The Poor Man's Air Force? Rebel Drones Attack Russia's Airbase in Syria

On the night of the 6 January 2018, the Russian airbase at Khmeimim was reportedly attacked. Videos and rumours from the airbase claimed that this attack may have included drones, although there were also reports the base coming under attack by rockets. These reports were interesting for two reasons. Firstly, the frontline was approximately 35 kilometres away, and therefore out of the range of most of the kind of artillery available to the rebels. Secondly, independent Russian newspaper Kommersant claimed that the same base had come under mortar attack on 31 December 2017, destroying four Su-24, two Su-35S and an An-72 military transport aircraft. This incident would have been the worst loss of equipment the Russian military had experience since the beginning of the conflict. This report of a mortar attack and damage inflicted attracted immediate skepticism, given the distance from the front lines and a variety of other factors such as the level of damage inflicted. The Russian Ministry of Defence (MoD) denied that seven planes had been destroyed, but did state that two servicemen had been killed by “sudden mortar fire”. However, there was also speculation that this attack could have been carried out by small drones, of the kind that so-called Islamic State (IS) have used so effectively.

The speculation around the attack on New Year’s Eve was strengthened when the Russian MoD released a statement and images of improvised drones that they claimed had attacked Russian bases in Khmeimim and Tartus on the night of January 6. This article will use open source methods to examine the circumstances around these drones, the attacks they took part in and the possibility they may have been responsible for theNew Year’s Eve attack against Khmeimim.

Note: all times used in this investigation are UTC unless explicitly stated. A short guide to how different social media platforms display time and date can be found here.

Image 1 – Map showing incidents involving this model of drone and frontlines at the beginning of 2018 (Map Source)

The attack on Khmeimim & Tartus on 6 January 2018

There appears to be a single video of the attack on this base, however it is impossible to geolocate as it was filmed at night. The video appears to have first been posted on 1741 on January 6 by the Facebook group “Network News Jabla” (NN Jabla), a group dedicated to news from Jabla, a town immediately South-West of Khmeimim airbase. The video describes an “Alarm sounding at Hamimim airport” as well as “anti-aircraft response to a remote-controlled aircraft”.

Video reportedly showing the attack on Khmeimim

On 8 January 2018, the Russian MoD released a statement and included imagery showing one the drones it stated it had downed, claiming:

• Six drones were intercepted and taken control of by Russian Electronic Warfare assets, of which:
  • Three landed successfully
  • Three exploded upon landing

• Seven drones were destroyed by Russian anti-air assets, in this case using the Pantsir-S1.

Analysis of the imagery released shows that at least two drones have been obtained in an apparently reasonably intact state.

Image 2

Image 3

Image 4

Note that image 3 and 4 appear to show different drones, as the undercarriage and wings (highlighted in yellow and red) have a slightly different configuration, indicating at least two drones were recovered. A later image, published by RT, shows six drones, of which three are fairly intact.

Image 5

These appear to be reasonably small drones, with a wingspan of approximately three or four meters. Their construction seems to be reasonably basic, with a plywood body covered in plastic sheets which has been secured using tape. A small engine, possibly petrol, provides propulsion. In a later statement, the Russian MoD was claimed that the drones originated from the town of Muazzara, likely to be Al Maouzra or الموزرة, in Idlib province.

The attack on Homs Military Engineering Academy on or before 3 January 2018.

These drones have been previously seen in other media emerging from Syria, although nothing on the scale of the reported attack at Khmeimim airbase. The two images below reportedly show a drone that was shot down at a Military Engineering Academy in Homs, over 100 kilometres southeast of Khmeimim. The embed code for the Instagram image linked to in this article show at least one of the images was uploaded at 08:05 AM (Syrian time) on January 3, well before the January 5-6 attack on Khmeimim airbase took place. Although the drone has been deformed, it is possible to see how it is virtually the same design as the drones used at Khmeimim.

