Subsea Cable Surveys Are Converging on the Same Behavioral Signature

At a Glance

• Six state-linked vessels operated above 11 subsea cable systems across the Pacific and Atlantic, plus a Baltic corridor between July and August 2026.
• The behavior is consistent, with sustained low-speed grid tracklines and multi-day dwell directly above cable routes.
• One Atlantic survey logged more than 550 hours of station-keeping across two cable systems, with over 209 hours on each individually.
• Most of these vessels have no prior recorded presence above the specific cables they surveyed.
• None of it required AIS manipulation, which is what makes it hard to catch with conventional screening.

Four Vessels Worked Five Pacific Cable Systems Simultaneously

Four Chinese state-owned research vessels conducted surveys directly above five Pacific cable systems this summer. Pacific Light Cable Network, Hawaiki, Bulikula, Honotua, and Juno.

Each shows the same behavioral profile of sustained low speed, grid tracklines, and multi-day dwell in position, consistent with systematic cable mapping rather than transit or general oceanographic work.

One vessel ran a 13-day systematic grid survey directly over the Pacific Light Cable Network in the Taiwan Strait and Bashi Channel.

A second held a tight-grid station-keeping posture for more than 9.5 days between the Hawaiki and Bulikula cables in the Central Pacific, a corridor where it has no prior recorded presence.

A third was positioned over the Honotua route linking French Polynesia and Hawaii.

A fourth sat above the Juno cable connecting Japan and the United States, immediately after completing a multi-day survey in the northwest Pacific. The trackline is the clearest illustration in the set of what systematic mapping looks like, a dense lawnmower grid laid directly across the cable route.

Three of the four have no logged presence above these specific cable locations before this summer. That detail separates this from routine research activity. A vessel with a decade of survey history in a region produces a different signal than one appearing above a named cable corridor for the first time.

That comparison requires years of activity history at vessel level. Windward’s Maritime AI™ behavioral models hold the full activity record for the global fleet, which is what makes a first-time appearance visible as an event rather than as an unremarkable position report.

The Taiwan Strait survey carries additional weight given the operating environment. Taiwan’s Ministry of Digital Affairs recorded seven submarine cable incidents in coastal waters in 2025, three caused by anchor dragging and two of those by illegal anchoring from foreign flag-of-convenience vessels. Two 2025 cases have since ended in criminal convictions, one involving a Togolese-flagged cargo vessel and one a Chinese fishing vessel.

One Atlantic Survey Ran 550 Hours Across Six Cable Systems

A Russian oceanographic vessel operated by a state institute under the Russian Academy of Sciences tracked above six transatlantic cable systems in two distinct phases between July 23 and August 23, 2026. Dunant, Amitié, Grace Hopper, Marea, Anjana, and Nuvem.

Phase one ran July 24 to 29 in the transatlantic corridor near 43 to 45 degrees north, with three stops totaling more than 26 hours.

Phase two is the significant one. From July 31 to August 23, the vessel held sustained loitering and station-keeping positions above Anjana and Nuvem in the Bermuda-Azores corridor, accumulating more than 550 hours combined and over 209 hours on each cable individually. The most intensive period ran August 11 to 13. The track progressed steadily from 31 degrees west to 21 degrees west through the Azores EEZ.

Windward confirmed the vessel on station independently of its own transmissions. All-source operational intelligence returned a SAR detection on August 17 at 07:49 UTC, placing it directly in the Nuvem corridor. The vessel was transmitting AIS at the time, and the two agreed. The point is that the confirmation did not depend on that.

Timing matters. Nuvem came ashore at Sines, Portugal on July 21, 2026. The vessel entered the corridor 10 days later and concentrated its longest dwell on the newest cable in the region and its nearest neighbor.

Windward assesses the two-phase structure as a stronger behavioral signature than a single loitering event. A survey pass across multiple systems, followed by 23 days concentrated on one recently commissioned cable, describes a sequence rather than a coincidence.

There was no AIS manipulation, no dark activity, and no identity changes across either phase. The presence was continuous and overt.

That fits a documented pattern. A cross-border investigation by Dutch outlet Pointer, working with journalists from six other countries, used decoded AIS and more than 1,000 intercepted Morse messages to identify at least 72 Russian research vessels linked to spying or sabotage, making 428 voyages since February 2022 across the Baltic and North Seas.

In April 2026, the UK disclosed a month-long deployment involving an Akula-class attack submarine and two deep-sea research submarines operating over critical infrastructure in the North Atlantic. Defense Secretary John Healey said there was no evidence of damage to cables or pipelines. Norway’s Ministry of Defence confirmed the activity was carried out by GUGI, describing it as evidence of Russia developing capabilities for mapping and potentially sabotaging Western infrastructure at depth.

The Baltic Case Shows the Pattern on a Commercial Hull

Not every case involves a research vessel.

A Liberia-flagged bulk carrier spent approximately 71 hours between August 15 and 18, 2026 inside the Finland-Estonia subsea cable corridor. The activity breaks down as 9.3 hours standing, 13.3 hours low-speed drifting, and 39.8 hours low-speed anchored, with 41.9 hours of that inside Estonia’s EEZ, before the vessel resumed transit west.

The position sits in one of the densest critical infrastructure areas in European waters. EESF-3 is the Helsinki-Tallinn telecom cluster comprising FEC-1, FEC-2, EESF-2, the Baltic Sea Submarine Cable and E-FINEST, the Estlink 1 HVDC interconnector, and the C-Lion1 telecom trunk running Helsinki to Rostock.

