Telegram-Chatbot Userbox. Ein Feld verifiziert den Nutzen. Für einen russlandfreundlichen AFD-Politiker gibt folgende Antwort.

Daten des AfD-Bundestagsabgeordneten Eugen Schmidt sind auch in den Userbox Daten vertreten. Rund 300 Mal, wobei möglicherweise nicht alles auf den Herrn im Bundestag anwendbar ist. Solang es Personendaten gibt, gibt es False Positives. Schmidt bestätigte im Februar dem Spiegel Magazin, dass der in der Ukraine geborene Wladimir Sergijenko, der für den FSB in Russland gearbeitet haben soll, auch für Schmidt gearbeitet hat. Auch Sergijenko taucht in Leaks auf.

Um bei investigativen Recherchen Erfolge zu verzeichnen, brauchen Journalisten Quellen. Neu ist das nicht. Früher hat man eine Quelle vermittelt bekommen. Man erschien mit einer Sporttasche und viel Kleingeld zu einem Treffen. Die Sporttasche deshalb, weil die Quelle, wenn man Glück hatte, einen Stapel an Dokumentenordnern mit dem Redakteur teilte. “Sie wanderten in die Sporttasche”, so ein älterer Kollege. Dann machte man sich auf zum Kopierladen, um dort mit dem Kleingeld die Dokumente zu vervielfältigen. Dann wurden die Dokumente wieder zurückgebracht.

Heute sind es offene Daten aus dem Internet und dem Deep- und Darknet, die es ermöglichen, Quellen anzuschreiben. Vielleicht findet man eine Person, die in einer offenen oder geschlossenen Sozial Media-Gruppe zu einem Thema etwas Kritisches schreibt. Man versucht, einen Kontakt herzustellen. Natürlich gehört immer ein Quäntchen Glück dazu, die richtige Person zu finden, sie richtig anzusprechen. Der Rest ist routinierte Online-Recherche. Diesen Teil schauen wir uns hier an. Leakdaten können hier großartige Erfolge bescheren. Oft bieten sich Quellen nicht an, haben einen traumatischen Leidensweg oder schlichtweg Angst. Sie scheuen sich vielleicht, den ersten Schritt zu machen. Wer sie findet und kontaktieren kann, kann am Ende eine Geschichte erzählen. Die zweite Gruppe, die mit Leakdaten ermittelt werden kann, sind mutmaßliche Täter.

Breach Daten

Leakdaten sind häufig Millionen von personenbezogenen Daten, die sich auf die tausenden Webseiten beziehen, die Nutzerprofile angelegt haben. Ein Forum, Datingseite, eine Social-Media-Seite, ein Onlineshop, eine Networking-Plattform, eine Gamingseite, alle wollen Ihre Daten. Wenn diese ihre Daten verlieren, landen sie oft offen im Internet. Und mit Ihnen Daten von mutmaßlichen Kriminellen.

Die Datentypen, die hier freigelegt werden, sind häufig von ganz unterschiedlicher Natur. Meistens sind es E-Mail-Adressen und Personenprofile. Aus dem Profil lässt sich oft viel herauslesen. Wird ein Social Media Konto weiter genutzt, lässt es sich zu zeitlichen Eingrenzung und geografischen Verortung einer Person nutzen. Mit Bio über die Person und ein Bild lässt sich weiter recherchieren.

Über 4,000 weitere Datenleaks beinhalten häufig eine Telefonnummer, die mit einem Nutzernamen oder Klarnamen in Verbindung steht, oder eine Anschrift oder auch schon mal eine “Secret Answer”. Da oft Menschen persönlich Details teilen (der Name der Mutter oder der Katze zb) kann das möglicherweise zentrale Hinweise liefern, um Täterrecherchen weiterzubringen.

Generell gilt, dass diese Daten niemals das Ende einer Recherche darstellen können und sollen. Der Doxxing Paragraf ahndet, das Teilen von sensiblen Personendaten. Mit ihnen sollte man nur mit äußerster Vorsicht und einem Vieraugenprinzip arbeiten. Sie sollten zu weiteren Informationen oder Quellen führen, die diese Details bestätigen. Und die Recherche sollte die Schwelle des öffentlichen Interesses nehmen.

Die Liste solcher Leaks ist lang. Oft ist es Glücksache, ob ein Leak in einer speziellen Recherche weiterhelfen kann oder nicht.

Breachdaten von Firmen existieren im Darknet oder auf Aggregationsplattformen. Breaches, die es im Darknet gibt, werden häufig von Hackergruppen angeboten. Große Datenleaks werden oft über Telegram oder X geteilt oder zumindest angekündigt. Im Fall eines Leaks, das im Juni die Runde machte, hat Sicherheitsforscher Troy Hunt Initiative ergriffen und die Daten in die Database von HaveIBeenPawned. Das hilft Journalisten weiter zu verstehen, ob und ggf wo ein mutmaßlicher Täter Daten verloren hat. Die Daten selbst teilt Hunt nicht.

Zum Thema der ethischen Verwendung der Daten ist zu sagen, dass es immer wieder vorkommt, dass Betrugsnummern mit Leakdaten aus TelegramBots zu weiteren Ergebnissen führen können.

Meist wird auf Telegramkanälen am ehesten die Mitteilung eines Leaks oder die Daten selber, verbreitet (wie poenamarket, DBLeaks, oder viele weitere, wie hier Ransomlook auflistet). Sie sollten auf keinen Fall einfach so die Daten heruntergeladen werden, und selbst auf der Seite sollten Sie nur mit einem Torbrowser und einem VPN arbeiten. Seiten wie Privtools.github.io/ransomposts weisen über 12,000 Einträge von angeblichen Datenbreaches seit 2020 aus.

Wenn ein Datenleak von einer Firma vermutet wird, kann man hier suchen. Leider besteht nur selten die Möglichkeit, Daten nach langer Zeit noch herunterzuladen. Es kommt jedoch immer wieder vor — oft deshalb, weil die Gruppen Alternativlinks betreuen, wenn Zugänge gekappt werden.

Interessiert an einer bestimmten Firma oder Organisation, wird ein Leak im Darknet wohl die folgende Darstellung haben. Eine Seite, wie hier von der Gruppe Monti, die eine “Wall of Shame” führt, also die Firmen, die nicht ausbezahlt haben. Danach ein Downloadlink, eine Textdatei, die in eine Excelliste umgewandelt werden kann. Der Downloadlink wiederum eine Onion URL.

Nur selten ist das der Weg ins Ziel. Dennoch gibt es gute Beispiele, in denen sich ein Leak anbietet und damit die Recherche weiterkommt. Ein Leak zur Firma Fabrega Molino schien vielversprechend. Die Firma agiert ähnlich wie die einst aus Panama stammende offshore law Firma und corporate service Provider Mossack Fonseca. Gleicher Standort und ähnliche Klientel. Die Firma baut für Leute und Konzerne neue Firmen auf, sogenannte Shellfirmen oder Frontfirmen. Mit ihnen lässt sich alles Mögliche anstellen und verstecken. Wenn man an ein Leak wie Fabrega Molino als Journalist herangeht, dann nur, weil man an die Daten auf keine andere Weise herankommt.

