Russia’s shadow fleet presents a sustained hybrid war threat at sea

On New Year’s Eve 2025, Finnish special forces descended from helicopters onto the deck of the Fitburg cargo vessel while it traveled across the Gulf of Finland, en route from the St. Petersburg port in Russia to Haifa in Israel.¹ The raid on the Fitburg, a Turkish vessel registered in Saint Vincent and the Grenadines, came hours after it caused an outage on the optical fiber cable linking Helsinki and Tallinn by dragging its anchor along the seabed. Finnish officials found sanctioned Russian steel aboard.² Finnish authorities have not publicly claimed that the cable damage was intentional, and the criminal investigation remains open.

Yet, this case offers an unusually clear window into the role of Russia's shadow fleet, a network of aged oil tankers employed to transport sanctioned oil and other products. But it is not solely a mechanism to avoid sanctions. It is functioning as a platform for Russia’s hybrid warfare, enabling undersea infrastructure sabotage and drone overflight over critical infrastructure in the Baltic and North Sea (see map below). It also increasingly operates alongside Russian military ships. 

Drawing on ACLED event-level data from 2025 and 2026, this report maps underwater infrastructure damage, drone activities, vessel seizures, and Russian naval counter-moves in the Baltic and North Sea, treating them as a single connected campaign. This distinction is crucial because the institutional frameworks built to manage commercial sanctions evasion are unable to manage this security threat. While Western governments have sought to respond to this threat through a range of legislative and direct actions, they have been unable to neutralize the threat that the shadow fleet poses to critical infrastructure at sea and on land. 

As long as a portion of Russia’s oil revenue depends on the shadow fleet, and the legal and operational gaps that make these activities deniable remain in place, the shadow fleet’s threat to Europe’s critical infrastructure will persist. In the next one to two years, the threats will involve risks to undersea cables connecting northern European countries. Moreover, the shadow fleet will remain a platform for drone reconnaissance over critical infrastructure — driving further escalations, including vessel seizures and counter-moves from Russia.

The fleet evades repercussions in the Baltic Sea

The shadow fleet’s threat is concentrated in the Baltic Sea, and three structural conditions allow for it to exist and evade substantial repercussions: the scale and opacity of the fleet itself, the geographic and infrastructural density of the Baltic Sea, and a legal framework that constrains what European coastal states can do about suspicious vessels.

In terms of the first condition, estimates of the fleet’s size vary widely, from over 1,000 to over 3,200 vessels, depending on the source.³ The Ukrainian government has documented 1,392 vessels.⁴ Reportedly, the fleet represents nearly one-fifth of all operational oil tankers worldwide and transports up to 80% of Russia’s seaborne crude oil exports.⁵ Its vessels often employ various concealment methods, including: multiple layers of shell companies, using flag-of-convenience, name changes, manipulation of Automatic Identification System (AIS) — intentional switching off of vessel transponders to evade tracking — recruitment of crew members via WhatsApp, payments made in cryptocurrency, and use of Starlink for communication.⁶

The second condition is the Baltic Sea’s geography (see map below). Russia’s Primorsk and Ust-Luga — large oil export ports — are located there. It also hosts critical infrastructure of European countries on a shallow seabed. Highly dense, relatively shallow, and semi-enclosed, the Baltic Sea can be accessed only through the three narrow  Danish Straits. Moreover, it has no high seas — all waters fall within the territorial seas or exclusive economic zones (EEZs) of the nine coastal states of Denmark, Estonia, Finland, Germany, Latvia, Lithuania, Poland, Russia, and Sweden.

The third condition is the legal framework. Under the United Nations Convention on the Law of the Sea (UNCLOS), coastal states’ authority to intercept suspicious vessels in their EEZs is tightly constrained by freedom of navigation provisions — even for sanctioned vessels.⁷ 

Hundreds of sanctions by the European Union, United States, and United Kingdom (see table below) have done little to curtail Russian shadow fleet activities in the Baltic Sea. While such sanctions allow for port entry and service bans, they do not give coastal states automatic boarding or seizure rights. To intercept a vessel in its EEZ, a European state must have reasonable grounds to suspect the vessel’s false-flag status under UNCLOS, or to conduct a criminal investigation.

Sanctioned shadow fleet vessels as of May 2026⁸

As a result, the Baltic Sea can serve as both a corridor for sanctioned shipping and a concentrated space for hybrid operations, though these events occur in the North Sea and English Channel as well.

Russian sabotage and surveillance at sea

The shadow fleet has been implicated in two main types of suspected hybrid activity: damage to undersea infrastructure and drone operations. For both, the large number of shadow fleet ships operating in the vicinity of incidents that appear to be linked to Russian hybrid activity, along with the use of masking tactics, make attribution difficult. Without proven intent or identified perpetrators, investigations are closed, with no consequences, and these activities continue.

Nordic and Baltic states’ undersea infrastructure takes the hit 

The damage to undersea infrastructure is the most visible dimension of the shadow fleet’s hybrid activity so far. The most affected countries are the Nordic and Baltic states, as their energy and digital connectivity depend on this infrastructure.

