the home of online investigations

You can support the work of Bellingcat by donating through the following link:

Addressing the Aeroflot MH17 Conspiracy Theory

August 8, 2018

By Aric Toler

Translations: Русский

On 8 August 2014, the Security Services of Ukraine (SBU) held a press conference at the Ukraine Crisis Media Centre in central Kyiv describing how they believed that Malaysian Airlines Flight 17 (MH17) was not the true target of the missile launch that killed 298 people on 17 July 2014, but instead Aeroflot Flight 2074 (AFL2074/SU2074). The intent of the downing of the airliner was for a Russian casus belli to invade Ukraine — openly, rather through covert support. The SBU and other Ukrainian government institutions quickly abandoned this theory and no longer refer to it when addressing the downing of MH17; however, a number of analysts and the former head of the SBU have continued to raise the Aeroflot conspiracy theory over the past few years.

As will be detailed in this article, the SBU’s August 2014 assertion that an Aeroflot plane was the intended target for the missile that instead downed MH17 has little basis in reality and has been supported most ardently by then-head of the SBU Valentyn Nalyvaichenko, who was relieved of his duty as the head of the SBU in 2015 and is now the leader of a Ukrainian opposition political party. This conspiracy theory would not be worthy of serious discussion if it were not for Nalyvaichenko and a number of Western, Russian, and Ukrainian analysts who have supported it over the past four years.

Details of the Aeroflot Conspiracy Theory

The August 8th SBU presentation provided the bulk of the material for the “Aeroflot Scenario” that has resurfaced in recent discourse.

The SBU’s presentation provided the following details to support the tremendously bold claim that Russia tried to shoot down its own passenger plane as a “false flag” attack to invade Ukraine:

  1. The Buk missile launcher that downed MH17 was meant to go to the village of Pervomayske west of Donetsk; however, by mistake due to the fact that the Buk crew was Russian and not familiar with the area, it went to a different village with the same name far east of Donetsk on the day of the downing.
  2. The route that the Buk took from the Russian border to the launch site south of Snizhne, by way of Donetsk, was not logical if the final destination was the eventual launch site. The route would have been logical if the intended destination was the Pervomayske west of Donetsk, near the Donetsk Airport.
  3. After downing Aeroflot Flight 2074, the wreckage of the plane would fall in territory under the control of the Ukrainian Armed Forces, thus providing a proof for a casus belli for Russia’s formal invasion of Ukraine.
  4. The large build-up of Russian forces at the Ukrainian border in mid-July 2014 shows their intention to invade Ukraine, and Russia would need a strong reason to send in its forces to the Donbas that summer.
  5. The flight path of AFL2074 was similar to that of MH17, thus they could be confused with one another.

Additional details, which will be addressed throughout this post, have been raised by independent analysts supporting this scenario.

Who Has Supported The “Aeroflot Scenario”?

Most recently, analyst Andreas Umland has given credence to the idea that MH17 was a planned attack in an “operation [which] would have followed the pattern of the 1999 bombings of Russian residential buildings which probably was a Russian secret service operation.”

Former SBU head Nalyvaichenko has not backed down from his claim that Russia intended to down an Aeroflot flight, tweeting out in 2016 that it was intended to create a justification “for a full out invasion of Ukraine”. In his 2016 tweet, Nalyvaichenko’s proof for his idea was that “both the MH17 and Aeroflot planes were painted in the same colors” [similar to how some conspiracy theorists claim that Putin’s jet returning from Brazil on 17 July 2014 looked like that of MH17], “there is more than one Pervomayske in Donetsk region,” and that the jet was in the area “at the same time and approximately at the same altitude”. Even though the SBU has long ago backed away from this claim, Nalyvaichenko has not.

As Umland details in his recent article, this scenario has also been supported or given additional credence by a number of well-known analysts and outlets, including InformNapalm (who have not discussed it much since August 2014), Russian historian Mark Solonin, and in a recent interview with Espreso, American journalist David Satter.

Why the Aeroflot Scenario Makes No Sense

At first glance, it’s easy to see why the Aeroflot Scenario is appealing: there are multiple villages named Pervomayske in the Donetsk Oblast, AFL2047 and MH17 did have similar flight paths, and it is extremely troubling to think that 298 lives were lost for no reason. But even a cursory glance at the events of 17 July 2014 shows that there is no reason to even consider this motive as a possibility.

Pervomayske Confusion

The central element of the Aeroflot Scenario is that an understandable mix-up happened: the Russian Buk operators went to the wrong village named Pervomayske, thus putting the missile launcher in position to shoot down the wrong passenger plane.