Das System nennt sich Aleph, ermöglicht Nutzern eine Datenbank mit diesen Daten zu bespielen und dort zu analysieren. Auf Aleph lassen sich unter anderem die 193.000 Namen und rund 13,000 E-Mail-Adressen ausmachen, die in den Dokumenten enthalten sind. Vermutet man eine Zielperson in Panama, die eine Firma gründete, könnte man hier nach E-Mail-Adressen oder dem Namen suchen. Für die Personenrecherche kann man mit dem Leak Verbindungen zu Entitäten ziehen, die eventuell schon bekannt sind.

Für die Personenrecherche lassen mit dem Leak Verbindungen zu Entitäten ziehen, die eventuell schon bekannt sind. Die These, die die schon bei Mossack Fonseca Kunde waren, haben sich später für neue Firmen entschieden.

Dann gibt es noch Breachdaten von großen Social-Media-Anbietern. Ein so ein Leak ist gerade jetzt vor ein paar Tagen wieder bekannt geworden. Ein umfangreiches Leak der Plattform X oder Twitter: 9.4 GB oder 200Mio. Ähnliches ist bereits 2021 geschehen.

Nur selten möchte man sich die Daten komplett immer selbst herunterladen. Das ist das Problem der Malware. Viren in den Daten lassen sich nie ausschließen und eventuell nur mit einer Cloud Lösung richtig vermeiden (wenn die Daten bei Google Drive zum Beispiel in der Cloud abgefragt werden, verhindert man, dass die Malware möglicherweise die eigene Maschine angreift).

Bis vor einem Jahr gab es eine Plattform, namens „Search.illicit.services“. Sie wurden später geschlossen, aufgrund von illegalen Aktivitäten, wie der Betreiber Zero Trust verlauten ließ. Sie hatte aber schon hervorragend gezeigt, wie wichtig diese Daten in Recherchen sein können. Das Problem war nur, dass man auch die Passwörter geteilt hatte. Etwas, was zu Problemen führen kann und Recherchen schnell unter den Hacking-Paragrafen fallen lassen kann.

Um das zu vermeiden, bieten sich Breachdaten Aggregationsportalen an. Die jedoch vorsichtiger entscheiden, was für Resultate sie geben und welche nicht. Zum Beispiel beim Thema Passwörtern. Eine dieser Plattformen ist Constella Intelligence. Ich habe über Constella schon einmal geschrieben. Die Plattform erlaubt es, mit jeglichem Input in einem Datalake von Milliarden von Einträgen zu Breachdaten zu suchen.

Im Regelfall sind diese Plattformen besonders nützlich, um aus einem Namen eine E-Mail, eine Adresse, eventuell eine immer noch gültige Telefonnummer zu zaubern. Wenn die richtige Zielperson gefunden wurden, kann man hier die Verbindung zwischen gefakte Nutzernamen und einer Telefonnummer herstellen, die an andere Stelle mit dem echten Namen in Verbindung steht.

Eine weitere brillante Plattform ist OSINT.Industries. Die Unternehmung ist von Nathaniel Fried geleitet, der immer wieder in verschiedenen Ländern Europas Vorträge zu OSINT und der Nutzung seiner Plattform gibt. Er interessiert sich auch für den Bereich Investigativjournalismus und unterstützt mit seiner Plattform Reporter:innen. Die Daten API von OSINT.Industries lässt sich mit einer E-Mail-Adresse oder mit einer Telefonnummer anfragen. Das Ergebnis einer Suche sind Accounts von unter anderem Social Media und Chat-Messaging-Plattformen, Spielwebseiten und Lern- und Sporttracking Plattformen. Gelegentlich ist auch ein Apple SignUp Profil dabei. Dort sieht man dann eine Telefonnummer gegen. Hat mal also aus anderen Suchen bereits eine Nummer zu Hand, lässt sich die damit bestätigen. Oft hilft es auch mit der visuellen Bestätigung von Identitäten. So weißen häufig Profile auf Skype oder Github ein Bild des Erstellers aus. Ein Bild kann dann mit zahlreichen Gesichtserkennungsalgorithmen mit anderen Bildern verglichen werden, bzw. könnte dazu dienen weiterzusuchen (wie mit PimEyes).

Einige Profile weißen Standortdaten aus. Diese kommen aus API von Plattformen wie Strava (wo Leute ihre Laufdaten vergessen) oder Google Rezessionen. Beides kann extrem hilfreich sein, um stimmige Ergebnisse aus den Falschen herauszusieben.

Australiens größter Hackerangriff: Aleksandr Ermakov

Australien: Ein Hackerangriff gegen Medibank Privat legt 9,7 Millionen personenbezogene Daten von Kunden frei, einschließlich sogenannten Medicare Versicherungsdaten und sensible Gesundheitsinformationen von Kunden. Darin sollen Namen von HIV-Patienten und andere äußerst sensible Daten gewesen sein, so die Berichterstattung. Es ist wohl bis Dato der größte Hackerangriff Australiens. Wer ist der Mann, der jetzt in der Anklage steht und sanktioniert wurde?

Mit dem russischen Namen des jungen Mannes kann gearbeitet werden. Man findet schnell die E-Mail-Adresse (ae.erXXXX@yandex.ru) eines Mannes mit dem russischen Namen „ермаков александр геннадьевич”. Und eine Telefonnummer: +9162897XXX.

Wenn wir die OSINT.Industries API anfragen, bekommt man unter anderem gespeicherte Inhalte von Airbnb. Ein Foto, das mit dem Account verbunden ist, zeigt Ermakov vor zwei Baloone.

Es ist dasselbe Bild, des australischen “Department of Foreign Affairs and Trade”, und von Berichterstattung der ABC News, des australischen öffentlich-rechtlichen Senders übernommen wurde. Die russische Telefonnummer bekommen wir so auch bestätigt. Die Vorwahl gehört in der Regel in die Region Moskau oder in seltenen Fällen, in den Raum St. Petersburg. Weiter Breachdaten bestätigen sein Geburtsdatum, May 16, 1990.

Unter anderem hat Ernakov wohl ein Hosting mit der URL millioner1.com im Sommer 2022 registrieren lassen. Am 2. April wurde die Seite von Webarchive archiviert, es ist eine Testdomain von der Firma FirstVDS.

Was Ernakov damit später anstellte, bleibt unklar. Klar ist, dass er immer wieder Kunden mit IT-Dienstleistungen hilft, neben seinen Hackertätigkeiten. Ermakov ist Teil REvil Ransomware Hackergruppe. Sein Komplize hat zumindest schon vor gut 10 Jahren gestohlene Kreditkarten vertickt haben. Über den Telegram Parsing Databaseleak finden wir den Usernamen “gustavedore” auf Telegram.

Der Username ist mit Forumeinträgen in Verbindung zu bringen, in denen ein Gustavedore zugibt, mit der Firma Shtazi IT involviert zu sein. Die Firma bietet unter anderem “Ruf-Management” und IT Services an. Die Firma ist mit Mikhail Shefel in Verbindung zu bringen. Er ist ein bereits bekannter Kreditkartenbetrüger, laut Brian Krebs. Leakdaten und Domainregistrierungen zeigen im Detail, wie der Trickbetrüger Shefel mit Ermakov zusammenhängt.

Krebs prüft den Spitznamen Gustavedore mit den Daten von der Intelplatfrom intel471.com. Die Suche zeigt, dass ein Nutzer mit dem Namen im November 2021 ein Ransomware-Programm namens Sugar erschuf. Er soll sich auf Angriffe von einzelnen Computern und Endnutzern konzentriert haben.

