MIOC INTELLIGENCE

Russian Vessel Loiters Above a Subsea Cable For 41 Days

Request a demo

What’s inside?

This analysis was produced by Windward’s Maritime Intelligence Operations Center (MIOC) — a mission-critical operations center powered by Windward’s maritime intelligence experts, operating as a seamless extension of your team. This is a sample of what we deliver. Vessel identifiers and ownership entities referenced in the underlying MIOC investigation have been redacted for external distribution. The behavioral findings reflect AIS data, multi-source signal fusion, and Windward’s Maritime AI™ behavioral models, with human analyst review. For intelligence tailored to your operational theater, visit the MIOC page.

Between February and April 2026, a Russian-flagged service and research vessel completed a five-month deployment from Vladivostok to the Caribbean and back, including a 41-day station-keeping window above a major trans-Atlantic telecommunications cable. The vessel made no port calls, conducted no ship-to-ship transfers, and met no other vessels across the entire voyage. It is owned through a Cyprus-based entity acting on behalf of a Russian parent company designated under OFAC sanctions since February 2023.

This is not an isolated case. It is the latest data point in an expanding pattern of Russian-linked research and survey activity in proximity to critical subsea infrastructure, now extending from the North Atlantic and Baltic into the Western Hemisphere.

What Happened

The vessel is a 36-year-old Russian-flagged service and research asset, 82 meters in length, registered to a Cyprus-based entity that holds the ship on behalf of a Russian parent company designated by OFAC since February 2023. The ownership structure, with a Russian operator behind a Cyprus intermediary, is characteristic of the opacity layers common across Russian-linked research and service fleets operating outside the North Atlantic.

The vessel departed Vladivostok in December 2025 and transited the Panama Canal on February 16, 2026. From that point forward, its pattern of life across the Atlantic broke from declarative voyage data in four distinct windows.

The vessel's route. Source: Windward Maritime AI™ Platform. — The vessel’s route. Source: Windward Maritime AI™ Platform.

(1) Following the Canal transit, AIS broadcasts became inconsistent with the physical behavior expected of a vessel transiting the Caribbean basin. The pattern is consistent with location tampering, a recognized form of deceptive shipping practices used to conceal a vessel’s true position. The behavior persisted for 48 hours, from February 16 to 18, with no ship-to-ship transfers detected during the window.

The vessel's anomalous pattern of life persisted for 48 hours between February 16 and 18, 2026. Source: Windward Maritime AI™ Platform. — The vessel’s anomalous pattern of life persisted for 48 hours between February 16 and 18, 2026. Source: Windward Maritime AI™ Platform.

(2) On February 24 at 18:03 UTC, the vessel sharply reduced speed and held position for 48 hours. On February 26 at 23:45 UTC, it altered course to north-northwest, a deviation inconsistent with its declared destination of Bridgetown, Barbados. After sailing 120 nautical miles, the vessel began loitering again on February 27. By February 28, it had reversed heading and rejoined the original track from February 24. The geometry of the deviation is highly improbable for standard navigation and is consistent with manipulated AIS transmissions concealing the vessel’s actual position during the window.

The vessel’s loitering patterns on February 24 and 27, 2026. Source: Windward Maritime AI™ Platform.

(3) On March 2, the vessel deviated south and bypassed its declared port call at Bridgetown entirely. It arrived off Tobago on March 3 and loitered for 48 hours in a structured back-and-forth pattern. The area is a recognized bunkering zone, but no other vessels were detected in the vicinity during the window. The precision of the back-and-forth track is itself analytically significant and is more consistent with coordinate manipulation than with active maneuvering. The vessel resumed an easterly transit on March 5.

The vessel’s path and back-and-forth pattern on March 3, 2026. Source: Windward Maritime AI™ Platform.

(4) On March 10, 2026, the vessel arrived at a position approximately 850 nautical miles west of Barbados and stopped. For the next 41 days, until April 20, it loitered within an 11-nautical-mile radius, and its speed never exceeded one knot.

The vessel’s loitering patterns between March 10 and April 20, 2026. Source: Windward Maritime AI™ Platform.

Cross-referenced against publicly available subsea infrastructure mapping, the holding position lies in the vicinity of the MONET submarine cable, a 10,556-kilometer trans-Atlantic telecommunications system connecting Boca Raton, Florida, to Fortaleza and Santos in Brazil. MONET is owned by a consortium that includes Google, Algar Telecom, ANTEL, and Angola Cables. The vessel maintained continuous AIS broadcasting throughout the 41-day window. The pattern is consistent with maritime research and survey activity above the cable corridor, a profile that aligns with infrastructure mapping or seabed survey rather than with the vessel’s declared service function.

