What Is Dark Activity, and Why Is It Surging in 2026?

At a Glance

• Dark activity refers to periods when a vessel stops broadcasting its Automatic Identification System (AIS) signal, during which the vessel’s position, course, and identity are not visible in the maritime tracking picture.
• Not all dark activity is illicit, with legitimate operational, technical, safety, and security justifications accounting for a share of the total, but sustained dark activity can conceal port calls, ship-to-ship transfers, cargo movements, and other activity that matters for compliance, enforcement, and intelligence.
• Windward’s Q2 2026 Maritime Risk Report tracked 2,157 unique cargo ships and tankers over 10,000 DWT conducting at least one prolonged dark activity event during the quarter, nearly five times the 449 vessels recorded in Q1.
• The number of prolonged dark activity events rose from 451 in Q1 to 3,137 in Q2, a sevenfold increase driven substantially by the operational realities of the Iran-Ukraine dual conflict environment.
• Russia recorded the highest concentration of dark activity globally in Q2, with nearly 4,000 individual events, while the Middle East Gulf accounted for one in four extended dark events as vessels stranded during the Hormuz closure switched off AIS for safety and security reasons.
• The compliance, insurance, legal, and naval intelligence communities have all had to adapt to an environment where dark activity is not episodic — it is a persistent operational feature that requires all-source intelligence to see through.

What Is Dark Activity?

Dark activity refers to periods when a commercial vessel intentionally stops broadcasting its Automatic Identification System, or AIS, signal. When a vessel goes dark, its position, course, speed, and identity are no longer visible to the shore-based and satellite-based tracking systems that comprise the global maritime picture. 

The vessel effectively removes itself from the operational view of regulators, insurers, port authorities, and other maritime stakeholders that rely on AIS as the foundational tracking signal.

Not every AIS gap counts as dark activity in the analytically meaningful sense. Brief outages of a few minutes or hours can result from technical issues, weather interference, satellite coverage gaps, or antenna problems. These short gaps are common across the global fleet and do not signal any operational anomaly.

The analytically important category is prolonged dark activity, defined by extended outages of three days or longer. A three-day AIS outage is long enough to conceal a port call, a ship-to-ship transfer, a cargo loading or discharge operation, or a deviation from an ordered voyage route. Below three days, most AIS gaps have plausible operational explanations. Above three days, the gap becomes a period where activity of consequence may have occurred without visibility in the tracking record.

Prolonged dark activity is not automatically illicit. Legitimate operational, technical, safety, and security factors can all explain why a vessel would deactivate AIS for an extended period. Naval and paramilitary operations sometimes require AIS silencing. 

Vessels transiting piracy-prone waters may deactivate AIS as a security measure. Ships operating in active war-risk zones may silence AIS with owner and flag state consent to reduce the vessel’s electronic signature and risk profile. These legitimate cases are a meaningful share of the total dark activity record.

The remaining share is where the operational and compliance concern concentrates. Prolonged dark activity that conceals sanctioned port calls, ship-to-ship transfers with sanctioned vessels, cargo loading at prohibited terminals, or voyage deviations that expose insurers, regulators, and counterparties to enforcement risk. Even when this share is smaller than the legitimate cases, it carries disproportionate risk. 

A single undetected sanctioned port call, ship-to-ship transfer with a designated vessel, or unauthorized cargo movement can trigger enforcement action, invalidate insurance coverage, expose financial institutions to sanctions violations, and compromise legal positions in charter disputes. This is why every prolonged dark activity event requires investigation, regardless of how small the illicit share of dark activity is overall.

Distinguishing the two categories is the analytical work that dark activity monitoring requires.

Why Is Dark Activity Surging in 2026?

Windward’s Q2 2026 Maritime Risk Report documented a substantial surge in dark activity across the global commercial fleet. 

A total of 2,157 unique cargo ships and tankers over 10,000 DWT conducted at least one dark activity event lasting more than three days during Q2, nearly five times the 449 vessels recorded in Q1. The number of prolonged dark activity events rose even more sharply, from 451 in Q1 to 3,137 in Q2, a sevenfold increase quarter over quarter.

Two operational realities are driving the surge:

1. The Iran Conflict and the Hormuz Closure

Following the outbreak of the Iran conflict on February 28, 2026, vessel traffic through the Strait of Hormuz collapsed. Visible AIS transits fell by more than 83% from pre-conflict baselines. A meaningful share of the remaining traffic transiting the Strait went dark, in many cases legitimately, with owner and flag state consent, for safety and security reasons in a war-risk environment. Vessels stranded in the Middle East Gulf during the closure also frequently switched off AIS as they waited for conditions to improve or transited out through the U.S.-supported southern corridor through Omani waters.

