Initial Summary

Place of incident: Hafsarja and Sheikh Yusuf villages, and Sahel al-Rouj plain in the western countryside of Idlib
Impact sites: A civilian home and a quarry located on the road between Hafsarja and Sheikh Yusuf villages as well as agricultural land and reportedly a training camp for militants on the outskirts of Sahl al-Rouj
Date: 8 September 2022
Timing: Between 11:01 and 12:32 Damascus time
Victims: Seven people killed, among them two children, and at least 13 injured as a result of the attack
Type of attack: Airstrikes and likely at least one surface-to-surface missile
Munitions likely used: Unconfirmed, although at least one 9M79 Tochka missile – possibly carrying 9N24 submunitions – was likely launched in the attack
Potentially responsible: Attacks were most likely carried out by Russian air forces

Introduction

On Thursday 08 September 2022, between 11:01 and 12:32 Damascus time, local observatories reported 11 airstrikes by three warplanes hitting the outskirts of the Hafsarja, Sheikh Yusuf, and Sahel al-Rouj villages west of Idlib. Later reporting would show at least one surface-to-surface strike on the area near Sahel al-Rouj. According to online open source information, the first three strikes occurred between 11:01 and 11:11 and struck a house and a quarry located on the road between Hafsarja and Sheikh Yusuf villages, killing seven civilians including two children. The strikes that followed hit the outskirts of Sahel al-Rouj, injuring one person, killing about 40 livestock, and damaging crops and solar panels. Available information also indicates this second attack targeted a former leader of the Katibat al Tawhid wal Jihad Brigade.

Methodology

Syrian Archive conducted an investigation into the incident by:

Preserving, analysing, and verifying 64 videos, photos, and reports shared online;
Geolocating the impact sites by matching unique identifiers seen both in visual documentation and in satellite imagery of the reported attack location;
Chronolocating the approximate attack timing by comparing the direction of shadows seen in on-the-ground footage with estimates from the SunCalc tool;
Identifying and preliminarily assessing damage documented at the geolocated impact sites;
Identifying and preliminarily assessing documentation of weapons and munitions reportedly used in the attack; and
Examining reports about and documentation showing casualties resulting from the attack.

In all, this investigation is a summary of multiple stages of analysis of available open source information. These sources provided information on the date, timing, locations, victims, and impacts of the attacks. By examining all available information, the Syrian Archive investigation team developed an understanding of the incident and its likely perpetrator.

For more details about Syrian Archive’s methodology, please visit our site.

About the impacted area

Hafsarja and Sheikh Yusuf villages are located in the Armanaz district in the Harem area in the western countryside of Idlib. Sahel al-Rouj is a nearby plain surrounded by the Harem Mountains. The valley is primarily used for agricultural purposes. Hafsarja, Sheikh Yusuf, and Sahel al-Rouj are also all located within the de-escalation zones established in May 2017 and are protected by a ceasefire established on 06 March 2020 by Russia and Turkey.

The two villages host 11,000 people displaced from the southern countryside of Idlib after military operations in 2020. The Harim and Armanax sub-districts (where the villages of Hafsarja and Sheikh Yusuf are located) and Sahel Al Rouj host a relatively large number of internally displaced peoples (IDPs), according to statistics provided by the Syrian Response Coordination Group from February 2020. According to the Response Coordination Group, these areas host 624 camps, which constitutes the majority of the 1,259 camps in northwestern Syria. Additionally, there are a large number of independent camps throughout the area including the Al Malaab camp in Hafsarja, a camp in the Hafsarja mountain, and the Al Balaa, Kabta, and Sikkat Hila camps in Sahel al-Rouj.

Geolocations

Location 1 near Hafsarja

On 8 September 2022, news network Rudaw posted to Facebook drone footage documenting attack impact sites. Comparing the visuals and available location information to satellite images, one of the documented locations appears to match a house and quarry near Hafsarja, between the villages of Hafsarja and Sheikh Yusuf.

Tents shown in the photos and videos of the impact site as well as reporting from the Syrian Network for Human Rights—show civilians and/or potential IDPs living near the impact site.

