Russia’s Shadow Fleet’s Been Busy…

This week marked the three-year anniversary of the Russian invasion of Ukraine (February 24, 2025). As we’ve discussed at length, the war has driven the emergence of Russia’s shadow fleet, or gray and dark fleets. They are used for smuggling Russian cargo while appearing legitimate, or at least trying to evade detection.

As if commemorating its own anniversary, the shadow fleet has been exceptionally active these past few weeks. 

Let’s dive in!

First-Time Visits

Over the recent 30-day period (January 25-February 24, 2025), 461 vessels flagged for sanctions compliance risk related to the Russian regime conducted 716 first-time visits to ports around the world. 

First-time visits are not inherently suspicious, but when occurring in bulk, specifically by vessels of interest that are related to sanctioned regimes, they could indicate: 

• New sanction evasion methods
• New trade relations being forged
• Other noteworthy trends 

This is why first-time visits in new geographies constitute an anomaly that is flagged in Windward’s platform, allowing users to scrutinize and monitor such events. 

A closer look at where these first visits occurred shows that the highest number was unexpectedly in Ukraine (30 visits), followed by Malaysia (25 visits). All of these vessels are affiliated with the Russian regime, either through ownership or behavioral indicators (port calls, for example). 

Several are also marked as high or moderate risk for smuggling. Among the higher-risk vessel groups, Malaysia emerged as the leading destination for first visits.

As Western sanctions have tightened on its popular third-country allies, such as India and China, Russia has been seeking new markets and transit routes for its oil exports. Malaysia has clearly emerged as one of the new destinations for the shadow fleet.

Malaysia’s position in Southeast Asia makes it an attractive transit point or destination for Russian oil exports, especially given the expanding Asian market for Russian oil. Unlike EU countries, Malaysia may have less rigorous enforcement of Western sanctions, making it a more accessible destination for the shadow fleet.

Security Incidents Involving Russian Shadow Fleet Tankers 

Italian port authorities reported an incident in the Savona port area buoy on February 14. Malta-flagged oil-product tanker Seajewel reported two explosions heard by the ship’s crew while offloading at one of the port’s offshore terminal buoys. 

Divers’ investigation of the Greek-owned vessel known to regularly trade Russian oil revealed two holes in the ship’s hull and dead fish around it. This raises the likelihood of an initiated explosion by an external factor. The vessel was transporting oil from Russia to Europe in violation of sanctions when these explosions occurred.

Windward’s Maritime AI™ platform flagged the Seajewel as high risk for sanction compliance back in November 2024, based on its port calls in Russia, dark activity, and suspicious cargo. 

There was another suspicious explosion earlier this month, on February 9, in Ust Luga, Russia. It involved the Antigua and Barbuda-flagged crude oil tanker Koala, which was reportedly damaged by mines near the port. 

The Koala was flagged on February 4 by Windward as a moderate risk for smuggling, due to multiple and recent identity changes, irregular business structure, and dark activities, which is added to its sanctions compliance high-risk score, in part for being owned by a sanctioned company (Cyprus-based). 

Suspicious Movements Around Turkish Underwater Cables  

There were reports in recent months that submarine cables were sabotaged in areas frequented by countries on either side of geopolitical divides – Russia and EU countries in the Baltic Sea, and China and Taiwan in the South China Sea. These events prompted probes into vessels that may be involved. Many of the vessels at the center of these investigations are shadow fleet ships.

Windward analysts detected suspicious movements around the Mednautilus Submarine System infrastructure, located in the Sea of Marmara. A gray fleet vessel, sailing under the Panama flag and marked as a moderate smuggling risk and moderate compliance risk, displayed unusual behavior above the cable – including unusual loitering multiple times in February.

That’s not all. Looking further into the vessel’s history, we found additional cases of long periods of loitering above submarine cables. The same vessel conducted slow-speed sailing around the C-Lion cable in November and December 2024. 

Before that, suspicious slow-speed sailing near Italy’s (Sicily) and Malta’s cable infrastructure in July 2024.

The Lines are Blurring – Do You Have a Clear Picture?

Shadow fleet vessels have been getting around:

• Exploring new territories to evade sanctions
• Being targeted by mysterious explosions
• Conducting highly unusual loitering near critical infrastructure

Shadow fleet vessels do not merely smuggle Russian oil and goods (which is a serious problem in and of itself). They are also used for cutting critical underwater cables and other nefarious activities. Traders and shippers, government agencies, and supply chain organizations must know what these vessels are up to, despite the difficulties of seeing into the “shadows.” 

Windward can help! 

Organizations must leverage technology – such as AI ship-to-ship models, data analytics and AI-powered monitoring tools – to significantly enhance risk-based due diligence efforts and detect potential red flags with greater accuracy and efficiency.

Our Maritime AI™ platform offers actionable visibility, so users can better understand how trade flows are changing, detect deceptive shipping practices, and stay on top of what is happening with the gray and dark fleets. Business intelligence can also mitigate risk for bunkering organizations and quickly spotlight new opportunities. 

And our new Critical Maritime Infrastructure Protection solution delivers real-time monitoring, behavioral analysis, and automated monitoring to safeguard these vital lifelines.

I Want to See a Spotlight on the Shadows