the home of online investigations

The Poor Man’s Air Force? Rebel Drones Attack Russia’s Airbase in Syria

January 12, 2018

By Nick Waters

Translations: Русский

On the night of the 6 January 2018, the Russian airbase at Khmeimim was reportedly attacked. Videos and rumours from the airbase claimed that this attack may have included drones, although there were also reports the base coming under attack by rockets. These reports were interesting for two reasons. Firstly, the frontline was approximately 35 kilometres away, and therefore out of the range of most of the kind of artillery available to the rebels. Secondly, independent Russian newspaper Kommersant claimed that the same base had come under mortar attack on 31 December 2017, destroying four Su-24, two Su-35S and an An-72 military transport aircraft. This incident would have been the worst loss of equipment the Russian military had experience since the beginning of the conflict. This report of a mortar attack and damage inflicted attracted immediate skepticism, given the distance from the front lines and a variety of other factors such as the level of damage inflicted. The Russian Ministry of Defence (MoD) denied that seven planes had been destroyed, but did state that two servicemen had been killed by “sudden mortar fire”. However, there was also speculation that this attack could have been carried out by small drones, of the kind that so-called Islamic State (IS) have used so effectively.

The speculation around the attack on New Year’s Eve was strengthened when the Russian MoD released a statement and images of improvised drones that they claimed had attacked Russian bases in Khmeimim and Tartus on the night of January 6. This article will use open source methods to examine the circumstances around these drones, the attacks they took part in and the possibility they may have been responsible for theNew Year’s Eve attack against Khmeimim.

Note: all times used in this investigation are UTC unless explicitly stated. A short guide to how different social media platforms display time and date can be found here.

Image 1 – Map showing incidents involving this model of drone and frontlines at the beginning of 2018 (Map Source)

The attack on Khmeimim & Tartus on 6 January 2018

There appears to be a single video of the attack on this base, however it is impossible to geolocate as it was filmed at night. The video appears to have first been posted on 1741 on January 6 by the Facebook group “Network News Jabla” (NN Jabla), a group dedicated to news from Jabla, a town immediately South-West of Khmeimim airbase. The video describes an “Alarm sounding at Hamimim airport” as well as “anti-aircraft response to a remote-controlled aircraft”.

Video reportedly showing the attack on Khmeimim

On 8 January 2018, the Russian MoD released a statement and included imagery showing one the drones it stated it had downed, claiming:

  • Six drones were intercepted and taken control of by Russian Electronic Warfare assets, of which:
    • Three landed successfully
    • Three exploded upon landing
  • Seven drones were destroyed by Russian anti-air assets, in this case using the Pantsir-S1.

Analysis of the imagery released shows that at least two drones have been obtained in an apparently reasonably intact state.

Image 2

Image 3

Image 4

Note that image 3 and 4 appear to show different drones, as the undercarriage and wings (highlighted in yellow and red) have a slightly different configuration, indicating at least two drones were recovered. A later image, published by RT, shows six drones, of which three are fairly intact.

Image 5

These appear to be reasonably small drones, with a wingspan of approximately three or four meters. Their construction seems to be reasonably basic, with a plywood body covered in plastic sheets which has been secured using tape. A small engine, possibly petrol, provides propulsion. In a later statement, the Russian MoD was claimed that the drones originated from the town of Muazzara, likely to be Al Maouzra or الموزرة, in Idlib province.

The attack on Homs Military Engineering Academy on or before 3 January 2018.

These drones have been previously seen in other media emerging from Syria, although nothing on the scale of the reported attack at Khmeimim airbase. The two images below reportedly show a drone that was shot down at a Military Engineering Academy in Homs, over 100 kilometres southeast of Khmeimim. The embed code for the Instagram image linked to in this article show at least one of the images was uploaded at 08:05 AM (Syrian time) on January 3, well before the January 5-6 attack on Khmeimim airbase took place. Although the drone has been deformed, it is possible to see how it is virtually the same design as the drones used at Khmeimim.

Image 6

Image 7

It should be noted that the yellow square highlights an item which resembles a GPS antenna, something the Russian MoD Facebook post claimed was also a component in the drones recovered from Khmeimim.

The attack on Khmeimim on or before 18:52, 1 January 2018

The images below, posted at 18:52 UTC on January 1 by the Facebook group NN Jabla (the same Facebook group that posted the video of the attack on Khmeimim on January 6) show another virtually identical drone, which was one of two reportedly downed in “rural areas”. The poster described hearing explosions at noon on 1 January 2018, which they believe were caused by these drones.

