From North Korea to Russia:
What #OSINT Reveals About Weapon Deliveries
As tensions mount in the Russia-Ukraine conflict, new intelligence points to North Korea’s increasing role in supplying Russia with much-needed munitions. Through OSINT (Open Source Intelligence) methods, we can trace the secretive routes these weapon shipments take, uncovering the networks of ships, rail transport, and storage depots. This post dives into what we know about these covert operations, examining satellite imagery, vessel tracking data, and trade analysis to shed light on the illicit arms trade fueling Russia’s war efforts.
In October 2023, White House officials presented satellite images showing stacks of covered goods at a rail station on the Russia-North Korea border, believed to be weapons shipments from North Korea to Russia. Kim Jong Un’s regime has been accused of sending arms to Russia in exchange for food and fuel, a practice dating back to 2022, when the Ukraine war began. The New York Times previously reported on this trade, which has been condemned by the U.S. government. Now South Korea alleges that food and fuel is not anymore the central factor. North Korea wants satellites and updates on its old military tech. Russia will bring change and take the shells, vehicles and troops in the meanwhile for a crippling war it leads.
Recently, the situation has escalated with reports of so-called ‘ghost ships’ covertly transporting military supplies to Russia since late 2023. This raises pressing questions about where and how these exchanges are taking place, and why international actors have yet to intervene.
The volume of North Korean munitions flowing to Russia, particularly after Kim Jong Un’s visit last year, likely surpasses the military aid Ukraine has received from Western allies such as the U.S. and EU at various points in the conflict. This highlights North Korea’s increasingly pivotal role in propping up Russia’s war effort, especially as Moscow grapples with critical ammunition shortages.
Deliveries are primarily conducted by sea, involving several shipments of munitions and possibly other military hardware. These transfers are substantial, suggesting a significant boost to Russia’s military capabilities. While precise figures remain elusive, the shipments reportedly include large quantities of artillery shells, rockets, and potentially other military supplies.
The use of ‘dark vessels’ — ships that disable their AIS tracking systems to evade detection — has become a key tactic in these operations. This method, also observed in Russian ship-to-ship transfers to circumvent sanctions, enables the clandestine transport of arms.
Supply chain
Key ports facilitating this trade are Najin (Rajin) in North Korea and Vostochny and Dunay in Russia. A significant number of vessels involved in these operations have been observed turning off their AIS tracking systems to evade detection, a tactic recorded in at least 19 instances since late 2023.
Once the munitions arrive at Russian ports, they are often transported by rail to strategic storage facilities like Tikhoretsk, which supports Russian operations closer to the Ukrainian front. Shipments include artillery shells, rockets, and potentially other military equipment, according to analysts. The scale of these transfers has grown since Kim Jong Un’s 2023 visit to Russia, with an estimated 7,000 containers of munitions delivered, underscoring North Korea’s critical role in sustaining Russia’s war effort amid its ammunition shortages.
CSIS analysis from February on these dark vessels, suggest at least 25 different visits or yoyages — which later increased to at least 32 trips — , and 19 dark vessels, could involved some 2.5 million rounds of artillery shells.
A report by the Japanese Ministry of Justice outlines the trade routes, mentioning the key ports of Rajin, Dunai, and Vostochny, as well as the critical train station at Tumangang/Khasan (Tumenjiang).
The train station is also highlighted on the CSIS Felt map, marking it as a key connection hub between North Korea and Russia. In addition to being a weapons transport hub, ChinaHansaTravel amusingly includes it on a scenic route for tourists. CSIS reportedly observed a significant increase in rail car traffic at the station between October 2023 and early 2024, compared to pre-COVID periods and the years between 2019 and 2023. For OSINT weapons traffic experts at CSIS, this activity strongly indicates North Korea’s ongoing supply of arms and munitions to Russia, as well as reciprocal trade from Russia to North Korea.
