Russia supplies Iran with cyber support, spy imagery to hone attacks: Ukraine

Highlights:
- Ukrainian assessment alleges
Russian satellite imagery aided Iranian strikes on US, regional targets
- Russia and Iran collaborate
on cyber operations, assessment says
- Western and regional sources
confirm increased Russian satellite activity, imagery sharing with Iran
Russian satellites
have made dozens of detailed imagery surveys of military facilities and
critical sites across the Middle East to help Iran strike US forces and other
targets, according to a Ukrainian intelligence assessment.
The conclusions,
reviewed by Reuters, also found that Russian and Iranian hackers were
collaborating in the cyber domain. They represent the most detailed account yet
of how Russia has provided secret support to Iran since Israel and the US
launched their assault on (28 February).
Russian satellites, the undated assessment
said, made at least 24 surveys of areas in 11 Middle Eastern countries from (21
March) to (31 March), covering 46 "objects", including US and other
military bases and sites including airports and oil fields.
Within days of
being surveyed, military bases and headquarters were targeted by Iranian
ballistic missiles and drones, the assessment said, in what it described as a
clear pattern.
A Western military
source and a separate regional security source told Reuters that their
intelligence also indicated intense Russian satellite activity in the region
and said that imagery had been shared with Iran.
Nine surveys
covered parts of Saudi Arabia, including five over the King Khalid Military
City near Hafar Al-Batin, in what appeared to be an effort to locate elements
of the US-made THAAD air defence system, the Ukrainian assessment said.
Areas of Turkey, Jordan, Kuwait and the United Arab Emirates also came under
satellite surveillance twice, while places in Israel, Qatar, Iraq, Bahrain and
Naval Support Facility Diego Garcia did once, it said.
In an emerging
trend, the assessment added, Russian satellites were actively surveying the
Strait of Hormuz, a vital waterway for a fifth of global oil and LNG flows
where Iran has imposed a de facto blockade to all but "non-hostile
vessels".
Permanent
communications channel
Reuters was not
able to independently confirm the content of the Ukrainian assessment.
White House
spokeswoman Olivia Wales said that no external support for Iran from any
country was affecting the operational success of the United States. The Iranian
foreign ministry had no immediate comment. The defence ministry in Russia,
which invaded Ukraine four years ago, did not respond to a request for comment.
European leaders
pressed US Secretary of State Marco Rubio on the issue at a G7 meeting last
month. Two diplomats said Rubio had not responded to the accusations, although
he has publicly dismissed Russian aid to Iran as insignificant.
The Ukrainian
assessment said that the exchange of satellite imagery was being organised
through a permanent communications channel used by Russia and Iran and could
also be facilitated by Russian military spies stationed in Tehran.
The regional
security source confirmed a specific incident detailed in the Ukrainian
assessment that was disclosed by Ukrainian President Volodymyr Zelenskiy last
week.
In that incident,
a Russian satellite took imagery of Prince Sultan Air Base in Saudi Arabia days
before Iran struck the facility on (27 March), hitting a sophisticated US E-3
Sentry AWACS aircraft, the assessment said.
A Russian
satellite passed over the same site on (28 March) to assess the strike's
impact, the assessment said.
'Comprehensive
strategic partnership'
Russia and Iran
have deepened military ties since Russian President Vladimir Putin ordered a
full-scale invasion of Ukraine in February 2022.
In particular,
Ukraine and the West say Iran provided long-range Shahed attack drones to
Russia, which in turn used them to bomb Ukraine, while also developing its own,
more sophisticated variants. Iran denies supplying weapons used against
Ukraine.
Putin and Iranian
President Masoud Pezeshkian then signed a Treaty on Comprehensive Strategic
Partnership in January last year.
Article Four of
the Treaty states that "in order to strengthen national security and
counter common threats, the intelligence and security services of the
Contracting Parties exchange information and experience."
Cyber operations
The Ukrainian
intelligence assessment and regional security source said Russia appeared to be
providing assistance to Iran in the cyber domain.
Hacking groups
controlled by Iran have stepped up operations since late February, targeting
mainly critical infrastructure and telecommunications companies in the Gulf,
they said.
The Ukrainian
assessment said Russian and Iranian hacker groups were interacting via Telegram
and noted collaboration between the Russian groups "Z-Pentest
Alliance", "NoName057(16)" and "DDoSia Project" and
Iran's "Handala Hack".
For example last
month, it said groups including Handala Hack published a warning on Telegram
about attacks on the information and communication systems of Israeli energy
companies.
The Russian groups
simultaneously published access credentials to control systems at critical
infrastructure facilities in Israel, it said.
Iranian hacker
groups have also used some techniques in operations that indicated they had
obtained them from Russian military intelligence hackers, it said.
For instance, it
said, Iranian hacker groups "Homeland Justice" (UAC-0074) and
"Karmabelow80" used ProfitServer, a Russian VPS provider from
Chelyabinsk, to register domains.
