Image 8

A video was later released by “Muraselon news” which, although posted later, appears to be the source of some of the images posted by NN Jabla. It shows the remnants of what is claimed to be a drone shot down at Khmeimim by the SAA. Analysis of the wreckage shows it appears to contain very similar components to drones we have previously analysed in this article

Image 9 – Comparison of plywood body. Left: Muraselon Video, Right: Russian MoD

Image 10 – Comparison of motors. Left: Muraselon Video, Right: Russian MoD

Image 11 – Comparison of batteries. Left: Muraselon Video, Right: Rusvesna Image from Homs

Drone downed, allegedly on Ghab Plain, on or before 08:38, 1 January 2018

An instance of this kind of drone has also been seen in apparently rebel-held territory after allegedly being downed by Ahrar Al Sham.

Image 12 – A translation of the caption reads: “Ahrar Al Sham Islamic Movement downed the reconnaissance aircraft of the regime.”

It is immediately obvious that this is the same kind of drone seen at Homs and Khmeimim. We can also tell from the alignment of the tape on the tail that this drone is likely unique and not one of the examples we’ve previously examined. The picture is allegedly from an Ahrar Al Sham fighter on the Ghab Plain, the nearest section of rebel-held territory to the Khmeimim airbase. Although it does not appear possible to geolocate this image, it is consistent with claims from the Russian MoD that the drones had flow from Muazzara in order to reach Khmeimim. Judging by the use of these drones to attack Russian forces, it seems likely that Ahrar Al Sham may have accidentally shot down a drone belonging to another rebel group.

Drone for sale on Telegram, timestamped on the evening of 31 December 2017

An investigation by Adam Rawnsley and Christiaan Triebert for The Daily Beast discovered this kind of drone for sale on Telegram, a popular messaging app which they and Eric Woods had previously shown was being used as an online arms bazaar. The seller also offered drone bombs for sale. The damage to the drone and the tape applied to the tail differs from that captured by Ahrar Al Sham, indicating that it is likely a unique drone. The fact that this drone is damaged raises questions about how it was obtained, and whether the seller was actually party to its construction or happened to find one that had crashed.

Image 13

When asked about the possible location of the seller and when it was posted, Rawnsley replied:

“The vast majority of locations mentioned by sellers in that market are located in Idlib. It’s of course possible that the drone seller could’ve been located elsewhere but Idlib is where most of the market’s activity appears to be concentrated… The post was timestamped the evening of December 31st and the photos appear to have been taken at night, although I can’t be certain when, precisely, they were taken.”

Analysis of the drone

Although the drone seems to be made of cheap materials, such as plywood, plastic sheeting and tape, it also appears to contain at least one relatively advanced component compared to the rest of the drone: a GPS antenna. The Russian MoD claim that the drones were navigating using GPS is consistent with what appears to be a GPS antenna identified in the wreckage seen at Homs. The lack of evidence of any cameras also tangentially supports this claim – without a camera or line of sight, an operator would find it difficult to pilot this drone, especially at ranges in the tens of kilometres. This suggests a level of automation in what initially appears to be a rather rag-tag set of drones. The range of the drone appears to be based on the targets hit on the night of January 6: as can be seen from the map, Tartus is almost exactly 100 kilometres from the alleged point of origin.

The undercarriage of these drones are also of an interesting design. None of the examples seen so far of this kind of drone have any kind of wheels. Instead, they have appear to have a basic plywood undercarriage which would likely produce very poor landings. Indeed it would not even be sufficient to call these undercarriages “skids”, as they are so short and thin.

Image 14

The apparent weak nature of this undercarriage begs the question of how these drones are launched and how they are recovered. Considering the size of these drones and their payload, it seems unlikely they are launched by hand. It is a possibility that these drones are launched off some kind of catapult launcher, as used by many current military and civilian drones. As for recovery, considering the relatively cheap materials used in their construction and the problems landing with such an undercarriage, it seems likely that these drones were regarded as disposable, and were never intended to return to their point of origin. Needless to say, returning to a point of origin while flying at relatively low speeds after bombing a major Russian base would probably not be a recipe for survivability for whoever had to collect them once they had crash-landed.

The bomblet release mechanism for this drone is also an interesting feature. The struts under the wings serve as hardpoints where bombs can be attached, with room for up to 10 bomblets per drone.

It appears likely that the bomblets are secured to this strut by some kind of mechanism that is controlled by the servo motor at the end. Without more detailed images of the inside mechanism it is difficult to state exactly how the mechanism functions. With only a single servo per strut it seems likely that these bomblets are all released at the same time.

