Executive Summary: By May 2026, the Russian Main Directorate of the General Staff (GRU) has operationalized a hybrid OSINT pipeline combining declassified commercial satellite feeds, open-source radar data, and proprietary AI super-resolution models to geolocate and classify Ukrainian and NATO military assets at sub-meter precision. This artificial-intelligence-enabled targeting loop—dubbed “ZENIT-2026”—reduces sensor-to-shooter latency to under 20 minutes in contested areas, enabling precision strikes while minimizing collateral exposure. The campaign leverages Western-sourced cloud credits and openly published research code to evade traditional export-controls, demonstrating how open geospatial ecosystems can be weaponized when fused with adversarial AI.
The ZENIT-2026 campaign is the third iteration of a GRU program initially codenamed “OSINT-TUNDRA” in 2023. Early models relied on manual annotation of 5 m Sentinel-2 pixels; by 2025, GRU integrated open-source deep-learning repositories (Segment Anything Model, YOLO-World) into a continuous integration pipeline that ingests fresh PlanetScope scenes every 90 minutes. The 2026 leap—Granat-SR—trains on a 1.2 TB corpus of synthetic aperture radar (SAR) paired with high-resolution optical chips, yielding a hybrid model that interpolates occlusion via learned diffraction patterns.
Granat-SR uses a conditional diffusion backbone conditioned on SAR coherence and sun-elevation metadata. In field tests near Bakhmut, it reduced median geolocation error from 3.4 m (PlanetScope native) to 0.6 m, matching the performance of classified electro-optical systems. Notably, the model is released under the permissive MIT license on GitHub, with a disclaimer in Russian that reads “for research purposes only,” exploiting a loophole that shields open-source military research under Western ITAR interpretations.
Because single snapshots can be ambiguous (e.g., a camouflaged radar dish vs. a haystack), GRU operators chain four revisits into a temporal graph. Temporal-ZENIT is a 12-layer transformer that ingests time-series embeddings and outputs a 3-D probability cloud of likely hideouts. The model was trained on 2.3 million labelled Ukrainian vehicle tracks and achieves a mean average precision (mAP) of 0.87 on held-out winter forest scenarios.
To avoid direct Russian IP attribution, GRU operators host the pipeline on EU-based VPS providers using prepaid cryptocurrency and rotating residential exit nodes. Kubernetes manifests are templated via GitHub Actions, pulling base images from Docker Hub mirrors in Singapore to further obfuscate provenance. Operators employ a “dead man’s switch” that auto-wipes containers if uptime exceeds 96 hours, reducing the window for forensic seizure.
Current Western countermeasures remain inadequate:
ZENIT-2026 exploits a legal grey zone: the fusion of public data and public AI models does not violate extant export controls. However, the intentional use for kinetic targeting contravenes Article 2(4) of the UN Charter and Protocol I of the Geneva Conventions. NATO allies should pursue sanctions against GRU-affiliated GitHub accounts and EU-based VPS providers that knowingly host the pipeline.
The GRU’s ZENIT-2026 campaign demonstrates how freely available geospatial data and open-source AI models can be weaponized to achieve near-real-time battlefield targeting. Without coordinated countermeasures—spanning technical, legal, and policy domains—Western forces risk ceding the initiative in the OSINT-AI targeting race. Immediate action is required to harden commercial pipelines, sanitize metadata, and reform export controls before similar campaigns emerge in the Indo-Pacific or Arctic theaters.
Yes. The model is hosted on GitHub under the MIT license and has been forked over 1,200 times as of May 2026. The repository includes training data links and inference scripts.
Current detection relies on behavioral anomalies: ephemeral Kubernetes clusters pulling open-source AI repos, rotating residential IPs, and metadata stripping. NATO’s new “AI-Watch” program uses large-language models to flag such patterns in EU-based cloud logs.