Ein weiteres Tool (das umsonst ist) heißt Epieos (https://epieos.com/). Epieos verbindet E-Mail-Adressen und Telnummerb mit Social-Media-Accounts. Besonders für schnelle Recherchen ist Epieos hilfreich.

Für eine noch rasantere Alternative, ob eine E-Mail existiert, empfiehlt sich der E-Mail Verifier von hunter.io. Der Use Case ist oft der folgende. Man hat einen Namen, keine E-Mail-Adresse. Deshalb versucht man eine logische E-Mail-Syntax mit dem Namen nachzubauen. Besonders für Quellen ist das oft hilfreich. Sie möchten sich nicht verstecken und haben eine alte E-Mail, die sich aus “Vor.Nachnamn@gmail.com” zusammensetzt (oder eine Variante mit — oder Abkürzung, oder so). Wenn der Verifier anschlägt, besteht die Möglichkeit, dass wir die Zielperson kontaktieren könnten oder noch mehr Informationen aus weiteren Profilen ziehen können.

Maltego

Um die Verbindungen der Breachdaten Recherche zu visualisieren, bieten sich das System von Maltego an. Wenn man Zugang zu der Enterprise Version hat, lassen sich eigene Daten aus den Daten APIs und den sogenannten Transformationsbüchereien ziehen. Breachdaten lassen sich auch integrieren.

OSINT Industries betreibt seit Mitte Mai eine eigene neue Transform Integration in Maltego. Wenn man eine E-Mail-Adresse recherchiert, lassen sich auch die verbundenen Profile einzeichnen.

Unten, der Fall des Aleksandr Ermakov nocheinmal mithilfe von Maltego und der API von OSINT Indsutries dargestellt

Agregatoren wie DDSecrets

Eine weitere wichtige Anlaufstelle für Leakdaten ist DDSecrets. Einzelne, oft journalismusrelevante Datensätze lassen sich hier gezielter runterladen, jedoch mit keiner Versicherung gegen Malware. Wer eine bestimmte Firma oder Geschäftsfeld abdecken will, und dazu ein Leak benötigt um weiter arbeiten zu können, lässt sich deren Datenbasis durchsuchen.

Journalisten bekommen häufig Zugang zu Daten von Distributed Denial of Secrets (DDSecrets) Hunter Plattform. Hunter erlaubt Datensätze, die bereits hochgeladen wurden, zu durchforsten und mit eigenem Input zu vergleichen. Besonders russischen Namen, E-Mail-Adressen und Standorte lassen sich dort oft finden.

Im weitesten Sinne ist die Datenbank https://avon.ccc.de/, die Einträge deutscher Bürger aus Gelden Seiten archiviert, auch ein Leak. Einige Male konnten wir Einträge zu Adressen, Familienmitgliedern einer Quelle oder eines Verdächtigen mit Avon.ccc bestätigt werden können.

Wer Anmerkungen zu Tools und Techniken hat oder weitere Informationen weiterleiten möchte, gern via Twitter (@Techjournalisto) eine DM senden.

Within seven hours, the dozens of ginormous oil tankers were cleared off the Laconian Gulf. “There is a possibility that the Navtex will be extended for a longer period of time beyond June 24”, one Greek government official told Reuters.

What’s here, is great but two years late. It’s here, the Laconian Gulf, in the south-eastern Peloponnese, where the world’s most devious regimes used to rendezvous. Not in person. But with gigantic oil cargo fleets. Iran, and especially Russia, found this spot very cozy. It’s quiet. It’s beautiful. And the Greeks are easy to please. Over the past two years, it became a safe haven and playground for Russian shadow fleet operators. Their oil tankers allegedly performed sanction busting ship to ship transfers (STS).

Especially recently, until the big bust by the Greek Navy, the number of oil smuggling surged. Between January and May 1st, data analytics firm Kpler counted 61 STS. Now it’s the end of the illicit oil trade bonanza? Why now? And will the hiatus last?

The big throw out in a place that used to house dozens of ships loitering at any given time, was caused by measures taken by the Navy: The called it: “international automated service for communication of navigational and meteorological warnings and forecasts, as well as urgent maritime safety information to ships”, short NAVTEX. And of all the people, it is thanks to the Greek government.

The pressure on Greece mounted. Not only took many of these illicit oil trades place right in front of Greek eyes. They were also accommodated with greek tankers that Russia purchased through third parties, shell firms.

Greek was found to “facilitate” these transfers in its Gulf over a long time. It’s the results of several investigations. A wave of international reporting took place in the past months, including one piece by the SZ.

Did it help? The number of STS now drastically slowed. The Greek authorities seem on top of their “naval advisory”. A moment of victory. Yes! But there remains a bitter taste. It should have happened years ago. Meanwhile, the Kreml used the money to finance its war.

What Oil Sanction: Status until end of April, 2024

Can Russia afford the war in Ukraine? Some economists think Putin can neither afford to win nor to lose it. Too expensive to rebuild Ukraine, so they claim. But to lead its aggression war, and sustain high military spending — to give the impression the country grows at a several percent GDP growth — Putin needs to sell oil. The oil buys the weapons and fills the defense industry’s factory halls with material and workers. A deadly cycle, that the Kremlin pursues with deadly ignorance.

Set under heavy sanctions by the EU, that selling spree of oil is challenged. Instead of being accommodated openly, it moved “dark” and undercover. Russia’s largest state oil firms manage to keep selling oil. In February, Russia’s monthly fossil fuel export revenues rose again. So, things looking good for the Kremlin, despite the EU trying to stop where possible, so they claim.

If, Russia should probably thank one country more than any other, then it’s Greece. It’s here where, in a quiet Greek Gulf, with the help of brazen maneuvers, Russian oil is being laundered. It’s here where it’s being transshipped from one to the next tanker, that later brings the oil off to refineries around the world. Only, in parts, to end up again in the EU.

After being “cleaned” from its original provenance, the oil can safely be imported to the EU. No one knows or wants to know. And those who do, don’t care or earn so much money, that they intentionally don’t care.

Especially concerning is the risk of an oil spill. A huge spill would spoil hundreds, if not thousands, of kilometers of delicate coastline. It’s the short summary of a long investigation by reporters of a Germany newspaper, Süddeutsche Zeitung. The research used a number of nifty OSINT techniques, worth revealing. This post delves into those, apart, that are probably most interesting for journalists and researchers.

The shadowfleet

“They do it in international waters so they can escape scrutiny”, says Michelle Wiese Bockmann. Bockmann works for Lloyds List, a big analytics firm, that built its own dataset on Russian Shadwofleet tanker vessels. Bockmann and her team applied a number of “factors”, rules if you will, to find out what oil vessels Russia controls and what they would classify as the Russian shadow fleet. At the beginning of 2024 Lloyds tracked some 530 Tankers worldwide that match their criteria. It is not an easy feat to link them to Russia, as the tankers are not directly owned by Russian entities. Instead, they are often owned by shell firms, often based abroad, such as in India.

What is according to Lloyds some 12 percent of the global trading fleet (if not more), are nebulous vessels that can’t be associated with a country or the business of a reputable owner. Data shows this development really well. As the number of tankers that Russian bought from mainly Greek shipping companies, the number of vessels in the “unknown” categories steadily increased:

The problem is, the tanker ships Russia bought to export his oil to third countries, are old and vulnerable. They may break easily. Experts see a jaw-dropping risk that they might cause a devastating oil spills. As these ships spend so much time in front of the Greek coast, OISNT techniques describe the facts on how dangerous the situation is.

