Russia supplies Iran with cyber support, spy imagery to hone attacks, Ukraine says

LONDON/PARIS — Russian satellites have made dozens of detailed imagery surveys of military facilities and critical sites across the Middle East to help Iran strike U.S. forces and other targets, according to a Ukrainian intelligence assessment.

The conclusions, reviewed by Reuters, also found that Russian and Iranian hackers were collaborating in the cyber domain. They represent the most detailed account yet of how Russia has provided secret support to Iran since Israel and the U.S. launched their assault on Feb. 28.

Russian satellites, the undated assessment said, made at least 24 surveys of areas in 11 Middle Eastern countries from March 21 to 31, covering 46 “objects”, including U.S. and other military bases and sites including airports and oil fields.

Within days of being surveyed, military bases and headquarters were targeted by Iranian ballistic missiles and drones, the assessment said, in what it described as a clear pattern.

A Western military source and a separate regional security source told Reuters that their intelligence also indicated intense Russian satellite activity in the region and said that imagery had been shared with Iran.

Nine surveys covered parts of Saudi Arabia, including five over the King Khalid Military City near Hafar Al-Batin, in what appeared to be an effort to locate elements of the U.S.-made THAAD air defence system, the Ukrainian assessment said.

Areas of Turkey, Jordan, Kuwait and the United Arab Emirates also came under satellite surveillance twice, while places in Israel, Qatar, Iraq, Bahrain and Naval Support Facility Diego Garcia did once, it said.

In an emerging trend, the assessment added, Russian satellites were actively surveying the Strait of Hormuz, a vital waterway for a fifth of global oil and LNG flows where Iran has imposed a de facto blockade to all but “non-hostile vessels”.

Permanent communications channel

U.S. space-tracking firm Kayhan Space said analysis of the orbital data it gathers indicated Russian satellites were repeatedly overhead of parts of the Gulf region during the period March 21 to March 31, including some that were capable of Earth observation, reconnaissance, imaging or surveillance.

The company said its analysis suggested Russian satellite activity over the region during the late-March period may have been more extensive than that detailed by the Ukraine assessment, while overhead activity does not confirm that imagery was collected.

White House spokeswoman Olivia Wales said that no external support for Iran from any country was affecting the operational success of the United States. The Iranian foreign ministry had no immediate comment. The defense ministry in Russia, which invaded Ukraine four years ago, did not respond to a request for comment.

European leaders pressed U.S. Secretary of State Marco Rubio on the issue at a G7 meeting last month. Two diplomats said Rubio had not responded to the accusations, although he has publicly dismissed Russian aid to Iran as insignificant.

The Ukrainian assessment said that the exchange of satellite imagery was being organized through a permanent communications channel used by Russia and Iran and could also be facilitated by Russian military spies stationed in Tehran.

The regional security source confirmed a specific incident detailed in the Ukrainian assessment that was disclosed by Ukrainian President Volodymyr Zelenskyy last week.

In that incident, a Russian satellite took imagery of Prince Sultan Air Base in Saudi Arabia days before Iran struck the facility on March 27, hitting a sophisticated U.S. E-3 Sentry AWACS aircraft, the assessment said.

A Russian satellite passed over the same site on March 28 to assess the strike’s impact, the assessment said.

A damaged U.S. E-3 Sentry aircraft following an Iranian strike on Prince Sultan Air Base in Saudi Arabia amid the U.S.-Israeli conflict with Iran. (Social media via Reuters)

‘Comprehensive strategic partnership’

Russia and Iran have deepened military ties since Russian President Vladimir Putin ordered a full-scale invasion of Ukraine in February 2022.

In particular, Ukraine and the West say Iran provided long-range Shahed attack drones to Russia, which in turn used them to bomb Ukraine, while also developing its own, more sophisticated variants. Iran denies supplying weapons used against Ukraine.

Putin and Iranian President Masoud Pezeshkian then signed a Treaty on Comprehensive Strategic Partnership in January last year.

Article Four of the Treaty states that “in order to strengthen national security and counter common threats, the intelligence and security services of the Contracting Parties exchange information and experience.”

The Ukrainian intelligence assessment and regional security source said Russia appeared to be providing assistance to Iran in the cyber domain.

Hacking groups controlled by Iran have stepped up operations since late February, targeting mainly critical infrastructure and telecommunications companies in the Gulf, they said.

The Ukrainian assessment said Russian and Iranian hacker groups were interacting via Telegram and noted collaboration between the Russian groups “Z-Pentest Alliance”, “NoName057(16)” and “DDoSia Project” and Iran’s “Handala Hack”.

For example last month, it said groups including Handala Hack published a warning on Telegram about attacks on the information and communication systems of Israeli energy companies.

The Russian groups simultaneously published access credentials to control systems at critical infrastructure facilities in Israel, it said.

Iranian hacker groups have also used some techniques in operations that indicated they had obtained them from Russian military intelligence hackers, it said.

For instance, it said, Iranian hacker groups “Homeland Justice” (UAC-0074) and “Karmabelow80” used ProfitServer, a Russian VPS provider from Chelyabinsk, to register domains.

