Representatives of Russian paramilitary formations are reportedly present aboard tankers belonging to Russia’s so-called “shadow fleet.” Specifically, individuals wearing uniforms are stationed on these vessels despite not being members of the crew. While they do not perform standard maritime duties, they appear to exercise a degree of authority on board, raising suspicions about their ties to Russian paramilitary organizations or intelligence services.
Many of these individuals are former military personnel, including veterans of the wars in Chechnya and Syria. Their reported responsibilities include ensuring that vessels do not deviate from assigned routes, even in contradiction to the captain’s orders or demands from NATO authorities, submitting daily reports on the condition of the vessel and crew behavior, and monitoring sailors’ conversations and contacts. This system allows Russia to employ foreign crews aboard shadow fleet vessels while maintaining effective control through a small number of Russian nationals.
Russia’s shadow fleet consists of approximately 1,500 aging oil tankers with opaque ownership structures that the Kremlin uses to export Russian oil in circumvention of European Union and U.S. sanctions. In an effort to cut off this source of war financing, the EU has continuously expanded its sanctions packages, placing dozens of such vessels on blacklists. Sanctions have targeted not only the tankers themselves but also foreign companies operating them. European countries have increasingly deployed naval forces to inspect and detain shadow fleet vessels at sea.
One notable case occurred in September 2025, when France seized the tanker Boracay. It later emerged that two Russian intelligence operatives were aboard the vessel. Both were employed by the private Russian company Moran Security Group. Their reported tasks included providing security for the vessel, monitoring the crew, and collecting intelligence. The Boracay has also been linked to drone activity over Denmark in 2025, including flights near major airports and military installations, as well as a series of airspace violations involving European countries.
The presence of uniformed individuals aboard tankers who are not members of the crew but nonetheless wield authority underscores the strategic importance of the shadow fleet to the Kremlin. Russia employs these vessels not only to sustain oil exports but also to weaken the effectiveness of EU and U.S. sanctions. According to expert estimates, such schemes have generated approximately $25 billion in additional revenue for the Kremlin over the past two years. Preserving energy export revenues enables Moscow to continue financing its war against Ukraine.
Russia’s shadow fleet has evolved from an economic sanctions-evasion mechanism into an element of a broader Kremlin hybrid strategy that combines commercial shipping with intelligence-gathering and sabotage activities. Its operation allows Russia simultaneously to finance the war effort, circumvent international restrictions, and create new instruments of pressure against Europe.
The reported control exercised over crews and navigation by individuals who effectively outrank the vessel’s captain reflects the subordination of commercial shipping to the Kremlin’s political and military objectives. Under such conditions, civilian tankers cease to be purely commercial assets and instead become instruments of Russian state policy, including within the framework of hybrid operations against Europe.
Granting authority to non-crew personnel that supersedes the decisions of a ship’s captain runs contrary to established principles of international maritime practice and maritime safety. Such arrangements undermine the chain of command aboard vessels and create additional risks for international maritime commerce.
For Europe, the activities of Russia’s shadow fleet represent a dual challenge. They not only erode the effectiveness of the sanctions regime but also provide a new mechanism of hybrid pressure, in which commercial operations serve as cover for intelligence and sabotage activities. Consequently, efforts to counter Russia’s shadow fleet should be viewed not merely as an instrument of economic pressure but as a matter of collective security for both the European Union and NATO.
The discovery of Russian security personnel and former military servicemen aboard shadow fleet tankers suggests that these vessels are no longer merely tools for circumventing sanctions. Increasingly, they appear to serve as platforms supporting Russia’s broader hybrid warfare strategy against Europe.
The presence of individuals with military or intelligence backgrounds who exercise authority independent of a vessel’s captain reflects a command structure that prioritizes state objectives over commercial considerations. Such personnel reportedly monitor crews, collect information, maintain operational secrecy, and ensure compliance with instructions originating outside the normal maritime chain of command. This arrangement effectively transforms civilian shipping assets into instruments of Russian state policy.
Several recent incidents reinforce concerns that the shadow fleet performs functions extending beyond oil transportation.