The different types of undersea cables present different threats. Damage to telecom cables accounts for the majority of incidents and gradually degrades communication. Power cable incidents occur less frequently but are more consequential, as they can cause immediate physical consequences. The rupture of the subsea electricity transmission line, Estlink 2, in December 2024 — which Finnish authorities suspect was caused by the shadow fleet Eagle S vessel — cut two-thirds of the electricity transfer capacity between Estonia and Finland in a single event, with repairs taking seven months. This incident led to the first seizure of a shadow fleet vessel by European authorities. In October 2025, however, a Finnish court dismissed the case due to its lack of jurisdiction and a lack of proven intent.

Sabotage of gas pipelines poses the highest strategic risk, as it undermines energy independence. The Balticconnector — which was damaged in October 2023 by a vessel registered in China that departed from a Russian port — was Finland and Estonia’s only non-Russian gas link, and its six-month repair reversed years of work toward energy independence from Russia.⁹ In the majority of these incidents, there is a recurring pattern of physical damage to the cables, with suspected vessels operating nearby, followed by investigations that struggle to prove intent. 

The pattern has continued. Since the beginning of 2025, four undersea cables have been damaged in the Baltic Sea. Sweden’s seizure of the Vezhen cargo ship in January 2025 ended with prosecutors ruling that the damage to the Sweden-Latvia telecom cable was accidental.¹⁰ Damage to the C-Lion1 cable connecting Germany to Finland, recorded in February 2025, could not be attributed to any vessel. In May 2025, Polish authorities observed the shadow fleet tanker Sun circling the undamaged SwePol cable before being driven off by a Polish aerial patrol.¹¹ Lastly, five days after the boarding of the Fitburg, Latvian authorities detained a vessel suspected of causing damage to the BCS East cable that runs between Latvia and Lithuania on 2 January, but released it due to a lack of evidence.¹²

According to maritime intelligence company Windward, 2,313 Russian-affiliated vessels visited the Baltic Sea between February 2024 and February 2025. Of these, only 436 used the Russian flag.¹³ At the same time, drifting activity — stationary vessels or vessels moving without apparent purpose, a pattern often associated with anomalous behavior near subsea infrastructure — increased by 153% year-on-year between February 2024 and February 2025, and by 849% in Finland’s EEZ alone. Moreover, the number of AIS gaps by these Russian-linked vessels exceeded 16,000 instances over this period, which is six times the baseline.¹⁴ Although individual vessel-level attribution remains difficult, the opacity at this scale creates conditions in which sabotage and reconnaissance become both feasible and deniable.

Drone incidents spike in 2025, but vessel links remain partial

Drone activity over critical European infrastructure is another major issue for which attribution is potentially even harder. Its significance lies not in any single incident but in a cumulative number of events in which drones appeared near the kinds of military, energy, and other infrastructure that shadow fleet vessels transit past routinely.

While only two incidents have occurred in 2026 so far, drone activity over critical infrastructure in Belgium, Denmark, Germany, and Norway spiked in 2025 (see graph below). ACLED records 54 suspected drone incidents across Europe’s coastal waters and inland within a range of 150 kilometers from the coast in 2025. These events often included overflights of airports, naval and military bases, and other critical infrastructure. At the same time, linking individual incidents to specific vessels is often not possible, and attribution to Russian actors is instead inferred from pattern and context. Only a small subset of events in the dataset has strong vessel-level links, and most are drone sightings, of which the launch point is unknown. At the same time, affected countries have struggled to turn these events into prosecutable cases.

The only verified drone launch from a ship was in February 2026, when the Swedish Armed Forces observed, jammed, and confirmed a suspected reconnaissance drone launch from the Zhigulevsk vessel against the French aircraft carrier Charles de Gaulle near Malmö.¹⁵ The Zhigulevsk, however, is a Russian intelligence military vessel, not a shadow fleet ship.

Nonetheless, strong circumstantial evidence of shadow fleet drone launches exists. In September 2025, Germany seized the Scanlark after prosecutors alleged it had launched a reconnaissance drone earlier in August that flew over a German Navy frigate at the Kiel naval base. German authorities found surveillance equipment on board and classified the Scanlark as a Russian espionage ship and a mobile base for drone operations.¹⁶

Another case involves the Pushpa, which also uses the names Kiwala and Boracay, a sanctioned tanker registered in Benin that runs the Russia-India route. MarineTraffic tracked it off the Danish coast in September 2025, during the wave of drone incidents that forced the closure of multiple Danish airports (see map below). The ship was seized by French naval forces.¹⁷

Finally, multiple events show only a suggestive correlation without vessel-specific tracking. In December 2025, four military drones entered the no-fly zone over Dublin Airport shortly after Ukrainian President Volodymyr Zelenskyy’s arrival. Irish officials made a hypothesis that the drones may have been launched from an undetected ship as part of Russian hybrid warfare, though they were unable to identify a vessel.¹⁸ Further incidents in France, Germany, and Scandinavian states in 2025 followed similar overflight patterns near military or critical infrastructure without conclusive attribution. 