A tent shown near the impact site - Source: Syrian Network for Human Rights

Satellite imagery from Google Earth Pro from before the attack on 11 December 2021 and the attack after on 29 October 2022 shows tents near the impact site and tents not longer near the impact site following the attack

Location 2 near Sahel al-Rouj

Additional attack sites reported on 08 September can be geolocated to Sahel al-Rouj farmland by analysis of online reporting including: the same Facebook video by Rudaw, a video shared by Orient News on Twitter, and a video shared by Qalaat Al Mudiq on Twitter reproducing content from the RVvoenkory channel on Telegram.

Geolocation of an attack near Sahel al-Rouj: the first image is from an Orient News video and the second is a satellite image of the same location from Google Earth at coordinates 35.943125, 36.494056

Geolocation of an attack striking a field near Sahel al-Rouj: the first is a satellite image from Google Earth showing coordinates 35.943125, 36.494056 and the second is from a Rudaw video.

Additional documentation from Aleppo Today and Sham Network show munition remnants reportedly used in the attack, discovered approximately 650 metres from the geolocated plumes of smoke.

What happened (and when)?

All available information indicates that between 11:01 and 12:32 Damascus time on 08 September 2022, multiple strikes hit the outskirts of the villages of Hafsarja and Sheikh Yusuf as well as Sahl al-Rouj in the western countryside of Idlib.

The attack near Hafsarja

Established in the above geolocation, one of the attacks under investigation impacted a home and quarry between the villages of Hafsarja and Sheikh Yusuf.

Summary of online reporting

On 08 September 2022, the earliest online reporting related to the attack was tweets by the Syrian Observatory at 11:01 local time, warning of Russian warplanes circling over the village of Hafsarja.

Screenshot from the tweet of the Syrian Observatory on Twitter

At 11:05, Syrian TV posted two photos to Twitter alongside a claim that Russian warplanes had struck the outskirts of Hafsarja, west of Idlib.

One minute later at 11:06, Step News Agency shared a tweet alleging an aerial bombardment with thermobaric missiles by Russian warplanes had hit the outskirts of Hafsarja. At 11:09, Mahmoud Abu Omar tweeted photos showing smoke plumes, claiming that 3 airstrikes attacked the outskirts of Hafsarja.

Pro-Syrian government news sources Al-Watan News and the Now Lebanon shared news of warplanes targeting "terrorist gatherings" on the outskirts of Hafsarja at 11:11.

Online reporting continued from media outlets and activists about the attacks: Radio AlKul, AlTareek Media, Radwan Tohme, and Thiqa News Agency all shared news and pictures of the bombing.

Syria TV shared breaking news of the continued bombing of the Hafsarja area, reportedly by Russian planes. Tareq Al-Ahmad and Ibrahim Radwan shared pictures of the attacks.

A picture from Ibrahim Radwan's tweet showing a plume of smoke rising over Hafsarja

Within hours, Syria Civil Defence shared on its Telegram channel a video showing the moments first responders arrived at the house and quarry impacted by this attack on Hafsarja.The first ten seconds of the video shows a warplane flying in the area and traces of smoke rising nearby. The footage is accompanied by the sound of a wireless radio alert: “the Russian planes launched missiles.”Additional footage shows the arrival of first responders to the impact site and treatment of victims. Syria Civil Defence later published a report on its website about the incident.

Screenshots from the Syria Civil Defence video of the incident posted to its Telegram channel showing a plane in the sky, the moment a strike on the impact site near Hafsarja, and rescue operations there

A picture from the Rouj Media Facebook page of the impact site near Hafsarja

A video posted on twitter shows the moment of an attack on multiple locations. However, between 0:14 - 0:26, the video shows the moment of three strikes on the home and quarry in Hafsarjah. The video, which is aerial footage of the airstrike, includes the date of the attack, 8 September 2022, and a strike occurring at 11:56 and two other strikes occurring at 12:19. The date shown on the video is consistent with Syrian Archive’s findings. The times shown on the video’s timestamp conflicts with other reports of when the attack occurred, including the metadata from photos taken at the attack site.

A geolocation confirming a video shows the moment of the attack in Hafsarja

Stills from a video showing the moment of the attack in Hafsarja with the video’s timestamp boxed in yellow

News media Syria TV, Aleppo Today TV, Al-Jazeera TV, Sham News Agency, Orient News, and the Kabus Jarablus Telegram channel also shared video reports about the incident. This reporting includes footage of the arrival of first responders, what appears to be an exact point of impact for one of the strikes, and people hiding and fleeing the continued bombing.