We have only a handful of images of this train terminal from Google Earth Pro, but they already show noticeable changes over time, indicating it has become much busier. When examining time-lapse images from Sentinel, the transformation is even more apparent. A comparison reveals that just months before the war, the station underwent a significant upgrade. While this could be coincidental, it may also be unrelated to any dealings with Russia.
The timelapse provides a more detailed view of the ongoing expansion of the cargo train hub.
The changes observed between March 2024 and October 2024, based on higher resolution satellite images, further confirm the CSIS findings that cargo turnover at the station remains consistently high. These results were verified using Planet Labs satellite imagery during the analysis.
Ships involved in the arms trade
As mentioned, analysts have reported that several Russian cargo ships are regularly traveling between North Korea and Russia. According to authorities, these vessels have been switching off their Automatic Identification System (AIS) to conceal their routes and destinations, as confirmed by satellite imagery. The vessels in question have been identified as part of a broader effort to evade detection, and satellite images corroborate these movements, further supporting claims of illicit activities between the two nations.
MARIA, General Cargo (IMO: 8517839, now called LEV YASHIN)
MAIA 1, General Cargo, IMO: 9358010
ANGARA (or ro-ro Angara), a Ro-Ro/Container Carrier, IMO: 9179842: The ANGARA has been previously involved in weapons shipments to conflict zones like Syria and Sudan.
The Angara almost always operates with its AIS (Automatic Identification System) turned off, though not entirely without exceptions. Between February and April 2024, the vessel was tracked at a port in China. In May 2024, it transferred to Vladivostok. After departing Vladivostok at the end of May, Angara has not appeared on AIS and remains untraceable via standard satellite tracking systems since then.
Exclusive research by newsmedia revealed the China angle. Satellite images show that China is playing a role in harboring a the cargo ship, implicated in arms transfers. In April, they found the ship has been in the Chinese shipyard since February 2024, following at least 11 deliveries of munitions between North Korean and Russian ports. A sign of China’s tacit support for Russia, complicating U.S. efforts to curtail military cooperation between the two nations.
Ownerships investigation
According to Lloyds list, a data provider and market intelligence company, the vessel Angara is owned by NB Shipping Company, with Marine Trans Shipping LLCin Russia serving as its ISM manager since August 2020. The registered owner is M Leasing LLC, a company also incorporated in Russia. Both NB Shipping and M Leasing are sanctioned entities. International experts could have anticipated the dubious nature of the Angara, as pointed out in a report by RUSI.
Previously sailing under the name Ocean Energy, the vessel was owned by the Kaalbye Group, a company accused of transporting Russian arms to Syria and South Sudan. During this period, arms trafficking observers, including @steffanwatkins identified the Ocean Energy as delivering Russian T-90 tanks from Russia to Iraq. This history underscores the vessel’s repeated involvement in illicit arms transport.
Spinning a web of sanctioned entities
Three vessels, confirmed by CSIC, are subject to sanctions by the U.S. Department of the Treasury and are also listed in the EU sanctions announced in June 2024. Among them is the Lady R, which, like the other vessels, is linked to MG-Flot LLC, also known as TRANSMORFLOT LLC SHIPPING COMPANY, a Russian shipping company that provides logistical support to the Russian Ministry of Defence. The company, headquartered at House 18 D (address), Premise 1, Lenina Street, in the Republic of Dagestan, owns vessels identified in arms shipments from Iran, aimed at supporting Russia’s full-scale invasion of Ukraine.”
In April, reports surfaced that the vessel Angara, which is under U.S. sanctions for transporting weapons, had been docked in Zhoushan, China, raising concerns about China’s indirect support for Russia’s war efforts. This support, including the Angara’s alleged role in transporting North Korean weapons to Russian ports, is expected to be a focal point in the upcoming discussions between U.S. Secretary of State Antony Blinken and Chinese officials in Beijing.
