Russian analysts can locate Ukrainian weapons plants from details in published photos and TV footage, Ukrainian defense outlet Oboronka reported on 29 October. Open-source researchers told the outlet how to hide those details.

Ukraine plans to build 7 million drones this year, and Russia is hunting the plants that make them. In June, the Security Service of Ukraine (SBU) said Russia’s GRU military intelligence was gathering data to prepare air strikes on defense plants and attacks on their engineers.

A TV clip, then missiles

On 7 April 2022, Ukrainian channel 1+1 aired a report from a workshop at the Kyiv Armored Plant converting captured Russian military equipment for Ukraine’s forces. On 14 April, Rybar, an anonymous pro-Russian Telegram channel, posted the factory’s location. Russian missiles hit the workshop on 16 April, killing at least three civilians, the Centre for Information Resilience (CIR) found.

Retracing the likely method, CIR wrote that wall colors, window size, and ceiling height could single out the plant, and Google Earth imagery the workshop. InformNapalm researcher Andrii Lisitsyn told Oboronka that matching a frame with old photos, satellite images, job ads, or staff profiles quickly narrows the search.

A Gaussian blur smears pixels but keeps part of the information, Oboronka wrote. In a 2020 blog post, aerospace engineering student Gonçalo Raposo showed it can be fully reversed if the exact filter and edge handling are known. Pixelation fails too: a 2022 neural network reconstructs plausible faces from pixelated images. Lisitsyn advises cropping or fully opaque masking instead, plus checking file metadata.

Leaks beyond photos

Some Ukrainian defense enterprises still keep accounts and procurement records in Russian 1C software, Oboronka wrote. Since 6 January 2026, 1C products have been on the State Special Communications Service’s list of banned software. The ban covers systems with state information resources and critical information infrastructure owned or managed by state bodies, state enterprises, and local governments, the service said.

Oboronka also wrote that days before the full-scale invasion, Spanish journalist Pablo González photographed production lines at engine maker Motor Sich. Poland held him from February 2022 until a prisoner swap sent him to Russia in August 2024. Prosecutors then indicted him under both his names, Pablo González and Pavel Rubtsov, for spying for Russian military intelligence.

Russia is expanding drone storage at the Hvardiiske military airfield in occupied Crimea, Ukrainian OSINT channel Dnipro Osint reported on 26 October, citing new satellite images. The channel did not say who took the images or when. Ukraine’s Security Service (SBU) said it struck drone hangars at the same airfield in July, and the military said strikes on 13 October damaged four drone storage sites nearby.

Hvardiiske has stayed in use since then. Ukraine’s General Staff has listed it among the sites Russia launched attack drones from in every daily report since 7 October. The airfield was on the list again on 24, 25, and 27 October, the night Russia aimed its main strike at Kyiv. The new construction, as the channel describes it, adds protected storage at a base Ukraine has already shown it can reach.

Shelters and “garages”

The images show more than 20 small shelters under construction, each protected by earth berms, the channel said. It also counted about 40 smaller structures it calls “garages.” It said they are meant for storing, servicing, and preparing Geran drones for launch.

Geran is the name Russia gives the Iranian-designed Shahed drones: the Shahed-136 became the Geran-2, which Russia now builds itself. The images show at least one hangar damaged by a Ukrainian drone hit, Dnipro Osint noted.

Launched from vehicles

Hvardiiske, north of Simferopol, uses mobile launch platforms instead of fixed installations, according to Dnipro Osint. Crews load drones onto specially equipped vehicles, which then launch them from the runway.

Struck repeatedly since June

On 24 June, the SBU said it hit infrastructure at Hvardiiske and at the Saky airbase. On 3 July, the SBU reported that its drones struck two hangars at Hvardiiske that stored Shaheds and aviation equipment. Ukraine’s General Staff said its forces struck the airfield again overnight on 5 July, and the SBU said a day later that it hit three hangars with aviation equipment there. A strike on 3 August destroyed nine aviation-fuel tanks and damaged two aircraft hangars, the General Staff said. Strikes on 13 October damaged four drone storage sites near Hvardiiske, with signs of secondary detonation, it reported two days later.

Not the only base Russia is building up

Hvardiiske is not the only Russian drone base Ukrainian OSINT channels have flagged this month. On 13 October, the anonymous channel Absolutely Reliable Source said Russia had nearly finished the first section of a launch site for jet-powered Geran-5 drones near Millerovo in Rostov Oblast, with eight launcher positions and 32 drone-preparation spots. Hvardiiske and Millerovo were both among the launch areas the General Staff listed for the night of 27 October, when Russia launched 280 Shahed-type drones, 69 of them jet-powered, with Kyiv as the main target.

Russian tech giant Yandex's data center in Sasovo burned out from the inside, a Ukrainian OSINT analyst wrote on 22 October. On cloud-free satellite images, he saw almost no significant holes in its roof. Ukrainian drones hit the site overnight on 8 October.

Sasovo was the first strike on a data center in Russia. It came two weeks after Russia destroyed data centers in Kyiv. Drones then hit Yandex sites in Vladimir and Kaluga, a Sber data center, and a VK data center near St. Petersburg, which VK acknowledged. In occupied Donbas, monitoring channels reported hits on buildings housing telecom operators.

What the analyst sees

The analyst, who goes by Harbuz, runs the Ukrainian OSINT channel Dnipro Osint. His roof reading comes from the images. His interior claim comes from what he called available information: he wrote that a fire broke out inside and put part of the equipment out of action.

In an earlier post, Harbuz wrote that a third of the data center had burned out. In the new one, he writes that the building burned out from the inside. He does not say whether he revised the earlier figure.

Russian outlet Agentstvo studied Airbus images from 12 October. It found damage on about a third of the building. Unlike Harbuz, though, Agentstvo described a blackened western roof with damage resembling holes.

What Yandex says

On 8 October, Yandex stated that the attack caused a fire and forced it to suspend operations at the site, which hosts tens of thousands of servers, Reuters reported. Yandex Cloud and the Disk and Documents services that run on it ran with major disruptions that morning, Russian outlet The Bell reported.

Later that day, the company stated: "The scale of the damage to the infrastructure is still being assessed. For the moment, we cannot confirm whether it is possible to restore the data centre equipment in Sasovo." Two of Yandex's three supercomputers, used to develop its AI model, are housed there.

The same day, journalists asked Ukrainian President Volodymyr Zelenskyy whether Ukraine was targeting Russian data centers. He did not refer specifically to the Yandex strike, Reuters noted, but said: "We always respond in mirror-like fashion."