伦敦/巴黎——据乌克兰情报部门评估，俄罗斯卫星对中东各地的军事设施和重要地点进行了数十次详细的图像勘测，以帮助伊朗打击美军和其他目标。

路透社审阅的调查结果还显示，俄罗斯和伊朗的黑客在网络领域存在合作。这些结果迄今为止最详细地揭示了自以色列和美国于2月28日发动袭击以来，俄罗斯如何秘密支持伊朗。

这份未注明日期的评估报告称，俄罗斯卫星在 3 月 21 日至 31 日期间，对 11 个中东国家的 24 个地区进行了至少 24 次勘测，覆盖了 46 个“目标”，其中包括美国和其他国家的军事基地和设施，例如机场和油田。

评估报告称，在进行调查后的几天内，伊朗的弹道导弹和无人机就对军事基地和总部发动了袭击，报告称这是一种明显的模式。

一名西方军事消息人士和一名地区安全消息人士告诉路透社，他们的情报还显示，俄罗斯在该地区卫星活动频繁，并称已将图像分享给了伊朗。

乌克兰方面评估称，九次勘测覆盖了沙特阿拉伯的部分地区，其中五次勘测覆盖了哈法尔巴廷附近的哈立德国王军事城，这似乎是为了定位美国制造的萨德防空系统的组成部分。

报告称，土耳其、约旦、科威特和阿拉伯联合酋长国的部分地区两次受到卫星监视，而以色列、卡塔尔、伊拉克、巴林和迪戈加西亚海军支援设施的部分地区受到一次监视。

评估报告还指出，俄罗斯卫星正在积极勘测霍尔木兹海峡，这是全球五分之一石油和液化天然气运输的重要水道，伊朗实际上封锁了除“非敌对船只”以外的所有船只。

永久通信渠道

美国太空追踪公司凯汉太空公司表示，对其收集的轨道数据的分析表明，在 3 月 21 日至 3 月 31 日期间，俄罗斯卫星反复出现在海湾地区部分上空，其中包括一些能够进行地球观测、侦察、成像或监视的卫星。

该公司表示，其分析表明，3 月下旬期间俄罗斯在该地区的卫星活动可能比乌克兰评估中详细描述的更为广泛，而高空活动并不能证实收集到了图像。

白宫发言人奥利维亚·威尔士表示，没有任何国家对伊朗提供外部支持，这并未影响美国的军事行动。伊朗外交部对此未立即置评。四年前入侵乌克兰的俄罗斯国防部也未回应置评请求。

上个月的七国集团峰会上，欧洲领导人就此问题向美国国务卿马可·卢比奥施压。两位外交官表示，卢比奥尚未对这些指控作出回应，尽管他曾公开否认俄罗斯对伊朗的援助，称其微不足道。

乌克兰方面的评估称，卫星图像的交换是通过俄罗斯和伊朗使用的永久通信渠道进行的，驻扎在德黑兰的俄罗斯军事间谍也可能为此提供了便利。

地区安全部门消息人士证实了乌克兰总统泽连斯基上周披露的乌克兰评估报告中详细描述的一起具体事件。

评估报告称，在那起事件中，一颗俄罗斯卫星在伊朗于 3 月 27 日袭击沙特阿拉伯苏丹王子空军基地几天前拍摄了该基地的图像，袭击击中了一架先进的美国 E-3 哨兵预警机。

评估报告称，3月28日，一颗俄罗斯卫星飞越同一地点，以评估此次袭击的影响。

在美以冲突期间，伊朗袭击了沙特阿拉伯的苏丹王子空军基地，一架美国E-3“哨兵”预警机受损。（社交媒体图片来自路透社）

“全面战略伙伴关系”

自俄罗斯总统弗拉基米尔·普京于 2022 年 2 月下令全面入侵乌克兰以来，俄罗斯和伊朗的军事联系日益加深。

乌克兰和西方国家尤其指责伊朗向俄罗斯提供了远程“沙赫德”攻击无人机，俄罗斯随后利用这些无人机轰炸乌克兰，同时还在研发自身更先进的改进型无人机。伊朗否认向俄罗斯提供用于攻击乌克兰的武器。

去年1月，普京和伊朗总统马苏德·佩泽什基扬签署了全面战略伙伴关系条约。

条约第四条规定，“为了加强国家安全和应对共同威胁，缔约各方的情报和安全部门交换信息和经验。”

乌克兰情报评估和地区安全消息人士称，俄罗斯似乎正在网络领域向伊朗提供援助。

他们表示，自2月下旬以来，受伊朗控制的黑客组织加大了攻击力度，主要目标是海湾地区的关键基础设施和电信公司。

乌克兰方面的评估称，俄罗斯和伊朗的黑客组织通过 Telegram 进行互动，并指出俄罗斯的“Z-Pentest Alliance”、“NoName057(16)”和“DDoSia Project”组织与伊朗的“Handala Hack”组织之间存在合作。

例如，上个月，该组织表示，包括 Handala Hack 在内的多个组织在 Telegram 上发布警告，称以色列能源公司的信息和通信系统正遭受攻击。

声明称，俄罗斯相关组织同时公布了以色列关键基础设施控制系统的访问凭证。

报告称，伊朗黑客组织在一些行动中使用了某些技术，这些技术表明他们是从俄罗斯军事情报黑客那里学来的。

例如，报告称，伊朗黑客组织“国土正义”（UAC-0074）和“Karmabelow80”使用俄罗斯车里雅宾斯克的 VPS 提供商 ProfitServer 注册域名。