NextFin News - Russian personnel connected to military and security services have been conducting intelligence operations in European waters under the guise of working on oil tankers, according to exclusive reports from Western and Ukrainian intelligence sources. Since the beginning of Russia’s full-scale invasion of Ukraine in 2022, the Kremlin has developed a shadow fleet comprising hundreds of tankers. These ships carry Russian oil from Baltic and Black Sea ports, bypassing Western sanctions and generating hundreds of millions of dollars in revenue annually for Moscow.
Recent intelligence confirms that some of these vessels, which are often registered in foreign countries unrelated to Russia, have taken on additional crew shortly before departure. These new crew members include Russian nationals with backgrounds linked to military and intelligence agencies. Two crew manifests inspected showed predominantly non-Russian crew, but at the bottom listed Russian competitors with valid Russian passports. The presence of these Russian operatives, according to intelligence, is coordinated through Moran Security, a secretive private security firm with deep ties to Russia’s military and intelligence community. Several assigned personnel are former mercenaries affiliated with private military contractors such as the Wagner Group.
Moran Security has been sanctioned by the U.S. Treasury since 2024 for providing armed protection services to Russian state-owned enterprises supporting Moscow’s war efforts in Ukraine. Intelligence sources say Moran’s operatives aboard these tankers act as overseers to ensure captains and crews—mostly non-Russian—comply with Kremlin interests. They also engage in covert espionage, including photographing European military installations, and reportedly some sabotage activities, although details remain scarce.
One prominent example is the tanker Boracay, a sanctioned vessel frequently changing names and registration flags, last boarded in September at the port of Primorsk near St. Petersburg by two Russian operatives listed as technicians. One former operative served in the Wagner group, the other was linked to Russian interior ministry special police. Boracay’s routes traverse sensitive maritime zones such as the Baltic Sea—a strategic chokepoint bordering NATO member states like Denmark and Sweden.
European maritime authorities and pilots have observed Russian personnel exerting disproportionate control aboard these vessels, sometimes wearing military uniforms and exhibiting hostility toward inspections. Notably, shortly after Boracay’s departure from Primorsk in late September, a series of drone incidents occurred disrupting Copenhagen airport and military bases in Denmark, raising suspicions of connection. Though no drones were found aboard the tanker when it was boarded by French military off Brittany in October, the presence of Russian security personnel has heightened concerns over espionage using commercial vessels.
The strategy of embedding armed security specialists and intelligence operatives on commercial tankers enables plausible deniability, complicating attribution and diplomatic response. This tactic fits into Moscow’s broader hybrid warfare approach aiming to destabilize and pressure Europe below the threshold of open conflict. Such operations exploit maritime routes critical for energy supplies and national security interests, increasing geopolitical and economic risks in the region.
The implications extend beyond immediate security concerns. The shadow fleet continues to enable Russia’s circumvention of sanctions designed to undermine its war economy, thereby funding the Kremlin’s protracted military aggression. These covert intelligence activities suggest an evolving use of commercial assets for strategic advantage, blending economic resilience with espionage capabilities.
Looking ahead, European security frameworks face substantial challenges. The vast number of shadow fleet vessels operating near European coasts complicates monitoring and enforcement efforts. Calls for coordinated international action to strengthen maritime registration, insurance regulation, and surveillance capabilities are intensifying. However, responses must carefully balance respect for freedom of navigation with enhanced security protocols to mitigate espionage and sabotage risks.
Given the persistent hybrid threats and the covert nature of Moran Security’s involvement, intelligence-sharing and joint operational readiness among NATO and EU member states are crucial. The evolution of Russia’s shadow fleet from mere sanction evasion to active espionage platforms indicates a shift toward integrated maritime and intelligence strategies in Moscow’s geopolitical contest. This multidimensional approach highlights the need for adaptive and resilient maritime security policies aligned with broader strategic defense imperatives.
In sum, the infiltration of Russian military-linked operatives into commercial vessel crews underlines a novel hybrid warfare vector, challenging Europe’s maritime domain awareness and raising significant questions about the future security landscape of critical energy and shipping corridors.
Explore more exclusive insights at nextfin.ai.