In September 2025, French authorities seized the tanker Boracay, which was suspected of involvement in drone activity over Denmark, including flights near major airports and military facilities. French investigators later confirmed that two Russian security operatives employed by Moran Security Group were aboard the vessel. One reportedly had a background linked to Wagner-affiliated structures. Their duties included crew surveillance, vessel security, and intelligence collection. French and international investigators viewed their presence as evidence that some shadow fleet vessels may support broader intelligence operations.
The Boracay case is not isolated. Investigations conducted in 2025–2026 identified dozens of former Russian military personnel, intelligence veterans, and former Wagner contractors serving as “security guards” aboard shadow fleet tankers transiting European waters. Their primary mission reportedly included monitoring foreign crews, preventing cooperation with European authorities, and maintaining operational secrecy. The quasi-military appearance of these personnel also appears intended to deter boarding operations and signal unofficial Russian state protection.
European security agencies have become increasingly concerned about the connection between shadow fleet vessels and incidents involving critical infrastructure. NATO’s launch of Operation Baltic Sentry followed a series of undersea cable disruptions in the Baltic Sea. Several investigations have linked vessels associated with Russia’s shadow fleet to suspicious movements near telecommunications cables, energy interconnectors, and other strategic infrastructure. Finnish authorities charged officers of the tanker Eagle S with aggravated sabotage after investigators concluded that the vessel intentionally dragged its anchor across the seabed for dozens of miles, damaging power and telecommunications cables connecting Finland and Estonia.
Additional investigations in Finland and Estonia have examined other vessels suspected of conducting similar operations against undersea infrastructure. While attribution remains legally challenging, the pattern of repeated incidents near critical maritime assets has significantly increased concerns that commercial vessels are being used as deniable tools for hybrid operations.
Another troubling development is the growing interaction between the shadow fleet and Russian military assets. European intelligence services have reported increased Russian naval activity along shadow fleet routes, while several incidents in 2026 involved Russian warships escorting sanctioned tankers through strategically important waterways. Such actions indicate that Moscow increasingly views these vessels as assets deserving state protection rather than merely commercial enterprises.
The economic importance of the shadow fleet explains this evolution. Estimates suggest that the network of approximately 1,500 aging tankers has generated tens of billions of dollars in additional oil revenue for Russia since the introduction of Western sanctions. These revenues remain a critical source of financing for Russia’s war against Ukraine. Consequently, the Kremlin has strong incentives to protect the fleet through intelligence, security, and military means.
From a strategic perspective, the shadow fleet increasingly resembles a maritime counterpart to Russia’s broader hybrid warfare model. Much as private military companies, cyber actors, and proxy organizations provide Moscow with plausible deniability on land, shadow fleet vessels offer a deniable maritime platform for intelligence gathering, infrastructure reconnaissance, influence operations, and potentially sabotage activities.
For Europe, this creates a challenge extending far beyond sanctions enforcement. The issue is no longer solely the illicit export of Russian oil. It concerns the emergence of a maritime network capable of generating revenue for the Kremlin, supporting intelligence collection, facilitating hybrid operations, and exploiting the legal ambiguities of international shipping. As a result, countering the shadow fleet should be treated not merely as an economic policy objective but as a core element of EU and NATO collective security.
There is high confidence that Russian intelligence services are involved in selected shadow fleet operations, but moderate confidence that they exercise direct operational control over the entire fleet. The most likely assessment is that the Kremlin employs a layered system in which commercial operators manage day-to-day shipping activities, while Russian intelligence and security structures oversee strategically important vessels, routes, and missions.
Rather than controlling all 1,500+ vessels individually, Russian intelligence services appear to focus on those ships that serve broader state objectives beyond sanctions evasion, including intelligence collection, influence operations, logistics support, and potentially sabotage activities.
The shadow fleet has become one of the most important mechanisms for sustaining Russian oil exports despite Western sanctions. Estimates suggest that it has helped preserve tens of billions of dollars in annual energy revenues that directly support Russia’s state budget and military expenditures.
Given the fleet’s importance to Russia’s wartime economy, it would be highly unusual for the Kremlin to leave its management entirely to private operators without oversight from security services.
