Why Russian-Linked Vessels Are Loitering Above European Subsea Cables

At a Glance

• Russian-flagged and Russian-linked vessels have been observed exhibiting behavior over European subsea cables with no commercial explanation, including zig-zagging, loitering, AIS gaps, and uneconomic routing directly above critical cable infrastructure.
• The documented case from the Russian shadow fleet involved a Cameroon-flagged sanctioned tanker zig-zagging over subsea cables in the Atlantic in both February and April 2026, with a 24-hour AIS gap above the same waters in January 2026.
• A Russia-flagged, Russia-owned, and sanctioned product tanker made diversions directly over undersea cables off Denmark and Germany in November 2025 and January 2026.
• A small Russia-flagged and sanctioned bunkering tanker was observed loitering over the Svalbard Undersea Cable System in September 2025 and the Greenland Connect cable in June 2025.
• In Q1 2026, Windward recorded more than 2,700 events globally where vessels remained near cable routes for over 24 hours.

Behavior With No Commercial Explanation

The signature is consistent across multiple vessels in different parts of European waters. A tanker arcs off its expected route. It loiters above a cable system, sometimes for hours, sometimes for days. Its AIS goes dark for long enough to obscure precise positioning but short enough to claim transmission failure. It re-emerges, continues on, and the voyage data shows nothing legally anomalous.

In each individual case, the behavior could be explained away as a weather diversion, a mechanical issue, or a signal loss. Examined as isolated events, none of the cases below would necessarily trigger an enforcement response. Examined as a pattern across Russian-flagged and Russian-linked vessels, in proximity to specific critical infrastructure, with similar behavioral signatures, the picture is harder to dismiss.

The vessels are operating in European waters that authorities are watching with increasing scrutiny. Since the Nord Stream pipeline sabotage in 2022, NATO has stood up a Critical Undersea Infrastructure Coordination Cell and a dedicated Maritime Centre for the Security of Critical Undersea Infrastructure at Allied Maritime Command. The seabed has emerged as a domain of gray zone aggression between Russia and NATO, and the vessels below are operating in that environment.

The Cases

Atlantic Cable Zig-Zagging During UK Channel Bypass

One document case involved a Cameroon-flagged tanker, one of 12 Russian shadow fleet vessels documented bypassing the English Channel in repeated diversions around Great Britain. Two of those diversions, in February and April 2026, produced a distinctive secondary pattern. While arcing around the outer edge of the UK’s Exclusive Economic Zone, the vessel did not transit its diversion route in a straight commercial line. The vessel zig-zagged over an area of the Atlantic where subsea cables are present.

A tanker with a declared commercial voyage between Russian Baltic ports and a global destination has no commercial reason to deviate from its arc to cross and re-cross specific stretches of open ocean. The vessel did it twice in two months, in the same waters, while its primary voyage purpose was already a sanctions-driven diversion away from coast guard scrutiny.

The Atlantic zig-zagging was preceded in January 2026 by a separate AIS gap. The vessel did not transmit AIS for just over 24 hours from January 9 to 10, in the same vicinity, while sailing northbound for Russia. AIS gaps of this duration are frequently operational. A tanker that goes dark for 24 hours above the same waters it will later zig-zag across is unusual.

Cable Crossings Off Denmark and Germany

A 40,161 DWT Russia-flagged, Russia-owned, and sanctioned product tanker was tracked in November 2025 and again in January 2026, making diversions that took it directly over undersea cables off the coasts of Denmark and Germany.

The vessel crossed directly over specific cable systems off Denmark and Germany twice in two months, in a region where European authorities are actively monitoring for vessels loitering near undersea cables. This is the kind of repeated pattern that warrants scrutiny.

Loitering Over Svalbard and Greenland Connect Cables

A small Russia-flagged and sanctioned bunkering tanker used to supply Russian fishing vessels was observed loitering over the Svalbard Undersea Cable System, the fiber-optic system connecting the Svalbard archipelago to mainland Norway.

In June 2025, the vessel was observed loitering over the Greenland Connect cable linking Greenland to Iceland and Canada.

Svalbard is a Norwegian territory adjacent to Russian Arctic interests. Greenland Connect is a key data link for North Atlantic communications.

On both occasions, the vessel was tracked above a cable system in circumstances that were unusual and uneconomic. The reasons behind it are not established.

What the Pattern Shows

Windward recorded more than 2,700 events globally where vessels remained near cable routes for over 24 hours during a single quarter. The three cases appear inside that broader data set, and they are clear examples of this behavioral pattern.

In another example, in early 2026, a Russian-flagged research vessel loitered above a major trans-Atlantic telecommunications cable for 41 days.

What Behavioral Intelligence Sees in Each Case

In each of the three cases, the flags are valid, and AIS is active. All carry sanctions designations or Russia-linked ownership that would place them on risk and compliance watchlists.

Behavioral intelligence catches what conventional screening misses. The same vessel zig-zagged over the same waters twice in two months. The product tanker diverted directly over the same cable systems in November 2025 and January 2026. The bunkering vessel held position above two different critical cables in two separate windows in the same year. 

This is the analytical layer that distinguishes cable protection monitoring in 2026 from five years ago. Single-source AIS monitoring sees vessels move. Behavioral intelligence sees what those movements mean across time, across vessels, and against maps of undersea infrastructure.

What This Means for Cable Protection

For cable operators and the public authorities they coordinate with, the cases have three operational implications.

The first is that shadow fleet tankers are now loitering over undersea cables, beyond known cases of research and survey vessels. These tankers have no obvious intelligence function but are exhibiting patterns previously associated with dedicated military or research platforms. Risk and compliance models built around naval intelligence vessels alone will miss this layer.

The second is that pattern recognition across voyages, not document checks, is what surfaces these cases. Watchlists, flag-state checks, and AIS broadcasts alone did not distinguish these vessels. 

The third is that the detection picture is improving, alongside the legal and regulatory framework and the geopolitical backdrop against which European authorities are acting. 

Critical Maritime Infrastructure Protection is Windward’s integrated framework for protecting subsea cables, offshore energy assets, and other critical maritime infrastructure. It combines vessel verification, behavioral risk profiling across multiple voyages, identity and ownership intelligence, and anomaly detection in defined infrastructure corridors. Underneath, Multi-Source Intelligence fuses SAR, EO, RF, AIS, and Maritime AI™ behavioral models into one operational picture that verifies what vessels actually do, surfaces the patterns that precede incidents, and provides the evidence base that operators and government partners can both act on. The cases above are the kinds of vessels this framework is built to surface, before the next incident becomes the case study.