As of May 14, 2026, the vessel was transiting the Pacific, returning to Russia with an estimated arrival in mid-June.

What It Signals

This deployment should be assessed within the broader pattern of suspected Russian research and survey activity in proximity to subsea infrastructure, rather than as a standalone event.

Russian-linked activity near critical undersea cables and pipelines have drawn sustained attention from European defense and intelligence services. UK and Nordic authorities have publicly identified Russian research and survey assets observed near subsea infrastructure in the North Atlantic, the Baltic, and waters approaching the British Isles. Following the Nord Stream pipeline sabotage in 2022, NATO stood up a Critical Undersea Infrastructure Coordination Cell in February 2023, followed by a dedicated Maritime Centre for the Security of Critical Undersea Infrastructure at Allied Maritime Command in 2024. The seabed has emerged as a domain of hybrid competition between Russia and NATO.

What distinguishes this case is the geography. The vessel did not loiter in the North Atlantic or the Baltic, where Russian deployments have drawn the most consistent enforcement attention. It loitered in the Western Hemisphere, above a cable connecting the United States to Brazil, on a route that carries internet traffic between two of the largest economies in the Americas. The behavior places the deployment in the same analytical category as documented Russian research and survey activity in European waters, but extends the geography westward into a theater where Russian-flagged research assets have not historically operated under this corporate umbrella.

The behavioral footprint adds a second dimension. The vessel did not turn off its AIS, change flag mid-voyage, or attempt to disappear from the global picture. What it did instead was move, loiter, and broadcast in patterns inconsistent with the voyage it declared. Four separate AIS anomalies in sixty days, combined with the 41-day station-keeping window above subsea infrastructure, form a coherent intelligence picture rather than a sequence of unrelated events.

A document-based screen would not have flagged this vessel. Its flag was valid, its filings were in order, and its AIS was on. The behavior is what surfaced the picture.

The ownership layer reinforces the assessment. The use of a Cyprus intermediary on behalf of an OFAC-designated Russian parent is a familiar structure in the post-2022 sanctions environment, in which Russian-linked assets are routinely held through third-country layers to obscure beneficial ownership. This is the vessel’s first recorded visit to the Caribbean and Atlantic basin under the current Russian flag and corporate umbrella, an observation that is itself anomalous for a vessel of this class and service profile.

Read together, the behavioral profile and the ownership structure place the deployment outside the range of activity that can be explained by commercial or scientific service work alone.

What to Monitor

A key question going forward is whether Russian-linked research and survey activity above subsea infrastructure becomes a sustained pattern in the Western Hemisphere, rather than a discrete deployment. The North Atlantic and Baltic precedents suggest such activity, once established in a theater, recurs across multiple vessels and corporate vehicles.

Three specific lines of follow-up are likely to define the analytical picture in the coming months.

The first is whether the same vessel, or other assets under the same Cyprus-Russia ownership structure, return to the Western Hemisphere on similar profiles. Repeat deployments would indicate an established operational pattern rather than a one-off mission.

The second is whether subsequent service disruptions, cable faults, or third-party surveying activity are reported along the corridor where the vessel held station. The 41-day loiter is most analytically valuable when correlated against follow-on events along the same infrastructure segment.

The third is the public posture of enforcement bodies in the U.S., Brazil, and partner states. Acknowledgment of the deployment, formal advisories to subsea infrastructure operators, or adjustments to the monitoring of Russian-linked research and service vessels operating outside the North Atlantic would each indicate that the case has shifted from analytical signal to operational priority.

In parallel, the broader category of Russian-flagged or Russian-owned service and research vessels active outside their traditional theaters warrants continued monitoring. Vessels in this category that combine an OFAC-designated ownership chain, a third-country flag-of-convenience or registry intermediary, and a service profile inconsistent with declared voyage data fit the behavioral pattern this deployment exemplifies.

Mission-Ready Intelligence, at Your Service

Detecting patterns like these requires more than static monitoring. Windward’s MIOC integrates multi-sensor intelligence with Agentic AI to detect, collect, and analyze threats in real time. To discuss ongoing intelligence coverage or ad-hoc forensic deep dives tailored to your operational theater, get in touch with us.