Historically, Russia has relied on intelligence structures to supervise strategically important sectors, including: Energy exports, Arms sales, Critical infrastructure, State-owned enterprises abroad, Maritime logistics.
Multiple investigations have identified: Former Russian military officers, Veterans of Chechnya and Syria, Former Wagner personnel, Employees of Russian private security companies aboard shadow fleet vessels.
Their functions reportedly include: Monitoring foreign crews, Ensuring compliance with instructions, Reporting on vessel activities, Maintaining operational security, Preventing defections or cooperation with Western authorities.
Such tasks resemble counterintelligence functions more than traditional maritime security duties.
Russian intelligence services have long used commercial entities as cover for overseas operations.
Examples include: Soviet-era merchant shipping used by the KGB and GRU officers. Russian shipping companies used for intelligence collection during the Cold War. Russian energy companies serving as platforms for influence operations abroad. The integration of intelligence officers into private military companies such as Wagner Group. The shadow fleet fits well within this historical pattern.
GRU (Military Intelligence)
The most likely candidate for operational involvement.
Possible missions: Monitoring NATO naval activity, Mapping critical infrastructure, Collecting maritime intelligence, Supporting sabotage operations, Coordinating with Russian naval forces.
Indicators include: Former military personnel aboard vessels, Operations near military installations, Activities around Baltic Sea infrastructure.
Assessment: High probability of GRU involvement.
The Federal Security Service likely plays a counterintelligence role.
Possible functions: Vetting crews, Monitoring personnel loyalty, Preventing information leaks, Screening foreign sailors, Investigating incidents involving detained vessels.
Assessment: High probability of indirect involvement.
The Foreign Intelligence Service is less likely to manage vessels directly but may exploit shadow fleet networks for: Human intelligence collection, Contacts in foreign ports, Access to logistics networks.
Assessment: Moderate probability.
Intelligence Collection
Shadow fleet vessels routinely transit: Baltic Sea, North Sea, Mediterranean, Black Sea, Arctic routes.
These routes provide opportunities to observe: NATO naval movements, Port security procedures, Energy infrastructure, Military exercises.
Commercial vessels can collect valuable intelligence without attracting the same scrutiny as military platforms.
Infrastructure Reconnaissance
Several shadow fleet vessels have appeared near: Undersea communication cables, Electricity interconnectors, Offshore energy infrastructure, LNG terminals.
While proximity alone does not prove intent, repeated patterns have increased concern among European intelligence agencies.
Support for Sabotage Operations
One of the most important intelligence questions is whether some shadow fleet vessels serve as: Platforms for deploying divers, Launch points for drones, Sensor deployment vessels, Logistics hubs for covert operations.
There is currently insufficient public evidence to confirm systematic use for sabotage, but the possibility is actively investigated by several European security services.
Reports that onboard security personnel can override captains’ decisions indicate a command structure that prioritizes mission objectives over commercial considerations.
Russia has increasingly demonstrated willingness to protect sanctioned vessels through diplomatic pressure and occasional naval presence.
This suggests that some shadow fleet assets are regarded as strategically important national assets.
Intelligence Estimate
| Question | Assessment |
| Are Russian intelligence services involved? | Very likely |
| Do they direct every vessel? | Unlikely |
| Do they oversee strategically important operations? | Highly likely |
| Is GRU involved? | High confidence |
| Is FSB involved? | High confidence |
| Is SVR involved? | Moderate confidence |
| Are some vessels used for intelligence collection? | Highly likely |
| Are some vessels used for hybrid operations? | Likely |
| Are some vessels involved in sabotage support? | Possible but unproven |
The most plausible assessment is that Russia’s shadow fleet should no longer be viewed solely as an illicit commercial network. Instead, it increasingly resembles a state-protected maritime ecosystem in which commercial shipping, intelligence collection, sanctions evasion, and hybrid operations intersect.
