In the geopolitical chess of international sanctions, where Western governments design complex legislation to suffocate Vladimir Putin’s war machine, sometimes checkmate comes not from a brilliant diplomatic maneuver, but from corporate stinginess. An entire global smuggling network, designed to the millimeter to be invisible to the eyes of Washington and Brussels, has fallen like a house of cards for not wanting to pay separate email bills. A simple saving in computer infrastructure has exposed a monumental flow of black money. a colossal IT blunder (a huge computer error) has brought to light a smuggling network that has moved at least $90 billion worth of Russian oil. As revealed by extensive research of the Finance Timesthis plot is mainly responsible for financing the Kremlin in its war against Ukraine. The British media has identified a network of 48 companies which, on paper, operated completely independently from different physical addresses. However, in practice, they acted in unison to disguise the origin of the crude oil, especially that of Rosneft, the Russian state-controlled oil company. The need to hide these exports became life or death for the Kremlin in October 2025, when the United States imposed direct sanctions to Rosneft and Lukoil. From that moment on, a previously unknown company called Redwood Global Supply was suddenly crowned as the largest exporter of Russian crude oil in the world. This firm, along with the rest of the network, is linked to a group of businessmen of Azerbaijani origin with privileged access to the leadership of Rosneft, led by figures such as Tahir Garayev and Etibar Eyyub. The independent Russian media The Moscow Times has been echoed of this discovery, highlighting a devastating fact: in November 2024, more than 80% of Rosneft’s maritime exports They moved through this network. Sergey Vakulenko, former head of strategy at Gazprom Neft and current researcher at the Carnegie Center, explained to this medium that using fifty shell companies is “an old trick from the 90s” to evade taxes, but he confesses his surprise at the fact that a single network has become so immensely crucial for a giant like Rosneft. The triumph of shadow intermediaries The existence of this network means, quite simply, that the Western sanctions system is full of holes and that Russia has managed to industrialize evasion. According to the investigationthe success of this $90 billion network was based on strict separation of roles to erase the money trail. The network used a group of shell companies exclusively to buy crude oil shipments in Russia, and another group of companies, totally different on paper, to sell them in key markets such as India or China. In this way, the initial buyer and the final seller almost never coincided in customs documents. Furthermore, in most cases, the crude oil was labeled under generic names such as “export mix”, which destroyed any possibility of tracing its origin or checking whether the price cap imposed by the G7 was being respected. As we already explained at the time in Xatakathis modus operandi It is not new and it relies on an architecture of evasion that has been brewing for years in places like the United Arab Emirates. Something very similar happened with the case of Christopher Eppinger, a young trader German that perfectly illustrates how this underworld works. As we detailed in our report, while Europe boasted of energy sovereignty, an army of new intermediaries moved to Dubai—a jurisdiction that does not apply sanctions to Moscow—to make gold. The network now discovered by the British media uses exactly the same tools that we already analyzed: the express creation of opaque companies, the use of the “ghost fleet” (aging ships that turn off their transponders when approaching to load Russian crude oil) and transfers of oil on the high seas to mix it and falsify its origin. The only difference is that the Rosneft network uncovered by the FT was operating on an unprecedented industrial scale… Until they made a rookie mistake on the internet. The rookie mistake This entire sophisticated international network collapsed due to an absurd detail that borders on comedy. He Finance Times discovered that these 48 multi-billion dollar companies shared a single private server for their emails: mx.phoenixtrading.ltd By pulling this digital thread, the journalists of the FT they managed to identify 442 web domains who shared administrative functions of back office on that same server. The next step was pure data mining: they compared the names of those domains with the customs records of Russia and India. Thus, they discovered that the domain foxton-fzco.com It corresponded to Foxton FZCO (based in Dubai), buyer of $5.6 billion in oil; and? advanalliance.ltd It was Advan Alliance, which sold 1.5 billion to India. The desire to create and destroy companies quickly to mislead sanctioners—according to The Moscow Timesthe average lifespan of these signatures is only six months—led the network to centralize your IT infrastructure to reduce costs. A saving that has cost them their anonymity. The show must go on In the short term, the strategy of those involved is denial and adaptation. How to collect Finance Timesboth Tahir Garayev and Etibar Eyyub have categorically denied their involvement in sanctions evasion, calling the accusations “baseless” (curiously, Eyyub sent his denial from an email address hosted on the compromised server). The original company that founded the network, Coral Energy (now 2Rivers), has also disengaged from operations. However, behind the scenes, the machinery is already looking for new avenues. A senior Russian energy executive, speaking on condition of anonymity, summed up the situation in the investigation starkly: “It creates additional costs and inconveniences. But at the end of the day, the show must go on.” The United Kingdom has already reacted to the investigation of the British media, sanctioning nearly 300 entities linked to this “dark web”, blocking Russian ships and banks. The fall of this immense $90 billion network shows that, in the 21st century, bank secrecy and flags of convenience are useless if the system administrator decides … Read more
