A new investigation by Bellingcat has uncovered multiple digital connections between Viory, a self-described “Global South” video news agency based in Abu Dhabi, and Ruptly, the Moscow-based video agency owned by the sanctioned Russian state media network RT.
The findings reveal shared technical infrastructure, overlapping backend systems and evidence suggesting a closer operational relationship than either organisation has publicly acknowledged.
Both Viory and Ruptly denied any connection when contacted by Bellingcat. However, investigators identified a series of independent technical indicators that collectively point to significant overlap between the two agencies.
The investigation identified several technical links spanning web infrastructure, hosting services and internal development tools.
Among the most significant findings was the discovery that Darpo Vision, the legal entity behind Viory, historically used a wildcard SSL certificate registered to Ruptly. Cybersecurity experts consulted during the investigation said that deploying such a certificate would normally require access to Ruptly’s private cryptographic key, which would typically only be available to administrators managing its infrastructure.
Researchers also identified four IP addresses that simultaneously hosted domains belonging to both Viory and Ruptly during 2025 and 2026. While shared IP addresses are not uncommon in cloud hosting environments, the repeated overlap across multiple domains adds another technical link between the two agencies.
Read also: Ruptly, a voice of Russian propaganda to international audience
Bellingcat also found evidence linking the agencies through Sentry, a platform used by developers to monitor website performance and software errors.
Analysis of Ruptly’s client portals showed that performance data was being transmitted to Sentry projects hosted on Viory-controlled domains. Different authentication keys appeared to have been configured for separate Ruptly services, suggesting deliberate integration rather than accidental duplication.
Investigators also identified backend login pages carrying references to both organisations. One Ruptly Sentry login page redirected users to a URL containing “viory”, while another developer page hosted under a Viory domain displayed a page title and metadata describing Ruptly instead.
A software engineering expert interviewed by Bellingcat said that while individual pieces of evidence could potentially have alternative explanations, the combination of shared certificates, infrastructure and monitoring systems made unrelated operation increasingly difficult to explain.
Viory launched publicly in late 2023, describing itself as a video news agency serving the Global South through a worldwide network of contributors. The company says it supplies raw video footage to media organisations in more than 170 countries and has established partnerships with broadcasters, universities and government institutions across Africa, Asia and the Middle East.
According to Bellingcat’s review, Viory has signed at least 30 cooperation agreements with organisations in more than 20 countries, including public broadcasters, journalism institutions and regional media associations.
The speed of this international expansion has attracted attention from researchers examining foreign information operations and international media influence.
The investigation builds upon earlier reporting by German journalists and open-source researchers who identified links between Viory and former Ruptly personnel.
One previously reported finding involved an email address associated with Darpo Vision that appeared to correspond with the name of Ruptly’s managing director. Other researchers documented movement of staff between the organisations and similarities in their business models and platforms.
Bellingcat’s latest investigation adds new technical evidence, including shared infrastructure and backend systems, that had not previously been documented publicly.
The group OSINT For Ukraine also found links between Ruptly and Viory, including the movement of multiple key staff between the two agencies and similarities between their platforms and content.
Researchers cited in the investigation also highlighted Viory’s editorial output, noting a consistent prominence of stories relating to Russia, China and cooperation between the two countries.
Analysts cautioned that editorial positioning alone does not demonstrate organisational control. However, when combined with technical infrastructure links and previously documented personnel connections, it contributes to broader questions about transparency and influence within international media ecosystems.
Viory maintains that it is a privately owned UAE-based company that receives no funding, direction or instruction from any state media organisation.
Ruptly likewise denied any connection with Viory and declined to address specific technical findings identified during the investigation.
The investigation highlights the growing role of digital forensic analysis in examining media organisations and information networks. SSL certificates, passive DNS records, hosting infrastructure and backend developer tools can reveal relationships that may not be visible through corporate records alone.
While no single technical indicator conclusively establishes ownership or operational control, investigators argue that multiple independent findings should be assessed together.
The findings also underline the continuing importance of independent investigative journalism in exposing opaque influence operations and hidden propaganda networks. At a time when Russia’s full-scale war against Ukraine continues and the Kremlin is accused of intensifying hybrid activities targeting Europe and other Western democracies, investigations that combine traditional reporting with digital forensic analysis play a critical role in public accountability.
They can reveal attempts to circumvent sanctions imposed on Russian state media, uncover concealed relationships between organisations, and provide governments, media outlets and the public with evidence needed to better understand the evolving architecture of information influence campaigns.
When Bellingcat published its investigation into the digital connections between Viory and Ruptly, it presented…
Volodymyr Zhemchuhov was born 80 kilometres from the Russian border, speaks Russian as his mother…
The Czech-led initiative that has supplied Ukraine with more than four million large-calibre artillery shells…
The UK has announced a new package of sanctions targeting cryptocurrency exchanges and illicit financial…
Latvia's foreign ministry has dismissed Moscow's threat to take the Baltic states to the International…
Paris prosecutors have launched an independent investigation into an alleged foreign influence operation that targeted…