What preceded the loitering is what conventional screening needs to catch. The vessel had just completed a 61-hour port call at Ust-Luga in Russia, bracketed by three AIS gaps totaling 64.8 hours. The longest, 25.7 hours, occurred during the exit transit. Windward flagged the vessel as high compliance risk under the Russia program.

During the loitering itself, AIS was continuous. No dark periods, no MMSI changes, no spoofing.

That distinction matters, because the corridor has recorded three subsea infrastructure incidents in under two years, and each involved a vessel that had just called at a Russian port.

In October 2023, the Balticconnector gas pipeline linking Finland and Estonia was severed by anchor drag, and Estonian police suspected the same vessel of damaging telecom cables to Finland and Sweden the day before, on its way to a port near St Petersburg.

On December 25, 2024, a tanker that had departed Ust-Luga with a cargo of oil products was suspected of cutting five submarine cables in the Gulf of Finland by dragging its anchor roughly 90 kilometers, including the Estlink 2 power cable. Cable owners faced at least 60 million euros in immediate repair costs. Finland charged the captain and first officer in August 2025, but a Finnish court dismissed the case in October 2025, finding that prosecutors had not proven intent and that negligence would fall to the flag state or the crew’s home countries.

On December 31, 2025, a cargo vessel sailing from St Petersburg to Haifa was detained by Finnish authorities with its anchor chain lowered after damage to a Helsinki-Tallinn cable in Estonia’s EEZ. Two crew members were arrested, and the investigation continues.

The 2024 case involved AIS anomalies during the transit that caused the damage. The vessel loitering in the corridor last month produced none. Clean AIS throughout, with the anomalies sitting upstream in the voyage.

The Common Signature Is Dwell, Not Deception

Across the Pacific, Atlantic, and Baltic, six vessels, two state affiliations, and both research and commercial hulls, the recurring indicator is the same. Extended time held in position directly above cable infrastructure, at speeds and in patterns inconsistent with the vessel’s stated purpose or transit.

None of these cases turns on spoofing. The Atlantic survey was transparent for a month. The Baltic loitering was transparent for its full duration. The Pacific vessels operated under their declared identities.

That is the operational problem. Screening built to catch deception finds nothing here, because there is no deception to find. The signal is in what the vessel did, how long it did it, and where. Detecting it requires an activity baseline for the vessel and a geofenced understanding of what sits on the seabed underneath it.

A vessel holding position for 209 hours above a cable that came ashore three weeks earlier is not anomalous because it hid something. It is anomalous because research vessels do not normally do that, and because this one had never done it there before.

What Infrastructure Owners and Agencies Should Be Monitoring

Baseline the vessel, not the flag. First-time presence above a specific corridor is a stronger indicator than nationality or ownership. Three of the four Pacific vessels had no history at the cables they surveyed, which is only visible with historical activity data at vessel level.

Geofence the asset, not the region. A cable corridor is a narrow polygon. Regional monitoring produces noise. Area-defined monitoring built around the actual route, with custom risk profiles and behavioral anomaly alerts, turns ambiguous loitering into a specific, reportable event.

Verify across sources, not against one. The Atlantic detection did not come from the vessel’s own broadcast. When a vessel goes dark, as the Baltic carrier did for 64.8 hours around a Russian port call, cooperative signals stop being an input at all.

Treat voyage history as part of the assessment. The Baltic vessel looked clean during the loitering. The dark activity sat one leg earlier. Assessing behavior only at the point of concern would have returned nothing actionable.

Detection Is a Fusion Problem, Not a Tracking Problem

None of these cases resolves from a single data source.

The Pacific surveys are visible as anomalies only against years of prior activity for each vessel. The Atlantic loitering required independent confirmation of position across 23 days. The Baltic case turns on connecting a clean loitering window to dark activity that occurred on an earlier leg, then to a compliance risk assessment built on ownership, port call history, and behavioral indicators rather than a sanctions list.

Windward’s Critical Maritime Infrastructure Protection is built for exactly this distinction. In open water, it flags vessels conducting suspicious research or survey activity, the standard cover for intelligence gathering near deep-sea infrastructure, and identifies the entities, affiliated vessels, and states behind them. Slow transit speeds and equipment deployment patterns give those missions away at depth. In shallow water, where most damage is unintentional but a growing share is deliberate, the task is separating the two using the same behavioral evidence. Monitoring is built around precise asset locations rather than broad regions, so a vessel entering a cable corridor produces an alert with vessel identity, ownership context, detected behavior, and proximity attached.

Where the concern is a corridor rather than a fixed asset, Mission Area Monitoring provides persistent all-source coverage organized around the operational use case instead of a static set of coordinates. AIS, satellite imagery, RF, digital presence signals, open-source intelligence, and any other necessary sources are fused and correlated as each detection arrives, which is what prevents a gap in one source from becoming a gap in the picture. Historical coverage is included from the start, so the activity baseline that makes a first-time presence legible as a change exists on day one rather than accumulating over months.

The Pattern Is Establishing Itself Faster Than the Response

Eleven cable systems across the Pacific and Atlantic saw sustained state-linked vessel presence in roughly one month. A Baltic corridor with three infrastructure incidents in two years recorded another 71 hours of unexplained loitering directly above it.

None of these events has been attributed to a confirmed act of sabotage, and none should be described as one. What can be said is narrower and still consequential. The behavior is consistent, and it is being repeated across theaters by different actors. In most cases, it is occurring above cables that these vessels had never been recorded above before.

The infrastructure is fixed and cannot be moved. The monitoring can be.

Written by Maya Romi, Windward Maritime Intelligence Content Specialist. Insights by Windward’s MIOC analysts.