The CLIO: A German vessel in the midst of Russian STS Transfers

On 30st of April, the oil tanker CLIO is on its ways again. According to open records, the vessel is owned by a German company based in Hamburg. Since 2022, it came to the Greek gulf several times. Here it “met” with tankers such as the ECO FLEET, that frequently visited Russian oil ports, since the war started.

The AIS tracking signal allows calculations that suggests who met with whoom. The behaviour of the CLIO notified ship trackers. There it clearyl “met” several times with other tankers in that very spot where the Russian shadow fleet is operating.

How do STS work?

In April, 2023 the 16-year-old CLIO (IMO: 9396660) had just stopped in the Greek Gulf of Laconian. It never crossed the Greek economic zone line, the 12-mile limit zone, data shows. It remained at all times here in international waters. The rendezvous with other tankers didnt last long.

A big trunk is being connected to the other vessel at high sea. Then the oil is being pumped. The process can take everything from 12-24 hours to days, depending on how much crude is transferred. There are also support vessels between the tankers, for extra safety, with so-called fenders. In the laconian gulf, those were greek. They help avoid collisions.

Transshipping, at high sea, can be a dangerous maneuver. Spills can happen all the time. It’s one reason why they are typically being done in port. But for Russia, that’s not an option. At-sea STS, transfers should only be done in accordance with trained people and port authorities in presence, one expert says.

In April, the 16-year-old CLIO had just stopped in the Greek Gulf of Laconian. It never crossed the Greek economic zone line, the 12-mile limit zone. It remained at all times here in international waters. The rendezvous with other tankers didn’t last long. Oil that is often illegally sold above the price cap, a sanction enforcing measure set to 60 USD in December 2022.

…Oil tanker A comes from Russia with russian oil…

….in Greece, they “meet”. Then oil tanker B takes oil to other places where it can be laundered ….

The company TB Marine Shipmanagement GmbH & Co. KG insists in a statement, it carries out its global activities in accordance with the international laws and regulations and has been shown to adhere to all current and new EU, US and UN sanctions rules.

The Network: AIS Data of hundreds of alleged STS transfers

Since December 2022, the 250m long CLIO tanker allegedly rendezvoused at least six times with other vessels in EU waters. Such meetups are per se not illegal. There is no international law that forbids encountering other vessels in open international waters.

No one would have even noticed, if the CLIO weren’t part of hundreds of a complex network of vessels and several hundreds of such encounters that happened here off the coast of Greece after the start of the War in Ukraine.

Data shows the complex network of encounters. Collected were they by an analytics firm using AIS tracking data since December 2022. The Open Graph Viz Platform software Gephi helped to visualize these connections of transfers.

Among the Russian shadowfleet, there are so-called mother ships and support vessels. Mother ships resemble kingpin tankers, that meet more frequently and come from Russia. Support vessels span out to other ports across the world, to ship crude to refiners.

Who rendezvous whom the most?

The 17-year-old AGNES met the most times with other tankers, according to the data: the Most notable partners were the ZELDA (IMO: 9327372), the tanker FOTUO and the KOCATEPE. Latter with its registered owner KOCATEPE SHIPPING LTD, was allegedly involved in the Russian illicit petroleum trade, according to Blacksea News. The AGNES, with its 228-meters, represents the core of this transshipment system.

THE TURBA

Another ship that has repeatedly visited the Laconic Gulf is the Aframax oil tanker Turba, which has already played a role in Bloomberg’s reporting (LINK).

Until December 2023 called the Turba, now ROBON, also appears in the data of this investigation. She rendezvoused with the oil tanker TAKMA (IMO 9252333). Now 27 years old (built in 1997), the Turba is one of the oldest and dangerious of Putin’s shadow fleet, and therefore poses a significant risk to the world’s oceans, experts say.

Accidents involving such old oil tankers are no rare sight. One example is the accident of the Prestige, a 26-year-old oil tanker with an unknown owner that sailed from Russia and contaminated 60,000 tons of crude oil off the coast of Spain in November 2002, polluting around 2,300 kilometers of coastal beach (source).

Russia shadow fleet tankers have shown up as having perculiar accidents. Last May, the Gabon -flagged tanker Pablo caught fire off the Malaysian coast.

And in October, the engine of the Turba broke down. The Turba has received its last inspection in 2017. And so it happended that last October, the 243 m long vessel simply stranded penniless 300 kilometers off the coast of Indonesia and was no longer operational. Suddently it was the problem of the Indonesian government.

In December, the authorities had to rescue a 23-year-old tanker. For experts is the Turba an established part of the Russian shadow fleet. Data shows it encountered several other vessels in the Laconian Gulf. According to the investigation by Bloomberg, together with the Simba, it applied advanced GPS spoofing techniques to mask its location, to contraband oil.

Like many of the tankers part of the Russian shadow fleet, they have to sail through the Bosporus. So-called shipspotterstake videos or photos from land and record their existence and verify AIS data. On September 23, 2023, the tanker Nargis (IMO 9353125 ) sails on the way to the Laconic Gulf. The Nargis appears at least eight times in the data of the STS transfers.

Like its fellow vessel, the oil tanker ATACAMA (IMO 9248801), the ship was built by the Indian company Gatik Ship Management, allegedly a proxy firm by the Russian state to contraband its crude to other markets. Unlike many of its fellow vessels, did the Atacama not move from Gatik Ship Management to Caishan Ship Management in early 2023, before again
transferring to Unic, so the report by lloydslist.

The ATACAMA, is not a sanctioned entity. Its presence in the Laconian Gulf STS transfers data — present at least 9 times — however, is still deeply concerning. Especially because possible ties to Europe. Allegedly at least once it was insured by Standard P&I Club per Charles Taylor & Co, according to STS transfers data.

In Georgia, the ship caused an outcry. The vessel attracted attention after being spotted entering the Black Sea port of Batumi, Georgia, the capital of the Autonomous Republic of Adjara. That the ship entered port in 2022, the deputy Minister of Economy and Sustainable Development Guram Guramishvili did not deny. However, that the vessel was sanctioned, he insisted, was not the case, a piece of disinformation spread by the media.

Connecting the dots: the ATACAMA

As a Russian shadow fleet vessel, the ATACAMA checks all boxes. It’s simply predestined to be part of the core fleet of Russia’s nefarious oil sanction breaching game, a number of sources told, who are familiar with the shipping business.

The 176m long and 31m broad vessel was built in 2003 by the Hyundai Mipo Dockyard Co. Ltd. This is ancient. It changed its flag state time and time again. It frequently traveled between Greece and Russian ports, forth and back. And displays a suspicious behavior. Both AIS data and satellite images confirm that the ship was involved in ship to ship transfers. The now 21-year-old vessel is much older than the age of the average oil tanker. How much older show statistics. For tankers, carrying oil and other liquids the two-decade peak that was just reached, was 12.9 years, according to FT reporting.

Its ownership history shows how the old age vessel ended up in the hands of the Kremlin. In 2022, the Atacama belonged to the company Marine Compass Inc. The manager was the Indian company Gatik Ship Management. Gatik is now well known. It acted as a proxy company for Russian oil exporters.