Image 6

Image 7

It should be noted that the yellow square highlights an item which resembles a GPS antenna, something the Russian MoD Facebook post claimed was also a component in the drones recovered from Khmeimim.

The attack on Khmeimim on or before 18:52, 1 January 2018

The images below, posted at 18:52 UTC on January 1 by the Facebook group NN Jabla (the same Facebook group that posted the video of the attack on Khmeimim on January 6) show another virtually identical drone, which was one of two reportedly downed in “rural areas”. The poster described hearing explosions at noon on 1 January 2018, which they believe were caused by these drones.

Image 8

A video was later released by “Muraselon news” which, although posted later, appears to be the source of some of the images posted by NN Jabla. It shows the remnants of what is claimed to be a drone shot down at Khmeimim by the SAA. Analysis of the wreckage shows it appears to contain very similar components to drones we have previously analysed in this article

Image 9 – Comparison of plywood body. Left: Muraselon Video, Right: Russian MoD

Image 10 – Comparison of motors. Left: Muraselon Video, Right: Russian MoD

Image 11 – Comparison of batteries. Left: Muraselon Video, Right: Rusvesna Image from Homs

Drone downed, allegedly on Ghab Plain, on or before 08:38, 1 January 2018

An instance of this kind of drone has also been seen in apparently rebel-held territory after allegedly being downed by Ahrar Al Sham.

Image 12 – A translation of the caption reads: “Ahrar Al Sham Islamic Movement downed the reconnaissance aircraft of the regime.”

It is immediately obvious that this is the same kind of drone seen at Homs and Khmeimim. We can also tell from the alignment of the tape on the tail that this drone is likely unique and not one of the examples we’ve previously examined. The picture is allegedly from an Ahrar Al Sham fighter on the Ghab Plain, the nearest section of rebel-held territory to the Khmeimim airbase. Although it does not appear possible to geolocate this image, it is consistent with claims from the Russian MoD that the drones had flow from Muazzara in order to reach Khmeimim. Judging by the use of these drones to attack Russian forces, it seems likely that Ahrar Al Sham may have accidentally shot down a drone belonging to another rebel group.

Drone for sale on Telegram, timestamped on the evening of 31 December 2017

An investigation by Adam Rawnsley and Christiaan Triebert for The Daily Beast discovered this kind of drone for sale on Telegram, a popular messaging app which they and Eric Woods had previously shown was being used as an online arms bazaar. The seller also offered drone bombs for sale. The damage to the drone and the tape applied to the tail differs from that captured by Ahrar Al Sham, indicating that it is likely a unique drone. The fact that this drone is damaged raises questions about how it was obtained, and whether the seller was actually party to its construction or happened to find one that had crashed.

Image 13

When asked about the possible location of the seller and when it was posted, Rawnsley replied:

“The vast majority of locations mentioned by sellers in that market are located in Idlib. It’s of course possible that the drone seller could’ve been located elsewhere but Idlib is where most of the market’s activity appears to be concentrated… The post was timestamped the evening of December 31st and the photos appear to have been taken at night, although I can’t be certain when, precisely, they were taken.”

Analysis of the drone

Although the drone seems to be made of cheap materials, such as plywood, plastic sheeting and tape, it also appears to contain at least one relatively advanced component compared to the rest of the drone: a GPS antenna. The Russian MoD claim that the drones were navigating using GPS is consistent with what appears to be a GPS antenna identified in the wreckage seen at Homs. The lack of evidence of any cameras also tangentially supports this claim – without a camera or line of sight, an operator would find it difficult to pilot this drone, especially at ranges in the tens of kilometres. This suggests a level of automation in what initially appears to be a rather rag-tag set of drones. The range of the drone appears to be based on the targets hit on the night of January 6: as can be seen from the map, Tartus is almost exactly 100 kilometres from the alleged point of origin.

