With recent talk of Russian disinformation campaigns related to the current tensions around Ukraine we thought it would be timely to revisit some of Russia's previous attempts at disinformation, in particular the four M's that describe their use of satellite and aerial imagery 🧵
The first M is “Misdate”. There have been a number of examples of Russian authorities using legitimate satellite imagery but claiming it is from a different date. One of the most well known is from Russia’s July 21st 2014 press conference on MH17: bellingcat.com/news/uk-and-eu…
Russian authorities used satellite imagery to claim a Ukrainian Buk missile launcher had been moved from its base on July 17th, the day MH17 was shot down. But comparison of the Russian pictures to Google Earth imagery showed major discrepancies.
An area of trees and bushes that had been cleared by July 1st 2014 had mysteriously reappeared in the Russian satellite imagery that was supposedly from the middle of July.
Elsewhere in the imagery an area of worn away grass from May 2014, which had vanished by June in Google Earth, also reappeared in the Russian satellite imagery from July 2014. This demonstrated Russian authorities had used misdated satellite imagery to make its claim.
In the case of a reported 2015 bombing in the town of Sarmin in Syria, documented in this Guardian video report, Russian authorities also presented misdated satellite imagery
Videos from the scene of the attack showed destroyed structures, including walls, buildings, and utility poles (shown above), yet those structures were still standing in the Russian imagery supposedly showing the location after the attack.
The second M is “Misrepresention” of what satellite imagery shows. In late 2016 the Russian MoD presented imagery it claimed showed that the M10 hospital in Aleppo was undamaged after allegations it had been hit in airstrikes.
This was particularly surprising as the bombing had been caught on CCTV cameras set up at the hospital, capturing the damage caused both inside and outside the hospital building.
A large crater right next to the hospital was also photographed. So, was the Russian MoD lying about the date of the satellite imagery, like they had been about the MH17 satellite images?
In fact they were simply lying that the imagery showed no damage from the attack. A variety of damage was visible in Russia’s own satellite pictures and Google Earth imagery, including a collapsed roof (red), another partly collapsed roof (blue), and the crater (green).
The 3rd M is for “Mislocate”. In October 2015, at the start of Russian air force bombing campaign in Syria, reports from Jisr al-Shughur stated that the Omar bin Al-Khattab mosque had been damaged in a Russian airstrike shown in the below footage:
The Russian MoD denied the mosque was damaged, presenting imagery of the site and stating: “Today the real picture is shown by the means of objective monitoring.” Unfortunately, there was one small problem.
The mosque that had been bombed had been filmed with a small commercial drone some months before it had been bombed, allowing the footage of the aftermath to be geolocated.
It became apparent that the mosque highlighted by the Russian MoD was an entirely different building. Not only that, on the image released they had conveniently covered the site of the actual bombed mosque with an infobox (as seen in the video below).
Finally, the 4th M is ”Modify.” When Russian authorities can’t lie about the time, place or reality itself, it modifies imagery to fit its claims.
Russian media was also caught out by modified satellite imagery, when Russia 1 broadcast images supposedly captured by a passing satellite of a fighter jet shooting down MH17.
Web sleuths quickly identified sections of the satellite imagery as copied from various online mapping services, and the image of the aircraft was the top result on Google Image Search for “боинг вид сверху”, or “boeing top view” in English. bellingcat.com/news/2014/11/1…
Given the Russian authorities’ track record in misusing and abusing satellite and aerial imagery, we hope this provides useful background for some of the potential issues to watch out for as the current crisis with Ukraine and Russia continues.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
The US military conducted an operation on Jan 3 to capture President Nicolás Maduro of Venezuela. Bellingcat geolocated videos of helicopters involved in the raid, piecing together potential movements of the assault force
The operation included air strikes targeting military sites, and a raid at Maduro’s residence inside Fort Tiuna in Caracas. In addition to armed helicopters, jets and drones provided cover for the assault force, according to the US military.
One video shows what appears to be 9 helicopters, including 7 Blackhawks and 2 Chinooks, flying in formation in the Fort Tiuna area as explosions occur. tiktok.com/@ceciarmy/vide…
Bellingcat’s work in 2025 verified war crimes, exposed deepfake abuse, and challenged disinformation. We want to uncover wrongdoing. We can with your support:
This is how we cut through the digital noise to tell stories that matter. bellingcat.com/donate
We've reported on conflicts around the world — from Myanmar to Gaza, Sudan to the DR Congo, Ukraine and beyond — verifying footage of war crimes, human-rights abuses and attacks on civilians. Read our latest on the reconstruction of Mariupol: bellingcat.com/news/europe/20…
In May we identified the person behind MrDeepfakes — one of the largest providers of non-consensual deepfake pornography. The platform was shut down after the investigation, and politicians from two European countries called for the extradition of its owner. bellingcat.com/news/2025/05/0…
An investigation by Bellingcat and @LloydsList found that Saudi Arabia joined the countries importing grain directly from a sanctioned port in occupied Crimea. Meanwhile Russia attempts to secure recognition of the Ukrainian territory via a US-led peace plan. bellingcat.com/news/2025/12/1…
Using Satellite imagery and Automated Identification System (AIS) data from Lloyd’s List Intelligence we show that a Russian owned bulk carrier sailed from Sevastopol to Saudi Arabia twice in recent months.
On both journeys, the ship turned off its AIS location data, hiding its presence in the port of Sevastopol. But satellite imagery confirms the ship was present at the port’s grain terminal. Satellite imagery: @vantortech
Russian state media are today alleging that a Bellingcat reporter was involved in an attempt to hijack a Russian fighter plane.
We would like to make clear that Bellingcat had absolutely no involvement in the alleged activities and the accusations towards us are entirely false.
The individual detailed in Russian media as a Bellingcat reporter has never worked for us in any capacity and we do not know who they are.
The picture and name in the press pass published in RU media does not depict any of our staff members or contributors. If they exist, we are unaware of them ever engaging with us.
The press pass is also not remotely like any Bellingcat ID or documentation.
The largest aid flotilla in history has been attacked twice in two days whilst in port in Tunisia. Open source analysis suggests an incendiary munition is to blame, contradicting official statements. bellingcat.com/news/2025/09/1…
On September 8 the main vessel in the flotilla, known as ‘the Family’ was struck by what witnesses claimed was a drone. Caught on another boat's camera, a flaming object had fallen onto the Family Boat from above.
Tunisian officials stated that there was “no evidence of any hostile act or external targeting”, claiming the resulting fire was due to “a lighter or cigarette butt”.
A new report by Bellingcat’s Justice & Accountability (J&A) Unit and @GLAN_LAW detailing the use of cluster munitions in civilian areas in Kharkiv at the beginning of the full-scale Russian invasion of Ukraine is published today. j-and-a.glanlaw.org/kharkiv
The report is based on 32 in-depth investigations of separate incidents that took place between February and April 2022. It offers one of the most detailed looks yet at the use of cluster munitions against civilian areas in the early stages of Russia’s full scale invasion.
Bellingcat’s J&A Unit worked on this report as a self-contained entity separated (‘firewalled’) from the rest of Bellingcat, ensuring that accountability work was conducted independently from other investigations, preventing possible bias.