OSINT Case Study: Geolocate Russian Army in Syria

The purpose of this case study is to show an example of an OSINT investigation that starts with an image and aims to geolocate it accurately. This blog also serves as a reference for the course given by Cylab entitled C3 - OSINT and aims to keep a written record of a resolution that students can consult. The scenario presented is fairly simple and classic, as it includes many elements in the image and in the basic context. Nevertheless, it remains interesting as it shows a real-life case of OSINT geolocation.

Scenario

This Telegram message was found on a Telegram channel around March. We would like to know exactly where they were based solely on analysis of the video.

Reference approach

As explained in class, when you want to geolocate a given image, there is a standard procedure to follow, which we will outline here in order. This is a list of the different steps to repeat. This list is clearly not exhaustive and requires creativity. Nevertheless, this list shares many recurring points among different investigations.

• Context: Study the image with its context, from where does it come from, from a particular situation, etc
• Exifdata: We’ll check thanks to exiftool additional data that could have been saved by the camera when picture was taken. Can be model, locations, etc
• Image reverse search: We’ll look for occurences of the image that could have already been published on the Internet
• Foreground: What are the elements that are clearly in the foreground of the image?
• Background: What are the elements that are visible in the background of the image?
• Map markings: What are the elements that stand in the image, the elements that are specific to the location being analysed
• Trial & error: We have to look on our map and try to confirm or negate the location found
• Confirmation: Once we are fairly certain of the location, we will confirm it using several elements

The investigation: step by step

Context, exifdata and image reverse search

The case is well chosen since reverse image search and EXIF data yield no results. This is where it stands out from other classic OSINT challenges and highlights the difficulty of a real-life scenario. We are therefore left with analysing the context, which is what makes it so important. We can therefore try to translate the message in Russian associated with the Telegram channel.

Greetings to all the lovely ladies from sunny Syria.

The guys from our team who are in Syria recorded a video greeting.

Since this is a video, it should also be noted that we analysed the audio with any2text to find out what was being said, but there was nothing of note to report. In any case, text is sufficient, we know that we’re in Syria!

Foreground, Background and Map Markings

First, let’s download the video to get better and higher image quality.

It should be noted here that each piece of visible information is important in terms of the location of the photo. It is necessary to take each piece of information into account, as they will all be important. Therefore, we can identify the following:

• Foreground in yellow: We can see that the four soldiers are sitting on a stone platform (1), slightly raised above the ground just below them (2), which is in turn raised above the end of the tree that we can see at point 3. So we have three layers of different levels that we can already see here
• Background in green: In the background, we see houses characteristic of the region, but also the mountains, which are also important for identification. Finally, we see the white or grey road that runs alongside the houses and disappears behind the tree and our character
• Map markings in red: So, obviously, there is the sea, which could have been included in the background. However, since it is so crucial to our research, we can include it in the map markings. We can also see the Russian flag and a pole in the background. Finally, we can see that the beach curves slightly to the left.

Perfect! From this, we can already tell that we are along the coast of Syria. This significantly reduces our search area!

Hum, wait, it still seems huge. Indeed, sometimes an OSINT investigation can take time and we should search for these red houses, the coastline curve and the grey road. However, we’re lucky for this time. Did you guess why? No, okay let’s make basic investigations about russian operations in syria. From there, we’ll able to see that Tartus naval base supported was implied in the Syrian civil war of 2015 and even obtained a free-of-charge 49-year lease, jurisdiction over the base. So, if there are Russian soldiers on the coastline of Syria, it should be in the surroundings of Tartus.

Perfect, we have narrowed down our search area even further. So now let’s look for our red houses with that distinctive curve along the coastline. This process may or may not take a long time, depending on your luck. Since we’re looking at fairly isolated houses, we move away from the city and look at the map on a fairly small scale, 1:20. And bingo! We find the curved beach with a few houses with red roofs. However, this is not enough evidence to ensure that we are in the right place. The next step would therefore be to take a closer look at these houses to see if they are the same ones in our base image. Unfortunately, we do not have any Street View, Mapillary or OpenStreetCam data.

Trial & errors

At this location on Google Maps, transferred to Google Earth, we can see that many elements correspond to our basic image. These include

• The curve of the beach
• The white platform
• The differences in elevation
• The tree
• The grey road
• And the post if we look at the shadow across the different dates

But this is not quite enough; ideally, we would need to confirm that the houses are indeed the same. This would provide an additional point of confirmation. We therefore need to take a closer look at these houses in a different way. Going back to the map, we can see that there is a point called ‘شاليهات ضباط طرطوس’ where a multitude of photos have been added by users. And that is exactly what we need in order to bypass the fact that we do not have Google Street View to see the coast at this location. Let us analyse these images and try to reconstruct the houses we can see at this level of the beach.

Let’s recall what we want to do. Based on the three images above, we would like to deduce the architecture of the red houses that were found at this location. This will allow us to determine whether these are indeed the red houses in the background of the starting image as well as the houses seen on Google Earth. Now that we have a plan for the houses in mind, let’s make a comparison to see if it works.

That’s perfect! Thanks to the images found on the ground, we can say that the houses match. What’s more, we also discovered in the images that there were street lamps with black bases and white tops, exactly like in our original image! This gives us strong evidence that we have found the right place on Google Maps.

Confirmation

In summary, we can say that this photo was taken at 34.91879, 35.87933 near the Tartus naval base around the beginning of March 2025. It should be noted that confirmation of the position of the sun and the wind on that date allows us to confirm that this is the correct location. Despite this, we have still found several pieces of information in this image that allow us to confirm the geolocation. We will therefore note here all the points that allow us to put forward such a hypothesis and make a visual comparison between the satellite image and our starting image.

• The houses
• The grey road
• The little tree behind a house (in white)
• The mountain
• The curve of the beach
• The white platform
• The differences in elevation
• The tree
• And the post if we look at the shadow across the different dates

This blog post is licensed under CC BY-SA 4.0