Alleged Grain Heist: A Bold Move by Russia Revealed

Risk & Compliance

What’s inside?

    Turkish customs authorities detained Zhibek Zholy, a Russian cargo ship carrying grain that Ukraine says is stolen, Ukraine’s ambassador to Turkey said on Sunday, according to reporting by CNBC and many other outlets. 

    The Windward Predictive Intelligence platform has interesting details and behavioral insights regarding the vessel in question and ownership companies. When compared to previous grain thefts and smuggling, the behavior in this incident is different and may show a bolder Russian strategy

    Brief Vessel & Ownership History

    The Zhibek Zholy cargo ship has a high risk rating since July 2021 from Windward’s AI-based, Maritime AITM technology based on its history of port calls, dark activities and Iran-adjacent loitering. It also sails under a sanctioned country’s flag (Russia) and is operated by a company based in a sanctioned country (also Russia). 

    Image 1 – Zhibek Zholy risk profile from the Windward Maritime AI™ platform – showing it was flagged as high risk since July 2021

    Zhibek Zholy is currently owned (registered owner) by Ktz Epress shipping and the beneficial owner is Ktz Express Jsc, a Kazakhstan-based company. GreenLine LLC, a Russian company, assumed the operator role on February 24, 2022, the first day of the Russian invasion. 

    The vessel has a history of engaging in dark activities around countries with shared borders near the Caspian Sea – Iran, Azerbaijan, Turkmenistan, Russia, etc. 

    Dark Activity Incidents in the Past Months 

    The vessel’s general method of operation since the war began appears to involve several dark activities occurring north of the Kerch Strait (not far from Kavkaz Port, Russia). The dark activity usually lasts either six or 11 days. When the vessel comes back online, its draft increases, suggesting that it may have loaded cargo while its AIS transponder was turned off. The vessel then sails to Turkey, where its draft updates show a decrease, suggesting that it may have offloaded cargo while at port. and offloads (based on its draft updates). It has been doing this since March, 2022

    For instance, between March 11-22, the vessel engaged in dark activity in Russian waters, at the northern end of the Kerch Strait. After the dark activity ended, the vessel’s draft increased from 3.3 to 4.5. Then on March 27, it went to Ambarli port, Turkey, where its draft decreased from 4.5 to 3.3, suggesting it offloaded a significant amount of cargo. 

    Between April 7-13, the vessel conducted dark activity in Russian waters, again north of the Kerch Strait. After coming back online, the vessel updated its draft from 3.3 to 4.6, suggesting it likely loaded cargo while its AIS was off. 

    Image 2 – The vessel’s journey between April 3 and 13, with its dark activity between April 7 and 13.

    The vessel then updated its destination to Bandirma port, Turkey, which it reached on April 23. It updated its draft from 4.6 to 3.2 following its port call, suggesting that the vessel offloaded cargo at Bandirma Port, Turkey. 

    From June 11-13, the vessel conducted dark activity in Turkey, right outside of Gulluk Port. This DA is notable, as all of its other dark activities were in Russian waters and above the Kerch Strait. The vessel’s draft increased from 3.3 to 4.7, suggesting it loaded cargo while dark. On June 18, the vessel conducted a port call at Novorossiysk port, Russia, where its draft decreased from 4.5 to 3.7. 

    Current Incident

    The vessel updated its destination to the port of Azov, Russia, on June 25. It then changed its destination to Ukraine, Berdiansk, and amere ten minutes later, the vessel changed its destination back to the port of Azov, Russia. 

    Approximately 30 minutes later, the vessel went dark in Russian waters, north of the Kerch Strait. The dark activity ended four days later on the 29th, in the same area of the Kerch Strait where the vessel usually turns its AIS back on. Notably, the vessel came back online on the Ukrainian side of the strait, which it had not done before. All of the other dark activities in Russian waters started and ended in the same area of the Russian EEZ.

    Image 3 – The vessel making its dark port call at Berdiansk on June 29th (Source: Planet Labs)

    The vessel’s draft update showed an increase from 3.4 to 4.7, indicating it loaded cargo. The vessel then updated its destination to the port of Karasu, Turkey, which it expected to reach on July 1. On June 30, the vessel arrived at the Turkish EEZ. It has been anchored since July 1.

    A New Wheat Theft & Smuggling Strategy?

    Most of the Russian wheat smuggling has followed a pattern, according to Windward’s proprietary, AI-based data. 

    The usual method in confirmed cases – Matros Koshka, Matros Pozynich, and Mikhail Nenashev – is:  

    • Dark activity between Turkish and Ukrainian waters, or dark activity starting and ending in Ukrainian waters near Crimea.
    • The vessel sails to Turkey and makes a port call (Nenashev), or sails to the Eastern Mediterranean and goes dark in Turkey or Cyprus to complete its journey to Syria, where it will offload while dark. 
    • Vessels will frequently say their destination is Kavkaz, Russia, before going dark. They also say Beirut, Lebanon, is their destination when heading out of Russia, and then they go dark and go to Syria instead (Koshka). 
    • When the vessels are dark in Ukraine, they are often at the grain terminal at Sevastopol, according to open sources who confirmed this via satellite. Satellites also helped catch at least one (Pozynich) at Latakia, Syria, offloading. 

    Comparing the routes of the three confirmed smugglers vs. Zhibek Zholy’s route shows the disparity in loading/off-loading areas and methods: 

    Image 4 – On the left: the paths of the three confirmed grain smuggling vessels (Matros Koshka, Matros Pozynich, and Mikhail Nenashev); On the right: The Zhibek Zholy’s path since the war began (February 24-July 3)

    This latest incident involving Zhibek Zholy is interesting, because it happened in the Sea of Azov, and in mainland Ukraine, not Crimea, where the other grain smuggling vessels have been spotted at Sevastopol. Russia seized Berdiansk in February. Is traveling to mainland Ukraine part of a brazen new grain smuggling strategy by Russia? 

    Matros Pozynich is currently dark in or near Ukraine, which may mean it is engaged in illegal activities involving grain. Windward will continue monitoring the situation…

    Stay on top of behavioral changes with 14-days of free access!

    Everything you need to know about Maritime AI™ direct to your inbox

    subscribe background image