Kyiv endures an hour-long combined strike as Kh-101s and ballistics land within minutes of each other

In the space of roughly ninety minutes on the night of 1–2 July 2026, the Ukrainian capital absorbed a coordinated Russian strike that open-source monitors logged as a succession of at least eight distinct inbound groups, mixing Kh-101 cruise missiles with shorter-range ballistic launches. The cluster of alerts — beginning at 22:53 UTC on 1 July and continuing past 00:29 UTC on 2 July — is the kind of compressed, multi-vector raid that Kyiv's air-defence crews now treat as routine, but the cadence on Tuesday night was unusually heavy for a single hour.

The story matters less for the volume of ordnance than for what the timing reveals about the pattern Russia has settled into: salvo after salvo launched across multiple hours, the same city targeted inside a single air-raid, with cruise and ballistic missiles interleaved rather than fired in clean phases. Open-source mappers, by the time Kyiv was told "all clear" at 23:05 UTC, were already logging the next wave of inbound groups.

The raid, in the order it was logged

The first alert in the sequence came at 22:53 UTC on 1 July, when the war_monitor channel posted "‼️Kyiv - descent of ballistics!" — a warning, in the shorthand of Ukrainian OSINT feeds, that ballistic missiles were entering their terminal phase over the capital. Within a minute, AMK_Mapping reported "Interception attempts over Kyiv"; at 22:54 UTC the same channel logged "2 impacts in Kyiv," without yet specifying the districts.

Forty minutes later, at 23:34 UTC, the vanek_nikolaev channel — one of several Ukrainian volunteer trackers that follow Russian launch aircraft in near real time — wrote that "5 jet mopeds are already flying to Kyiv," using the colloquial term for cruise-missile carrier aircraft, and added that "of the 5 jet mopeds, 2 remain for Kyiv." The distinction is telling: of the cruise-missile carriers then airborne, two were committed to the capital while the rest were vectored elsewhere, an indication that the salvo was a single national wave with multiple terminal targets, not a Kyiv-specific package.

The compressed phase that followed carried the raid. At 23:37 UTC, intelslava reported "New explosions in Kyiv." Between 00:05 and 00:11 UTC on 2 July, AMK_Mapping traced the first Kh-101 cruise missiles approaching the city "from the east," with an interception logged "east of Kyiv" at 00:06 UTC, an impact "in southeastern Kyiv" at 00:11 UTC, and a second interception over the eastern part of the capital at 00:21 UTC. By 00:27 UTC, the same channel reported "Multiple more missiles flying in" and warned that "these missiles are now approaching eastern Kyiv," and at 00:29 UTC it logged an "Interception over Kyiv." Across that ninety-minute window, the channels intersperse "approaching" warnings, "interceptions," and "impacts" in a pattern consistent with cruise missiles being shot down over the eastern districts while ballistic warheads reached their terminal points elsewhere in the city.

What the OSINT layer can — and cannot — tell us

The four channels doing the logging — AMK_Mapping, intelslava, vanek_nikolaev, and war_monitor — are not official sources, and the framing of their posts reflects that. AMK_Mapping is a volunteer mapper; intelslava publishes in a flag-tagged Russia-versus-Ukraine format that signals both sides' claims; vanek_nikolaev tracks launch aircraft and ballistic trajectories using the colloquial "jet moped" and "ballistic" vocabulary common to the Ukrainian air-tracking community; war_monitor distributes terse warnings. None of them is a substitute for a Ukrainian air-force or General Staff briefing, and none claims to be.

What they reliably establish is the shape of the attack: a first wave of ballistics between 22:53 and 23:37 UTC, a short lull while new launch aircraft took position, and a second wave combining Kh-101s and additional ballistics from roughly 00:05 to 00:29 UTC. What they do not establish is the full count of missiles launched, the count that reached the ground, the districts that absorbed impacts, or the casualty and damage figures. The official Ukrainian accounting — from the air force, the Kyiv City Military Administration, or the State Emergency Service — is the source a reader should treat as definitive on outcomes; these channels are the source a reader should treat as definitive on what was visible from the ground and across the tracking community in near real time.

The interleaving of cruise and ballistic missiles inside a single compressed window is the detail that carries analytical weight. Cruise missiles travel low and slow, giving Ukrainian mobile fire groups time to engage; ballistic missiles travel fast and high, compressing the reaction window to seconds. Firing them inside the same window forces defenders to triage — engage the cruise missiles at lower altitude while ballistic warheads arc overhead, or hold ground-based systems for the ballistic threat and accept that cruise missiles will run further into the city. That defenders on the night of 1–2 July were credited by OSINT trackers with at least three interceptions — at 00:06 UTC, 00:21 UTC, and 00:29 UTC, all in the eastern districts — is consistent with the doctrine Kyiv has spent the last three years refining.

The longer arc: a familiar pattern at growing tempo

Combined cruise-and-ballistic strikes on Kyiv have become a recurring feature of the war's fourth year, and the cadence on Tuesday night fits the trend. What stands out is not the existence of the raid but its compactness: eight distinct inbound groups in roughly ninety minutes is a heavier compression than the open-source record typically shows for a single capital, even allowing for the fact that tracker vocabulary ("2 more interceptions," "multiple more missiles flying in") tends to understate rather than overstate the actual count.

The strategic logic behind the pattern is now familiar enough to be worth stating plainly. Russia lacks the cruise-missile production rate to sustain nightly city-by-city strikes, so it concentrates launches into periodic large salvos that mix types and aim to saturate Ukrainian air defence across multiple engagement envelopes. The targets, in Kyiv's case, are dual: infrastructure that directly serves the war effort, and the civilian-adjacent districts from which air-defence crews and decision-makers operate. The Ukrainian counter-doctrine — early-warning networks, mobile fire groups, and the now-substantial Western-supplied surface-to-air inventory — is built to absorb exactly this kind of raid, and the night's interceptions are a data point in its favour.

Stakes and what remains uncertain

If the current tempo holds, the capital faces a recurring question of how to keep mobile fire groups supplied with interceptors at the rate the salvos consume them, and how to harden the parts of the city's electrical and rail grid that are the consistent terminal targets of these raids. The political stakes are simpler: each combined strike tests the air-defence system in the most public possible setting, and each successful defence — partial or otherwise — reinforces the case that the Ukrainian system is absorbable, not fragile.

What the OSINT layer still cannot resolve is the human cost of the night. None of the four channels publishing during the strike reported casualty figures, and none claimed to know the count of cruise missiles intercepted versus the count that struck their targets. The official Kyiv City Military Administration briefing, once it lands, is the figure that will define this raid in the public record; until then, the open-source picture is one of a compressed, mixed-type strike that the capital's defenders partially met, in the dark, over its eastern districts.

Desk note: Monexus treats the four tracking channels — AMK_Mapping, intelslava, vanek_nikolaev, war_monitor — as primary sources for the sequence and shape of the strike, and explicitly flags them as volunteer OSINT feeds rather than official accounts. The Ukrainian side's eventual official briefing, once available, will be the canonical record on damage and casualties; this piece records what the open-source layer captured, in the order it captured it, and is not a substitute for that briefing.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

• https://t.me/AMK_Mapping
• https://t.me/AMK_Mapping
• https://t.me/intelslava
• https://t.me/AMK_Mapping
• https://t.me/AMK_Mapping
• https://t.me/AMK_Mapping
• https://t.me/AMK_Mapping
• https://t.me/intelslava
• https://t.me/vanek_nikolaev
• https://t.me/AMK_Mapping
• https://t.me/war_monitor