Russian Analysts Locate Ukrainian Factories via Background Details in Video

Russian analysts identified a drone unit base in late October after reviewing footage from a television broadcast. The Rubicon drone unit was filming its successes, but the camera crew included background details that gave away the location. A bilingual sign above a toilet, metal access hatches, and specific ceiling fixtures allowed investigators to pinpoint the site. The unit was stationed in exhibition pavilions at Patriot Park outside Moscow.

The incident underscores a growing vulnerability for Ukrainian defense manufacturers. Russian open-source intelligence, or OSINT, groups are actively scanning public media for clues. A single photo in a press release or a television clip of a new weapon can reveal a factory's coordinates. Russian analysts examine shadows, roof structures, and window shapes to find targets for missiles or Geran drones.

Vadym Hlushko, founder of the Ukrainian community CyberBoroshno, notes that Russian OSINT teams often work with military intelligence agencies. They combine public data with information from informants, bought databases, and hacking operations. Major channels like Rybar and LostArmour maintain close ties to the Russian military apparatus. Rybar received funding from Yevgeny Prigozhin in 2020, while LostArmour has tracked losses since 2014.

The method relies on cross-referencing small visual details. In April 2022, the Rybar channel identified a workshop at the Kyiv Armoured Plant from a report on Ukraine's 1+1 channel. Analysts matched the wall color, window shape, and ceiling height against archive photos and Google Earth imagery. Russia struck the plant with missiles two days after the footage aired.

Andrii Lisitsyn, an OSINT investigator with InformNapalm, explains that location identification comes from combining multiple clues. Exterior features like roads and railway tracks help, but interior details are often more telling. Columns, overhead beams, machinery, and supplier logos can narrow down a site. If a frame matches old photos, satellite imagery, or employee profiles, the number of possible locations drops quickly.

A joint investigation by CyberBoroshno and Dnipro OSINT communities demonstrated this approach. They identified a workshop at Russia's Kupol plant by noting square and rectangular windows alongside large rooftop structures. These features did not match the plant's official address. Further research showed the company had leased a former production site of the Izhevsk Mechanical Plant. Satellite images confirmed the workshop was located there.

Power lines and vegetation also serve as identifiers. The shape of pylon cross-arms and the number of insulators can indicate a region. Analysts use tools like Shadow Finder to determine the exact time of a photo based on shadow direction. In 2014, Bellingcat used similar methods to locate the launch site of the missile that shot down MH17.

Reflections in glass can also expose locations. In 2022, Bellingcat geolocated a photo of a Russian missile programming team in Moscow. Details reflected in a window, including air-conditioning units and neighboring columns, confirmed the site as the Defense Ministry headquarters. In 2023, CyberBoroshno identified a Russian drone operator by analyzing a photo containing a gas pipe and a red Niva car. They traced the operator's identity through his wife's VKontakte profile and provided coordinates to the military. The position was struck by HIMARS rockets.

Post-production editing remains a challenge. Gaussian blur, a common tool for hiding backgrounds, can be mathematically reversed if the filter parameters are known. Pixelation is also imperfect. In 2022, Chinese researchers developed a neural network that reconstructs faces from pixelated images. The model tested on a dataset of 182,732 photos can produce plausible reconstructions of obscured areas. Cropping or compositing images may be safer than simple blurring.