Below, a screenshot from the SBU August 8th press conference shows the flight paths of MH17 and AFL2047, with our annotation to the screenshot highlighting the key data points. Both flights passed through the area around the same time in the late afternoon of 17 July 2014.

Below, a map created by the Dutch-led Joint Investigation Team (JIT) shows the route of the Buk on 17 July 2014, overlayed with the approximate locations of missile launch site and the three nearby Pervomaysk villages — two being Pervomayske, and one Pervomaysky. This village name is extremely common in the region as a Soviet holdover, as it means “First of May” (International Workers’ Day).

The Buk crew gathered in eastern Donetsk in the morning of the tragedy, departing some time after 10am, and arriving in Snizhne approximately 2-3 hours later. These two details alone derail the “confusion” scenario, as DNR militants and commanders gave direct and explicit orders for the crew to go eastward towards Snizhne. Sergey “Khmury” Dubinsky, who was quite familiar with the area, relayed instructions to the Donetsk People’s Republic (DNR) and Russian militants in the convoy to meet in eastern Donetsk near a Vostok Battalion base. This meeting place would make no sense if the eventual destination was northwest of Donetsk, and the crew then headed east for hours before arriving in Snizhne. While in Snizhne, the Buk was unloaded near a separatist base in the city center by the Furshet supermarket. As detailed in intercepted phone conversations published by the JIT, at about 1pm that afternoon, a DNR militant with the Buk called for further instructions on where he was to take the Buk, receiving a specific directive to take it past Snizhne.

If the actual target location was the Pervomayske near Donetsk, it would be illogical for separatist commanders to continue to give new directions to the field south of Snizhne.

This scenario does not make any more sense if we were to assume that separatist leadership misunderstood Russian commands about which Pervomayske was the destination. According to the Aeroflot Scenario, this operation was meant to kill nearly 200 Russian civilians, constituting one of the most elaborate false flag attacks in history and among the most significant geopolitical incidents since 9/11, leading directly to the outright invasion of Ukraine. Even accounting for a recent history of incompetence among Russia’s military and security services, it is inconceivable that Russia would provide this missile launcher with the sole purpose of downing an Aeroflot passenger flight and not monitor its progress throughout the day. The false flag would have required absolute secrecy; however, as Bellingcat and others have detailed, the movements of this Buk missile launcher through the Donbas on 17 July 2014 were extremely public, with eyewitnesses and Ukrainian media outlets reporting on its movements throughout the morning and afternoon. The Buk was not moved through eastern Ukraine in a covert mission or under the cover of nightfall after it arrived in Donetsk — it was done in broad daylight along major highways and through city centers, with literal sirens sounding as it passed through crowded streets.

Furthermore, a high-ranking GRU officer, Oleg Ivannikov (“Orion”), was fully aware of the Buk’s arrival and transport in the Donbas. He was one of the most senior conduits between the Russian military and security services and the so-called separatist republics in 2014, meaning that there was a readily-available contact to communicate any urgent directives between Russian and separatist leadership. If DNR military intelligence, headed up by Sergey Dubinsky, made a mistake in sending the Buk to the wrong village, it is unthinkable that this mistake would not have been noticed and reported to Russian military or intelligence immediately, considering how this Buk was, according to Nalyvaichenko, meant to kill nearly 200 Russian civilians and launch a massive war.

Strategic Value of the Buk-M1 at the Launch Site

Another point raised either explicitly or implicitly by the Aeroflot Scenario is to discount the strategic importance of placing a Buk missile launcher in the field south of Snizhne, close to the vital hill of Savur-Mohyla. The village of Pervomayske was also situated along the only proper road between Snizhne and Savur-Mohyla.

This point was addressed directly by Ukraine@War/Dajey Petros, arguing that the MH17 launch site was chosen on accident is that it lacked strategic value compared to a more westward location. This assertion comes from how there was already air defense coverage from Russian systems across the border in this area, while there was relatively little cover closer to Donetsk. Ukraine@War provided two maps with the Buk’s radius in two maps, as seen in the screenshot below:

This assumption ignores the situation on the ground on July 17th. Just two days before the MH17 shootdown, a Ukrainian jet missed its mark while trying to bomb a separatist base in central Snizhne. Eleven civilians died. On either July 16, Igor “Strelkov” Girkin and Aleksandr Borodai, two of the highest ranking DNR officials and commanders, personally visited an area near Stepanivka that is just a few kilometers away from the eventual MH17 launch site. A Strela-10 anti-aircraft missile system was present in the background of an interview with Girkin at this location.

