Russian Shadow Fleet: Current Intelligence Assessment
- RFN- OS
- Jul 30
- 4 min read
Premise: Monitoring and Tracking Systems
In the current operational environment, monitoring the Russian shadow fleet is a strategic priority for international maritime security. There's an intensifying reliance on specialized databases such as "sketchy.boats," a dedicated platform that allows for the verification and inclusion of potentially suspicious vessels identified as part of the shadow fleet. This tool is a critical asset for naval intelligence, enabling the crowdsourcing of information and collaborative monitoring of suspect naval units.
The importance of such databases cannot be overstated in the current geopolitical landscape. The ability to rapidly track and identify shadow fleet vessels through these systems significantly multiplies the force for maritime intelligence operations. Our dedicated website will maintain an updated list and map of monitored units, providing continuous support for naval intelligence analyses, drawing in expert intelligence analysts.
Key Departure Ports and Primary Destinations
Departure Hubs
The primary departure hubs for shadow tankers are located in the Baltic (Ust-Luga and Primorsk terminals) and the Black Sea (Tuapse and Novorossiysk terminals). In the first half of 2024, these terminals accounted for 42% of Russian seaborne hydrocarbon exports. These vessels frequently operate under the flags of convenience from countries like Gabon, Liberia, and the Cook Islands, and regularly call at Russian oil ports including Primorsk, Ust-Luga, Vyssotsk, and St. Petersburg.
Routes and Destinations
Shadow fleet units primarily utilize three strategic corridors:
Baltic Route: From the Baltic to Asian destinations, transiting through the North Sea and circumnavigating the northern UK to bypass traditional chokepoints like the English Channel.
Black Sea Route: From Tuapse and Novorossiysk terminals towards the Mediterranean, with primary destinations in the Middle East and Asia.
Arctic Route: Utilizing ports such as Murmansk, operational for 7-8 months a year, en route to Asian destinations via the Northern Sea Route.
Operational tactics employed include spoofed geolocation data, false routing, switched-off communications, and ship-to-ship transfers in international waters.
New FSB Security Directives
Vessels originating from foreign ports are now permitted to enter Russian ports only with the explicit authorization of the respective seaport captain, which must be coordinated with a Federal Security Service (FSB) official. This decree was signed by Vladimir Putin in response to new EU sanctions, mandating FSB approval for foreign vessel access to Russian ports.
This directive, issued on July 21, 2025, is a precautionary measure aimed at preventing potential damage to Russian port infrastructure and shadow fleet units during loading operations. The imposition of mandatory FSB pre-authorization underscores Russia's escalating concern for the security of its illicit commercial naval operations.(@SONARROW_OSINT)
Recent Incidents and Attacks on Shadow Fleet Units
Infrastructure Sabotage
The most significant escalation in recent months involves the direct participation of the shadow fleet in sabotage operations against critical Western infrastructure. The tanker Eagle S, suspected of being part of Russia's "ghost fleet," is implicated in damaging the EstLink 2 power cable between Finland and Estonia on December 25, 2024, reportedly using its anchor.
Kinetic Attacks against Units
Since January 2025, there has been an intensification of attacks against shadow fleet tankers. Six tankers have been struck by explosions of unknown origin, all occurring after the vessels had made calls at Russian ports. The latest incident involves the Eco Wizard, which experienced two detonations ten minutes apart on July 6 while berthed. This pattern of attacks suggests the existence of coordinated maritime counter-intelligence operations, designed to degrade the shadow fleet's operational capability through direct action.
Protection and Escort of Units: The Estonia Case
Russia has demonstrated a willingness to actively protect its shadow fleet units through direct intervention. The recent incident involving the tanker Green Admire, detained by Russian authorities while transiting a route previously agreed upon with Estonia and Finland, highlights the crucial and controversial role of Moscow's "shadow fleet."
This episode underscores how Moscow is escalating its protective posture towards shadow fleet units, directly challenging international agreements to ensure the protection of its illicit commercial operations. For the first time, a Russian warship, the corvette Boyky, directly escorted two tankers of the "shadow fleet" through the English Channel, providing direct protection to these commercial units.
Evasion Tactics and Alternative Routes
Diversification of Arctic Routes
To counter intensified controls on traditional routes, Russia has shifted some of its shadow fleet activities towards Arctic ports such as Murmansk. However, these represent a fallback solution, as they are only navigable for seven to eight months of the year.
Northern UK Routes
Shadow fleet units have developed navigation patterns aimed at evading controls by circumnavigating the northern UK, exploiting international waters to minimize exposure to Western maritime authority inspections. This tactic enables them to avoid traditional chokepoints like the English Channel, where joint NATO patrols increase the likelihood of interdiction and inspection.
Institutional Response and Countermeasures
NATO and the EU have initiated a monitoring mission following suspicious incidents attributed to the Russian "ghost fleet" and have introduced new sanctions. The intensification of countermeasures indicates recognition of the shadow fleet as a systemic threat to maritime security and Western economic stability.
Intelligence Assessment
The Russian shadow fleet currently serves as a multi-purpose instrument for Moscow: economically, it circumvents oil sanctions; operationally, it provides sabotage capabilities against critical infrastructure; strategically, it constitutes a power projection asset in the maritime domain.
The tactical evolution towards utilizing Arctic and northern routes, combined with active protection of units by Russian authorities, indicates a maturation of the operational concept. The series of kinetic attacks against tankers suggests the existence of coordinated counter-operations, likely conducted through proxies or Western special units.
Continuous monitoring via specialized databases like sketchy.boats and collaborative intelligence remain the most effective tools for tracking and neutralizing this asymmetric threat in the maritime domain.
Comentários