Meanwhile, the voyages of MAIA 1 have continued into the summer of 2024. After being untraceable between October 2023 and April 1, the vessel was spotted in Slavyanka Bay, Russia, before heading to Vladivostok. By June, it appeared in Vanino, and by early September, it was located near the North Korean border in Nakhodka Bay. However, the AIS signals from MAIA 1 show signs of being spoofed, suggesting the vessel’s actual whereabouts could have been elsewhere — however hard to confirm. The timelabs shows a vessel of the size anchoring at roughly that spot.
Since the beginning of September, a vessel resembling the MAIA-1 has been visible in the bay. It maintains its AIS signal while anchored, allowing it to be tracked during its stay.
One key takeaway is the power of visualization. The team at CSIS effectively used a Felt map to illustrate the entire delivery chain of weapons — from a port near North Korea to the frontlines of the conflict. The map, enhanced with satellite imagery intelligence, captured key locations and provided interactive annotations, allowing viewers to grasp the complexity of the arms transfers in one clear view.
For those unfamiliar, Felt is a relatively new platform for creating interactive maps, which has quickly become a popular tool in OSINT (Open Source Intelligence) research. I used it in a previous journalism project to build detailed, collaborative maps without requiring coding skills. Felt excels at making OSINT evidence user-friendly and visually engaging, outperforming traditional platforms like Google Maps in terms of flexibility and capacity for handling large datasets. This makes it ideal for mapping complex information such as troop movements or supply chains.
The focus on key ports like Najin Port in North Korea and Dunay Port in Russia illustrates their critical roles in the weapons trade. Dunay, near Vladivostok, serves as a receiving hub for shipments from North Korea, while Najin, located in the Rason Special Economic Zone, is a known departure point for illicit goods. Satellite imagery, along with increased activity from North Korean military vessels, supports the theory that these ports are central to a coordinated supply chain funneling arms to Russia amid international sanctions.
At Najin, the presence of warehouses, loading docks, and cargo vessels tied to sanctioned goods raises further red flags. While satellite images provide visual evidence of arms storage and shipping preparations on vessels like the ANGARA, the most compelling confirmation came from the U.S. Mission to the UN, which released intelligence in mid-October, corroborating these weapons transfers (link).
The researchers then looked at the port a few and months weeks later, and found no upending of the heightened activity of the trade of countless of shipping containers, here well to be seein in dark blue.
If we compare Planet satellite images between Juni 2023 and October 2024 for the location of the three peers of Najin/Rajin Port, we spot on the 78 images hightened activities.
In total, I observed approximately 32 different vessels moored and loading cargo based on the available satellite images. This suggests the actual number may be higher, as cargo movements are visible even in images where no vessels are present.
When comparing the port’s usage from 2020 to the onset of the war, we see that the middle pier, which was primarily used for commodities such as coal, has been converted into a dedicated cargo-loading pier. Notably, the only appearance of traditional cargo vessels in Google Earth imagery occurred in 2023, marking a significant shift in the port’s operations.
Exact locaitons of the sanctioned vessels transporting equipment and weapons to Russia:
From the RUSI report illustrations we can pull all relevant coordinates of the five shipments between August and October 2023.
ANGARA AT RAJIN, NORTH KOREA, Geo: 42.227, 130.284
THE ANGARA AND MARIA AT DUNAI, RUSSIA, Geo: 42.866, 132.364
DUNAI MILITARY FACILITY, RUSSIA, Geo: 42.886, 132.363
While we now know that the two ships, the Angara and the Maria, were loading cargo at Rajin port, other vessels involved remain unmentioned, including one significant ship. After taking a screenshot of the coordinates in Rajin, we used Google Images to search for exact matches. A Vox article described it as “a suspected Russian ship about 120 meters long”. But what is this vessel that appeared on October 7th?
According to the Royal United Services Institute (RUSI), the vessel is likely the Lady R — the same ship referenced by Russian Foreign Minister Sergei Lavrov and linked by an American diplomat to a controversial incident.
