The Shadow of Ruptly: Investigating the Digital Footprints of Viory

"In the age of misinformation, the line between fact and fiction is blurrier than ever."

This sentiment, shared by the Abu Dhabi-registered video news agency Viory on LinkedIn in April 2026, serves as a mission statement for the organization. Presenting itself as the "video news agency of the Global South," Viory has positioned itself as an essential partner for media houses, offering training to help journalists navigate the complexities of verification. However, an extensive investigation by Bellingcat into the digital infrastructure of Viory suggests that when it comes to the agency’s own origins and operational ties, the line between fact and fiction is significantly more obscured than its marketing materials suggest.

Evidence uncovered through technical analysis points to deep-seated links between Viory and Ruptly, the Berlin-born news agency controlled by the sanctioned Russian state media outlet Russia Today (RT). Despite both organizations vehemently denying any association, a trail of shared IP addresses, digital security certificates, and internal data telemetry suggests a relationship far more intimate than a mere coincidence of shared software providers.

The Genesis of a "Global South" Agency

Viory’s rise has been meteoric. Launching in November 2023, the agency claimed to hit the ground running with a pre-assembled team of over 150 full-time staff and a network of 3,000 video journalists spanning 170 countries. Under its legal entity, Darpo Vision FZ LLC, the agency established itself in an Abu Dhabi free zone—a jurisdiction known for its favorable business incentives and high levels of corporate privacy.

By mid-2026, the scale of Viory’s integration into the media ecosystem had become significant. Press releases indicate at least 30 cooperation agreements with national press agencies across Africa, Asia, and the Middle East, along with training partnerships with academic institutions. The agency’s influence was further cemented by the inaugural "Global South Video News Awards," a high-profile event held at the Abu Dhabi BRIDGE Summit in December 2025.

However, the rapid establishment of such a vast infrastructure raised questions among open-source investigators. Was this truly a new, independent player, or was it an effort to bypass the reputational and financial barriers imposed on Russian state-backed media?

Ruptly: The Sanctioned Predecessor

To understand the suspicion surrounding Viory, one must look at its alleged predecessor, Ruptly. Founded in 2013, Ruptly was RT’s attempt to challenge Western news agencies like Reuters and AFP by providing an "alternative" supply of raw video footage.

Following the 2022 Russian invasion of Ukraine, the European Union sanctioned RT and its parent company, ANO TV-Novosti, citing their role in spreading disinformation. The sanctions effectively crippled Ruptly’s financial operations in Germany, forcing the company into insolvency by October 2024. Yet, Ruptly continued to broadcast from Moscow. The striking similarity in business models—providing raw video feeds to global subscribers—between the dying Ruptly and the newly minted Viory has led many observers to suspect that the latter is a reincarnation of the former, designed to evade the reach of Western sanctions.

A Chronology of Converging Digital Paths

The investigation into the ties between these two entities relies on a breadcrumb trail of technical markers that began emerging shortly after Viory’s inception.

• December 2022: Darpo Vision registers the domain darpo.vision via a Russian registrar with a Moscow-based phone number.
• 2024: Felix Huesmann of RedaktionsNetzwerk Deutschland identifies an email address associated with Darpo Vision that matches the initials and surname of Dinara Toktosunova, the managing director of Ruptly.
• June 2024: VirusTotal records reveal that darpo.vision began utilizing a wildcard SSL certificate issued to ruptly.video.
• May 2025 – May 2026: Technical monitoring identifies that Viory and Ruptly domains were consistently resolving to the same Russian IP addresses.
• March 2026: An API scan confirms that Ruptly’s client login pages were actively transmitting site performance and error data to Viory’s internal tracking systems.
• May 2026: A developer test page for Viory is found to contain metadata and page titles identifying the site as "Ruptly."

The Technical Evidence: More Than Coincidence

The most damning evidence lies in the architecture of their respective websites. According to James Wilson, a veteran software and networking engineer, the use of a wildcard SSL certificate is a "smoking gun" for deep-level coordination.

"The fact that darpo.vision was using a wildcard SSL certificate for ruptly.video indicates that whoever was running the Viory site had access to the private key for Ruptly’s security certificate," Wilson explained. "Normally, only the people operating the host’s web infrastructure have access to that. While a hack is theoretically possible, it is implausible that a third party would use a stolen key on a domain that triggers browser-level security warnings."

Furthermore, the integration of Sentry—a tool for monitoring application errors—revealed that Ruptly’s domains were sending telemetry data directly to Viory’s backend. In several instances, Ruptly login pages were found to be using favicons hosted on Viory servers, and in one notable case, a Ruptly login page automatically redirected users to a Viory-titled authentication portal.

Wilson notes that these are not the results of "lazy copy-pasting." The implementation of unique API keys for each Ruptly domain, all feeding into a centralized Viory Sentry project, suggests a deliberate, engineered effort to consolidate technical oversight of both platforms under a single administrative umbrella.

Official Responses and Denials

When confronted with these findings, both organizations maintained a strict narrative of independence.

In an email response, Viory stated: "Viory has no connection with Ruptly; any suggestion otherwise based on ordinary use of similar digital platforms, tools or cloud providers is poorly founded and inaccurate. Viory is a UAE-based, privately held, self-funded and 100% privately owned organization, and receives no funding, direction or instructions from any state media."

Ruptly, when approached for comment on the specific technical findings—including the transfer of error data to Viory—declined to answer, dismissing the inquiries as "irrelevant."

Implications: The "Global South" as a Strategic Shield

The implications of these findings extend far beyond the technical. If Viory is indeed a continuation of Ruptly, it suggests a sophisticated strategy by state-backed actors to maintain global media influence despite Western sanctions. By rebranding as a "Global South" agency, Viory successfully positions itself as a neutral, independent source of news, potentially bypassing the scrutiny that typically follows Russian state-affiliated content.

Anna Hiller, an analyst at the Institute for Strategic Dialogue, points out the editorial consistency between the two. "When accessing Viory, the prominence of pro-Russian and pro-China content is immediately noticeable," she noted. "This is not just about the technical infrastructure; it is about the ideological output that fills the void left by sanctioned entities."

For smaller media outlets in developing nations, who may lack the resources to verify the provenance of every video clip they purchase, the existence of such an agency poses a significant challenge. By operating under the guise of an independent regional actor, Viory may be successfully injecting Kremlin-aligned narratives into global media supply chains, effectively laundering propaganda through the veneer of a legitimate news agency.

As the digital ecosystem becomes increasingly complex, the case of Viory serves as a reminder that transparency in ownership and infrastructure is not merely a technical detail—it is the foundation of journalistic trust. In an era where the line between fact and fiction is constantly under siege, the ability to trace the origin of the stories we consume has never been more vital. The technical evidence surrounding Viory suggests that, in the shadows of the digital world, the old state-media machines are not disappearing; they are merely finding new domains.