Thread by @nixintel

Last week a key ransomware threat actor was arrested in Kiev, Ukraine.

I wondered if it was possible to do a little geolocation and find out where he was living the high life.

The source video is the official release from the Ukranian Police:

Using YouTube-dl to download the video and FFMPEG to split into a series of stills makes finding clues a little easier.

(Guide here: nixintel.info/osint-tools/us…)

You can also use Frame-by-Frame to do this in your browser (HT @salaheldinaz)

watchframebyframe.com/watch/yt/I20fa…

Here are the key images with exterior detail:

1) Yellow/Green pipe construction outside.
2) "Autograph" sign on the wall.

So we know the building is in Kiev - but where?

A search for businesses called "Autograph" only brings one plausible match in Kiev - a beauty salon on Yevhena Konvaltsia Street.

g.page/autographfashi…

Verifying the location is not so easy though...

The Google Street View coverage is 6 years out of date. Here's where Autograph should appear.

We need to find an alternate image source.

Mapillary often has coverage where Street View does not. Here's the location in 2019.

The distinctive yellow pipe and tall background buildings are very similar the ones in the arrest video.

Business Facebook pages can also be useful for localised images. This is from the Autograph salon Facebook page.

The sign from the police video is in the green square. The orange arrow is likely the door they entered through.

There might be little Street View coverage, but photos uploaded to Google Maps help to fill the gaps with local detail.

Here's the perfect picture that explains the yellow/green pipes in the first frame of the video:

google.com/maps/@50.42719…

Notice the green pipes/slide reflected in the window when the police enter the apartment block.

So all this means that the arrested ransomware suspect was living in the "Aristocrat" apartment complex in Kiev.

Apartments there currently selling for the equivalent of beween $170k and $220k.

(Avg UKR salary is approx $700 US per month)

blagovist.ua/eng/search/apa…

(There might be another one for sale very soon...)

The full story by @campuscodi is here:

https://twitter.com/campuscodi/status/1444965770862211074