2. The Ukraine War and Russian Dark Fleet Operations

The ongoing Russia-Ukraine war has continued to shape maritime activity across 2026, with successive rounds of U.S., UK, and EU sanctions targeting Russian oil, LNG, and shipping infrastructure. Russia’s response has been to expand and evolve its shadow fleet, the network of tankers, ownership structures, and service providers that move Russian energy exports outside conventional enforcement reach. Dark activity is a core operational tool in that ecosystem.

Russia recorded the highest concentration of dark activity globally in Q2, with nearly 4,000 individual events. This reflects the operational reality of the Russian shadow fleet, which continues to move sanctioned crude, refined products, and LNG through networks designed to evade Western enforcement. Dark activity is used to conceal port calls at sanctioned terminals, ship-to-ship transfers with sanctioned counterparties, and cargo movements that would otherwise trigger regulatory action.

The geographic shift between Q1 and Q2 is striking. In Q1 2026, Indonesia, China, and Romania recorded the highest volumes of prolonged dark activity, with Russia ranking fourth. In Q2, Russia moved to the top, and the Middle East Gulf jurisdictions of Saudi Arabia, Oman, Iran, and the UAE collectively accounted for one in four extended dark events. Indonesia, China, and Vietnam remained among the busiest locations. This geographic redistribution reflects how quickly the operational environment can shift when major geopolitical events change the calculus for vessel operators worldwide.

Dark Activity in the Strait of Hormuz

The Hormuz situation is worth examining in more detail because it illustrates the dual-use nature of dark activity clearly.

Following the outbreak of the Iran conflict, visible AIS transits through the Strait collapsed. 

February 2026 recorded approximately 3,750 AIS-visible monthly transits. March fell to 450. Traffic began to rebound in mid-June following the June 17 Memorandum of Understanding between Iran and the U.S. and the formal lifting of the blockade on June 18. Transit volumes rose above 20 crossings per day, and Chinese-affiliated and European-owned vessels resumed movement. The recovery appeared short-lived. On June 20, Iran announced the Strait was closed again and reinstated the Persian Gulf Strait Authority (PGSA) toll and clearance system.

Traffic through the Strait continued to fluctuate through the remainder of the quarter, and even after the partial recovery, June remained approximately 83% below the pre-conflict baseline.

Behind that headline decline in visible transits, a growing share of the vessels still moving through the Strait were operating with AIS switched off. Some of those dark transits were legitimate. Vessels stranded during the closure switched off AIS for safety and security reasons, with owner and flag state consent. Vessels transiting the U.S.-supported southern corridor with military escort silencing AIS to reduce their electronic signature.

Dark activity in the Strait of Hormuz served dual purposes. The same operational tool that gave stranded merchant vessels a defensible safety measure also gave the shadow fleet a concealment tool. Distinguishing the two, in near real time, is one of the analytical challenges the current environment has produced.

A composite pattern illustrates what dark activity looks like in this environment. A vessel approaches the Strait of Hormuz broadcasting AIS. As it enters the war-risk zone, AIS is switched off. The vessel disappears from the tracking picture for a defined window. When AIS is restored, the vessel is at a different position, its cargo condition may have changed, and its declared voyage may no longer match what actually occurred. The dark window is where the operational question lives, and it is where compliance teams, insurers, legal counsel, and enforcement authorities now need to focus their analytical attention.

What Dark Activity Can Conceal

Prolonged dark activity is analytically important because of what a vessel can do during the period when it is not broadcasting position.

Unreported Port Calls

A vessel can enter a sanctioned or prohibited port, complete a full loading or discharge operation, and depart, all within a dark window of a few days. The port call does not appear in the AIS record. The vessel’s declared voyage history shows a clean routing.

Ship-to-Ship Transfers

Two vessels can rendezvous in international waters or in a jurisdictional gray zone, transfer cargo between them, and depart in different directions. If both vessels are dark during the transfer, the event is invisible in AIS. This is a common tool in shadow fleet operations for moving sanctioned cargo between vessels of different flag or ownership profiles.

Cargo Diversion or Contamination

Cargo loaded at one port and declared for one destination can be redirected, offloaded partially, or blended with cargo from another vessel during a dark window. The receiving party at the declared destination has no visibility into what actually happened during transit.

Voyage Deviations

A vessel can deviate from an ordered voyage route to visit ports, transit areas, or conduct activities that the charter or the cargo interest did not authorize. If the deviation happens during a dark window, the operational record shows only the entry and exit points of the darkness.

Unauthorized Loading or Discharge

A vessel can conduct cargo operations at facilities that its documentation does not authorize, or without the operator or flag state’s knowledge. These operations produce no AIS record if the vessel is dark.

