Russian satellites have reportedly conducted dozens of detailed imagery surveys of military facilities and critical sites across the Middle East, an action a Ukrainian intelligence assessment suggests was intended to aid Iran in striking US forces and other targets.
The conclusions, which have been reviewed by Reuters, further indicate a collaboration between Russian and Iranian hackers in the cyber domain.
These findings offer the most comprehensive insight yet into Russia’s covert support for Iran since the Israel and US assault on 28 February.
According to the undated assessment, Russian satellites carried out at least 24 surveys of areas across 11 Middle Eastern countries between 21 and 31 March.
These operations covered 46 “objects”, encompassing US and other military bases, as well as key infrastructure such as airports and oil fields.
The assessment highlights a clear pattern, noting that military bases and headquarters were subsequently targeted by Iranian ballistic missiles and drones within days of being surveyed.
This intelligence has been corroborated by a Western military source and a separate regional security source, both of whom confirmed intense Russian satellite activity in the region and the sharing of imagery with Iran.
Nine surveys covered parts of Saudi Arabia, including five over the King Khalid Military City near Hafar Al-Batin, in what appeared to be an effort to locate elements of the U.S.-made THAAD air defence system, the Ukrainian assessment said.
Areas of Turkey, Jordan, Kuwait and the United Arab Emirates also came under satellite surveillance twice, while places in Israel, Qatar, Iraq, Bahrain and Naval Support Facility Diego Garcia did once, it said.
In an emerging trend, the assessment added, Russian satellites were actively surveying the Strait of Hormuz, a vital waterway for a fifth of global oil and LNG flows where Iran has imposed a de facto blockade to all but “non-hostile vessels”.
Permanent communications channel
U.S. space-tracking firm Kayhan Space said analysis of the orbital data it gathers indicated Russian satellites were repeatedly overhead of parts of the Gulf region during the period March 21 to March 31, including some that were capable of Earth observation, reconnaissance, imaging or surveillance.
The company said its analysis suggested Russian satellite activity over the region during the late-March period may have been more extensive than that detailed by the Ukraine assessment, while overhead activity does not confirm that imagery was collected.
White House spokeswoman Olivia Wales said that no external support for Iran from any country was affecting the operational success of the United States. The Iranian foreign ministry had no immediate comment. The defence ministry in Russia, which invaded Ukraine four years ago, did not respond to a request for comment.
European leaders pressed U.S. Secretary of State Marco Rubio on the issue at a G7 meeting last month. Two diplomats said Rubio had not responded to the accusations, although he has publicly dismissed Russian aid to Iran as insignificant.
The Ukrainian assessment said that the exchange of satellite imagery was being organised through a permanent communications channel used by Russia and Iran and could also be facilitated by Russian military spies stationed in Tehran.
The regional security source confirmed a specific incident detailed in the Ukrainian assessment that was disclosed by Ukrainian President Volodymyr Zelenskiy last week.
In that incident, a Russian satellite took imagery of Prince Sultan Air Base in Saudi Arabia days before Iran struck the facility on March 27, hitting a sophisticated U.S. E-3 Sentry AWACS aircraft, the assessment said.
A Russian satellite passed over the same site on March 28 to assess the strike’s impact, the assessment said.
‘Comprehensive strategic partnership’
Russia and Iran have deepened military ties since Russian President Vladimir Putin ordered a full-scale invasion of Ukraine in February 2022.
In particular, Ukraine and the West say Iran provided long-range Shahed attack drones to Russia, which in turn used them to bomb Ukraine, while also developing its own, more sophisticated variants. Iran denies supplying weapons used against Ukraine.
Putin and Iranian President Masoud Pezeshkian then signed a Treaty on Comprehensive Strategic Partnership in January last year.
Article Four of the Treaty states that “in order to strengthen national security and counter common threats, the intelligence and security services of the Contracting Parties exchange information and experience.”
Cyber operations
The Ukrainian intelligence assessment and regional security source said Russia appeared to be providing assistance to Iran in the cyber domain.
Hacking groups controlled by Iran have stepped up operations since late February, targeting mainly critical infrastructure and telecommunications companies in the Gulf, they said.
The Ukrainian assessment said Russian and Iranian hacker groups were interacting via Telegram and noted collaboration between the Russian groups “Z-Pentest Alliance”, “NoName057(16)” and “DDoSia Project” and Iran’s “Handala Hack”.
For example last month, it said groups including Handala Hack published a warning on Telegram about attacks on the information and communication systems of Israeli energy companies.
The Russian groups simultaneously published access credentials to control systems at critical infrastructure facilities in Israel, it said.
Iranian hacker groups have also used some techniques in operations that indicated they had obtained them from Russian military intelligence hackers, it said.
For instance, it said, Iranian hacker groups “Homeland Justice” (UAC-0074) and “Karmabelow80” used ProfitServer, a Russian VPS provider from Chelyabinsk, to register domains.