The point is not that every drone incident traces to a specific vessel, because most cannot. It is rather that the shadow fleet’s operational environment allows for persistent access to the critical infrastructure of European coastal states. A typical tanker traveling from the Russian port of Primorsk to India is traveling within drone range of Copenhagen airports, Swedish naval bases, and German critical infrastructure. For European authorities, this means the threat they face is not a sequence of sabotage events that can be deterred by protecting individual sites or focusing on individual vessels, but rather a persistent reconnaissance and harassment hazard in the environment of commercial transits.

European seizures are on the rise, and Russia has escalated in response

European enforcement actions against the shadow fleet have expanded substantially since late 2024, but the institutional response has not kept pace with the threat it is meant to address (see graph below). Although surveillance and interdiction operations have likely reduced the risk of cable damage, they currently do not address the underlying environment that enables hybrid operations: the volume of vessel transits and the opacity of ownership and crewing. Seizures and boardings of vessels by European countries are likely to continue, while Russia’s counteractions, including military ships escorting shadow fleet vessels, airspace violations, military-linked crewing, and reflagging from flags of convenience to Russia-flagged vessels, are likely to escalate in parallel.

Since the first shadow fleet ship was boarded in December 2024, NATO has launched the Baltic Sentry¹⁹ and the United Kingdom the Nordic Warden.²⁰ ACLED records eight European enforcement actions against shadow fleet vessels, of which three occurred in 2025 and five in the first four months of 2026, mainly on the basis of suspicion of being stateless or using false flags under UNCLOS.²¹

Russia is reacting to these enforcement actions using military ships. For example, the corvette Boikiy ship escorted sanctioned tankers Selva and Sierra through the English Channel in June 2025.²² When Estonia attempted to intercept the Gabon-flagged tanker Jaguar in May 2025, a Russian Su-35 violated Estonian airspace and escorted the vessel into Russian waters.²³ And in March 2026, a Kremlin aide announced that Russia considers escorting shadow fleet vessels with naval warships.²⁴ While the direct trigger was a Ukrainian sea-drone strike on the Russian LNG tanker Arctic Metagaz in the Mediterranean Sea as part of Ukrainian strikes against Russian maritime oil targets that started with a drone strike on a shadow fleet tanker back in December 2024, it formalizes the approach that has already been taken in the Baltic Sea.

Another measure that Russia has undertaken is the reflagging of these vessels — changing their registration from a flag of convenience to the Russian flag. As of February 2026, nearly 70 vessels have been reflagged to the Russian registry since May 2025, and another 120 are projected to be reflagged in the coming months.²⁵ This is a reaction to European states using the UNCLOS “without nationality” clause to justify boarding these ships.²⁶ Finally, an investigation also documented systematic deployment of Wagner- and Russian intelligence-linked personnel aboard Baltic Sea shadow fleet tankers since 2025.²⁷

Lastly, the shadow fleet’s activity should not be analyzed in isolation from military activities. The intelligence vessel Yantar — which is reportedly equipped with lasers that have been used against the UK’s Royal Air Force aircraft and which has long been suspected of mapping undersea cables²⁸ — continues to loiter in the UK’s EEZ, while the confirmed drone launch from the Zhigulevsk shows that the Russian military performs surveillance activities alongside the shadow fleet vessels. Furthermore, corvette escorts completely break down the distinction between commercial and military operations.

The effect is a self-reinforcing cycle. While European enforcement raises the cost of the shadow fleet’s operations, Russia’s counter-moves raise the cost of European enforcement. Neither side has an incentive to choose confrontation, but each step increases the risk of miscalculation.

Europe’s response to the hybrid threat

The threat posed by Russia’s shadow fleet is likely to persist in the next year or two. The drop in drone incidents in the first months of 2026 may reflect a seasonal lull, a change to other modalities, or improvements in European defense or deterrence, but it is too early to attribute it to any one cause. More critical infrastructure sabotage events are likely in the Baltic Sea, including the targeting of critical infrastructure, telecom cables, power links, and gas pipelines connecting northern European countries. European seizures under UNCLOS will follow where possible, and Russian counter-moves such as naval escorts, airspace violations, military crewing, and reflagging to the Russian registry will likely escalate in parallel.

Europe’s institutional setting for managing commercial sanctions evasion is not prepared for the hybrid threat posed by Russia’s shadow fleet. The reflagging of vessels to the Russian registry reduces the possibility of boarding under UNCLOS, while the presence of military ships as escorts or military crew aboard vessels increases the risk of escalation if vessels are boarded. A less likely but plausible scenario also includes localized armed incidents resulting from a miscalculation during boarding operations. 

Responses calibrated to single sabotage events are no longer valid for a campaign that operates as a system. These responses raise the cost of individual incidents but not the cost of the underlying operation, which depends on a large volume of vessel transits, the opacity of ownership, and the legal cover that reflagging now restores. The shadow fleet is integral to Russia’s hybrid warfare strategy and war economy, and its threat to European waters is not likely to subside. The scale of the problem demands systematic cross-domain event-level tracking of the kind this report begins to provide.

Visuals produced by Christian Jaffe.