Eyewitness footage published by Kabus Jarablus to Telegram, documenting multiple explosions near Hafsarja

Ahmed Ibrahim Al-Sheikh, brother of the owner of the quarry who was reportedly killed in the attack, told Sham news reporters, “what happened is unbelievable, all of the people who were killed were civilians, just daily workers at the quarry looking to survive.”

Screenshot from Ahmed Ibrahim Al-Sheikh's interview on Al-Sham news, showing his brother's demolished house

Videos posted online, including a video showing the moment of the attack, do not show a military presence in or around the impact site

Chronolocation

To determine the timing of the strikes impacting the home and quarry near Hafsarja, Syrian Archive examined the earliest upload times for available open source information, identified reports and claims about the attack timing, conducted shadow analysis to estimate filming time for videos showing the moment of or the minutes directly after the strikes, and compared this information against data from local flight observatories.

Detailed above, the Syrian Observatory posted to Twitter the earliest online reporting relevant to the attack at 11:01 local time, signaling the presence of aircraft in the area. Shortly thereafter at 11:05, Syria TV posted the first images of a smoke plume over the Hafsarja area. Reporting continued throughout the day, alleging multiple strikes on the impact site. Al-Jazeera confirmed initial reports that the attack time was 11:00 local time.

Detailed later in this investigation, other local observatories reported a strike on the Hafsarja village at 11:02 and again at 11:14. This is consistent with a statement to Rudaw made by an eyewitness and worker in another, nearby quarry: “I heard the sound of a missile hit near the stone quarry where I work, my brothers and I hid in place. There was a second raid and after it ended we went to the place and found the body of the quarry’s owner and his son. Ten minutes later a third raid targeted the quarry."

A screenshot of the SunCalc tool shows the time and position of the sun at 11:15 local time on 08 September 2022 at the geolocated impact site near Hafsarja. The orange circle is the sun’s position. The red outlined circle is the location of a building that appears in an original video provided to Syrian Archive from a source in Hafsarja documenting the aftermath of the attack. The direction of the building’s shadow pictured in the footage approximately match the direction estimated for shadows at 11:15 local time on 08 September 2022.

Damage

Videos by** Syria Civil Defence, Rudaw, Al Furat, Al Jazeera, Union of Revolution Activists, Orient TV, Syria TV,** and Kabous Jarablus document extensive, structural damage to a home and quarry facilities near Hafsarja, all allegedly linked to the 08 September 2022 strikes.

Screenshots from a Rudaw report documenting extensive destruction of a house

Screenshots from an Al-Sham video show destruction to a home near Hafsarja

Aircraft documented

Syria Civil Defence and Macro Media Center both shared footage reportedly documenting planes flying over Hafsarja around the time of the attack on 08 September 2022.

By preliminary visual comparison, the Syria Civil Defence video and one of the Macro Media Center photos appear to match the Sukhoi Su-24 aircraft. Specifically, the shape of the wings and the nose of the aircraft. Available information indicates that at the attack time Su-24 aircraft were in use by both the Syrian and Russian forces in Syria.

Macro Media Center also shared a photo of a second, distinct aircraft. By preliminary visual comparison – the shape of the wings and tail of the aircraft in addition to the colour of the fuselage and the nose – this second aircraft appears to be a Sukhoi Su-34. Importantly, the Russian Air Force is reported to be the only party to the conflict to fly the Sukhoi Su-34 aircraft in Syria. Available information does not indicate Syrian Air Force use of the Sukhoi Su-34 aircraft.

Detailed later in this investigation, this preliminary visual analysis is consistent with information shared by local flight observatories reporting the presence of three warplanes—two Sukhoi-24 and one Sukhoi 34—over the attacked areas at the time of the raids, in addition to reconnaissance aircraft. According to the local observatories, all aircraft took off from the Russia-operated Hmeimim military base.

The attack near Sahel al-Rouj

Geolocated above, the second attack on 08 September 2022 in the western countryside of Idlib struck farmlands near Sahel al-Rouj.

Summary of online reporting

Reports about an attack striking farmland near Sahel al-Rouj began at 11:12 local time, when the Rouj Media page shared news about two air strikes in the area. The page continued to publish news of successive strikes until 12:35.