On 16 July 2014, the day before the MH17 shootdown, a satellite image on Google Earth shows a Su-25 fighter jet– certainly a Ukrainian one — near the area where Girkin, Borodai, and eventually the Buk that downed MH17 were present.

Below, a map shows activity in the area from July 15 to 17th, including the July 16th shootdown of a Ukrainian Su-25 fighter jet near Hryhorivka, 13 kilometers south of the MH17 launch site. Clearly, the area was heavily contested in mid-July 2014, especially in regards to Ukrainian airstrikes and Russian/DNR air defense.

While some have argued that the Buk TELAR sent to Ukraine must have been intended to down a passenger plane due to the significant heights its missiles can reach, this is also unconvincing when considering the tremendous strategic value of securing the skies around Savur-Mohyla in mid-July 2014. The Buk-M1 is able to down targets flying at a much higher altitude (~22,000 meters) than MANPADS (the common 9K38 Igla system can reach ~3,500 meters) or the Strela-10 anti-aircraft missile system (~3,500 meters), and there are many non-civilian targets that the Buk-M1 can reach that the other systems present near Savur-Mohyla could not. The Su-24 jet, for example, can reach 11,000 meters, the An-26 cargo plane can reach 7,500 meters, and the Il-76 cargo plane can reach 13,000 meters. While these aircraft can be and were downed by systems less powerful than the Buk-M1 throughout the Ukrainian conflict, there is clear value to having an extremely powerful anti-aircraft missile system to provide additional support in the area. Additionally, the operating range of the Buk-M1 is much greater than other systems present in the area, providing an additional layer of air defense in the area in which the Ukrainian Air Force was extremely active at the time.

Lastly, and perhaps most obviously, we can point to the intercepted private conversations between the Russian and DNR commanders from mid-July 2014, discussing how a Buk was coming to the area to provide protection from constant Ukrainian aerial strikes. Dubinsky specifically mentions the activity of Ukraine’s aerial force near Marynivka, which would have been within the operational radius of the Buk system while at the MH17 launch site.

The Roundabout Route

The SBU’s August 8th press conference and other promoters of the Aeroflot Scenario have pointed to the meandering route that the Buk convoy took from Russia to the launch site south of Snizhne as evidence that the intended destination was west of Donetsk.

The approximate route that the Buk took from the Russian border to the launch site–with some likely inaccuracies in the exact roads taken, such as between Alchevsk and Debaltseve and uncertainties surrounding the route between Yenakieve and Donetsk–can be seen below.

The argument that there was a more direct route from the Russian border to launch site can be countered with a few key details. For one, other border crossing points, such as due south and east of the launch site, were not safe to use at the time due to pockets of Ukrainian control. The crossing point near Severny was used extensively in July 2014, even though equipment had to taken a fairly lengthy trip to Donetsk from there.

We can observe military equipment take roughly same route on July 15, two days before the MH17 downing. Below, we see that a convoy with Russian military equipment took the same route from the border to Donetsk, with some differences between Yenakieve and Donetsk.

It was vital that the Buk passed through Donetsk because this was the meeting point for a number of Russian and DNR militants answering to Sergey “Khmury” Dubinsky. A small convoy of tanks from the Donetsk-based Vostok Battalion left at approximately the same time as the Buk convoy and traveled along the same route to Snizhne.

In other words, the route that the Buk took from the Russian border, through Luhansk, Donetsk, and eventually to Snizhne, was possibly the safest available route for Russian and DNR forces at the time. Another possible route was from Yenakieve to Shakhtarsk, skipping Donetsk; however, meeting in Donetsk was easier with a number of Russian/DNR commanders and militants present there that morning. As seen in the July 15th map above, there were a number of Russian/separatist checkpoints and fortifications along this route.

Battles were raging near the Luhansk Airport (south of Luhansk) in mid-July 2014, making the area between Luhansk and the southern Russian border unsafe for a military convoy, especially with a piece of equipment as valuable as a Buk TELAR.

This route does not lend any additional credibility to the idea that the western Pervomayske village was the intended destination for the Buk, as a Russian/separatist convoy would have had to take the same route for both the “eastern” and “western” Pervomayske villages. If anything, the fact that Russian and DNR forces met in eastern Donetsk, rather than a more central or western location such as the Donbass Arena, shows that the intended destination was always eastward, rather than westward, from Donetsk.


