A Transparent Battlefield? How OSINT Is Transforming the War in Ukraine

Oct 21, 2026 17:11 Updated Oct 21, 2026 18:07

12 min read

Prefer U24 Media on Google

Authors

Louis Beaudemont

Reporter

“OSINT has never been used as massively as with the war in Ukraine,” says French analyst Clement Molin, one of the most followed war specialists on X. 

Molin’s open-source data analysis, satellite imagery, and videos—through which he creates dozens of maps and analyses each month—along with his cross-referencing and insights, are studied and debated by journalists, military officials, and political decision-makers worldwide. His analysis often contradicts claims by Russian state media and precedes Ukraine’s official announcements on counter offensive actions, such as the retaking of territory.

Yet Molin is only 20 years old, an international relations student working from his computer in France, and has never received formal academic training in military data analysis.

Molin’s case illustrates a broader transformation. The increasingly central role of open-source intelligence (OSINT) in analyzing war—and even influencing its course by shifting authority away from military commands and traditional journalists—has empowered a new self-taught generation that grew up with the internet, social media, and artificial intelligence assistants: the OSINTers.

The first social media war

Gathering and analyzing information from publicly available sources to generate actionable intelligence (one definition of OSINT) has become a major discipline nowadays. But is it capable of complementing, if not rivaling, traditional military services? Surprisingly, yes. 

Publishing content on social media is difficult to control, given how central this practice has become to people's daily lives worldwide and how essential it is to the 21st-century digital economy. On TikTok alone, 34 million videos are published worldwide every day. On March 6, 2022, TikTok suspended new video uploads and live-streaming for Russian IP addresses, but its Russian variant, VK Clips, still sees hundreds of thousands of videos posted daily.

Russia’s war in Ukraine has become the "first social media war," as researchers Johannes Niu, Mila Stillman, and Anna Kruspe say in their academic study OSINT or BULLSHINT? Exploring Open-Source Intelligence tweets about the Russo-Ukrainian War. It highlights the importance of the narrative battle and the profound transformation of military intelligence, once the exclusive domain of states and government agencies.

The [Russian] invasion has amplified the role of social media in modern warfare, marking this conflict as the 'first social media war,' where online narratives can significantly impact the geopolitical landscape.

Johannes Niu, Mila Stillman, Anna Kruspe

In 2022, following the start of Russia’s full-scale invasion of Ukraine, Molin began actively tracking events through social media, particularly X. Eager to understand and replicate the geolocation and analysis of satellite imagery and Telegram videos he discovered, he gradually developed his own research tools using open-source data, from satellite imagery to the smallest data footprint. 

So, what can you uncover with just an internet connection? Here’s a breakdown of the different types of open source data used, from macro (GEOINT) to micro levels (SOCINT, CYBINT):

1. Macro level (Space & Global): Public and commercial satellite imagery (optical, infrared, SAR radar) via platforms like Copernicus / Sentinel Hub, NASA FIRMS, Maxar, or Google Earth Engine. In the context of the war, this allows for mapping fortifications, tracking strategic movements, and thermal detection of explosions.

2. Meso, institutional level (Infrastructure & Registries): Public state registries, financial and transport databases (Companies House, SEC, Flightradar24, MarineTraffic, WHOIS registries). Used to trace financial flows and identify shell company structures. 

3. Local level (Terrain & Surroundings): Crowdsourced mapping and ground-level imagery (OpenStreetMap, Google Street View, Mapillary, SunCalc). This enables the exact geolocation of equipment and chronolocation by analyzing solar angles. 

4. Micro, Community level (Digital Ecosystem): Social media networks and instant messaging channels (Telegram, TikTok, X, Reddit, Facebook). This enables near-real-time reporting from the ground and tracking of equipment losses.

5. Nano level (Technical & individual): File metadata, digital identifiers, and network records (EXIF data via ExifTool, pseudonyms via Maigret, Shodan or Censys search engines). Essential for strict media authentication and identifying the devices used to capture footage.

How much of the battlefield can anyone really see?

Can a 20-year-old student track an entire army movement? Not really, but the abundance of digital data has democratized access to strategic information, making it possible for people with no military training—from independent researchers to specialized NGOs—to follow troop movements, map evolving front lines, and unmask disinformation operations. This provides unprecedented transparency.