Many the ships that Gatik once owned, at least 30 ships, have already been resold and are now sailing under new flags. The ship received its new flag in August 2023 . The owner is now Marine Compass in Mumbai, and the manager, Unic Tanker Gemi Isletmediligi AS ., in Izmir, Turkey . The registered owner, according to shipping data, is now Felicia Seaways Company in Greece.

At the beginning of last year the turkish media website Cagdaskocaeli reported that the an inspection team at Kocaeli Metropolitan Municipality in northern Turkey spotted a vessel in the Gulf of Izmit, allegedly polluting the sea. The website showed several images of ATACAMA and claimed the operator was fined more than 30 million turkish lira, 858,762 Euro.

Oil can be seen spattered over the port plattfrom and also in the water, shimmering on the surface.

Video here: https://www.dailymotion.com/video/x8he6s9

OSINT can uncover AIS Spoofing techniques

Spoofing, the act of masking the AIS signal the vessels send out for safety, is said to have occurred too. It is defined as the intentional alteration of one’s own GPS transponder signal.

At the end of September, Bloomberg was able to provide an analysis on the Turba, and how it managed to adjust its AIS signal during an STS transfer maneuver.

No AIS is not per se illegal: It does constitute a breach of SOLAS Annex 17 of the AIS requirements. This is the IMO Convention for Safety of Life at Sea (SOLAS) V/19.2. 4 ships of 300 or 500 tons ( large tonnage ) must have an AIS transponder on board and send a signal.

TankerTrackers co-founder Sam Madani classifies actions of the Russian Shadow Fleet in the Laconic Gulf. Spoofing hasn’t happened that often lately, he said. Russia’s spoofing activities have been reduced in most places. Spoofing would still be used on a large scale in the Black Sea. Regarding oil tankers, Madani says that ships are much more likely to turn off AIS altogether.

That some turm platanly their AIS off isnt hard to validate. Simply compare whats on the tracking platforms and whats on satellite.

What the analysis showed, that on satellite data, there were frequently more tankers to be seen than AIS records suggested.

The discrepancy for February 9th, 2024, showed up on Vesselfinder ‘s live tracking map with 16 large ships. 26 large ships at a similar time were shown on satellite images. There were approximately 10 pairs of ships in the Gulf.

The Greek tug Othello moved back and forth between the pairs, sailing more slowly as it approached each pair of ships. The AIS signal from Greek passenger ships also gives the impression that crew members were brought to and fro the port in Gytheio. There were other Greek ships doing the same. For experts, a clear sign that the Greek authorities know about the transfers, and are complicit in the illicit ones.

MaritimeInsight wrote in a report that as a rule, ships involved in an STS transfer must seek permission from the relevant port state authority to carry out the transfer.

Madani from TankerTrackers explained that As a rule, tugs are sent from the Greek coast to circle the STS pairs with a boom line to be able to collect spilled oil in the event of an accident: “ If the STS’s were carried out unsupervised in the Mediterranean Sea, this would probably immediately alert Frontex and this would give rise to all sorts of liability cases ,” so Madani.

Old, rusty, badly in shape

The shadow fleet consists of old and badly maintained tankers. That’s no secret for anyone who takes a look at them. When Russian proxy companies bought the lot of tankers, the ships are ever since often cheaply serviced and checked, one source said. Often this is where they cut corners, simply to save money. Recently shot images of some of the Russian shadow fleet tankers, show how on some the coat of paint was poorly added, so that the old vessels’ names shine through.

Risk of an oil spill

In April last year, Rolf Thore Roppestad, chief executive at Norway’s Gard, one of the largest ship insurers, warned that thousands of ships without liability took a great risk by performing these STS maneuvers. A social and ecological catastrophe is waiting to happen, he told the Financial Times

How high is the risk that something will go wrong during an STS transfer and trigger an oil catastrophe? It’s difficult to pin down. The fact is, a lot can go wrong. If ships do not more in the port, but transfer crude oil on the high seas. Experts warn of high risks of pollution and a fire risk, according to a report by one outlet. A leak could simply form, especially on the high seas, with waves, wind and weather. In the event of an accident, the crew must be well-trained, experts advise. In the best case, there is equipment for fire fighting. But for that, the operator of a vessel must invest in equipment and to train crew well. It’s unlikely to be the case, on the old vessels part of the shadow fleet.

Fire Fighting and Oil Spill Equipment to be present and crew to be well trained to use them in Emergency. & All Guidelines to be followed as Per Mepc 59, Marpol Annex 1 Chapter 8, Sopep, SMPEP, STS Transfer Guide and Operational Plan (link)

Environmental damage analysis: Air pollution and noise

The tankers cause noise that cause a problem in the picturesque bay. Some protected animal species live in the coast.

Worst case scenario: An oil spill

Cormac McGarry at the company ControlRisk explains that aging tankers pose a high risk, and possible accidents should be taken seriously.

Pictures of the port in Gythion show emergency vessels, that would step in, in the the event of an oil disaster. The Greek authorities are apparently aware of the risk.

Petros Kokkalis, left-wing EU parliamentarians in October last year, placed a request and the EU Commission entitled “Dangerous Operations in the Laconian Golf, a sea protection area”.

Nature 2000 protected area would be affected in the event of an oil spill. And data shows how: In the event of an accident of one tankers, several Several Natura 2000 areas, would be affected. An oil spill would affect at least 200 km of coastline. But a much larger area would be affected by a disaster for years to come.

Several Sentinel 2 satellite images portray hints of streaks of oil at the water surface in the Gulf.

Similar to the example of Finland, the Russian shadow fleet vessels are insufficiently insured. In the case of an oil catastrophe, none would know or be responsible for to pay up, experts say.

How much would a spill cost

Alex Prezanti from the organization State-Capture.org explains how to calculate the possible costs of an oil spill.

“I can only give a very crude estimate because how much an oil spill would cost depends on many factors including the volume of oil; the geographic spread of the slick; the type of marine and coastal environments that it would affect; the time and resources that it would take to clean it up”, he explains. There is also a separate cost in terms of loss of biodiversity and long-term impact on the ecology — so any estimates are purely cost of cleanup.

There are actually very few examples to look at in terms of precedent, and not so many recent ones. The two most relevant examples are the Deepwater Horizon spill, and the FSO Safer operation. In the former case, BP estimates that the cost of cleanup was $61.6 billion USD for 3.19 million barrels of oil spilled into the Gulf of Mexico. Crudely, that works out at about $20,000 USD per barrel of spillage, he says. A UN-commissioned study on the impact of FSO Safer tanker spilling its crude off the coast of Yemen concluded that it would cost $20 billion USD to clean up the 1.1 million barrels of oil in the tanker — which works out at about $18,000 USD per barrel.

The Russian shadow fleet consists of Afromax tankers (750,000 barrel capacity) and Suezmax tankers (1 mil barrel capacity). Based that a full Suezmax tanker spilling its entire crude load would cost in the region of $19 bn USD to clean up. An Afromax tanker spillage would cost around $14.2 bn USD to clean up. Much would depend on how much crude the tanker is actually carrying and how much is actually spilled, as well as where it is spilled, he thinks.