The undercarriage of these drones are also of an interesting design. None of the examples seen so far of this kind of drone have any kind of wheels. Instead, they have appear to have a basic plywood undercarriage which would likely produce very poor landings. Indeed it would not even be sufficient to call these undercarriages “skids”, as they are so short and thin.

Image 14

The apparent weak nature of this undercarriage begs the question of how these drones are launched and how they are recovered. Considering the size of these drones and their payload, it seems unlikely they are launched by hand. It is a possibility that these drones are launched off some kind of catapult launcher, as used by many current military and civilian drones. As for recovery, considering the relatively cheap materials used in their construction and the problems landing with such an undercarriage, it seems likely that these drones were regarded as disposable, and were never intended to return to their point of origin. Needless to say, returning to a point of origin while flying at relatively low speeds after bombing a major Russian base would probably not be a recipe for survivability for whoever had to collect them once they had crash-landed.

The bomblet release mechanism for this drone is also an interesting feature. The struts under the wings serve as hardpoints where bombs can be attached, with room for up to 10 bomblets per drone.

Image 15 (Courtesy of Eric Woods)

It appears likely that the bomblets are secured to this strut by some kind of mechanism that is controlled by the servo motor at the end. Without more detailed images of the inside mechanism it is difficult to state exactly how the mechanism functions. With only a single servo per strut it seems likely that these bomblets are all released at the same time.

Image 16 – Servo indicated in yellow (Courtesy of the Russian MoD)

Image 17 – Drone bomblets: note the attachment point highlighted in red (Courtesy of Eric Woods)

Analysis of the bomblets

By closely examining the bomb, we can work out its basic construction: a core of explosive inside a layer of ball-bearings, encased in a white plastic shell and detonated by an unidentified type of fuze, probably point detonating.

Image 18 – The yellow arrows indicate where ball-bearing are visible within the bomblet

The images released by NN Jabla on 1 January 2018 contain further images that appear to show portions of these bombs after detonation, including the fuze, portions of the casing, and ball-bearings encased in epoxy resin.

Image 19 – Note the ball-bearings encased in what appears to be some kind of epoxy resin.

A later image released by the Russian MoD not only matches images of debris released on January 1, it also clearly shows the construction a bomblet in its entirety, as well as details of the fuze, which appears to be point detonating with a simple striker at the tip.

Image 20 – Note the BB’s encased in epoxy and the simple construction of the fuze

One of the images, allegedly taken by Ahrar Al Sham, shows a curious extension to the fuze, although its exact purpose has not been established. It is a possibility the rods are to detonate the munitions at knee or waist height, thereby increasing their lethality.

Image 21

The bomblets associated with these drones are neither small mortar bombs, nor, as IS used on a large scale, modified conventional munitions. Instead they appear to be custom made for use with drones. IS, the Iraqi Federal Police and the PKK have all used bomblets which appear superficially similar, but none of these match munitions associated with this drone.

Analysis of the tactics

Using the sources and analysis above, we can make an educated guess at the manner in which these drones are being deployed. In three of the four incidents above at least two drones are mentioned, while at Khmeimim on January 6, allegedly ten were deployed. The lack of cameras on the drones suggest that they are likely pre-loaded with a flight plan and then flown autonomously to their target, where they dropped their payload en mass on a given GPS coordinate.

Since the bomblets are unguided and are deployed from a moving fixed-wing, rather than a hovering rotary wing drone, it seems unlikely these drones are that accurate. Therefore, dropping numerous bombs from numerous drones simultaneously seems to be a reasonable course of action to increase the chance of hitting something. Considering the relatively cheap build quality, limited ability to land safely, and potential for compromise on recovery, it is a possibility that these drones are then discarded or deliberately crashed after their mission.

Curiously for such an audacious attack against a high-profile target, no group has yet claimed responsibility for any of these strikes. Considering the numbers of drones involved in these raids and the high profile of the target set, it seems likely there was significant planning involved in these strikes. The fact that no group has claimed them is striking.

