Full Report
The Insider's correspondent in Ukraine examined a mesh modem — one made by China’s Xingkai Tech — that was found in a Russian Gerbera drone. Then, posing as a Russian military supplier, they obtained evidence that the Chinese company is knowingly willing to sell its modems to the Russian drone factory in Alabuga. Several banks, including DBS Bank, China Merchants Bank, and Ping An Bank, are actively facilitating these sales. Mesh networks are the most practical technology for controlling Russia’s long-range drones over Ukraine. They allow operators to control drones manually and send commands in flight, exploiting gaps in Ukrainian air defenses. According to The Insider’s estimates, Xingkai Tech accounts for about half the market for high-power mesh modems used in Gerbera and Geran drones, making its supplies critical to Russian military manufacturers.
Analysis Summary
# Tool/Technique: Xingkai Tech XK F-359 Mesh Modem
## Overview
The XK F-359 is a high-power hardware mesh networking modem manufactured by China’s Shenzhen Xingkai Technology (Xingkai Tech). While commercially available, it is being utilized as a critical communication component in Russian long-range Unmanned Aerial Vehicles (UAVs), specifically the **Gerbera** and **Geran** (Shahed variant) families. Its purpose is to establish resilient, decentralized communication links that allow for manual drone control and real-time command transmission deep within contested airspace, bypassing traditional electronic warfare and air defense measures.
## Technical Details
- **Type:** Hardware Tool / Communication Infrastructure
- **Platform:** Embedded systems within UAVs (Gerbera, Geran-2)
- **Capabilities:** High-power mesh networking, signal relaying, manual flight control over long distances, and data transmission.
- **First Seen:** Reported in active use in Ukraine circa mid-2024; widespread adoption noted in 2026.
## MITRE ATT&CK Mapping
- **[TA0011 - Command and Control]**
- **[T1090 - Proxy]**: Using intermediary drones as relay nodes to mask the point of origin or extend range.
- **[T1105 - Ingress Tool Transfer]**: Facilitating the movement of commands from ground stations to deep-penetration drones via a mesh relay.
- **[TA0009 - Collection]**
- **[T1557 - Adversary-in-the-Middle]**: (Potential) Intercepting or relaying signals between nodes.
- **[Technique - Non-Standard Port/Protocol]**
- Use of specialized mesh protocols to evade standard frequency jamming and detection.
## Functionality
### Core Capabilities
- **Mesh Networking:** Automatically creates a self-healing network where each drone acts as a node, passing data to the next.
- **Signal Relaying:** Allows drones near the border to connect to Russian/Belarusian repeaters, extending the control range hundreds of kilometers into Ukrainian territory.
- **Real-time Control:** Supports manual flight operations and in-flight mission adjustments, moving beyond pre-programmed GPS coordinates.
- **Gap Exploitation:** Enables drones to navigate through "blind spots" in air defense coverage by maintaining connectivity through the mesh.
### Advanced Features
- **High-Power Output:** Designed for long-range transmission capable of overcoming environmental interference.
- **Low Latency:** Optimized for the manual piloting of "FPV-style" long-range drones (Gerbera).
- **Redundancy:** If one node (drone) is destroyed, the mesh reconfigures to maintain the link with remaining assets.
## Indicators of Compromise
- **File Hashes:** N/A (Firmware-based; specific binaries not provided in text).
- **Hardware Identifiers:** Model XK F-359 (often misidentified as XK F-358).
- **Network Indicators:**
- Utilization of specific radio frequency (RF) bands associated with Xingkai Tech mesh protocols (typically non-standard Wi-Fi frequencies).
- C2 Traffic: Encapsulated control data originating from RU/BY border repeaters.
- **Behavioral Indicators:**
- "Swarming" or "Daisy-chain" flight patterns where multiple UAVs maintain consistent spacing to act as relays.
- UAVs maintaining control links even in areas with heavy GPS jamming.
## Associated Threat Actors
- **Russian Federation Military:** Primary end-user.
- **Alabuga Special Economic Zone:** The specific manufacturing facility in Russia integrating these tools.
- **Shenzhen Xingkai Technology (Xingkai Tech):** The primary supplier.
## Detection Methods
- **Signal Intelligence (SIGINT):** Monitoring for the specific RF signature and hopping patterns used by the XK F-359 chipset.
- **Physical Analysis:** Inspection of downed UAVs for the distinctive unbranded silver/metallic casing of the F-359 modem.
- **Spectrum Analysis:** Identifying unexpected mesh network traffic in high-altitude bands not typically used by commercial or civilian devices.
## Mitigation Strategies
- **Electronic Warfare (EW):** Targeted broadband jamming of the specific frequencies used by Xingkai mesh devices.
- **Supply Chain Interdiction:** Sanctioning and monitoring of financial intermediaries (e.g., DBS Bank, China Merchants Bank) facilitating the sale of these modems.
- **Kinetic Interception:** Prioritizing the destruction of "relay" drones (often flying at higher altitudes or near borders) to break the mesh link for drones deeper inland.
## Related Tools/Techniques
- **Starlink:** Previously used by Russian forces for similar C2 purposes before access was restricted.
- **XK F-358:** A predecessor or variant often confused with the F-359.
- **Gerbera Drone:** The specific "decoy/strike" UAV platform designed to carry this mesh technology.