“I suspect that a cleanup operation in the Laconian Gulf would be on the expensive side — given the relative cost of labor, the nature of the coastline and the famously fickle ocean currents”, Alex Prezanti

Conclusion

The risk these old ships bear on the situation for Greece remains underestimated and underreported. Often it is too complex for journalists to explain, next to the sanction breaking behavior, what bearing the shadow fleet has on the environment. For questions on the OSINT techniques used here, get in touch on Twitter/X: @Techjournalisto

Read on:

https://www.sueddeutsche.de/projekte/artikel/politik/putin-russland-oel-sanktionen-griechenland-eu-e302502/

END

Dmitry Khoroshev ist zwar erst 31, soll aber schon mindestens 100 Millionen USD auf seinem Kryptokonto sitzen haben. Als “LockBit” soll er alles ergaunert haben, was er bekommen konnte. Auch mit Hackerangriffen auf Krankenhäuser. Das Profil des jungen Mannes will aber nicht so richtig ins Bild passen, wie sich das Gericht in Amerika das vorstellt. Zur Anklage aus den USA stellen sich Fragen, die die Personalie so nicht beantwortet. Was man mit offenen Daten bestätigen kann und was nicht (#OSINT Analyse).

Ein Datingprofil, das nicht unscheinbarer wirken könnte: ein junger Mann um die 30. Sein Profilbild, ein Selfie, nachts auf einer beleuchteten Straße Russlands. Name “Herr Andrey”. Der Mann trägt Kopfhörern und einen Hoodie. Irgendwie wirkt er desinteressiert. Aber er möchte Frauen kennenlernen. 18 bis 50, also alles, was nicht bei drei auf dem Baum ist. “Suche Sex“ steht da.

Der junge Mann heißt aber gar nicht Andrey. Eigentlich heißt er Dmitry Yuryevich Khoroshev. Es ist ein falsches Datingprofil von vor einiger Zeit. Khoroshev wird nun öffentlich vorgeworfen, er soll im Wert von hunderten Millionen USD in Bitcoin von westlichen Firmen gestohlen haben. Und zwar mit Ransomware Betrugsgeschäfte.

Sicherheitshalber gibt Andrey im Datingprofil ein „stabiles Durchschnittseinkommen“ an. Er will keine Aufmerksamkeit mit seinem Erfolg. Keine Frau, die nur sein Geld will. Hinzukommt, dass sich das ergaunerte Geld nur schwer in harte Währung, wie in ein teuren Urlaub, umwandeln lässt.

Khoroshev soll der Ransomware König sein, Leiter und Kingpin der Gruppe Lockbit, mit dem Alias Lockbitsupp. So soll er maßgeblich als Anführer einer der gefürchteten Ransomware Hackergruppen gelten. Über 2000 bis 2500 (Stand 7.Mai) Opfer, also größtenteils private Firmen, soll Lockbit gehackt haben.

Zwischen $120 und $500 Million in Ransom Zahlungen soll LockBit erbeutet haben. Nach Daten und Links von Privtools, einer Seite die Ransomware Hacks katalogisiert, gab es mindestens 42 “.de” Domains die Lockbit gehackt und erpresst haben soll. Darunter sind namhafte deutsche Mittelständler sowie große Unternehmen. Auch dabei: die Deutsche Telekom. Der führende Telekommunikationsanbieter auf dem deutschen Markt soll eine Frist bis zum 21. Mai gesetzt bekommen haben. Ein nicht-veröffentliche Summe soll bezahlt werden, um zu verhindern, dass die gehackten Daten ins Internet gespielt werden. Ein Sprecher des Konzerns streitet das ab. Es handle sich lediglich um Gerüchte.

Wer ist Khoroshev?

Die Anklage des US Gerichts, die erklärt, dass der in den Staaten angeklagte Russe seit 2019 Lockbit sein soll. Eine weitere Publikation der amerikanischen Behörden, eine sogenannte Cyber-related Designation, nennen mehrere Schlüsselinformationen und Eckdaten aus dem Netz. Sie ermöglichen eine erste Onlinesuche und Verifikation. Geboren wurde der nun 31-Jährige am 17. April 1993. Voller Name ist DMITRY YURYEVICH KHOROSHEV, in kyrillisch Дмитрий Юрьевич Хорошев. Mit dem Alias Lockbitsupp, Putinkrab sowie seine Steuernummer (366110340670) soll dem jungen Hacker ein Strich durch die Rechnung gemacht werden.

Es ist unwahrscheinlich, dass die US-Behörden den in Russland-lebenden Mann jemals in die Finger bekommen. Da das US-Gericht jetzt aber den Hacker offen zur Schau stellt, kommt die Frage auf: Wissen so nicht auch die russischen Steuerbehörden bescheid?

Im privaten würde so etwas als Doxxing gelten. Die US-Behörden sind sich angeblich sicher , dass ihre Beweise handfest sind. Und genau da scheiden sich die Geister. Denn einige, die sich in der Szene auskenne, haben Zweifel dass Lockbit gleich KHOROSHEV ist.

Folgende E-Mail-Adressen werden in den US Daten genannt: khoroshev1@icloud.com und sitedev5@yandex.ru.

Eine Bitcoin Adresse wird genannt: bc1qvhnfknw852ephxyc5hm4q520zmvf9maphetc9z

Khoroshev Pass ID Nummern, er hat zwei 2018278055 (Russland) 2006801524 (Russland).

Wo ist zu Hause, wo die Arbeit, wo das “Hackerbüro”?

Wir starten mit den einfachsten Informationen. Russland hat ein überschaubares System an Personeninformationen, die über die Steuernummer im Netz abgerufen werden können (der sogenannte ИНН Nummer). Hat man eine Steuernummer einer Person, kennt man Wohnort, Unternehmen, die geleitet oder gegründet worden. Bei einem Entrepreneur gibt die Steuernummer einiges preis. Eine Yandex Suche nach Khoroshev Steuernummer aus den Aktion bestätigt Khoroshev Wohnort (Voronezh Region). Es ist auch dort wo die russischen Behörden ihm seinen Pass ausgestellten (Novousmansky Kreis, Ort: Otradnoe).

Als Beruf gibt er Entrepreneur, an, also ein Start-up Gründer, der seit 2021 aktiv ist. Mitte 2020 wird er ins Steuersystem geführt (link, link). Khoroshevs Firmen, die er gründete und leitete, stehen da. Die Firma ООО “ТКАНЕР” (tkaner) führt er nur ein Jahr und beschäftigte sich mit online Retail. Die Firma ООО “ВИПГЕО” war auf das Geschäft mit Touristeninformationen ausgelegt. Damals war ein Gryadunov Alexander Alexandrovich, auch noch an Bord. Dieser soll dem Spirit vom Start-up Traum treu geblieben sein, und leite heute die Firma S.S.S.R.

Für die erste Firma erstellte Khoroshev eine Webseite. Sie nennt sie tkaner.com, das belegen WhoIs Einträge. Mindestens sechs weitere Domains lassen sich Khoroshev zuordnen. Es ist für einen ambitionierten Entrepreneur erst mal nichts Ungewöhnliches, eine gewisse Zahl an Webseitendomains anzumelden. Über Webseiten werden Geschäfte gemacht. In einigen der Seite geht es um Marketing im Retailsektor. Es passt zu dem jungen Mann, der sich auf Bildern inszenieren weiß. Oft sind die Bilder gut, da seine jetzige Partnerin eine Fotografin sein soll. Valeria S. studiert am Voronezh Institute of High Technologies. Profilbild mit Mann in Uniform.