“With the advancement and accessibility of technologies such as artificial intelligence, machine learning, and data analytics, OSINT has evolved to provide unprecedented real-time insights into battlespace situational awareness and enemy movements,” writes William L. Mitchell, Associate Professor at the Norwegian Defense Language and Intelligence Academy.

One of OSINT’s major contributions to the war is its ability to offer near-immediate, publicly accessible situational awareness. Tracking the conflict via OSINT offers "the closest vision of reality that one can possibly have," says Molin.

By cross-referencing videos published on Telegram channels with satellite imagery from European programs like Copernicus, Molin manages to verify the authenticity of troop movements, map Russian bombings, trace Ukrainian fortification lines, and methodically record military equipment losses.

Like him, hundreds of accounts—some more legitimate than others—post images and analysis to prove the authenticity of an action, the advance of either side, or the use and destruction of specific equipment. It is difficult to say who is behind these mostly anonymous accounts, but Molin notes a trend.

You’d be surprised how young OSINTers are. Not even 20 years old—some are 16, 17, 18.

Clement Molin

OSINT analyst

An analysis by Molin posted on X in September 2026, highlighting the success of a counteroffensive operation by the Ukrainian Army's 3rd Army Corps north of the Lyman salient, was viewed over 1 million times and cited by experts, journalists, and politicians worldwide. His analysis preceded the corps commander's announcement regarding the ongoing operation. 

At the same time, Russian leader Vladimir Putin falsely announced the capture of Sviatohirsk, 25 kilometers further west. This was quickly denied by the 3rd Army Corps commander, Andrii Biletsky, who, after six months of silence, publicly announced Operation Vivaldi, confirming Molin’s assumptions.

This digitization of the battlefield has profoundly shifted the balance between traditional military expertise and civilian research. Academic institutions, international research organizations like ACLED or the US-based think tank Institute for the Study of War (ISW), and news media increasingly rely on OSINT data. And this can be dangerous for both sides.

“When it comes to Ukrainian offensives, I often have more information than what is public or known,” says Molin. “Generally, I wait one to two weeks before talking about it to avoid endangering the offensive.”

How OSINT shapes military operations in Ukraine: targeting, kinetic deception, and OPSEC risks

Anonymity does not exist.

Artem Starosek

Molfar Intelligence CEO and Founder

One of the most striking developments of Russia's war in Ukraine is the direct integration of OSINT into the core of the military targeting cycle and kinetic operations. Open-source analysis is no longer limited to remote observation; it has become an active operational component of modern warfare.

Target identification and fire recalibration

Tactically, open data shared on social media provides unprecedented precision. By cross-referencing localized video footage with satellite imagery, analysts can pinpoint the exact locations of command posts, armored subunits, and ammunition depots.

Furthermore, OSINT plays a direct role in battle damage assessment and recalibrating artillery strikes.

“More operational information is publicly available, further blurring the lines between civilian and military sensors,”  writes Mitchell, “reinforced by the many cases of civilians unwittingly posting positions of strategic assets or even unwittingly providing battle damage assessment pictures and videos seconds after a strike.”

This immediate visual feedback allows artillery crews to verify a strike's effectiveness, instantly adjust geographic coordinates for subsequent volleys, and establish an accurate count of destroyed or damaged equipment.

Dozens of photos and videos posted on social media near military targets also allow Ukraine's armed forces to conduct precise deep strikes into temporary occupied territories or Russia, sometimes thousands of kilometers from the Ukrainian border, by providing a recent 3D view of the target and its surroundings, compared with satellite imagery.

For instance, on August 14, 2022, Ukrainian forces struck a headquarters of the Russian Wagner mercenary group in Russian-temporary occupied Popasna in the Donetsk region, after Russian war correspondent Sergey Sreda accidentally revealed the location by posting photographs on Telegram. The photos included an address sign for a local shelter where the mercenaries were based.

Some Russian analysts claimed that the leak was intended to provoke a strike from Ukraine’s side and reveal the location of Ukraine’s HIMARS launcher position.

OSINT is also important to assess the damages after a strike and verify claims of both sides. On September 11, 2026, Ukrainian FP-1 long-range drones struck a gas condensate processing facility in Russia's Yamalo-Nenets Autonomous Okrug, traveling a record distance of more than 3,200 kilometers. The extent of the damage was not first published by the military, but by a Ukrainian OSINT group called CyberBoroshno.

