Since the full-scale invasion of Ukraine in 2022, Russia has not only built a vast fleet of tankers to avoid Western sanctions and continue exporting crude oil from the Baltic and the Black Sea, but has turned that logistical infrastructure into something much more ambitious.
How much? The size of an old continent.
The fleet in the shadows. According to Western and Ukrainian intelligence sources cited by CNN, Part of this so-called shadow fleet is being used as a covert platform for espionage and hybrid operations in European waters.
We are talking about hundreds of ships that routinely sail near the coasts of EU and NATO countries, generating income of hundreds of millions of dollars for Moscow while, at the same time, expanding the radius of action of its security services away from Russian territory.
“Civilian” crews with a detail. The pattern detected by the intelligence services is revealing. Many of these tankers, registered under flags of convenience and with mostly Asian or African crews, incorporate just before setting sail to one or two Russian citizens additional.
The crew lists show as simple “technicians”but his background tells another story: former police officers, members of special units of the Ministry of the Interior, veterans of the Russian army or former mercenaries linked to Wagner. They are often the only Russians on board and, according to testimonies of Danish maritime pilots and European observers, exercise an authority that goes beyond the civilian chain of command, even imposing itself over the ship’s captain.
Moran Security and privatization. Many of these men would be linked to Moran Security Groupa private Russian company with deep ties to the FSB, GRU, and the Kremlin’s military contractor ecosystem. Moran was sanctioned by the United States Treasury in 2024 for providing armed security services to Russian state companies, and his history connects directly with Wagner and with operations in scenarios such as Syria or Somalia.
Its corporate structure (with registrations in Moscow and in opaque jurisdictions such as Belize) and its professional profile, explicitly oriented to recruit veterans of special forces, fit perfectly into the logic of hybrid warfare: formally private actors that allow the Russian state to operate with a high degree of plausible deniability.
Espionage and internal control. The functions of these “technicians” would not be limited to protecting the cargo. Ukrainian and Western sources maintain that also supervise captains non-Russian vessels to ensure that the ships are acting in the interests of the Kremlin and that, in at least one documented case, took photographs of European military installations from one of these tankers.
Furthermore, although details are scarce, intelligence services suggest that some of these men have participated in acts of sabotage. These would not be direct confrontations, but rather low-profile actions designed to collect information, generate uncertainty and strain the limits of the Western response.
The Boracay case. He Boracay tanker illustrates this dynamic well. Sanctioned, with frequent changes of name and flag, two Russian citizens embarked in September in the port of Primorsk, near Saint Petersburg. Both were listed as technicians and were the only Russians among a crew of Chinese, Burmese and Bangladeshis. Coincidence or not, his crossing through Danish waters overlapped with a wave of sightings of drones near the Copenhagen airport and Danish military bases.
Days later, the ship was boarded by the French navy against Brittany for irregularities in their documentation. No drones were found on board, but the presence of the two Russians came to light and they were discreetly questioned. For some analyststemporal correlation proves nothing, but for others It fits too well with the pattern of trial and error in the “gray zone.”
Drones, sensors and something new. Beyond Boracay, Swedish and Danish authorities have detected on other ships in the shadow fleet antennas and masts not usually found on civilian merchant ships, as well as hostile behavior towards inspectors and an obsession with photographing critical infrastructure.
In an environment like the Baltic, a strategic bottleneck surrounded by NATO countries, any anomalous activity becomes a disproportionate weight. For European security services, these ships are ideal mobile platforms: seemingly legal, difficult to intercept without diplomatic escalation and capable of approaching ports, cables, bases and airports without raising immediate alarms.
Hybrid warfare at sea. All this fits with a broader strategy that senior intelligence officials, such as the new head of British MI6describe as constant testing “below the threshold of war.” Drones near airports, aggressive activity at sea, discreet sabotage and covert espionage are part of the same repertoire.
The shadow fleet is not only an economic instrument to circumvent sanctions, but an extension of the Russian security apparatus, capable of operating in a space where Western legal and military responses are slow and politically sensitive.
The European dilemma. Europe thus faces an uncomfortable decision. Intercepting ships without insurance, with dubious documentation or with armed personnel on board could stop these practices, but it also carries the risk of a direct russian reaction.
As summarized on CNN a veteran Danish maritime pilot, no small country wants to be the first to make the move. The answer, if it comes, will have to be collective. Meanwhile, the shadow fleet continues growing and sailingdemonstrating that for the Kremlin the war is not only being fought in Ukraine, but also in the seas surrounding Europe, silently and in civilian uniform.
Image | kees torn, Greg Bishop
In Xataka | For years Europe has wondered how to stop the Russian ghost fleet. Ukraine just showed you the way: with AI
GIPHY App Key not set. Please check settings