By Galina Korol | 2026-01-14

Russia's so-called shadow fleet was once discussed mainly as a sanctions-evasion tool. That framing no longer holds. By the end of 2025, the fleet increasingly drew attention as a security threat, particularly in the Baltic Sea. Hundreds of aging oil tankers sailing under obscure flags now form part of the Kremlin's hybrid infrastructure. Along with millions of barrels of oil, intelligence officials say, these civilian vessels may carry surveillance equipment, private military personnel and potential sabotage teams.

'Technicians' aboard

On paper, crews on these tankers look international, staffed by sailors from Myanmar, Bangladesh or China. But CNN reported December 19 that Ukrainian intelligence has identified a troubling pattern: before ships depart Russian ports such as Primorsk or Novorossiysk, additional passengers board.

Shipping documents list them as "technicians." Their backgrounds suggest otherwise.

Ukrainian intelligence said the men are typically Russian citizens with experience in security services. Many are linked to the Moran Security Group, a private firm Western intelligence agencies associate with Russian military and intelligence structures and that is sanctioned by the US Treasury Department.

According to Ukraine's Foreign Intelligence Service, Moran personnel began appearing on shadow fleet tankers about six months ago and are often the only Russians aboard.

The tanker Boracay illustrates the pattern. After a voyage on September 20, intelligence services scrutinized the vessel, which has repeatedly changed names and registrations. Two "technicians" boarded the ship at Primorsk. One was a former police officer and ex-mercenary with the Wagner private military company. The other listed an official address associated with Russia’s Defense Ministry.

Investigators later identified a similar "specialist" aboard another tanker, a veteran of an elite regiment of Russia's Internal Affairs Ministry.

Danish sea pilots from the DanPilot service said these individuals often wear uniforms resembling Russian navy camouflage, act aggressively during inspections and appear to outrank the ship's captain.

Swedish coast guard and military personnel have also reported seeing people on shadow fleet tankers who did not appear to be part of the merchant crew. Last year, the Swedish navy documented unusual equipment on such vessels, including antennas and masts inconsistent with commercial shipping.

A source told CNN that Moran personnel were seen photographing European military installations from a tanker. Oleksandr Stakhnevich of Ukraine's Foreign Intelligence Service said these men monitor crews to ensure they act in the Kremlin's interests.

Jacob Kaarsbo, a former Danish intelligence officer, described the arrangement as classic "plausible deniability."

"Everyone with even half a clue knows that these guys take their orders from the Russian state but it’s hard to prove," Kaarsbo told CNN.

Wagner's afterlife

The presence of security veterans aboard oil tankers reflects a broader evolution of Russia's private military companies after Yevgeny Prigozhin's failed uprising and the dismantling of Wagner.

Serhii Kuzan, a military expert and chairman of the Ukrainian Security and Cooperation Center, told Kontur that Wagner units were not disbanded after their "march on Moscow." Instead, they were reassigned and pushed farther from Russia.

In regions where political or legal constraints prevent official Russian agencies, particularly military intelligence, from operating openly, Moscow relies on proxies in the form of private military companies.

"Officially they're not connected to the state, but they are actually carrying out the state's missions," Kuzan said, calling the model a way to maintain flexibility and deniability.

"Technically these aren't Russian military personnel but rather 'mercenaries' who can work anywhere -- in Africa, on land, at sea or aboard a tanker," he said.

Kuzan said the deployment of former Wagner fighters and security officers aboard tankers fits squarely into this logic.

'Not united by oil'

Other incidents suggest Russia increasingly treats its tanker fleet as infrastructure for hybrid warfare -- intelligence gathering, pressure tactics, shows of force and covert sabotage.

Kuzan cited the 2024 case of the tanker Eagle S, which damaged undersea cables in the Baltic Sea, as a warning that commercial vessels can be weaponized.

He also cited the Boracay as a suspected platform for espionage. Kuzan said the tanker was detected off Denmark’s coast in September 2025 at the same time a mass drone launch disrupted operations at Copenhagen’s airport and violated the airspace of Danish military bases, raising the likelihood that the vessel was used as a drone launch platform.

After French authorities searched the Boracay off France's coast, Russia publicly "pledged to respond," a reaction Kuzan said only deepened suspicions of state involvement.

Andrii Klymenko, head of the Black Sea Institute of Strategic Studies, said any commercial vessel can be converted into a covert combat platform. Missile systems concealed in standard shipping containers blur the line between merchant and military fleets.

"An Iskander or Kalibr missile can be launched from a standard shipping container. . . . It looks just like an ordinary container with goods from China, but inside there’s a launcher," Klymenko told Kontur.

This tactic allows ships to evade early warning systems. In the Baltic and North seas, weak monitoring of container traffic creates strategic risk, he said.

Klymenko argued that the term "shadow fleet" obscures reality. There is no hidden armada, but a global tanker fleet transporting Russian oil. About 60% moves through the Baltic, 20% via the Black Sea, 25% through the Far East and 3 to 5% from Arctic ports.

Ownership is also largely transparent, he said. Roughly 40% of the tankers belong to Greek shipowners, with others owned by firms in Azerbaijan, the United Arab Emirates, China and India. Only 2 to 4% are registered in offshore jurisdictions with unclear ownership.

As long as oil exports continue, Klymenko warned, so will the war.

"The Russians will boldly restore Russian flags on tankers. The process has already started. There will be armed security on every [tanker]. The ultimate scenario is to proclaim [the tankers] as state vessels," he said.

That outcome would erase the distinction between civilian shipping and military assets -- and turn Russia's tanker fleet into a direct security threat.