Image 16 – Servo indicated in yellow (Courtesy of the Russian MoD)

Image 17 – Drone bomblets: note the attachment point highlighted in red (Courtesy of Eric Woods)

Analysis of the bomblets

By closely examining the bomb, we can work out its basic construction: a core of explosive inside a layer of ball-bearings, encased in a white plastic shell and detonated by an unidentified type of fuze, probably point detonating.

Image 18 – The yellow arrows indicate where ball-bearing are visible within the bomblet

The images released by NN Jabla on 1 January 2018 contain further images that appear to show portions of these bombs after detonation, including the fuze, portions of the casing, and ball-bearings encased in epoxy resin.

Image 19 – Note the ball-bearings encased in what appears to be some kind of epoxy resin.

A later image released by the Russian MoD not only matches images of debris released on January 1, it also clearly shows the construction a bomblet in its entirety, as well as details of the fuze, which appears to be point detonating with a simple striker at the tip.

Image 20 – Note the BB’s encased in epoxy and the simple construction of the fuze

One of the images, allegedly taken by Ahrar Al Sham, shows a curious extension to the fuze, although its exact purpose has not been established. It is a possibility the rods are to detonate the munitions at knee or waist height, thereby increasing their lethality.

Image 21

The bomblets associated with these drones are neither small mortar bombs, nor, as IS used on a large scale, modified conventional munitions. Instead they appear to be custom made for use with drones. IS, the Iraqi Federal Police and the PKK have all used bomblets which appear superficially similar, but none of these match munitions associated with this drone.

Analysis of the tactics

Using the sources and analysis above, we can make an educated guess at the manner in which these drones are being deployed. In three of the four incidents above at least two drones are mentioned, while at Khmeimim on January 6, allegedly ten were deployed. The lack of cameras on the drones suggest that they are likely pre-loaded with a flight plan and then flown autonomously to their target, where they dropped their payload en mass on a given GPS coordinate.

Since the bomblets are unguided and are deployed from a moving fixed-wing, rather than a hovering rotary wing drone, it seems unlikely these drones are that accurate. Therefore, dropping numerous bombs from numerous drones simultaneously seems to be a reasonable course of action to increase the chance of hitting something. Considering the relatively cheap build quality, limited ability to land safely, and potential for compromise on recovery, it is a possibility that these drones are then discarded or deliberately crashed after their mission.

Curiously for such an audacious attack against a high-profile target, no group has yet claimed responsibility for any of these strikes. Considering the numbers of drones involved in these raids and the high profile of the target set, it seems likely there was significant planning involved in these strikes. The fact that no group has claimed them is striking.

Did these drones attack Khmeimim on New Year’s Eve?

The attack on Khmeimim on New Year’s Eve remains shrouded in mystery. We only know that two Russian soldiers were killed and some kind of damage was likely inflicted on the aircraft there. Only three images exist which show damage to planes there, and they were only partially verified, though there is currently no evidence to contradict their veracity. However, the images must have been taken shortly after the damage was inflicted, as one of them clearly shows fluid gushing from the plane.

Image 21 – Note the liquid spraying from the plane

The rainy weather seen in the images certainly matches the weather on the evening of the New Year’s Eve.

Image 22

Additionally a tail-number for an SU-24 in the images matches one previously sighted at the base. A geolocation can also be made using the comparison of the background of one of the images and a video that was filmed in Khmeimim early in 2018.

Image 23

 

Although there is no direct evidence that these drones were involved in the attack on New Year’s Eve, circumstances and context suggests it should be considered as a possibility. The defence systems around Khmeimim have allegedly never been breached before, including when the base came under rocket attack on December 27. Therefore for an attack to kill two soldiers and damage planes suggests it came from an unexpected vector. A close mortar attack by a group of well-trained militants who infiltrated across the front lines could fulfill these criteria.

The discovery of two of these drones on January 1 near the airbase suggests an alternate possibility: that a drone attack caused the damage and killed the two Russian soldiers. Several drones with similar radar cross-sections to large birds, and moving at similar speeds, could feasibly escape detection if they were unexpected. This scenario, backed up with evidence of drones in the area on or before the 1st of January, should certainly be considered as a credible possibility.

Summary

It is clear from these incidents that weaponised drones continue to pose a direct threat to forces operating within Syria. Since New Year’s Eve there have been at least four attacks involving these drones, Khmeimim and Tartus on January 6, Homs on January 2-3 and the area in the vicinity of Khmeimim on or before January 1. It should be considered a credible possibility that drones recovered on New Year’s Day participated in the attack on Khmeimim on New Year’s Eve. If we add together all these attacks, as well as the drone for sale on social media, we can account for 18 drones, and there were possibly more that either escaped, crashed or were not found.

