Russia supplies Iran with cyber support, spy imagery to hone attacks, Ukraine says

The conclusions, reviewed by Reuters, also found that Russian and Iranian hackers were collaborating in the cyber domain. They represent the most detailed account yet of how Russia has provided secret support to Iran since Israel and the U.S. launched their assault on Feb. 28.

Russian satellites, the undated assessment said, made at least 24 surveys of areas in 11 Middle Eastern countries from March 21 to 31, covering 46 "objects," including U.S. and other military bases and sites including airports and oil fields.

Within days of being surveyed, military bases and headquarters were targeted by Iranian ballistic missiles and drones, the assessment said, in what it described as a clear pattern.

A Western military source and a separate regional security source told Reuters that their intelligence also indicated intense Russian satellite activity in the region and said that imagery had been shared with Iran.

Nine surveys covered parts of Saudi Arabia, including five over the King Khalid Military City near Hafar Al-Batin, in what appeared to be an effort to locate elements of the U.S.-made THAAD air defence system, the Ukrainian assessment said.

Areas of Turkey, Jordan, Kuwait and the United Arab Emirates also came under satellite surveillance twice, while places in Israel, Qatar, Iraq, Bahrain and Naval Support Facility Diego Garcia did once, it said.

In an emerging trend, the assessment added, Russian satellites were actively surveying the Strait of Hormuz, a vital waterway for a fifth of global oil and LNG flows where Iran has imposed a de facto blockade to all but "non-hostile vessels."

Permanent communications channel

Reuters was not able to independently confirm the content of the Ukrainian assessment.     

White House spokeswoman Olivia Wales said no external support for Iran from any country was affecting the operational success of the United States. The Iranian foreign ministry had no immediate comment. The defense ministry in Russia, which invaded Ukraine four years ago, did not respond to a request for comment.

European leaders pressed U.S. Secretary of State Marco Rubio on the issue at a G7 meeting last month. Two diplomats said Rubio had not responded to the accusations, although he has publicly dismissed Russian aid to Iran as insignificant.

The Ukrainian assessment said the exchange of satellite imagery was being organized through a permanent communications channel used by Russia and Iran and could also be facilitated by Russian military spies stationed in Tehran. 

The regional security source confirmed a specific incident detailed in the Ukrainian assessment that was disclosed by Ukrainian President Volodymyr Zelenskiy last week.

In that incident, a Russian satellite took imagery of Prince Sultan Air Base in Saudi Arabia days before Iran struck the facility on March 27, hitting a sophisticated U.S. E-3 Sentry AWACS aircraft, the assessment said.  

A Russian satellite passed over the same site on March 28 to assess the strike's impact, the assessment said. 

'Comprehensive strategic partnership'

Russia and Iran have deepened military ties since Russian President Vladimir Putin ordered a full-scale invasion of Ukraine in February 2022.

In particular, Ukraine and the West say Iran provided long-range Shahed attack drones to Russia, which in turn used them to bomb Ukraine, while also developing its own, more sophisticated variants. Iran denies supplying weapons used against Ukraine.

Putin and Iranian President Masoud Pezeshkian then signed a Treaty on Comprehensive Strategic Partnership in January 2025. 

Article Four of the Treaty states that "in order to strengthen national security and counter common threats, the intelligence and security services of the Contracting Parties exchange information and experience."

Cyber operations

The Ukrainian intelligence assessment and regional security source said Russia appeared to be providing assistance to Iran in the cyber domain. 

Hacking groups controlled by Iran have stepped up operations since late February, targeting mainly critical infrastructure and telecommunications companies in the Gulf, they said.  

The Ukrainian assessment said Russian and Iranian hacker groups were interacting via Telegram and noted collaboration between the Russian groups "Z-Pentest Alliance," "NoName057(16)" and "DDoSia Project" and Iran's "Handala Hack."

For example, last month, it said groups including Handala Hack published a warning on Telegram about attacks on the information and communication systems of Israeli energy companies.

The Russian groups simultaneously published access credentials to control systems at critical infrastructure facilities in Israel, it said.     

Iranian hacker groups have also used some techniques in operations that indicated they had obtained them from Russian military intelligence hackers, it said.     

For instance, it said, Iranian hacker groups "Homeland Justice" (UAC-0074) and "Karmabelow80" used ProfitServer, a Russian VPS provider from Chelyabinsk, to register domains.      

————

Steve Holland also contributed reporting to this story.