How Russian OSINT finds Ukrainian plants

TLDR

• Ukrainska Pravda says Russian analysts can locate Ukrainian arms plants from walls, windows, roofs, power lines and background details.¹
• The Centre for Information Resilience found Rybar geolocated the Kyiv Armoured Plant from a TV report before a 2022 strike.³
• Ukrainian researchers advise cropping or opaque masking instead of blur, and checking file metadata, because blur can be reversed.¹²

Ukrainska Pravda published a guide on 3 November on how Russian open-source analysts locate Ukrainian arms plants from published footage, and how defence firms and journalists can film without giving a site away.¹ It follows an Oboronka report on 29 October, relayed by Euromaidan Press, that Russian analysts can find Ukrainian weapons plants from details in photos and TV footage.²

Why it matters: the same geolocation craft that investigators use to verify footage is used to find targets, so the publisher's choices about what appears in the frame decide what a hostile analyst can work out. Ukrainska Pravda describes Rybar-type channels as tied to Russia's military and security services, citing a CyberBoroshno founder, and no independent check of that link was made here.¹

Driving the news:

• The Kyiv Armoured Plant case: the Centre for Information Resilience found that Rybar geolocated a workshop shown in a 1+1 TV report broadcast on 7 April 2022 and published its coordinates. A missile strike on 16 April killed at least three civilians.³ Ukrainska Pravda says the analysts used wall colour, window shape and ceiling height, cross-checked against archive photographs and Google Earth.¹
• Ukrainska Pravda describes the same cross-referencing in a CyberBoroshno and Dnipro OSINT investigation of a workshop at Russia's Kupol plant. Rooftop structures and window shapes did not match the plant's official address, leading to a former production site that satellite images from different dates then matched.¹
• It also cites a Radio Liberty investigation that tracked a base of Russia's Rubicon drone unit to exhibition pavilions at Patriot Park near Moscow, using metal hatches, ceiling fixtures and a bilingual sign in a propagandist's TV report.¹
• Clues the article lists include power-line cross-arms and insulators, shadows, vegetation, and reflections in windows. It cites Bellingcat's 2022 geolocation of a photograph taken in the courtyard of the Russian Defence Ministry's headquarters.¹
• InformNapalm's Andrii Lisitsyn says analysts narrow locations by matching a frame with old photos, satellite images, job advertisements, staff profiles or contractor materials.¹²

What to do about it: Ukrainska Pravda says Gaussian blur can be mathematically reversed if the filter settings and edge handling are known, citing an engineer's blog, and that a 2022 neural network reconstructs plausible faces from pixelated images. Lisitsyn advises cropping or fully opaque masking and checking file metadata.¹² Euromaidan Press, summarising Oboronka, adds that some Ukrainian defence firms still keep accounts in Russian 1C software, which has been on Ukraine's banned-software list since 6 January 2026.²

The other side: none of the sources reviewed carries a response from Rybar or other Russian channels.

Single-source note: the guide is a Ukrainska Pravda explainer built largely on interviews and earlier investigations. This article reviewed about the first two-thirds of it, and not the Radio Liberty, Bellingcat, Kupol or Oboronka originals. The Ukrainska Pravda text says the Kyiv strike came two days after the footage was released, but the Centre for Information Resilience dates the broadcast to 7 April and the strike to 16 April, and Euromaidan Press says Rybar posted the location on 14 April, two days before the strike.¹²³