The Russian MoD claim that whoever launched these drones required nation-state support is dubious. The suggestion that a United States Poseidon aircraft is somehow related to these drones is even more so. The materials and construction of these drones, including their munitions, could all be sourced using relatively local means. No component is particularly advanced, except for the GPS antenna which is fairly standard in most commercial off-the-shelf (COTS) drones anyway. IS managed to create an entire drone program with its own bureaucracy, improvised drones and mass-produced munitions. It is hardly surprising another actor in the Syrian conflict has also managed to do this. What is different about these attacks is the tactics used. Although IS reportedly sometimes operated more than a single drone at a time, they did not appear to have ever used a massed attack on this kind of scale using drones flying with a measure of autonomy. This indicates a strategic grasp of the use of drones, as well as a high level of planning. The lack of any kind of claim, or even rumours from the rebels, indicates that whoever is producing these drone and launching these attacks has a high level of discipline and an understanding of operational and personal security. There is little doubt they will be a priority target once identified.

Although some regard the threat from COTS and improvised drones as negligible, they have the power to inflict losses at both a tactical and strategic level. IS proved this in their extensive use of COTS drones during 2017, including a spectacular attack on an ammunition depot in Deir Ezzor. Whoever launched the attack on Khmeimim came very close to imposing a strategic blow on Russian air assets in Syria, a vital source of support for the regime. Although the plastic sheeting, tape and simple design may belie the illusion of sophistication, it seems that the use of drones, whether military, COTS or improvised, is taking another step to becoming the future of conflict.

 

Thanks for this article goes to: Private Joker, Qalaat Al Mudiq, Abraxas Spa, Robi Sen and Adam Rawnsley

Nick Waters

Nick is an ex-British Army officer and open source analyst. He has a special interest in the conflicts in Syria, as well as social media, civil society, intelligence and security. Contact via Twitter: @N_Waters89

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

20 Comments

  1. Hans-Peter Zepf

    Interesting. And thank You for your clear writing which shows that easy understanding of english reports for non native english speakers is possible (many writers try to prove the opposite.)
    Thanks for the report which shows:
    The drones have been primitive what is easy understandable for a single use garment. However the automatic navigation is really advanced, precise. It is, lets express like that, still surprising which degree of military technology is available for allegedly isolated rural figthers in a remote province without foreign assistance???????
    But the report not covers sufficiently the attack to Khmeimim on 31st/1st. You did not show the photos of the damage of the russian fighter planes. I am absolutely sure that this degree of damage could not be achieved by these drone bomblets. And a second aspect: Causing this degree of damage (either 3 or 7 fighter planes + at least 2 soldiers) can be only achieved by either extreme precission of the attack (knowing and programming the exact positions of the planes) or a huge number of bombs/missiles or a big degree of coincidence (what I do not believe). By sure there has been more technology involved than the primitive drones shown.

    Reply
  2. Aradir

    For me its pretty clear, that no foreign entity or even a major player of any kind was involved in these attacks. The drones used only commercial aviliable parts, but mostly these were easy to aquire. But i have no doubt that even a little bit of tech-support from the outside would have made a huge difference. There is probably a lot more commercialy aviliable tech, that could have dramatically increased the effectivness of those drones. Just imagine those thing equipped with a camera and a long range antenna to guide them in for the last meters. If an entity like the CIA was behind such a low-tech-attack, then they could have increased the damage by the factor ten or more with under 500 dollars and a quick visit in the local Walmart.

    What i find a more realistic scenario is a small group of persons under the rebells, who just want to act someway. And even if the war in Syria is going on for some years, don´t forget the high education levels in this country. It is entirely plausible to me that a semitalented hobbyist could built such devices, especially if he/she/them have an internet connection.
    @Hans-Peter Zepf: You seem to ignore that quite a bit, when you are sceptic if a group of locals could have pulled that of. Rural does not mean stupid or not capable.

    Its should be quite easy for a civilian to aquire the needed parts and then launch their attack at a prominent target like the russian airport. Its probably one of the publicly known military installations in the region and worldwide. Why shouldn´t a group of pissed of citizens decide to strike back in some form?

    For me the whole setup and their silence after the attacks are at least pointing toward a group of civilians. After all: Wouldn´t soldiers try to get bigger and more sophisticated bombs on those drones? This design looks more like someone operating with an open Wikipediapage about mortarshells and not like someone with actual experience in that area.
    Also military personell would probably use such a victory as an opportunity to gaing new fighters, while a group of civilians would probably more clandestine, especially if they have family in the area.

    Reply
  3. Friend Ten

    You might want to compare the motors to Russian drone motors. Haven’t found that type of motor on markets.