Shadow fleet ships operated near European critical infrastructure before sabotage incidents
Publicly named cases are limited. The strongest are:
| Vessel | Infrastructure / incident | Assessment |
| Eagle S | Estlink 2 power cable and telecom cables between Finland and Estonia, damaged on 25 Dec. 2024 | Strongest shadow-fleet case. Finland detained the tanker; later charges alleged anchor-dragging over a long distance. |
| Boracay / Pushpa / Kiwala | Suspected link to drone activity near Danish airports and military sites in Sept. 2025; previously stopped near Muuga Bay, Estonia | Suspicious, but not proven sabotage. French authorities boarded it; reports say two Moran Security Group personnel were aboard. |
| Astrol-1 | Scrutinized in relation to the Danish drone incidents | Mentioned as a vessel under scrutiny, but public evidence is weaker than for Boracay. |
| Oslo Carrier-3 | Also scrutinized around the Danish drone incidents | Suspicious proximity case; no public proof of direct role. |
| Fitburg | Telecom cables between Finland and Estonia, 31 Dec. 2025 | Russian-linked cargo vessel, not clearly an oil “shadow fleet” tanker. Finland referred four suspects to prosecutors. |
Two important related cases are not classic Russian oil shadow-fleet tankers, but matter analytically:
| Vessel | Why it matters |
| NewNew Polar Bear | Suspected in the 2023 Balticconnector pipeline / cable damage; Chinese vessel with reported route relevance to Russian ports. |
| Yi Peng 3 | Chinese-flagged vessel implicated in 2024 Baltic telecom cable damage; reportedly captained by a Russian national. |
Bottom line: the clearest shadow-fleet infrastructure case is Eagle S. Boracay/Pushpa/Kiwala is the clearest case linking a suspected shadow-fleet tanker to a broader hybrid-operation environment, especially drone activity and Russian security personnel onboard. The wider pattern includes Chinese-linked merchant vessels, suggesting Moscow may use not only Russian oil tankers but also friendly or deniable commercial shipping networks near European critical infrastructure.
The Soviet Union did not operate a “shadow fleet” comparable to today’s Russian fleet of aging tankers with opaque ownership structures. However, Moscow employed several maritime mechanisms during the Cold War that served similar strategic purposes: sanctions circumvention, covert logistics, intelligence collection, and plausible deniability.
From an intelligence perspective, today’s Russian shadow fleet can be viewed as a hybrid descendant of several Soviet-era practices.
The USSR did not possess a dedicated shadow fleet of oil tankers, but Soviet merchant shipping, fishing fleets, front companies, and maritime intelligence networks frequently performed functions that closely resemble some of the activities attributed to Russia’s shadow fleet today.
Soviet Merchant Fleet as an Intelligence Platform
The Soviet merchant fleet was one of the largest in the world.
Companies such as:
- Sovcomflot (later Russian)
- Black Sea Shipping Company
- Baltic Shipping Company
- Far Eastern Shipping Company
maintained global operations.
Western intelligence services long assessed that some Soviet merchant vessels carried:
- KGB officers,
- GRU personnel,
- SIGINT equipment,
- reconnaissance teams.
Many Soviet merchant captains maintained direct reporting relationships with security services.
Ports visited by Soviet vessels were routinely exploited for intelligence collection.
Fishing Fleets as Intelligence Assets
One of the closest historical analogues to modern hybrid maritime operations was the Soviet distant-water fishing fleet.
Throughout the Cold War, Soviet trawlers operated near:
- NATO naval bases,
- submarine routes,
- missile test ranges,
- communications infrastructure.
Western navies frequently accused Soviet fishing vessels of:
- electronic intelligence collection,
- naval surveillance,
- monitoring submarine movements.
Many fishing vessels reportedly hosted intelligence officers disguised as civilian personnel.
This model resembles modern concerns about shadow fleet vessels operating near critical infrastructure.
The USSR established extensive networks of: trading companies, shipping intermediaries, offshore commercial entities,
particularly in: Cyprus, Malta, Austria, Finland, Switzerland.
These structures were often used to: acquire restricted technologies, conceal ownership bypass export controls, facilitate covert financial operations.
While not identical to modern tanker ownership chains, they served a comparable concealment function.
During Cold War conflicts, Soviet shipping companies transported military cargo under civilian cover.