Bei der kleinen Firma Tkaner handelt es sich auch um das Start-up, das mit der E-Mail-Adresse aus der US Anklage verbunden ist. Mit der E-Mail khoroshev1@icloud.com ausgestattet befragen wir die OSINT Suchplattform Hunter von Constella Instelligence. Sie zeigt dutzende Einträge. Khoroshev ist durchaus präsent im Netz. Über die letzten zehn Jahre legt er immer wieder Profile mit dieser E-Mail-Adresse an, auf verschiedensten Plattformen im Internet. Er ist fleißig und lebt sich privat wie geschäftlich im Netz aus.

Was die Leakdaten noch zeigt, ist, dass er so oft unvorsichtig seine gesamten persönlichen Daten im Netz präsentierte. Kein Opsec und präventive Löschung seiner Daten. So steht auch eine Telefonnummer der Recherche in einem Leakeintrag vom 17. April 2024 auf XFit.ru, ein Fitness und Erholungscenter.

In Voronezh gibt es vier Xfit. Er oder seine Frau sind sehr sportlich. Dieser Analyse soll nicht Doxing nachgesagt werden, deshalb werden hier auch keine genaueren Informationen genannt. Der Eindruck, den Khoroshev im Netz jedoch vermittelt, ist keiner, den einen kühl-kalkulierten Groß-Cyberkriminellen zeigt. Eher jemand, der sich im Internet auslebt und weniger die Konsequenzen im Kopf hat.

Eine Constella Instelligence Suche nach der Telefonnummer bringt fünf unterschiedliche Adressen zu Tage. Hat Khoroshev Teil des Geldes in Immobilien gesteckt? Sein Bankkonto hatte Khoroshev bei einer kleinen Bank, der Альфа-Банк. Die Kontonummer nach Einschätzungen vom Cyberintelligence Outfit Treadstone 71 und CIO Jeffrey Bardin gilt als “40817810704520020947”.

Wer denkt dort, wo Khoroshev lebt und arbeitet, stehen teure Villen mit teuren Gärten, der irrt. Die Adressen des angeblichen Betrügers liegen in einfachen Wohngebieten. Eine davon ist an der Straye Kaliningradskaya Ulitsa, 108, Appartment 61. Eine rund hundert Quadratmeter große Wohnung unweit des Zentrums von Voronezh. Dicke gelbe Blumen wuchern vor dem neun-geschössigen Hochhaus, die man auf Google StreetView Bildern sehen kann. Die Sonne scheint in die Kamera. Es ist keine vermögende Gegend. Megateure Autos und überreicher Luxus gibt es hier weit und breit nicht. Die Daten kommen aus der russischen Regierungsdatenbasis und zeigen auch hier wieder wie unvorsichtig er agierte.

Die Profile, die mit Khoroshevs E-Mail-Adressen verbunden sind, geben Hinweise auf sein Leben. Sie werfen aber auch Fragen auf. So ist es möglich, dass Khoroshev ein Zocker ist, ein Freund des online Gamings. Er spielt Call of Duty im Netz. Er zahlt gelegentlich mit Paypal und nutzt Apple Produkte mit seiner Apple ID. Er organisiert sich mithilfe eines Notion Accounts. Er programmiert C++ Code und hat sich irgendwann einmal ein Github Konto angelegt, das auf den Usernamen sitedev5 läuft. Es gibt dort zwar kein Programmiercode (mehr). Trotzdem hilft uns diese Suche weiter. Der Username wurde auf anderen Seiten recycelt. Das hängt wohl weniger daran, dass Khoroshev faul ist. Er möchte wiedererkannt werden.

OSINT Kollegen von Predictalab finden einen User mit dem Namen sitedev5 in einem Autoverkaufs online Forum wieder. Als ein Mercedes Coupe zum Verkauf ansteht, kommentierte Khoroshev. Er fahre auch einen Mercedes-Benz GLE-Class Coupe. Ein schönes Gefährt. Aber keines für jemand, der 100 Millionen herumliegen hat. Der Nutzer kommt aus der 1 Million Metropole Voronezh, könnte also durchaus Khoroshev sein.

Weitere Suchen führen zu einem offenen VK Profil. Profilbild mit kurzen Haaren, Jeans und Apple Watch. In einem Studio aufgenommen. Auch hier hat der junge Mann schlampig gearbeitet. Bis heute lassen sich seine VK Kontakte im Profil einsehen. Der Geschäftskollege Gryadunov ist nicht dabei. Das Profil also nur eine Ablenkung? Mindestens über ein Dutzend weitere VK Kontos findet man. Viele sind bereits gelöscht.

VK-Profile können eine Goldgrube für persönliche Informationen sein. Im Falle von Khoroshev lassen sich Bilder auf Reisen finden (wie auf der Krim), oder in Kampfuniform. Das Abzeichen seiner Uniform (unten) lässt sich mit Yandex Reverse Bildsuche als Interne Truppen des Ministeriums für innere Angelegenheiten der Russischen Föderation (ВВ МВД oder VV MVD) identifizieren. Also hat Khoroshev gedient. Eine Beziehung zu Russlands Diensten? Unwahrscheinlich oder zumindest noch nicht belegt. Zudem ist das Geld, das Lockbit ergaunert, nur eine minimale Hilfe in der großen Kriegsmaschinerie des Kremls, so Kommentare auf X. Dennoch gilt: Das was Lockbit in Europa und den USA anrichtete, die Angriffe zeigten Wirkung: Die Angst für Geld gehakt zu werden und damit möglicherweise pleitezugehen, diese Angst ist real. Lockbit ist mitverantwortlich.

Khoroshev ist rechts auf dem Gruppenselfie zu sehen. Weiter rechts, eine Truppe, zu der das Abzeichen gehört. Das Bild wurde auf der Seite eines 31 jahre alten Konstantin Zolotorev gefunden.

Nicht nur auf VK war der stets glattrasierte Russe aktiv gewesen sein. Andere OSINT Kollegen zeigten auf, dass der Username dkhoroshev auf einer bekannten Virus und Malwareseite an einem Tag im März 2015 aktiv geworden war. Die Konversation, über einen Vault Ransomware Trojaner, startete um rund 10 Uhr morgens und endete spätabends. Die Aussage, dass Khoroshev einen Verkauf einfädeln wollte, sei aber falsch, so ein OSINT Twitter Account auf X. Hier sei Khoroshev selbst zum Opfer einer Attacke geworden. Constella Leakdaten zeigen, dass es sich beim Username möglicherweise um денис хорошев, also Denis Khoroshev, aus Moskau, handelte.

Eine heiße Spur führt zu Webseiten, die mit Khoroshevs Telefonnummern verbunden sind. Wie Visualisierung Khoroshev ins größere Bild des Lockbit Kosmos passt, hat pancak3lullz (X Thread) aufgedröselt. Der angebliche Strippenzieher hinter Lockbit erscheint als kleine Antenne des größeren Lockbit Universums.

Khoroshevs registrierte Domain ist mit den Emails webmaster@stairwell.ru sowie admin@stairwell.ru in Verbindung zu bringen. Nach den Hinweisen von OSINTer und Journalist Brian Kebs (Post) steht die Domain stairwell.ru auch mit der E-Mail-Adresse pin@darktower.su in Verbindung. Diese Mail hängt an einer von Khoroshevs Telefonnummern, 79518539388. Und ist im Datenleak firstvds.com wiederzufinden.