For compliance teams, insurers, and enforcement authorities, the presence of a prolonged dark activity event is not conclusive evidence of any of these concealments. But it is the operational condition under which each of them becomes possible. Investigating what happened during a dark window is where the analytical work now concentrates.

Who Needs to Understand Dark Activity?

Dark activity has become an operational concern across multiple stakeholder communities.

Compliance teams at banks, marine insurers, commodity traders, and shipping companies need to detect dark activity as part of counterparty screening and voyage risk assessment. A vessel with a history of prolonged dark activity carries different risk than a vessel with a clean AIS record, regardless of what its documentation shows.

Naval forces and coast guards need dark activity intelligence to support maritime domain awareness, interdiction operations, and enforcement. A vessel operating dark in a region of interest is a candidate for further investigation, whether the mission is sanctions enforcement, counter-narcotics, or protection of critical maritime infrastructure.

Cable and offshore infrastructure operators need dark activity monitoring to detect vessels that may pose risk to subsea cables, pipelines, or offshore platforms. A vessel loitering above critical infrastructure with AIS switched off is exactly the operational pattern that recent enforcement guidance has focused on.

Legal counsel and arbitrators handling charter disputes, cargo claims, and marine insurance litigation need dark activity reconstruction to establish what happened during periods when a vessel was not self-reporting. The evidentiary question in many current maritime disputes is exactly this reconstruction.

Regulators and enforcement agencies need dark activity intelligence to support sanctions designations, investigations, and enforcement actions against vessels and entities operating outside the conventional maritime order.

How Is Dark Activity Detected?

Because dark activity is defined by the absence of an AIS signal, detecting it in itself is straightforward. Any vessel that has been broadcasting and then stops for three or more days is producing a prolonged dark event. The analytical challenge is not detecting the darkness. It is understanding what happened during it.

Understanding what happened requires multi-sensor intelligence that does not depend on the vessel’s own broadcasts. Several sensor and analytical inputs contribute.

Satellite Imagery

Synthetic aperture radar (SAR) and electro-optical (EO) imagery can detect vessel presence at specific locations regardless of whether the vessel is broadcasting AIS. High-resolution EO imagery can also confirm vessel identity through distinguishing features when the resolution supports it.

Radio Frequency Detection

Vessels emit RF signals from their operational systems even when AIS is off. RF detection can provide an independent positioning signal that confirms or contradicts a vessel’s inferred location during a dark window.

Behavioral Pattern Analysis

A vessel’s operational history, ownership profile, flag history, and comparative behavior against similar vessels of similar type all provide analytical context. A vessel that has gone dark under conditions consistent with its historical operational pattern carries different risk than a vessel that has gone dark in an anomalous manner.

Multi-Sensor Fusion

When these inputs are combined, they produce a reconstructed picture of what the vessel likely did during the dark window, with the specific sensor and analytical inputs that support the conclusion. No single source produces certainty. Together, they produce a defensible operational picture.

What This Means for the Environment Ahead

Dark activity is not a temporary anomaly. The Q2 2026 surge reflects operational realities — the Iran conflict, the ongoing Ukraine war, and the growth of the shadow fleet — that are not going to reverse in the near term. Dark activity will remain a persistent feature of the maritime environment across the coming quarters and likely years.

The stakeholder communities that have adapted to this reality already are the ones that treat dark activity as an operational condition to be monitored, investigated, and understood, rather than as an anomaly to be flagged and set aside. The communities that continue to treat dark activity as an edge case will find their analytical picture increasingly incomplete as the share of maritime traffic operating dark for meaningful periods continues to grow.

The tools required to see through dark activity are available. All-source intelligence, behavioral pattern analysis, and reconstruction of activity during dark windows are all operational realities in 2026. The distinction between practitioners who can operate effectively in this environment and those who cannot is increasingly about analytical infrastructure, not about access to data.

How Windward Sees Through Dark Windows

Windward’s Maritime AI™ Platform tracks dark activity as a foundational element of the vessel risk picture. All-Source Operational Intelligence fuses AIS with satellite imagery, radio frequency detection, and behavioral context to reconstruct what vessels are doing during dark windows, independent of what their broadcasts show or fail to show.

Know Your Vessel (KYV™) consolidates the vessel-specific risk picture across historical behavior, ownership, flag, and identity, providing the baseline against which dark activity is analytically meaningful. Behavioral pattern recognition surfaces the operational patterns that mark shadow fleet activity, cable-proximate risk, and sanctions evasion behavior.

For compliance teams, insurers, naval procurement, legal counsel, and infrastructure operators, the analytical fit is direct. Dark activity is where the operational picture goes quiet. Multi-sensor intelligence is what allows that picture to remain readable when the primary signal goes silent.

Based on Windward’s Q2 2026 Maritime Risk Report. Researched and written by Maya Romi, Maritime Intelligence Content Specialist, Windward