Since the full-scale invasion of Ukraine in 2022, Russia has not only built a vast fleet of oil tankers to avoid Western sanctions and continue exporting crude from the Baltic and Black Sea, but has turned that logistical infrastructure into something much more ambitious.
How much? The size of an old continent.
The fleet in the shadows. According to Western and Ukrainian intelligence sources cited by CNN, part of this so-called shadow fleet is being used as a covert platform for espionage and hybrid operations in European waters.
We are talking about hundreds of ships that routinely sail near the coasts of EU and NATO countries, generating hundreds of millions of dollars in revenue for Moscow while, at the same time, expanding the radius of action of its security services away from Russian territory.
“Civilian” crews with a detail. The pattern detected by the intelligence services is revealing. Many of these tankers, registered under flags of convenience and with mostly Asian or African crews, incorporate one or two additional Russian citizens just before setting sail.
In the crew lists they appear as simple “technicians”, but their backgrounds tell another story: former police officers, members of special units of the Ministry of the Interior, veterans of the Russian army or ex-mercenaries linked to Wagner. They are often the only Russians on board and, according to testimony from Danish maritime pilots and European observers, they exercise authority that goes beyond the civilian chain of command, even overriding the ship’s captain.
Moran Security and privatization. Many of these men would be linked to Moran Security Group, a private Russian company with deep ties to the FSB, the GRU and the Kremlin’s ecosystem of military contractors. Moran was sanctioned by the United States Treasury in 2024 for providing armed security services to Russian state companies, and her history connects directly with Wagner and with operations in scenarios such as Syria or Somalia.
Its corporate structure (with registrations in Moscow and in opaque jurisdictions such as Belize) and its professional profile, explicitly aimed at recruiting special forces veterans, fit perfectly into the logic of hybrid warfare: formally private actors that allow the Russian state to operate with a high degree of plausible deniability.
Espionage and internal control. The functions of these “technicians” would not be limited to protecting the cargo. Ukrainian and Western sources maintain that they also supervise non-Russian captains to ensure that the ships are acting in the interests of the Kremlin and that, in at least one documented case, they took photographs of European military installations from one of these tankers.
Furthermore, although details are scarce, intelligence services suggest that some of these men have participated in acts of sabotage. These would not be direct confrontations, but rather low-profile actions designed to collect information, generate uncertainty and strain the limits of the Western response.
The Boracay case. The Boracay oil tanker illustrates this dynamic well. Sanctioned, with frequent changes of name and flag, two Russian citizens embarked in September in the port of Primorsk, near Saint Petersburg. Both were listed as technicians and were the only Russians among a crew of Chinese, Burmese and Bangladeshis. Coincidentally or not, its journey through Danish waters overlapped with a wave of drone sightings near Copenhagen airport and Danish military bases.
Days later, the ship was boarded by the French navy off Brittany due to irregularities in its documentation. No drones were found on board, but the presence of the two Russians came to light and they were discreetly questioned. For some analysts, the temporal correlation proves nothing, but for others it fits too well with the pattern of trial and error in the “gray zone.”
Drones, sensors and something new. Beyond Boracay, Swedish and Danish authorities have detected on other ships in the shadow fleet antennas and masts that are not usually found on civilian merchant ships, as well as hostile behavior towards inspectors and an obsession with photographing critical infrastructure.
In an environment like the Baltic, a strategic bottleneck surrounded by NATO countries, any anomalous activity takes on a disproportionate weight. For European security services, these ships are ideal mobile platforms: seemingly legal, difficult to intercept without diplomatic escalation and capable of approaching ports, cables, bases and airports without raising immediate alarms.
Hybrid warfare at sea. All of this fits into a broader strategy that senior intelligence officials, such as the new head of Britain’s MI6, describe as constant testing “below the threshold of war.” Drones near airports, aggressive activity at sea, discreet sabotage and covert espionage are part of the same repertoire.
The shadow fleet is not just an economic instrument to circumvent sanctions, but an extension of the Russian security apparatus, capable of operating in a space where Western legal and military responses are slow and politically sensitive.
The European dilemma. Europe thus faces an uncomfortable decision. Intercepting ships without insurance, with dubious documentation or with armed personnel on board could stop these practices, but also carries the risk of a direct Russian reaction.
As a veteran Danish maritime pilot summarizes on CNN, no small country wants to be the first to make the move. The answer, if it comes, will have to be collective. Meanwhile, the shadow fleet continues to grow and sail, demonstrating that for the Kremlin the war is not only being fought in Ukraine, but also in the seas surrounding Europe, silently and in civilian uniform.
Imagen | kees torn, Greg Bishop
In WorldOfSoftware | For years Europe has wondered how to stop the Russian ghost fleet. Ukraine just showed you the way: with AI
In WorldOfSoftware | A ghost fleet has mapped the entire underwater structure of the EU. The question is what Moscow is going to do with that information.
