{"id":19090,"date":"2026-02-21T06:07:23","date_gmt":"2026-02-21T06:07:23","guid":{"rendered":"https:\/\/informnapalm.org\/en\/?p=19090"},"modified":"2026-02-21T06:18:34","modified_gmt":"2026-02-21T06:18:34","slug":"russian-drone-operators-use-belarus","status":"publish","type":"post","link":"https:\/\/informnapalm.org\/en\/russian-drone-operators-use-belarus\/","title":{"rendered":"Ukrainian hackers uncover how Russian drone operators are using Belarus"},"content":{"rendered":"

On February 18, 2026, Ukrainian President Volodymyr Zelenskyy imposed sanctions against Belarusian dictator Alyaksandr Lukashenka for his role in escalating and prolonging Russia’s aggressive war against Ukraine. One of the stated reasons is that in the second half of 2025, Russia deployed a system of repeaters for the control of attack UAVs on the territory of Belarus. This significantly expanded Russia’s ability to strike the northern regions of Ukraine, from Kyiv to Volyn. Some of the attacks, including strikes on energy and railway infrastructure, would not have been possible without the assistance of the Belarusian side.<\/b><\/p>\n

The imposition of sanctions was the culmination of a months-long cyber operation by Ukrainian hacktivists from the<\/b> Fenix<\/b><\/a> cyber analytics center,<\/b> supported by volunteers of<\/b> InformNapalm<\/b><\/a> international intelligence community.<\/b><\/p>\n

Details of the cyber operation<\/h2>\n

During the operation, hacktivists broke into the accounts of dozens of Russian military personnel and gained access to monitoring systems used by attack drone operators. Round-the-clock covert surveillance of their activities was organized, and the data obtained was promptly transmitted to the Ukrainian Defense Forces. This increased the effectiveness of countering Russian drone attacks, in particular by providing information about drone routes and flight missions.<\/p>\n

The operation continued from at least mid-2025 and by February 2026 had exhausted its reconnaissance potential, one of the reasons being successful strikes by the Defense Forces of Ukraine on Russian command posts.<\/p>\n

Let’s go back to September 2025. The analysis of intercepted drone operator chats revealed that Russia actively used Belarusian civilian infrastructure\u2014primarily cell towers\u2014to plan drone routes. This ensured stable communication channels and made it possible to reach targets on the northern and western borders of Ukraine. In addition, deliberate UAV incursions into the territory of NATO countries were recorded.<\/p>\n

\"\"<\/a><\/p>\n

A broadcast screen of the desktop and software of Russian operators, displaying the image from the drone’s camera.\u00a0On the right side of the chat there is a message from an operator with the nickname user5214: “<\/i>Drone<\/i><\/b> \u042b\u042b12057<\/i><\/b> normal takeoff at 11:08 in the direction of Chernihiv.” Date: 9\/25\/2025.<\/i><\/p>\n

\"\"<\/a><\/p>\n

Route planning broadcast screen.<\/i>
\nOn the right side of the screen there is operators’ chat:<\/i><\/p>\n

\u2013 “Please inform me<\/i> when<\/i><\/b> Comrade General<\/i><\/b> arrives.”<\/i>
\n\u2013 “Gerbera 14922, normal 14:58, Gerbera 29097, normal 14:40, Gerbera 26153, normal 15:06.”<\/i>
\n\u2013 “Geran 1140, normal at 16:07.”<\/i><\/p>\n

\"\"<\/a><\/p>\n

A typical route plan: takeoff from Russian territory, fly over Belarus along the Ukrainian border, and then strike targets in Ukraine.<\/i><\/p>\n

Hidden threat monitoring<\/h2>\n

For months, Ukrainian IT specialists covertly monitored the chats and activities of dozens of Russian attack drone operators, promptly transmitting the information to the Defense Forces. This significantly increased situational awareness and the effectiveness of drone interception and suppression.<\/p>\n

The operation lasted over six months and facilitated a number of related actions by the Ukrainian Defence Forces:<\/p>\n