Examples include:
Cuba
During the Cuban Missile Crisis Soviet merchant vessels transported: missiles, military personnel, support equipment.
Civilian vessels were deliberately used to disguise military deployments.
Middle East
Soviet cargo vessels supplied: Egypt, Syria, Iraq, often carrying military equipment while officially operating as commercial ships.
Africa
Merchant shipping networks supported Soviet activities in: Angola, Mozambique, Ethiopia, Libya.
Commercial shipping and state security objectives were frequently intertwined.
KGB and GRU Maritime Operations
The KGB maintained a dedicated maritime intelligence capability.
Functions included: Collection of information on: NATO ports, logistics systems, ship movements, infrastructure vulnerabilities. Recruitment of: sailors, dock workers, shipping executives.Monitoring: naval deployments, military exercises, submarine operations.
The GRU similarly used maritime channels to support military intelligence collection.
Similarities With Today’s Shadow Fleet
| Soviet Practice | Modern Shadow Fleet Equivalent |
| Merchant vessels carrying intelligence officers | Security personnel and suspected intelligence-linked operatives aboard tankers |
| Fishing fleets conducting surveillance | Tankers operating near critical infrastructure |
| Front companies concealing state activity | Offshore ownership structures |
| Civilian vessels supporting military goals | Commercial tankers supporting hybrid operations |
| Maritime intelligence collection | Monitoring of European maritime activity |
| Covert logistics support | Sanctions-evasion oil exports |
The current Russian shadow fleet differs from Soviet practices in several important ways.
The USSR was largely integrated into its own bloc and did not face a global sanctions regime comparable to today’s restrictions on Russia.
Today’s shadow fleet exists primarily to preserve oil export revenues despite sanctions.
Use of Flags of Convenience
Modern shadow fleet vessels frequently operate under: Panama, Liberia, Gabon, Cameroon, Comoros, and other flags.
This practice was far less developed during the Cold War.
The Soviet fleet was state-owned.
Today’s shadow fleet relies on: shell companies, offshore ownership, complex insurance arrangements, rapidly changing registries.
This provides far greater deniability.
Historical Precedent Most Relevant Today
The strongest Soviet precedent is probably not merchant shipping but Soviet fishing fleets.
During the 1970s and 1980s, NATO increasingly viewed Soviet trawlers as: intelligence platforms, surveillance assets, tools of strategic reconnaissance.
Today’s concerns about shadow fleet vessels loitering near: undersea cables, energy interconnectors, ports, military facilities, closely resemble Western concerns about Soviet maritime activity during the Cold War.
A reasonable intelligence assessment would be:
The Soviet Union did not maintain a shadow fleet in the contemporary sense, but it routinely integrated commercial shipping, fishing fleets, intelligence collection, covert logistics, and geopolitical objectives. Russia’s current shadow fleet appears to represent an evolution of these Cold War practices, adapted to the requirements of sanctions evasion, hybrid warfare, and economic survival under Western pressure.
In that sense, the shadow fleet is not a completely new phenomenon—it is a modernized maritime instrument built on longstanding Soviet traditions of blending civilian and state security activities at sea.
The use of private military companies (PMCs) aboard civilian vessels is not unusual in international shipping. Since the late 2000s, hundreds of commercial ships have employed armed private security teams to protect against piracy, particularly in the Gulf of Aden, Indian Ocean, Gulf of Guinea, and Strait of Malacca.
However, the Russian shadow fleet case differs fundamentally from normal maritime security practice.
In most countries, maritime PMCs are hired to protect ships from external threats and operate under the captain’s authority. In the Russian case, available reporting suggests that security personnel may monitor crews, influence navigation decisions, collect intelligence, and serve state interests that extend beyond vessel protection.
The difference is not the presence of armed guards, but their function, chain of command, and relationship to the state.
Worldwide Practice
Somalia Piracy Crisis (2008–2015)
The modern maritime security industry emerged during the Somali piracy crisis.
Thousands of vessels transiting: Gulf of Aden, Arabian Sea, Western Indian Ocean began hiring private security teams.