Screenshot from a Rouj Media video documenting animals reportedly killed in the attack on Sahel al-Rouj

Screenshots from a Rudaw video showing smoke plumes near Sahel al-Rouj

A report shared by Sham news appears to show the first moments of an attack on the Sahel al-Rouj area: the filmer can be heard saying “launched” – in apparent reference to the launching of a missile – accompanied by clips of smoke rising. The same video includes statements by a responding member of Syria Civil Defence describing the attack and livestock killed as a result. The video also shows an unexploded missile in the Sahel al-Rouj area, general destruction, and traces of blood at the incident site.

Screenshots from a video by Sham news reportedly documenting the attack near Sahel al-Rouj

Importantly, video posted online appears to be reconnaissance footage documenting the impact site and attack near Sahel al-Rouj. This footage captures what appears to be a drone taking off from the targeted location. Russian, Syrian, and pro-government media reported that the attack targeted the commander of Katibat al Tawhid wal Jihad Brigade, Sirajuddin Mukhtarov, Abu Salah Al-Uzbeki, others present at the attack site near Sahel al-Rouj, and a facility for manufacturing drones.

A video broadcast by the Syrian Al-Ekhbariya channel shows reconnaissance footage apparently documenting the entire attack, including: target acquisition, an aircraft launching munitions, and the launch of a surface-to-surface attack, and explosions at the impact sites. However, by preliminary analysis the footage of planes shown in the Al-Ekhbariya video first appeared online in a video of Russian military exercises from 2020.

Screenshots from an Al-Ekhbariya video (right) and on-the-ground footage from Rudaw (left) showing what appear to be matching smoke plumes

Chronolocation

Syrian Archive corroborated reports of the approximate attack time by analysing the direction of the shadows appearing in a video published by Rudaw that captures the moment of strikes near Sahel al-Rouj.

A screenshot of the SunCalc tool shows the time and position of the sun at 12:00 local time on 08 September 2022 at the geolocated impact site near Sahel al-Rouj. The orange circle is the sun’s position. The red outlined circle is the location of the attack site, documented in the Rudaw footage. The direction of the trees’ shadows pictured in the Rudaw footage approximately match the direction estimated for shadows at 12:00 local time on 08 September 2022

This is consistent with local observatories’ reports that the attack near Sahl al-Rouj began at approximately 11:16 local time and continued until 12:32.

Damage

The attack near Sahel al-Rouj appears to have had wide-ranging damage and impacts in the area, including: damage to trees and agricultural lands, the killing of livestock, damage to the tents of residents who farmed the land, and damage to the solar panels relied upon to irrigate crops.

Munitions documented

Videos and photos shared online document the remnants of a munition reportedly launched in the attack.

Screenshots from an Orient News video showing the found munition remnants

Screenshots from a Sham news video showing the found munition remnants

A geolocation where the missiles fell in Sahl al-Rouj - comparing the landmarks between the video published by Al-Ekhbariya and the maps in Google Earth

The munition appears to match a 9M79 Tochka missile. According to the Landmine and Cluster Munition Monitor, the 9M79 Tochka is manufactured in Russia and has been used by both Syrian and Russian forces in Syria. The rocket's distinctive shape, fins, and tail wings match the remains visible in videos and photos posted online. The 9M79 Tochka can carry cluster submunitions.

Syria Civil Defence claimed in a tweet that a 9M79 Tochka used in the attack was loaded with 9N24 cluster submunitions, approximately 40% of which did not explode. Further, Orient News reported discovery of what may be the remains of white ribbon-type stabilisers in an impact crater, possibly indicative of the 9N24 submunition previously seen in Syria. This submunition type has also been recently documented in Ukraine, employed by Russian forces there. However, at the time of the investigation, Syrian Archive could not find other, clear documentation of cluster submunition remnants linked to the attack.

Footage from Orient News appears to show white, ribbon-type cloth – possibly stabilisers for the 9N24 submunition

Possible military objective

Mentioned above, a video documenting the moment of the attack claims it was a part of Turkish-Russian cooperation in which the Turkish Ministry of Defence shared with Russian forces “the coordinates of the training camp of HTS militants near Ash-Sheikh-Yusef, which also housed a workshop for the production of UAV and IED.” This footage also captures what appears to be a drone taking off from the targeted location.

