OSINT Analysis: Six Russian Ships Active Near Nord Stream Sabotage Site According to Intelligence Source
OSINT data helps corroborate report of Russian ships possibly being in close proximity to the Nord Stream sabotage site.
If you enjoy my content, please consider supporting my work here and on Twitter with a premium Substack subscription. I keep all my OSINT related content freely available so that everyone can benefit from the information shared.
UPDATE: The AIS data for the Swedish warship that appears to have rushed to investigate something at the site of the NS explosions on September 22nd is no longer visible on MarineTraffic. If you search for the MMSI number on that date now, it now shows no data available. I won't rule out a strange bug or other weird cause, but the fact that it was still available on the 25th and then gone on the 26th, the day after this piece was published, is very odd.
Now that “t-online” have published the article we have been working on together for the past week and a half, I can finally share all the research behind it and details I had to leave out of my previous piece. “t-online” contacted me after an intelligence source had told them the names of six Russian naval vessels that were reportedly spotted in the vicinity of the Nord Stream sabotage site. With this information, I have spent the past week collecting and analyzing any open source information I could find in order to try to corroborate as much of their information as possible.
The Six Ships
“t-online”s intelligence source supplied them with the names of six very specific Russian naval vessels which I will detail below:
Project 141S Rescue ship SS-750 carrying the AS-26 Project 1855 Priz Deep-Diving Rescue Vehicle
Project 503R Medium Intelligence ship, Syzran
Project 02980 Rescue Tug, SB-123
Project 02980 Rescue Tug, Aleksandr Frolov
Neustrashimy-class frigate, Yaroslav Mudry
Steregushchiy-class corvette
Timeline of Events
On September 19th, a large Russian naval exercise taking place in the Baltic began, involving a significant portion of the Russian Baltic Fleet. According to the Russian MoD the exercise involved more than 15 vessels and would take place at several locations exclusively inside the Russian EEZ by Kaliningrad. This exercise reportedly included a convoy escort aspect including the Yaroslav Mudry and two Steregushchiy-class corvettes. Through Russian MoD press releases, I have identified 17 vessels that reportedly took part in this exercise. There is however no mention anywhere of the SS-750, SB-123, Aleksandr Frolov or Syzran being involved the exercise in any way.
The 17 ships mentioned:
It was also reported through Russian MoD press releases the Russian commando frogmen, likely from the 313th PDSS Detachment based in Baltiysk, were part of the exercise.
The publicised Russian naval exercises took place exclusively in the area marked red in the image above.
Through images uploaded to the Sputnik Mediabank of the Russian naval vessels leaving the port of Baltiysk on September 21st it is possible to use Suncalc to estimate the time of day the pictures were taken. The ships left for the exercise at approximately 14:00-15:00 UTC
Through the use of AIS data, it is possible to locate the time when the Aleksandr Frolov and SB-123 rescue tugs left Baltiysk on the 21st. The Aleksandr Frolov left its dock at 00:01 UTC, 14 hours before the vessels that were part of the exercise left.
Approximately fifty minutes later at 00:50 UTC the SB-123 leaves the dock and follows the Aleksandr Frolov.
Unfortunately the SS-750 does not use AIS, so it is not possible to track this vessel directly through MarineTraffic and AIS data. It is however possible to attempt to track it through other indirect means. Though an Google Earth image taken on October 10th 2022, we know exactly where the SS-750 was docked at that time. This image shows that it is the outer of the two Project 141 ships docked in Baltiysk, as we can see the AS-26 Project 1855 Priz Deep-Diving Rescue Vehicle stored on the deck of the vessel.
With this information we can use combination of Sentinel 2 and Sentinel 1 imagery of the site to establish if the SS-750 was missing from this location during the timeframe we are interested in. Sentinel 2 imagery confirms that the SS-750 was missing on September 22nd and that it would have also been the outer ship on September 21st.
With a Sentinel 1 imagery it is possible to confirm that both Project 141 vessels were missing on September 21st and that the SS-750 returned some time between September 24th and September 26th.
The Sentinel 1 image from September 21st was taken at 04:52 UTC, which confirms that the two Project 141 vessels left port prior to the other vessels that took part in the naval exercises in the Russian EEZ.
Using this information, it was possible to locate the Russian tug RB-401 seemingly moving a ship out of the location where the SS-750 was located at 00:22 UTC on September 21st. This means that it is highly likely that the SS-750 left in between the two Project 02980 Rescue Tugs and may have sailed with them to their destination.
From the port at Baltyisk, the two Project 02980 Rescue Tugs proceeded out of the Russian EEZ and into the Polish EEZ. Here they would turn off their AIS, with the Aleksandr Frolov doing it last at 14:22 UTC. At the time that the Aleksandr Frolov disabled its AIS, the vessel was 45nm (83km) southeast of the primary Nord Stream 1 sabotage site. The vessels were both traveling at 9kn which which means that if they headed to the site and kept their speed, they would arrive at the location at approximately 19:30 UTC.
At the same time, the USS Kearsarge (LHD-3) Wasp-class amphibious assault ship, USS San Antonio (LPD-17) San Antonio-class amphibious transport dock and USS Gunston Hall (LSD-44) Whidbey Island-class dock landing ship were leaving the Baltic Sea.
