Leveraging OSINT for Threat Intelligence in Hybrid Warfare

In an age where information moves faster than bullets, Open-Source Intelligence (OSINT) has emerged as a vital pillar in modern warfare. OSINT involves the collection and analysis of publicly available data from sources such as social media, satellite imagery, and online news. In the context of hybrid warfare, a strategy that blends conventional military tactics with cyber attacks, disinformation campaigns, and irregular tactics, OSINT plays a crucial role in shaping threat intelligence.

I am writing this blog post to explore how OSINT has been effectively leveraged in hybrid warfare scenarios in Ukraine, Gaza, and parts of Africa. Through real-world examples, we examine how open-source intelligence enhances battlefield awareness, informs cyber-kinetic strategies, and exposes disinformation, ultimately reshaping the contours of modern conflict.

The Role of OSINT in Hybrid Warfare

Hybrid warfare relies on a fluid blend of cyber operations, traditional combat, and psychological influence. OSINT serves multiple purposes in this domain:

• Situational Awareness: Analysts use satellite imagery and social media to track troop movements and verify military engagements.
• Cyber-Kinetic Coordination: Cyber attacks can be timed to coincide with physical strikes, leveraging digital chaos to amplify kinetic impact.
• Information Operations: Disinformation can be tracked and countered through OSINT, revealing bot networks or fabricated narratives.

The open nature of OSINT makes it a double-edged sword. While it empowers defenders with actionable intelligence, it also equips adversaries with tools to manipulate perception and coordinate attacks.

Case Study: Ukraine

Photo Credit to Anadolu Ajansi

Ukraine represents one of the most well-documented instances of OSINT use in hybrid warfare. Since the onset of the conflict in 2014, and especially during the 2022 full-scale invasion, open-source intelligence has been leveraged extensively by both governmental and independent actors. 

Tools such as Telegram, TikTok, and Sentinel Hub have enabled analysts and journalists to track military movements, often through civilian-captured videos that are geolocated and verified for authenticity. Investigative organizations like Bellingcat have harnessed geospatial data and visual evidence to expose war crimes and identify those responsible. 

Moreover, OSINT has been instrumental in countering misinformation, with analysts using metadata and timestamp verification to validate or debunk viral content. Ukraine’s strategic deployment of OSINT has not only supported its defense operations but also galvanized international support through transparent reporting.

Case Study: Gaza

Photo Credit to Centre For European Reform

In the context of Gaza, OSINT has played a multifaceted role encompassing both humanitarian verification and strategic intelligence. Satellite imagery and user-generated content have been vital in confirming the scale of civilian casualties and structural damage, often in environments where access for traditional media is limited. Social media platforms are extensively used by all parties involved to shape public perception, making narrative warfare a critical dimension of the conflict. 

OSINT tools have helped identify fake accounts, manipulated footage, and coordinated propaganda efforts. Furthermore, the timing of certain cyber attacks on Israeli infrastructure in conjunction with rocket launches suggests a level of cyber-physical synchronization that OSINT has helped to reveal. The Gaza case exemplifies how OSINT can clarify complex, polarized information environments and contribute to accountability and situational awareness.

Case Study: Sahel Region, Africa

Photo Credit to Bangkok Post

The Sahel region in Africa presents a different but equally critical landscape for OSINT application. Here, hybrid warfare often involves militant groups, state security forces, and international peacekeeping missions. OSINT has been used to track the movements and activities of jihadist groups through local news reports, social media chatter, and satellite imagery. 

The region's complex geography and limited formal intelligence infrastructure make open-source data particularly valuable. Tools like PlanetScope have been employed to monitor illicit trade routes and detect illegal mining operations, which often fund armed conflict. Additionally, peacekeeping operations by the UN and NGOs benefit from OSINT to map risk areas, understand local conflict dynamics, and improve mission safety. Although technological resources may be more limited than in Ukraine or Gaza, the use of OSINT in the Sahel illustrates its adaptability and importance in low-visibility conflict zones.

Tools & Techniques

OSINT practitioners in hybrid warfare rely on a diverse range of tools that help them transform fragments of public information into actionable insights. Geospatial tools like Sentinel Hub, Google Earth Pro, and Planet Labs allow for the analysis of satellite imagery and terrain patterns, which are instrumental in tracking movements and identifying impact zones. 

Social Media Intelligence (SOCMINT) platforms such as TweetDeck, Twint, and OSINTgram help monitor and analyze social conversations, detect sentiment, and uncover coordinated disinformation campaigns. For verifying visual content, tools like InVID, Metadata2Go, and Forensically are essential for checking image authenticity and metadata. Lastly, link analysis tools like Maltego and SpiderFoot enable the mapping of relationships and digital footprints across domains, users, and infrastructure, offering deeper insights into threat actors and their networks.

Ethical & Legal Considerations

The use of OSINT in hybrid warfare raises important ethical and legal questions that must not be overlooked. One significant concern is the trade-off between speed and accuracy while there is pressure to quickly release intelligence, doing so without proper verification can result in damaging false positives. 

There is also the issue of privacy, where civilians unknowingly become sources of intelligence through publicly shared content, potentially putting them at risk without their consent. Additionally, operational security must be maintained, as even open data can inadvertently expose sensitive troop movements or strategic plans. Striking a balance between transparency and responsibility is key to maintaining the integrity and safety of OSINT operations, especially in conflict zones where lives and missions are at stake.

Final Reflection

In hybrid warfare, where the battlefield spans cyberspace, city streets, and the human mind, OSINT stands as a critical asset. It enables timely threat detection, supports operational planning, and fosters global accountability. As technology evolves and conflicts become more complex, the role of OSINT will only grow in significance.

For nations, analysts, and citizens alike, understanding and leveraging open-source intelligence is no longer optional. It is essential for navigating the realities of modern conflict.

References

1. Bellingcat. (2022). "Tracking Russian Military Movements Through Open Sources." https://www.bellingcat.com
2. NATO Strategic Communications Centre of Excellence. (2020). "Hybrid Threats and the Role of OSINT."
3. OSINT Techniques, 9th Edition by Michael Bazzell. (2023).
4. Planet Labs. (2023). "Monitoring Conflict Zones with Satellite Imagery." https://www.planet.com
5. BBC Verify. (2023). "Verifying Footage from Gaza Conflict."
6. UN Office for West Africa and the Sahel. (2022). "Security Developments and Threat Monitoring Using OSINT."
7. InVID Project. (2021). "Video Verification in Conflict Journalism."
8. Center for Strategic and International Studies (CSIS). (2023). "Cyber and Kinetic Synergies in Modern Warfare."