A Twitter user who identifies as an observer of the Syrian Arab Army tweeted about Russian warplanes flying over Idlib airspace at 11:15 local time on 8 September 2022. Shortly after at 11:27, the user tweeted about continuing air raids on “terrorist sites” west of Idlib, mentioning 8 strikes by that time. This same account also shared a video from SANA news reporting about Russian operations in Idlib to attack terrorist headquarters.

SANA news agency reported that the Syrian missile forces and the Russian air force carried out an operation in Idlib to target training headquarters for "terrorists" to launch and direct drones.

Russian, Syrian, and pro-government media reported that the bombing targeted the commander of Katibat al Tawhid wal Jihad Brigade Sirajuddin Mukhtarov, Abu Salah al-Uzbeki, other individuals at the location, and a factory for manufacturing drones.

A map of showing the location of Tawhid wal Jihad Brigade fights - Source: Syrians for Truth and Justice

The Tawhid wal Jihad Brigade is a small jihadist organization, composed of majority Uzbek members. It was founded between 2013-2014 and pledged allegiance to al-Qaeda in 2015. The number of its fighters is estimated at about 500 fighters distributed in Jabal al-Summaq and the Jisr al-Shughur countryside. On 7 March 2022, the United States State Department designated Tawhid wal Jihad Brigade as a Global Terrorist Organisation, adding the group to the UN Security Council Sanctions List for ISIS and Al Qaeda.

Mukhtarov—also known as Abu Salah Al Uzbkei—is of Kyrgyz origin and former leader of the Tawhid wal Jihad Brigade, which was formerly in Jabhat Al Nusra, but later broke away as an indpedent military entity in Idlib. He is also the founder and leader of the Uzbek battalion within Hayat Tahrir al Sham since he arrived in northern Syria in 2015.

Mukhtarov was demoted from his leadership role in Tawhid wal Jihad Brigade in April 2019. His position was assumed by Abdul Aziz Al Uzbek who later defected in May 2020 and joined Ansar Al Din. In June 2020, Hayat Tahrir Al Sham arrested Mukhtarov for about nine months, and after his release he reportedly joined Ansar Al Din.

Areas with Tawhid wal Jihad Battalion fighters are between 10 to 27 kilometers from the impact sites in Hafsarja.

However, local activists and journalists disagree that Mukhtarov was killed in the attack. Relying on open source information, Syrian Archive was unable to independently verify claims that Sirajuddin Mukhtarov was killed in the attack.

Videos online reportedly document a response from military factions in Idlib to the attack, including by Hayat Tahrir Al Sham as well as The National Front for Liberation and Jaish Al Izza, both of which are affiliated with the Syrian National Army.

Victims of the attack

In the hours following the attack, social media activists shared pictures and names of the casualties from the attack. Pictures of bodies being removed from rubble were shared online. Through close analysis of this documentation, Syrian Archive confirms that seven people, including two children, appear to have been killed and more than 13 people were reportedly wounded in these attacks on Hafsarja and Sahel al-Rouj.

More specifically, four of the attack’s reported fatalities were a father and two sons from the Tayfur family and a man from the Al Daher family who were displaced from the village of Al Dana. Additionally, the attacks killed three people including two children from the Eid and Awaida families and a young man from the Setifi family.

Potentially responsible

Syrian news outlets and activists blamed Russian forces for the attacks impacting both Hafsarja and Sahel al-Rouj. These allegations appear to be consistent with available aircraft and munition documentation, detailed above.

To further assess these claims, Syrian Archive searched open source sites affiliated with or loyal to Russia and the Syrian government to potentially confirm that these areas were targeted by the Russian Air Force. Specifically, Syrian Archive looked for news about targeting with reference to "terrorist or terrorist gatherings."

Russia Today, Russia in Arabic, Al-Manar TV, Al-Alam TV, Nour Al-Huda Press, the Syrian Army Operations Channel, Al-Nimr Channel, the Information Branch, the Tiger Forces Channel for the Liberation of Idlib in Telegram, and Fawj Al-Hawashem, shared news and pictures of Russian aircraft attacking these areas in the western Idlib countryside.

Syrian government channels and their followers shared news about the two incidents including pictures of aircraft and ammunition used in the attack, flight data, and video depicting the Sahel al-Rouj attacks via a reconnaissance plane.