Did these drones attack Khmeimim on New Year’s Eve?

The attack on Khmeimim on New Year’s Eve remains shrouded in mystery. We only know that two Russian soldiers were killed and some kind of damage was likely inflicted on the aircraft there. Only three images exist which show damage to planes there, and they were only partially verified, though there is currently no evidence to contradict their veracity. However, the images must have been taken shortly after the damage was inflicted, as one of them clearly shows fluid gushing from the plane.

Image 21 – Note the liquid spraying from the plane

The rainy weather seen in the images certainly matches the weather on the evening of the New Year’s Eve.

Image 22

Additionally a tail-number for an SU-24 in the images matches one previously sighted at the base. A geolocation can also be made using the comparison of the background of one of the images and a video that was filmed in Khmeimim early in 2018.

Image 23

Image 24 (source: https://youtu.be/DoVaDo9N1M0?t=45)

Although there is no direct evidence that these drones were involved in the attack on New Year’s Eve, circumstances and context suggests it should be considered as a possibility. The defence systems around Khmeimim have allegedly never been breached before, including when the base came under rocket attack on December 27. Therefore for an attack to kill two soldiers and damage planes suggests it came from an unexpected vector. A close mortar attack by a group of well-trained militants who infiltrated across the front lines could fulfill these criteria.

The discovery of two of these drones on January 1 near the airbase suggests an alternate possibility: that a drone attack caused the damage and killed the two Russian soldiers. Several drones with similar radar cross-sections to large birds, and moving at similar speeds, could feasibly escape detection if they were unexpected. This scenario, backed up with evidence of drones in the area on or before the 1^st of January, should certainly be considered as a credible possibility.

Summary

It is clear from these incidents that weaponised drones continue to pose a direct threat to forces operating within Syria. Since New Year’s Eve there have been at least four attacks involving these drones, Khmeimim and Tartus on January 6, Homs on January 2-3 and the area in the vicinity of Khmeimim on or before January 1. It should be considered a credible possibility that drones recovered on New Year’s Day participated in the attack on Khmeimim on New Year’s Eve. If we add together all these attacks, as well as the drone for sale on social media, we can account for 18 drones, and there were possibly more that either escaped, crashed or were not found.

The Russian MoD claim that whoever launched these drones required nation-state support is dubious. The suggestion that a United States Poseidon aircraft is somehow related to these drones is even more so. The materials and construction of these drones, including their munitions, could all be sourced using relatively local means. No component is particularly advanced, except for the GPS antenna which is fairly standard in most commercial off-the-shelf (COTS) drones anyway. IS managed to create an entire drone program with its own bureaucracy, improvised drones and mass-produced munitions. It is hardly surprising another actor in the Syrian conflict has also managed to do this. What is different about these attacks is the tactics used. Although IS reportedly sometimes operated more than a single drone at a time, they did not appear to have ever used a massed attack on this kind of scale using drones flying with a measure of autonomy. This indicates a strategic grasp of the use of drones, as well as a high level of planning. The lack of any kind of claim, or even rumours from the rebels, indicates that whoever is producing these drone and launching these attacks has a high level of discipline and an understanding of operational and personal security. There is little doubt they will be a priority target once identified.

Although some regard the threat from COTS and improvised drones as negligible, they have the power to inflict losses at both a tactical and strategic level. IS proved this in their extensive use of COTS drones during 2017, including a spectacular attack on an ammunition depot in Deir Ezzor. Whoever launched the attack on Khmeimim came very close to imposing a strategic blow on Russian air assets in Syria, a vital source of support for the regime. Although the plastic sheeting, tape and simple design may belie the illusion of sophistication, it seems that the use of drones, whether military, COTS or improvised, is taking another step to becoming the future of conflict.

Thanks for this article goes to: Private Joker, Qalaat Al Mudiq, Abraxas Spa, Robi Sen and Adam Rawnsley