Russia’s vast “shadow fleet” of vessels has been seen primarily as a means of keeping the Kremlin’s oil revenues flowing despite Western sanctions. But a new report from the monitoring group ACLED argues the fleet has evolved into something bigger – a flexible platform for hybrid warfare across northern Europe.
In a report published on Friday, the conflict-monitoring organisation ACLED describes an increasingly emboldened maritime system that allows Moscow not only to circumvent sanctions, but to operate in the grey area between commerce, espionage, intimidation and sabotage.
Despite hundreds of sanctions, Russia is still successfully using the fleet to sustain its war economy, exposing vulnerabilities in Europe’s critical infrastructure.
According to ACLED, the fleet comprises anywhere between 1,000 and 3,200 vessels. Ukrainian authorities have identified nearly 1,400 ships, while estimates suggest the network now transports up to 80 percent of Russia’s seaborne crude exports.
Many of the vessels are ageing tankers hidden behind layers of shell companies, false registrations and frequent name changes.
Crews are reportedly recruited through WhatsApp, communications rely on Starlink, payments can be made in cryptocurrency, and ships often manipulate or disable their Automatic Identification Systems to avoid tracking.
This has allowed Moscow to keep oil moving around the globe even as the European Union, the United Kingdom and the United States have imposed broad sanctions. As of May 2026, the EU alone had sanctioned 632 vessels linked to the shadow fleet.
However, under the UN Convention on the Law of the Sea, European states cannot board or seize suspicious vessels unless they can prove criminal activity or demonstrate that a ship is effectively “stateless” – which has created an ideal operating environment for Russia.
Military implications
The Baltic Sea has become the focal point of shadow fleet activity, being home to Russia’s major oil terminals at Primorsk and Ust-Luga. The region is also dense with undersea telecoms cables, electricity links and gas pipelines connecting Nordic and Baltic states.
On New Year’s Eve 2025, Finnish special forces boarded the cargo ship Fitburg after an undersea cable between Helsinki and Tallinn was damaged. Investigators said the vessel had dragged its anchor along the seabed while travelling from St Petersburg towards Israel. Finnish authorities later discovered sanctioned Russian steel on board.
Although investigators stopped short of claiming deliberate sabotage, the episode highlighted the increasingly blurred line between sanctions evasion and hybrid warfare.
Maritime intelligence company Windward recorded more than 2,300 Russian-affiliated vessels entering the Baltic between February 2024 and February 2025. During the same period, “drifting activity” – when a vessel is stationary or moving slowly without any obvious navigational purpose – near subsea infrastructure increased dramatically, while more than 16,000 gaps in vessel tracking signals were recorded.
The result is a persistent atmosphere of uncertainty that benefits Moscow, according to Windward.
French enforcement
France has become one of the more visible European players in terms of testing how far coastal states can go in response to Russia’s shadow fleet.
One key case involved the tanker Pushpa – also known as the Kiwala or the Boracay – a sanctioned vessel operating on the Russia to India route.
French naval forces seized the ship after it was tracked off the Danish coast, during a wave of drone incidents which temporarily closed several Danish airports in September 2025.
There is no claim that the tanker directly launched the drones. But the incident demonstrated that European governments are increasingly willing to act on the risks created by the shadow fleet’s presence, even if individual incidents remain difficult to prove.
In February 2026, Swedish forces reportedly observed and jammed a reconnaissance drone launched near Malmö against the French aircraft carrier Charles de Gaulle.
That drone was traced not to a shadow fleet tanker, but to the Russian intelligence vessel Zhigulevsk, but the episode underlined that the boundary between commercial shipping, intelligence activity and military pressure is becoming harder to draw.
The cost to Moscow
In terms of a wider European response, NATO has launched the Baltic Sentry operation, while the UK has introduced its Nordic Warden surveillance measures. Since late 2024, eight European enforcement actions against shadow fleet vessels have been recorded, mainly through boardings and seizures where legal grounds can be established.
Moscow, however, has adapted quickly. Some tankers have been escorted by Russian warships, while dozens of vessels have been reflagged under the Russian registry to make boarding more difficult in legal terms. There has also been increasing use of military-linked personnel aboard commercial tankers.
European action thus raises the cost to Russia of using a shadow fleet, but the fleet remains central to keeping its oil revenues flowing despite sanctions.