Major firms included: G4S Maritime, Control Risks, Ambrey, Drum Cussac
Their mission was straightforward: Prevent boarding by pirates, Protect crew, Secure cargo, Provide crisis response.
A study by the International Maritime Organization and industry groups found that no vessel carrying a professional armed security team was successfully hijacked by Somali pirates.
Typical Maritime PMC Functions
Worldwide, maritime security contractors usually: Vessel Protection, Watchkeeping, Threat detection, Anti-piracy patrols, Access control.
Security teams: Respond to pirate attacks, Escort crews to safe rooms, Coordinate with naval forces.
They may recommend: Course changes, Speed increases, Defensive procedures.
However, final authority remains with the captain.
Under international practice the captain remains the ultimate authority aboard the vessel.
This principle is deeply rooted in maritime law.
Security personnel: Advise, Protect, Assist but do not command the vessel.
PMC personnel are: Not state agents, Not military personnel, Not intelligence officer. Their role is commercial.
Examples of Legitimate Maritime PMC Use
The Russian Difference
The Russian shadow fleet case differs in at least five important ways.
Normal maritime PMCs protect ships.
Reported Russian personnel may: Monitor crews, Report to outside organizations, Ensure compliance with political directives, Prevent cooperation with foreign authorities.
These activities resemble counterintelligence functions.
In standard maritime security:
Captain → Security Team
In reported Russian cases:
Captain ↔ Security Personnel ↔ External State Structures
If security personnel can override navigational decisions or influence routing, this creates a parallel command structure.
This is highly unusual.
Western maritime PMCs serve commercial clients.
Russian security personnel may be protecting: Sanctions-evasion operations, Strategic state revenue streams, Intelligence collection missions.
This blurs the distinction between commercial security and state operations.
Worldwide maritime PMCs rarely conduct intelligence operations.
Most maritime PMCs operate in environments dominated by piracy or criminal threats.
Russia’s shadow fleet operates within a broader geopolitical confrontation involving: Sanctions, Intelligence competition, Infrastructure security, Hybrid warfare.
This changes the strategic significance of onboard security personnel.
The Russian model resembles several historical precedents more closely than modern maritime security.
Soviet Merchant Shipping
The USSR frequently placed: KGB officers, GRU officers, Political officers aboard merchant vessels.
Their mission included: Crew monitoring, Intelligence collection, Loyalty enforcement.
This is a closer analogy than modern anti-piracy teams.
Chinese Maritime Militia
People’s Armed Forces Maritime Militia uses ostensibly civilian vessels to support state objectives.
Similarities include: Civilian appearance, State direction, Strategic missions.
Iranian Shipping Networks
Some Iranian commercial vessels have reportedly been used for: Intelligence support, Weapons transfers, IRGC-linked operations.
The distinction between commercial and state activity becomes blurred.
Intelligence Assessment
| Feature | Normal Maritime PMC | Reported Russian Shadow Fleet Practice |
| Protect vessel from pirates | Yes | Yes |
| Under captain’s authority | Yes | Not always clear |
| Intelligence collection | Rare | Possible |
| Crew monitoring | Rare | Reported |
| State-directed mission | Rare | Likely on some vessels |
| Strategic sanctions-evasion role | No | Yes |
| Hybrid warfare relevance | Minimal | Significant |
The use of private security personnel aboard civilian vessels is a well-established global practice and, by itself, is not unusual. What distinguishes the Russian shadow fleet is the reported integration of security personnel into a broader state-directed system that combines sanctions evasion, crew control, intelligence collection, and strategic objectives.In most maritime industries, private security guards protect a ship. In the Russian shadow fleet, the evidence suggests that some security personnel may also protect the Kremlin’s interests, making them closer to political officers, intelligence assets, or hybrid warfare facilitators than to conventional maritime security contractors. This is what makes the Russian case strategically different from standard international practice.
More on this story: The Greek Connection: How Shipowners Sustain Russia’s Shadow Oil Fleet
More on this story: The Graham Sanctions Bill: Strategic Escalation Against Russia’s Shadow Economy
More on this story: Axis of Arms: Russia and Iran’s Expanding Shadow Trade”