    Reply
  4. Mung_GK

    Ok, so the attack to Khmeimim was most probably done with Mortars.

    About the drone attack threat – while it is tactically interesting, the military effect could easily be shielded with simple wooden shelters in carport-style.
    The small radar cross-section means that there is only little payload to carry, and thus little penetration power.

    Reply
      • Ayatollah Ghilmeini

        other than the engine, there are almost zero metal for radar to detect, the rest is undetectable plastic and wood…..

        Reply
  5. Techniker

    Coordinates from Googlemaps accuracy 3m
    SU-24 Bomber
    35.411326
    35.945573
    (35°24’40.8″N 35°56’44.1″E)
    SU-35 Fighter
    35.412401
    35.945071
    (35°24’44.6″N 35°56’42.3″E)
    Transportflugzeuge
    35.406913
    35.953659
    (35°24’24.9″N 35°57’13.2″E)
    Autopilot including Pivotsonde Barometer and GPS
    https://hobbyking.com/en_us/arkbird-2-0-autopilot-system.html?___store=en_us
    or
    https://hobbyking.com/en_us/feiyu-tech-fy-41ap.html?___store=en_us
    or you use one of the Freeware Autopilot Electronics

    So much for military technology.

    Reply
  6. Ray Tracer

    A little update: The Russian MOD held a briefing regarding the incident.
    It’s available on YT: https://www.youtube.com/watch?v=MgmJWY0AEZY
    There, some new pictures where shown, clearly depicting a Pixhawk flight controller and what appears to be probably a long-range, high-powered video transmitter in the 900-2.4GHz range (5GHz ones are much smaller).

    Reply
  7. Mad Dog

    If you know the GPS coordinates of the parked aircraft and have a reliable GPS system on board, you can make a fairly respectable attack on those aircraft. Sending a number of the drones to the same coordinates only makes success that much more achievable. Puncturing fluid tanks, especially for fuel amidst an attack using explosives could possible set off a fluid explosion that would be much more damaging than just the ball bearings alone. So, IMHO, it is very possible that several aircraft were damaged or destroyed.

    Reply
    • Aradir

      Only if the Russian airforce suddenly forgot standard safetyprocedures. They would not let their airassets just stand on the tarmac, especially not in an AO that has a lot of natives with a grudge against the Russians and access to light artillery.
      I can´t imagine that the russian airforce is not using hardened shelters against exactly this kind of attack.

      Reply
      • Mad Dog

        Have you seen any hardened shelters. I haven’t in all the photos that BC provides. Does the Russian Air Force ever forget standard safety procedures? You must be joking! Happens all the time. With no other air assets in the area, the Russkies just got far too complacent! LOL.

        Reply
  8. genaut

    Any idea how the russians could have taken control over these drones? I mean if they are flying autonomous only with GPS input, does that mean the russians are able to fake GPS data in order to actively steer/crash a drone?

    Reply
    • Ray Tracer

      There are several ways the Russians could have taken control – IF they had seen this attack coming… These drones have a very little radar cross-section and the attackers probably let them fly just 30m above ground.
      Very short timeframe for GPS hijacking. Additionally the sat-receivers onboard very often receive GPS, BAIDU and GLONASS (very few even GALILEO) simultaneously and discharge measurements that differ too much.
      They could have had more luck with a directly taking over the remote control system (if there’s any) or just hit them with a high-powered UHF/VHF beam.

      Reply
  9. Alex

    GPS devices are subject to international COCOM restrictions to stop you using them to make ballistic missiles. IIRC the implementation, in firmware, is that they stop working above 60,000ft and above a speed I forget. One advantage of a slow/low drone solution rather than an artillery rocket/mortar solution is that this won’t be a problem and you can use the full potential of GPS.

    I also note you’ve covered that white epoxy machining process before.

    Reply
  10. Stanley Tolle

    The Iranian’s took control of a stealth USA drone awhile back, steered and crash landed it at a chosen location. If I remember it right they did it by manipulating the GPS signals from the ground (what was reported). RT reported that the Russian defence forces did something similar. They reported that the drone control signals were detected and that the drones were taken under control and force down. My guess, since these drones were GPS guided, this how they they did it. There may have been some control of the drone or drones since one photo show a video antenna. The Russian air defense videos once and awhile talk about defending against drones. My thinking was they may have been caught flat footed in a first attack and we’re more ready for an second attack. There have not been any more US drones brought down so my guess it the US drones have been hardened so they can’t be GPS spoofed anymore.

    Reply

Leave a Reply to Ray Tracer

  • (will not be published)