Flight observation data

All available flight observation data is consistent with key findings: the reported presence and identification of Russian aircraft over Hafsarja and the neighbouring towns during the approximate attack time appears corroborative of the alleged perpetrator, chronolocated timing, and geolocated impact sites.

To reach this conclusion, Syrian Archive first cross-referenced open source documentation of the attacks and their aftermath with flight observation data from an established spotter organisation that documents sightings of warplanes by people (called “observers” and “spotters”) situated throughout Syria. These observers collect data on the aircrafts they see such as the type of plane and the direction the plane is flying. Syrian Archive analysed this organisation’s data for potentially relevant flights sighted briefly before, during, and after the chronolocated time of the attacks.

According to the data, at 10:20, 10:33 and 11:11 local time, spotters situated near Russian-operated Hmeimim Air Base – located about 91 kilometres southwest of Hafsarja – identified Russian fixed-wing aircraft leaving the base, heading southeast.At 10:59, spotters identified Russian fixed-wing aircraft flying northwest over Ariha, an area about 23 kilometres southeast of Hafsarja. Between 10:59 and 12:31, several fixed-wing Russian planes were seen flying north over Jabal al-Zawiya, an area about 37 kilometres southeast of Hafsarja. Then, at 11:01, 11:03, 11:04, 11:09, 11:12, 11:17, 11:19, 11:23 and 11:31 Russian fixed-wing aircraft were spotted circling over Hafsarja. Russian fixed-wing aircraft were again seen over the area approximately 50 minutes later, at 12:19, 12:30 and 12:33. Reconnaissance planes were also identified flying over the area from 11:07 until 11:54.

Syrian Archive then compared the above data to publicly available flight observation reports shared by four local, Syrian observatories: Jisr Al-Shughur Observatory, Al-Ahrar Observatory, Idlib Observatory, and Syria Observatory. These sources reported the following potentially relevant sightings:

Warplane circling over Hafsarja at 11:00
Multiple strikes on Hafsarja at 11:02
Launched on Hafsarja at 11:05
Launched on Hafsarja at 11:09
Launched near tHafsarja at 11:12
Launched near Hafsarja at 11:14
Launched on Sahel al-Rouj at 11:16
Launched on Sahel al-Rouj at 11:24
Launched on Sahel al-Rouj at 11:25
Launched on Sahel al-Rouj at 11:48
Launched on Sahel al-Rouj at 12:18

Consistent presence in an area and circling behaviours by warzone aircrafts generally indicates target acquisition and/or preparation for an imminent strike. However, the observatory reports do not alone establish that any of the observed aircraft were directly involved in the strikes documented near Hafsarja or Sahel al-Rouj. And, flight data should be treated with caution: misidentifications of aircraft and other spotter errors can happen.

Conclusion

Through information detailed above, Syrian Archive assessed claims and documentation of at least 11 airstrikes and one surface-to-surface missile hitting the outskirts of the Hafsarja, Sheikh Yusuf, and Sahel al-Rouj villages west of Idlib on 08 September 2022.

All available reporting indicates these attacks resulted in the deaths of at least seven civilians, including two children, in addition to destroying a house and quarry in Hafsarja as well as impacting civilian tents and solar panels near Sahel al-Rouj. About 40 heads of livestock were also killed.

Also documented in online open source information is the reported presence and targeting of a training camp for militants and former Katibat al Tawhid wal Jihad Brigade commander, Sirajuddin Mukhtarov, in the area near Sahel al-Rouj.

By our analysis of available news reports, photos, and videos documenting the incident, flight observations, munitions found, statements by parties to the Syrian conflict – including the Syrian government’s confirmation via the Syrian Al-Ekhbariya channel and video Russia shared from a reconnaissance plane near the location –Syrian Archive concludes that Russian and Syrian forces are most likely responsible for the attack.

.css-68jq5d{padding-bottom:1.45rem;color:#ffffff;-webkit-transition:0.25s;transition:0.25s;}.css-68jq5d:hover{-webkit-text-decoration:underline;text-decoration:underline;}INVESTIGATIONS

Alleged Russian attacks on Hafsarja and Sahl al-Rouj in Idlib

Table Of Contents

INVESTIGATIONS