This incident involved an alleged arms shipment (weapons) from South Africa to Russia during a mysterious and clandestine port call in December 2022, which ignited a political uproar. The Lady R has also been spotted in North Korea and China, in addition to making multiple transits through the Bosphorus on its way into and out of the Black Sea.
Ro-Ro Cargo Ship, IMO 9161003
Satellite images have captured vessels traveling between Russia and North Korea at Dunai Port in Russia, with a particular focus on cargo ships docking in areas not typically used for regular commercial trade. Unusual crane activity and container movements, especially in isolated or restricted sections of the port, suggest that these locations may be handling materials discreetly, avoiding public scrutiny.
The use of smaller vessels frequently traveling between Russia and North Korea further indicates an attempt to obscure the nature of the trade, likely to evade detection by international monitoring bodies. This behavior aligns with patterns seen in arms smuggling operations, where minimizing visibility is key.
At Najin Port, a 101-meter-long vessel has been observed docked since October 2020, without having moved. This vessel was spotted again in October 2023, during the peak of suspected weapons smuggling activities. It is believed to be a general cargo ship, possibly used for transporting a variety of goods, including munitions or military supplies. The presence of smaller boats on its deck suggests it could be used for logistical tasks, such as deploying smaller craft for cargo handling or covert operations.
Another notable observation is a 64-meter-long vessel, which ChatGPT identifies as either a general cargo ship or possibly a smaller bulk carrier. The exact type remains uncertain, but based on its dimensions and structure, it likely fits into one of these categories. Further analysis or verification from maritime tracking tools would be necessary to confirm its specific classification.
Given its size, the vessel in question is likely designed for transporting various goods, possibly in containers or bulk, but on a smaller scale compared to larger cargo or container ships. These types of vessels are commonly used for short sea shipping or regional maritime transport routes.
Noteworthy vessels connected to North Korean ports, particularly in relation to weapons, munitions, and military supplies, include:
1. MAIA 1 (IMO: 9358010)— This general cargo ship has been implicated in arms transfers and other illicit cargo exchanges between North Korea and Russia. It has been observed making voyages between North Korean ports, such as Najin, and Russian destinations, often with its AIS turned off to avoid detection. The MAIA 1 sailed under a German flag until 2017. It was recorded at Vostochny Port, Russia, on February 5, 2024, and a few days later at Najin, North Korea, the same location where the *Lady R* was seen loading cargo.
2. VYACHESLAV ANISIMOV (IMO: 9004463) — Another Russian cargo ship involved in North Korea-Russia trade, particularly suspected of transporting military supplies. Similar to other vessels in this network, it is believed to turn off its tracking systems during voyages to evade scrutiny.
Both vessels are part of a larger pattern of covert arms shipments between North Korea and Russia, with efforts to conceal these activities through AIS manipulation.
All roads lead to MG-FLOT
MG-FLOT is one of seven companies sanctioned by the U.S. Treasury in May 2022 in response to the ongoing war in Ukraine. The company’s entire fleet, consisting of 16 vessels (and more as shown below), including the Lady R, was blacklisted as part of these sanctions. Additional vessels associated with MG-FLOT were also targeted. The details of the fleet can be verified through platforms like Opensanctions, which tracks entities involved in international sanctions lists.
I inquired which of these vessels had been near North Korea and was not on our radar. The LADY D (formerly known as MALIY B.S.) is a general cargo ship with a gross tonnage of 9,611 GRT, now registered under the Russian flag (though it previously sailed under the German flag). Over the past year, the vessel has been highly active across Europe, including in the Gulf of Finland and St. Petersburg in June and July. It is one of the most active vessels under the Russian flag, operated by the MG-FLOT company (Sanction authorities)
Sanctions authorities have flagged the vessel for allegedly transporting Russian weapons exports to India via the Bosphorus Strait and for instances of AIS (Automatic Identification System) shutdowns. Despite this, the vessel has docked in at least a dozen ports in the past year. Notably, it was observed in the Bay of Nakhodka, near where the Angara was spotted at Vostochny Port, before making a trip to North Korea’s Rason Port in 2023, according to NK News.
