Eg, NATO observation craft or satellites.
Per Wiki, we have a satellite image from shortly after it was struck:
> An image from a satellite with cloud-penetrating synthetic aperture radar (SAR) revealed that at 18:52 local time (UTC+03:00) on 13 April 2022, Moskva was located at 45°10′43.39″N 30°55′30.54″E, about 80 nautical miles (150 km) south of Odesa, east of Snake Island and around 50 nmi (90 km) from the Ukrainian coast. An analysis suggested this was not long after the damage occurred which caused the ship to eventually sink. In the image, the cruiser is accompanied by other vessels.
And a US airplane in radar range when the attack happened:
> There was a US Navy P-8A Poseidon maritime surveillance aircraft in the area before the sinking. The P-8A from Italy was patrolling within its radar range over the Black Sea and the US, when asked, did identify the ship as the Moskva as part of intelligence sharing to help Ukraine defend against attack from Russian ships.
And a drone, likely operated by Ukraine:
> The operation to sink Moskva may have been assisted by the use of at least one Bayraktar TB2 drone (UCAV), which seems to have observed the event and may have played other roles in the ship's sinking. […]
> Mevlutoglu mentioned that Rear Admiral Oleksiy Neizhpapa, commander of the Ukrainian naval forces, had in the past suggested that TB2 drones would be used with Neptune launchers for target reconnaissance.
https://en.wikipedia.org/wiki/Sinking_of_the_Moskva
A boring but likely kill-chain:
1. SAR satellites spot the Moskva fleet.
2. US P-8 begins a track and feeds that data into shared intelligence.
3. US advisors alert Ukraine that Moskva is spotted and within engagement range.
4. Ukraine TB2 is flown on site, using that data.
5. Neptune launchers and missiles in flight are fed data from TB2.