Both Russian and Ukrainian authorities understand the problem and are trying to address it by threatening prosecution. Dozens of videos showing the aftermath of Russian Shahed drone strikes on Kyiv in broad daylight have been published live on social media, supposedly allowing Russians to assess damage in real time and adjust their targeting. Ukraine's Security Service (SBU) regularly reminds the public that unauthorized dissemination of such data is punishable.

OSINT as a tool of military deception

Open-source intelligence is also a key channel for large-scale military deception. In his academic study on the summer 2022 Ukrainian counteroffensive, Mitchell demonstrates how Ukraine leveraged the open-source ecosystem to mislead Russian commanders.

By orchestrating a persistent narrative announcing a major counteroffensive in the southern Kherson region, Ukraine reportedly generated a strong “illusory truth effect.” Web data analysis tracked over 16,930 mentions of the combination of words “Kherson” and “counter-offensive” in English and 3,412 in Russian between April and August 2022. 

Convinced that the Kherson region was Ukraine’s top strategic priority to sever the land bridge to occupied Crimea, the Russian command redeployed its most battle-hardened units—including the 1st Guards Tank Army, the 20th Combined Arms Army, the 76th Air Assault Division, and the 106th Airborne Division—from the Kharkiv front to the south. 

This massive transfer weakened Russian defensive positions in the northeast, allowing Ukrainian forces to launch a surprise counteroffensive in the Kharkiv region in September 2022 and liberate more than 1,000 square miles of territory in a matter of days.

Deconstructing Russian disinformation: The war of "half-truths"

Beyond tactical battlefield observation, OSINT has become a primary defensive weapon against foreign information manipulation and interference (FIMI) operations led by the Kremlin. Russia’s information warfare strategy does not rely solely on outright lies, but creates chaos and doubt by manipulating “half-truths.” Citing work by researcher Peter Pomerantsev, Lukian Halkin, director of the Molfar Institute, notes that Russian operations typically take a core of real facts (about 10%) and attach a highly emotional, misleading narrative (90%).

Read more

Category

Anti-Fake

Four Key Instruments of Russian Propaganda: Dismiss, Distort, Distract, Dismay

Jan 06, 2025 14:11

“Russia’s mode of operation in the information space is to create chaos through half-truths,” says Lukian.

A striking example analyzed by Molfar involves actress Angelina Jolie’s visit to Ukraine. Russian propaganda channels hijacked a video report from the UK media outlet The Sun, Halkin recalls, inserting fake video elements while keeping the outlet’s watermark to falsely claim that the actress’s bodyguard had been forcibly conscripted by a territorial recruitment center (TRC). This crude yet viral edit served as a catalyst for a broad destabilization campaign designed to undermine public trust in Ukraine's mobilization process.

To counter these coordinated networks, OSINT analysts track technical markers of inauthenticity. As Halkin points out, one of the most revealing indicators is the synchronized timing of posts across social channels: "For instance, within about an hour's difference, 50 Telegram channels can publish the exact same information. This is the simplest way to track coordinated activity."

Molfar Intelligence has developed proprietary software that aggregates our teams' analytical experience, allowing us not only to track disinformation campaigns at their embryonic stages, but to actively counter them.

Lukian Halkin

Head of the Molfar Intelligence Institute

However, when addressing whether factual truth can ever match the virality of falsehoods, Lukian notes that it’s already a lost battle. 

"Is it possible to make the truth as viral as a lie?” he said, “No, that is impossible... A clickbait news story will be read dozens, hundreds, or even thousands of times more than its debunking. It is much easier for us to pre-empt and anticipate these campaigns than to try to debunk them afterward."

As French anthropologist Paul Virilio put it, we are maybe witnessing the emergence of “a war of images and sounds replacing the war of objects (projectiles, more or less devastating explosive vectors...) in favor of a desire for generalized illumination, capable of rendering everything visible and known, in every place and at every moment—a technological version of the Eye of God that would forever banish accident and surprise.”

Be part of our reporting

We report from the front lines to show the reality of war. Your support helps us stay there and tell the stories that matter.

DONATE NOW