Given the location of the US Navy vessels at the time, it is possible that the Russian vessels just avoided their radar by being just outside the radar horizon of the vessels.
The following map shows the approximate radar target visibility range due to the horizon for the Danish Scanter 4000 located on Bornholm and the nearest Swedish coastal radar system. It also includes the US Navy vessels. The red and yellow circles are dependent on the height of the target.
At the time that the Russian vessels were traveling without active AIS, a US MH-60R began a flight over the Baltic Sea from Gdynia, Poland.
It is possible that the MH-60R saw unknown contacts heading towards the Nord Stream area at around 17:00 UTC using its AN/APS-153(V) Multi-Mode Radar. At its altitude of 1775ft, the radar horizon would allow the radar to pick up contacts close to the eastern side of the Nord Stream 1 sabotage area. While the MH-60R would likely not be able to identify the contacts, it would relay the location and heading, which combined with the contacts not having active AIS may have resulted in the P524 leaving Rødbyhavn shortly after.
At 19:50 UTC on September 21st, the Royal Danish Navy Diana-class Patrol Vessel P524 Nymfen left Rødbyhavn and headed directly towards the Nord Stream 1 sabotage location. The P524 Nymfen was the closest Royal Danish Navy vessel, after the P523 Najaden left Bornholm on September 17th. The P524 Nymfen heading straight for the Nord Stream 1 sabotage location overnight is highly unusual, as this would be only the second time in many years that a Royal Danish Navy vessel has taken an interest in the area. The Minerva Julie spending a week drifting over the area caused no response by the Royal Danish Navy.
The P524 Nymfen arrived in the area at around 06:15 UTC on September 22nd. Here the P524 lingered for approximately 30 minutes before moving closer to the area. It then turned back disappearing from AIS tracking at 07:44 UTC. The P524 shows up again on AIS at 14:37 UTC when the P524 would be on its way back to Bornholm.
I suspect that the Royal Danish Navy may have been alerted either by the MH-60R or the radar station on Bornholm of suspicious activity just prior to the P524 leaving Rødbyhavn. The Nord Stream 1 sabotage site is only a few nautical miles from a very active shipping lane, so it would require something quite abnormal to elicit this response. The Minerva Julie was in the area for 8 days acting suspicious without any response by the Royal Danish Navy. If the Russian vessels went to the Nord Stream site, it was well timed, as the P524 was the nearest Royal Danish Navy vessel and was 10 hours of travel time away.
At 07:12 UTC on September 22nd, a Swedish Air Force S 100B Argus airborne early warning and control (AEW&C) aircraft would take off from Malmen Airbase and fly a highly unusual route over the Baltic Sea. While Swedish AEW&C flights over the Baltic Sea are very routine, often taking off at the same time in the morning, this particular flight path is not routine. At 08:36 UTC the aircraft would reach the position indicated on the track below before flying to Ronneby Airport for a 30 minutes, likely to refuel.
Almost immediately after the aircraft reached the point above, the HSwMS Visby (K31) Visby-class corvette left port at Karlskrona naval base and sped towards the site of the Nord Stream 1 sabotage, reaching speeds of over 27 knots. From here over the next few days the HSwMS Visby (K31) would make several trips east, including one towards Kaliningrad while also disabling AIS multiple times for several hours at a time.
At the same time as this Poland and several other countries launched the naval exercise Rekin-22, also in the southern Baltic. Several vessels from this exercise are caught on Sentinel 2 imagery just off the coast of Poland heading east at 10:05 UTC on September 22nd.
Interestingly 2 vessels with no active AIS can be seen approximately 23 km North West of the NATO ships tailing them just on the edge of Polish territorial waters. These two vessels are approximately 100 meters and 130 meters long. These ships could be the Yaroslav Mudry and one of the two Steregushchiy-class corvettes.
Concurrently with the above, a Polish PZL M28B Bryza reconnaissance aircraft took off and took an interest in the same area as the HSwMS Visby (K31) and Swedish Air Force S 100B Argus airborne early warning and control (AEW&C) aircraft.
At approximately 19:50 UTC on September 21st, a Project 1388NZ Communication boat, KSV-2168 left Baltiysk.
After leaving Baltyisk, it would take up a position a few miles off the coast and remain stationary at this location for the following days. As the vessel is used for both communication and as an “admiral boat”, it being present at the time of the large naval exercise is not unusual.
The unusual part happens on September 23rd when the SB-123 and Aleksandr Frolov once again appear on AIS just off the coast of Kaliningrad. Once then reappear, both vessels head towards the KSV-2168, where they stay for approximately 12 hours. Why are two rescue tugs that do not appear to have been involved in the exercise rendezvousing with the KSV-2168?
In conclusion, OSINT alone cannot solve the mystery of the Nord Stream sabotage or what these vessels were doing on September 21st-23rd, a few days before the explosions. It does however seem likely that the unusual events on these dates are somehow a key part of the Nord Stream sabotage mystery.
Outstanding work once again! Thank you for summarizing in your conclusion.
Phenomenal investigation