Russia supplies Iran with cyber support, spy imagery to hone attacks, says Ukraine

LONDON/PARIS – Russian satellites have made dozens of detailed imagery surveys of military facilities and critical sites across the Middle East to help Iran strike US forces and other targets, according to a Ukrainian intelligence assessment.

The conclusions, reviewed by Reuters, also found that Russian and Iranian hackers were collaborating in the cyber domain.

They represent the most detailed account yet of how Russia has provided secret support to Iran since Israel and the US launched their assault on Feb 28.

Russian satellites, the undated assessment said, made at least 24 surveys of areas in 11 Middle Eastern countries from March 21 to 31, covering 46 “objects”, including US and other military bases and sites including airports and oil fields.

Within days of being surveyed, military bases and headquarters were targeted by Iranian ballistic missiles and drones, the assessment said, in what it described as a clear pattern.

A Western military source and a separate regional security source told Reuters that their intelligence also indicated intense Russian satellite activity in the region and said that imagery had been shared with Iran.

Nine surveys covered parts of Saudi Arabia, including five over King Khalid Military City, near Hafar Al-Batin, in what appeared to be an effort to locate elements of the US-made THAAD air defence system, the Ukrainian assessment said.

Areas of Turkey, Jordan, Kuwait and the United Arab Emirates also came under satellite surveillance twice, while places in Israel, Qatar, Iraq and Bahrain and Naval Support Facility Diego Garcia were surveyed once, it said.

In an emerging trend, the assessment added, Russian satellites were actively surveying the Strait of Hormuz, a vital waterway for a fifth of global oil and liquefied natural gas flows where Iran has imposed a de facto blockade to all but “non-hostile vessels”.

Reuters was not able to independently confirm the content of the Ukrainian assessment.

White House spokeswoman Olivia Wales said no external support for Iran from any country was affecting the operational success of the US.

The Iranian Foreign Ministry had no immediate comment. The Defence Ministry in Russia, which invaded Ukraine four years ago, did not respond to a request for comment.

European leaders pressed US Secretary of State Marco Rubio on the issue at a Group of Seven meeting in March.

Two diplomats said Mr Rubio had not responded to the accusations, although he has publicly dismissed Russian aid to Iran as insignificant.

The Ukrainian assessment said the exchange of satellite imagery was being organised through a permanent communications channel used by Russia and Iran and could also be facilitated by Russian military spies stationed in Tehran.

The regional security source confirmed a specific incident detailed in the Ukrainian assessment that was disclosed by Ukrainian President Volodymyr Zelensky last week.

In that incident, a Russian satellite took imagery of Prince Sultan Air Base in Saudi Arabia days before Iran struck the facility on March 27, hitting a sophisticated US E-3 Sentry AWACS aircraft, the assessment said.

A Russian satellite passed over the same site on March 28 to assess the strike’s impact, the assessment added.

‘Comprehensive strategic partnership’

Russia and Iran have deepened military ties since Russian President Vladimir Putin ordered a full-scale invasion of Ukraine in February 2022.

In particular, Ukraine and the West say Iran provided long-range Shahed attack drones to Russia, which in turn used them to bomb Ukraine, while also developing its own, more sophisticated variants.

Iran denies supplying weapons used against Ukraine.

Mr Putin and Iranian President Masoud Pezeshkian then signed a Treaty on Comprehensive Strategic Partnership in January 2025.

Article Four of the treaty states that “in order to strengthen national security and counter common threats, the intelligence and security services of the Contracting Parties will exchange information and experience”.

The Ukrainian intelligence assessment and regional security source said Russia appeared to be providing assistance to Iran in the cyber domain.

Hacking groups controlled by Iran have stepped up operations since late February, targeting mainly critical infrastructure and telecommunications companies in the Gulf, they said.

The Ukrainian assessment said Russian and Iranian hacker groups were interacting via Telegram and noted collaboration between the Russian groups Z-Pentest Alliance, NoName057(16) and DDoSia Project and Iran’s Handala Hack.

For example, in March, it said groups including Handala Hack published a warning on Telegram about attacks on the information and communication systems of Israeli energy companies.

The Russian groups simultaneously published access credentials to control systems at critical infrastructure facilities in Israel, it said.

Iranian hacker groups have also used some techniques in operations that indicated they had obtained them from Russian military intelligence hackers, it added.

For instance, it said, Iranian hacker groups Homeland Justice (UAC-0074) and Karmabelow80 used ProfitServer, a Russian VPS provider from Chelyabinsk, to register domains. REUTERS