Pundits like the X account @Auonsson speculated in August 2023 that a vessel might have picked up arms in India (Link), as it showed a different draft reading at the end of June, indicating it had collected cargo.
“…She left reporting 5.6m, returned reporting 6.7m, suggesting more cargo on the return trip” (Thread). Such observations wouldn’t be possible without accounts like @YorukIsik, who capture reliable photos and videos at key maritime chokepoints, such as the Bosporus. While Russia is purchasing weapons from North Korea, India frequently buys arms from Russia, further intertwining these global arms trades.
The Russian military must store North Korean-supplied artillery shells somewhere, and experts believed that one of these locations is the Tikhoretsk Munitions Storage Facility. In September 2024, this facility was heavily damaged by Ukrainian drone strikes, with reports indicating significant destruction. link
The Tikhoretsk site, located in the northern Caucasus, is believed to be one of the destinations for the long supply chain of North Korean munitions. On September 21, 2024, Urkainian drones targeted this major ammunition depot, among other sites. According to reports from UK-based defense think tank RUSI, this facility was housing weapons supplied by North Korea to support Russia’s war effort.
Experts believe that Russia is storing North Korean-supplied artillery shells, in part, at the Tikhoretsk Munitions Storage Facility. As of now, shipments from North Korea have slowed, not due to sanctions enforcement, but likely because of production or logistical challenges within North Korea, according to reports from NKPro.
In June, South Korean Defense Minister Shin Wonsik confirmed that over 10,000 shipping containers, possibly containing up to 5 million artillery shells, had been sent from North Korea to Russia. Alongside artillery, North Korea has also reportedly supplied dozens of ballistic missiles, signifying the deepening military cooperation between the two nations.
In exchange, Russia is believed to be providing North Korea with advanced technology to bolster its satellite development, along with military hardware, including tanks and aircraft, to support North Korea’s aging military infrastructure.
North Korea’s involvement in Russia’s war in Ukraine is raising alarms among experts. In June, Pyongyang announced plans to send an engineering unit, and recent reports suggest North Korean military personnel may already be on the ground. In October, reports indicated North Korean generals were killed in Donetsk (ground reporting), confirming the presence of troops and signaling an expansion of their involvement in the conflict.
This escalation hints at future shipments potentially including more personnel, strengthening North Korea’s alignment with Russia. The presence of North Korean soldiers marks a significant shift in the conflict, raising concerns about regional stability. Furthermore, OSINT evidence from drone footage showed Ukraine’s forces destroying a North Korean Bulsae-4 anti-tank missile alongside a British AS-90 self-propelled artillery, further highlighting the diverse military hardware involved.
Conclusion:
A few days ago, Ukraines President Zelensky said that “North Korea has in fact joined the Russian war on Ukraine”. This is already not just about transferring weapons. This is actually about transferring people from North Korea to the military forces of the occupier, Zelenskyy said. Some even say that without the equipment supplied by the DPRK to Russia in 2023 and 2024, it would not be able to think about an offensive operation which is going now.
The organized weapons trade between North Korea and Russia has shown a an ongoing pattern, with vessels turning off their Automatic Identification System (AIS) and frequently commuting between the two countries, often carrying heavy cargo. This behavior raises red flags in OSINT circles, as it follows a familiar track record of Russian-owned vessels engaging in sanctioned or covert activities. Initially, the trade involved smaller shipments such as artillery shells, but it has since escalated to include larger military equipment and soldiers — soon possible whole troops of DPRK soldiers.
This progression, from ammunition to full-scale military support, to China helping along the way, reveals the potential for a new phase in their relationship, likely driven by Russia’s ongoing conflict needs and North Korea’s strategic interests.