Assigning a more nefarious motive than incompetence to the downing of MH17 has been a common practice since the tragedy took place. The JIT has been tasked with determining the motive and series of events that led to the downing of MH17, and much of this can only be determined through detailed investigative work outside of the realm of open source information. However, readily available open source information can easily debunk the fringe idea of assigning the motive to the downing as originally being a false flag attack targeting an Aeroflot plane. This idea is entirely rooted in two details — the coincidence of the flight paths of MH17 and AFL2047 and the multitude of villages called Pervomayske and Pervomaysky in the Donbas. However, it is hard to take this idea seriously when comparing these two details rooted in coincidence with the materials uncovered from four years of investigative work supporting the idea that the intended destination of the Buk was to a field south of Snizhne, providing a powerful layer of air defense to an area suffering from constant Ukrainian aerial attacks.

Aric Toler

Aric Toler started volunteering for Bellingcat in 2014 and has been on staff since 2015. He currently heads up Bellingcat's training efforts and its Eastern Europe/Eurasia research.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.


  1. Sean Lamb

    Anyone have an opinion about, Stefan Beck or this article?

    Do they have agenda at all? Google translate gives a readable translation.

    Seems he was acting as spotter (although he denies it) for the Donbass behind government lines. And he phoned to a friend in Donetsk that two Su25s were approaching 30 minutes before the shot-down. He seems to think they were carrying non-guided missiles, bombs under their wings, not anti-aircraft missiles – which suggests he isn’t constructing an anti-Ukraine narrative (although he claims – credibly in my opinion – to have been tortured).

    He came to the attention of the Kiev regime because all the phone calls were taped. He was interviewed by the JIT team, who he claims tried to accuse him of involvement in the downing of MH17. After that he was convicted of terrorism and imprisoned. He was exchanged in a prisoner swap in December 2017. It appears the Ukrainians knocked his teeth out.

    He has a lot of interesting details – and not obvious detail – that strikes me as credible. For example he specifies that one of the JIT who interviewed him was a New Zealander.

  2. pardu

    Hello , I am an ex from the french air france , specialized during the cold war in analyzing and listening , in the eighties ,to any aircraft of the USSR while they training in DDR and Czechoslovakia and Poland .
    I just want to come to the subject of the SU25 Frogfoot and the air to air to interception missions at high altitude .
    The SU25 has one mission : ground attack . Their pilots are trained for these missions . They have no radar . They fly slowly especially with they have something under their wings : bombs or fuel tanks .

    Air to air interception : a fighter is most of the time guided by an air defence controler who can see the target on its screen and who will guide the fighter , we call it a presentation , behind the target . This implies a lot of VHF or UHF communication , this is another mission and air defence pilots are trained for this .
    To present a SU 25 , lets say with two IR guided under its wing behind a liner flying at 450 knots at FL 360 is just impossible . The SU25 does not have the speed for that , and if we imagine a parrallel head on presentation this would imply that the SU25 would be already at the FL than the MH17 . But : russian radars , and it was confirmed by the russian ministry of defence at the end , did not spot anything flying in the area of the MH17 .
    My ex colleagues and I think that when russian authorities accused a SU25 this was already a statement coming from non military russian authorities , any general of the russian air force would never have chosen the option of a SU25 , because this is just impossible for this type of aircraft to accomplish such a mission .
    And … if you want to shoot down a liner you need very big air to air missile , such as the K8 which shoot down the Korean air OO7 .
    And anyway both parties , the JIT and russian authorities agree on the fact that the MH17 was shot down by a BUK , the investigation has proved it .
    So the ukrainian SU25 shooting down was the first explanation given by Russia , this was one their first mistake and not their last version .
    By the way : we never heard from 1982 till the closure of our stations along the iron curtain a SU25 training on air to air interception mission , this would have interested us very much . We used to exchange at the STRA all infos with the Us forces and the German forces and they also never mentionned such a training for a Frogfoot .

    • Concerned Citizen

      Pardu wrote:
      “My ex colleagues and I think that when russian authorities accused a SU25 ”

      They didn’t. Try listening to what they actually said, not what you are told they said.

      • pardu

        They totatlly did , here is the video of RT with the russian army explaining the topic of the ukrainian SU25 flying near the MH17 .
        It was made in july 2014 .
        So now could you explain to us why you are wrong ?
        Do you want some more explanations from ex of the frenh force specialized in such topics ?

        • Concerned Citizen

          They said there was a radar trace that could have been an SU25. That’s all.

          No I don’t want to hear any of your explanations since you don’t seem able to separate your own fantasies from what was actually said.

          • pardu

            Now that you have understood that you were wrong I give you another russian article :
            the russian investigators claim that they have a witness , a ukrainian military , who saw the SU25 taking off that same day with air to air missile .