Tel: +79518539388

Die Domain wurde 2020 angemeldet, was zu den Informationen der Anklage passt. SU von darktower.su steht übrigens für “Union of Soviet Socialist Republics (USSR)”. Die E-Mail ist reichhaltig an Leakdaten. Es kommt aus einen “maliziösen” Webhost Breach sowie aus dem Leak von Memoraleak. So lässt sich auch die Tangente zum Decknamen “Dima” herstellen (Dima, so heißt es, kenne den Eigentümer dieser Website http://fpteam-teceats.com/board/ — er erkläre das auf Exploit im Jahr 2011).

Der User soll die Hacker Forumseite fpteam-cheats kennen, so Cybershafarat. Die E-Mail Adresse hängt auch an einem Adobe Profil sowie einem Datingprofil der Amerikanischen Datingseite Zooks (2016) und einer weiteren Datingseite Badoo (2016). Mit dem Leak zu firstvds.com lässt sich die Verbindung zu Khoroshev bestätigen. Bis 2024 wurden die E-Mail nach Intel der Seite sprashivai.ru verwendet. Ein Twitter Profil das 2010 gegründet worden ist tauch auch auf. Dimitry, mit Usernamen “Pioneer_3D” steht da.

Wer ist “Mr Pin”?

Was sich hier ergibt, passt zu dem, was andere herausfanden. Khoroshevs trat angeblich mit dem Username “Pin” (und der Email pin@darktower.su) als russischer Kommentator mit 13 Einträgen 2012 auf dem internationalen Cybercrime Forum Opensc auf (so zumindest Intel471 sowie Krebs). Er soll neben Datenverschlüsselungsprobleme und Debugging von Programmen um unter anderem die Frage gestellt haben, wie man Malware in Speicherplatz induzieren kann, und so Windows Rechner angreifen könne.

Mit Pin soll Khoroshevs auch möglicherweise zur gleichen Zeit, um die 2012er Jahre, in Hacker Chatrooms von Antichat vertreten gewesen sein. Unabhängig bestätigen lässt das sich hier nicht. Pins Auftritt auf Antichat soll eine ICQ Nummer enthalten haben, auf der der User wiederum kontaktfreudig gegeben haben soll. Die ICQ ID 669316 ist eine heiße Spur. Sie führt zu einem Forum in dem er 2011/2012 aktiv gewesen war.

Auf Forum.zloy.bzsoll mit dem Usernamen “NeroWolfe”. Das Leak zu ZLoy zeigt NeroWolfes DoB (April 17, 1991). Bis auf die Jahreszahl passt das zu Khoroshev (er ist 1993 geboren). Auch die E-Mail des Accounts d.horoshev@gmail.com passt ins Bild.

Die Recherche zu NeroWolfe ist auch deshalb wichtig, weil sie die Entwicklung des C++ Programmierers in die Hackingwelt darstellt. Unter anderem soll der User 2013 Malware “Loader Programme” in den Hackerforen Verifiedangeboten haben. Ziel war es mit diesen Programmen den Sicherungsschutz bei Window Rechnern zu umgehen. Auch auf dem Cybercrime Forum Exploit war NeroWolfe aktiv.

Krebs Schlussfolgerung aus den Recherchen zu NeroWolfe und den Hacker-Forumeinträgen ist, dass Khoroshev nicht den Anschein gibt, als fürchte er enttarnt zu werden. Seine Hacker Social-Media Profile sind leicht in Verbindung mit seiner Person zu bringen.

Eine weiter email von ihm, 3k@xakep.ru ist mit NeroWolfes (aber auch unterwegs mit dem Usernamen Nero_Wolfe oder Pony1, oder дмитрий юрьевич/Dmitry Yuryevich) Chatprofilen verbunden, und lässt sich auch zu einem VK Profilvon Khoroshev spannen, sowie einem Profil des illegalen/maliziösen CRDShop.su sowie einer Deutschen IP Adresse, und vielen weiteren Verbindungen:

Obwohl Khoroshev erst Anfang 30 ist, hat er schon viel in der Szene erlebt. Wenn die Informationen stimmen, hat er essenziell dazu beigetragen, das Modell Ransomware for a Service zu etablieren. Die Daten lassen vermuten, dass er schon mindestens ein Jahrzehnt mit Ransomware und Hacking zu tun hat.

Am 7. Mai hat das US-Staatsministerium angekündigt, eine Belohnung von bis zu 10 Millionen US-Dollar demjenigen anzubieten, der Informationen, zur Verhaftung und Verurteilung von Khoroshev beitragen kann.

Neben Khoroshev werden auch eine Handvoll weiterer Hacker in der US Anklage genannt. Darunter auch der mit dem Spitznamen Wazawaka, mit bürgerlichen Namen: Mikhail Pavlovich Matveev. Der “Coconspirator” soll Lockbit und damit Khoroshev geholfen haben, die Hacker Angriffe auszuführen.

Wie das Leben eines Most Wanted ist, zeigt Matveev auf Social Media. Er meldete sich kürzlich aus seinem Luxuswagen mit einem Selfievideo zu Wort und brüllt einen russischen Song. Er wirkt erschöpft. Tiefe Augenringe zeigen den Komplizen von Khoroshev. Von dem vitalen Hacker mit den kurzen Haaren aus 2023 gibt es keine Spur mehr.

ENDE

Thanks to Lindsay Whyte and Constella Intelligence

Das vielleicht Interessanteste an dieser Recherche war es, wie gestohlene Breach Leakdaten mir dabei halfen, die Welt des Mannes zu erklären, der selbst Daten klaute.

Weitere Eckdaten und Quellen zu LockBit/Khoroshev Recherchen

Prescient: Blog zu einigen verifizierten Erkenntnissen

https://www.linkedin.com/pulse/unmasking-lockbitsupp-prescient-edge-gjprc/

Nicknamen — horoshev, cijixody, 123456a, Legenden Ghost, darkbot4, pony1 (on the pony1 website), anakonda66, dmitro8654567888, NeroWolfe (profile on Exploit since 2011, 520 posts)

Firmensitz: 394006, Voronezh, Kirova st., 28,

Email Addressen— d.horoshev@gmail.com, khoroshev1@icloud.com (attached to the company), 3k@xakep.ru (registered on the exploit hacker forum), darkbot@smtp.ru

Telefonnummern: 79518539388, 79673415167, 79521020220, 84732414824, 79518535470, 79663197842, 79518539348 (linked to tg), 79826204216

Neuestes VK Profil — https://vk.com/d_khoroshev (inaktiv/gelöscht)

VK des Mädchens, mit dem er studierte:— https://vk.com/id166467435 (sie sagte, dass Dima jetzt in Zypern lebe), https://vk.com/dmitro8654567888

Vater: Khoroshev Yuri Viktorovich 06/18/1961, OGRN: 321366800053738 INN: 366101146405, 79042145563

Passwörter: Fursty44111, 123456aa, fkkjfgegecmrf, 2259848

https://x.com/fs0c131y/status/1788918541132976581

https://krebsonsecurity.com/2024/05/how-did-authorities-identify-the-alleged-lockbit-boss/

https://cybershafarat.com/2024/05/10/dmitry-khoroshev-lockbitabbadon-deanon-club-https-t-me-wbdffz2oovdjy2m0may-09-2024/