        • Concerned Citizen

          The Russian government has:

          NOT stated an SU25 shot down MH17

          NOT stated they have a witness , a ukrainian military , who saw the SU25 taking off that same day with air to air missile .

          It’s not complicated. Also stop posting articles and videos in Russian please.

  3. Mak

    Rob, try to answer my two questions asked earlier, arguing with telephone conversations and Wostok battalion tanks – why did BUK crew shoot a civilian passenger plane and why in the MH-17? Eric also didn’t say any word about it. No answers? “Aeroflot Scenario” has the answers.

    Now is 3rd question.

    3. Aeroflot flight AFL2074/SU2074 all the time passed outside of Ukraine, before and after MH-17 tragedy. A few days before the tragedy this flight was moved over the Ukrainian territory, and on the tragedy day it was held at a minimum distance to the western Pervomayskiy, at a BUK missiles reachable distance.

    What is very important, the Aeroflot flight AFL2074/SU2074 flew near the WEST Pervomayske exactly at the same time as the MH-17 near the EAST Pervomayske.

    Try to answer this question.

    “Aeroflot Scenario” has the answer.

    • Yurij Honcharuk

      Not certainly in that way. SU 2074 normally flies the way it flew on July 17. But. In the period July 10-17, he constantly changed course. He shifted towards Ukrainian troops. I think that this was deliberate provocation to cause the actions of Ukrainian air defense.

      • pardu

        Yurij you write : ” SU 2074 normally flies the way it flew on July 17. But. In the period July 10-17, he constantly changed course. He shifted towards Ukrainian troops” :
        you should know this concerning civil flights and control : this area is under the control of Dnipro radar , the liners using this path follow the instructions given by Dnipro radar . If as you mention but without any proof , in the former days the flight SU2074 constantly changed course then a complain against this bevahior would have been passed to Eurocontrol : have you heard of any russian crew who did not respect ground instructions and who were fined , or forbidden , by Eurocontrol ? Or Aeroflot . No of course .

    • Rob

      Mak said “why did BUK crew shoot a civilian passenger plane and why in the MH-17? Eric also didn’t say any word about it. No answers? ”

      Only one man can answer that question.

      The other questions : Who, What, Where and When have been answered by Bellingcat. The Russian 53rd Brigade from Kursk, using a BUK TELAR from Snizhne on the 17th of July.

      And they provided ample evidence that the BUK went to its intended launch location.

      • Concerned Citizen

        Bellingcat have answered nothing. The materials they rely on are unverified social media postings.

  4. John Dowser

    Agreed that targeting Aerofot looks more like cherry picked evidence, mostly serving to provide convenient answers to some of the more puzzling aspects of the case. But this article is not addressing those problems at all and therefore not really can counter the theory at least in the eyes of many. This is understandable.

    Example: “defense to an area suffering from constant Ukrainian aerial attacks”.

    Can anyone submit evidence, beyond the telephone tap that aerial attacks were structural enough in one limited, static area as to justify this TELAR transport?

    The hardly mobile TELAR is used here in a very uncommon manner. There are better more mobile systems to send over the border to deal with a local Su-25, I’d suggest.

    A better theory would ask if it’s possible that a whole Buk system would have been deployed. For example six launchers/batteries, radar and command. Then it would have a function to seal off a larger area (cauldron) from pending air attacks. It would be worthwhile to transport one or two TELARs the whole way around the front as to prevent anyone opening up escape routes. It would be a position for a bit longer.

    Most Buk vehicles would be inside Russia still, around, on or behind the border.

    This approach would take away concerns of why the TELAR would be exactly there as it would have been important to close a larger per-determined airspace, depending where other TELARs and command is located for radio links. These locations are planned in advance and as such driving instructions would be precise.

    Now it’s true this makes the theory of any “accident” harder. How can a complete Buk system make that mistake as they would have way more information. But then again for example Iran Air Flight 655 was misidentified as F-14 Tomcat partly because of IFF tracking errors. A comparison between 1988 US Navy ship technology and 1983 Buk radar system in terms of how IFF signal are dealt with could be interesting. Perhaps better than discussing why one manic TELAR would aim semi-randomly at the sky at 10km. Which keeps fueling a lot of speculation.

  5. PeterFaf

    AAi is part of Asad Abbas & Co. (Chartered Accountants), an accounting, tax and business consultancy firm in UAE and a member of PrimeGlobal International, one of the 5 largest associations of independent accounting firms in the world. Asad Abbas & Co. (Chartered Accountants) provides cost-effective and efficient professional services to the business community.


Leave a Reply

  • (will not be published)

You can support the work of Bellingcat by donating through the following link: