Vessels Loiter Over Subsea Cables and Pipelines Across Five Theaters

At a Glance

• Two Chinese state-linked vessels spent September running structured survey grids over separate transpacific subsea cable corridors, one around the Guam cable hub and one over the Japan to U.S. cables east of Japan.
• A third Chinese research vessel has been holding station in the Bashi Channel inside the Philippine EEZ since September 22 while spoofing its AIS position more than 2,000 nautical miles away, with its destination field reading “TOWING 1NM CABLE.”
• Two vessels are holding position over the Bab el-Mandeb cable corridor off Djibouti, one a Russia-linked bulk carrier loitering for more than eight days, the other a zombie identity spoofing its position for six weeks after departing the Houthi-held port of Hodeidah.
• Two sanctioned tankers that loaded at Primorsk a day apart ran matching 40- and 45-hour loiters over the FLAGS and Alwyn-Frigg gas pipelines feeding St Fergus, which supplies 25 to 50% of Britain’s gas.
• Two Russian-flagged tugs, one towing a barge fitted with a seabed-capable excavator, have spent a month over the Kattegat and Skagerrak cable corridors, prompting a Danish municipality to activate its crisis group.
• A Russian trawler with a documented IUU record has been working just outside Canada’s EEZ directly above five transatlantic cables since late August.
• Saudi terminals in the Middle East Gulf loaded 3,911 kbpd of crude between September 1 and 27, more than four times the August figure, with only four of 55 tankers calling with AIS on.
• Roughly 75 high-speed craft were observed swarming off Khasab on September 26, the largest swarm tracked since late June.
• Windward’s visual link analysis has connected 45 Russia-trading shadow fleet tankers to a single untraceable Hong Kong nominee director.

Chinese Survey Grids Converge on the Guam and Japan Cable Corridors

Two Chinese state-linked vessels have spent September running structured survey grids over separate transpacific subsea cable corridors, one around the Guam cable hub and one over the Japan to U.S. cables east of Japan.

A Chinese-flagged fishery patrol vessel operated by a state fishery research institute has run research-pattern grids on both sides of the Guam subsea cable hub for seven weeks. From August 31 to around September 20, it worked a grid east of Guam between the Bulikula and SEA-US cables. After crossing the Guam and CNMI EEZ between September 20 and 22, it began a second grid west of Guam in the Philippine Sea, still running as of September 29. From August 11 to 29, it had conducted similar activity next to the Philippine EEZ. On September 13, it met a Cook Islands-flagged tanker east of Guam for approximately six hours, likely to refuel. AIS has remained on throughout.

This is the first time the vessel has conducted this kind of activity in the region, having previously operated around China and occasionally in the Indian Ocean. The north-to-south legs and repeated slow-speed stops resemble a survey rather than a fishery patrol or a transit. Both grids sit on cable routes landing at Guam, the landing point for 11 subsea cables and a principal link between the U.S. and Asia. The activity fits a wider pattern of Chinese research vessels mapping the seabed around the Philippines, Guam, Hawaii and Wake. 

The head of U.S. Naval Intelligence has said this data enables submarine navigation, concealment, and the positioning of seabed sensors or weapons. In mid-2025, a Chinese research vessel ran a comparable lawnmower mapping pattern just outside Guam’s EEZ for more than five weeks. A fishery patrol vessel draws less attention than a declared research ship, and its grids sit directly on the cable routes. Seven weeks of back-to-back activity, most of it around the Guam cable hub, supported by a tanker meeting that allows it to stay at sea, points to possible deliberate mapping of the seabed and cables around Guam.

Separately, a Chinese research vessel owned by a state university has been running a research grid east of Japan in the Northwest Pacific since September 11. Over 18 days, it made 27 low-speed research stops across an area crossed by the JUNO, Jupiter, FASTER, Topaz, Unity, PLCN, Pacific Crossing-1 and TGN-Pacific cables, which link Japan, Taiwan and the Philippines to the U.S. Its AIS stayed on throughout, and it is now heading southwest at 13 knots.

This is the vessel’s fourth trip to the same area since May 2024 and the first since November 2025. Each trip lasted 18 to 24 days and followed the same route through the Luzon Strait past Japan. Before 2024, the vessel worked mostly in the South China Sea. Returning to the same cable corridor every six to twelve months builds a multi-year record of the seabed and water conditions over these cables, which is the data needed to locate and reach them. A U.S. congressional commission report has warned that China is building dual-use capabilities to target transpacific cables.

A Research Vessel Spoofs Its Position Over the Luzon Strait Cables

A Chinese research vessel has been holding station in the Bashi Channel since 22 September, about 38 nm northwest of Itbayat, Batanes, inside the Philippine EEZ, while its AIS reports it somewhere else entirely.

The vessel left Xiamen on 19 September and sailed south past Taiwan into the strait. Windward data shows AIS spoofing and jamming around it while it loiters in a tight box over the cable routes, its reported track jumping between false positions while the ship itself appears to stay put. Its AIS destination field reads “TOWING 1NM CABLE.” The Philippine Coast Guard says the ship’s AIS placed it off Papua New Guinea, more than 2,000 nm away, that it ignored repeated radio challenges, and that the behavior is consistent with an unauthorized seabed survey.

The loitering box sits over the cables that run through the Luzon Strait: SEA-ME-WE 3, the China-US Cable Network, SJC, EAC-C2C, APCN-2 and the FLAG North Asia Loop, all of which also land in mainland China or Hong Kong. The same corridor carries cables that do not touch China at all: the TPU Taiwan–Philippines–U.S. system, in service since May 2026, and the planned AUG East linking Taiwan, the Philippines, Japan and Southeast Asia. Disrupting those would not affect Chinese traffic.

A vessel holding position over cable routes, concealing its location, and reporting a destination that reads like towed survey gear is consistent with seabed survey work, not transit or routine research. It fits a wider pattern of Chinese research-vessel activity around Taiwan since June, including operations near Taiwan’s undersea cables.

Windward’s MIOC fused AIS, spoofing and jamming detections, and cable-route data to place the vessel where its AIS said it was not. That is the purpose of all-source operational intelligence: establishing the actual position when the reported one is false.

Two Vessels Hold Position Over the Bab el-Mandeb Cable Corridor

An Antigua and Barbuda-flagged bulk carrier has been loitering at the Gulf of Aden approach to Bab el-Mandeb since September 16, off the coast of Djibouti above the India Europe Xpress, AAE-1 and SeaMeWe-5 cables, for more than eight days with no port call, ship-to-ship transfer or cargo activity. It broadcasts underway using engine at under 1 knot with its destination field set to armed guards onboard. The vessel carries a Windward Russia-related compliance flag dating to January 2026 and was re-registered in July 2026 under a new name, manager, and MMSI, its fourth MMSI and third name change since 2021.

The loiter box sits on the route of three cables, one of which was cut in February 2024 when a drifting ship dragged its anchor across the southern Red Sea seabed. Anchors and fishing gear cause most cable faults worldwide. The seabed here is approximately 268 to 1,380 meters deep, too deep for normal anchoring, which fits the vessel staying under power, but the shallower parts are within reach of a bulk carrier’s full anchor chain. Cables are usually buried only down to 1,000 to 1,500 meters, and below that lie exposed on the seabed. A recently re-registered, Russia-linked bulker holding position over this ground for over a week with no commercial activity has no clear reason to be there, and a single anchor let go in the shallower sections would be the same mechanism that cut cables in the area in 2024.

A second vessel, using the identity of a St Kitts and Nevis-flagged container ship reported dead since 2020, appeared on AIS on July 24 as it left Hodeidah, the Houthi-held port in Yemen. It called at Hodeidah twice more, between July 27 and 29 and between August 8 and 13. Since August 14, it has been spoofing its position, broadcasting a looping track in a tight box just off Djibouti directly over where AAE-1, SeaMeWe-5 and IEX approach their landing points. Across those 41 days, it has made no port calls and done no cargo work, with more than 20 AIS gaps, including a 40.5-hour dark period between September 8 and 10.

This comes as Iran has weighed attacks on Gulf undersea cables, while the Houthis have taken Mocha and islands near Bab el-Mandeb and have reportedly threatened to harm underwater telecommunications cables in the region over the past two years. A zombie vessel reappearing out of Hodeidah and then spoofing its location over one of the region’s main cable landing points for six weeks has no clear commercial explanation, and its Hodeidah origin points to a possible Houthi link.

Matching Loiters Over the Pipelines Feeding Britain’s Main Gas Terminal 

Two crude tankers under UK and EU Russia sanctions, one Chinese-owned and one commercially controlled by a Russian state shipping company since July 12, 2026, loaded at Primorsk a day apart between September 16 and 18 and both declared Port Said as their destination. Both then held position in the same box east of Shetland, the first for approximately 40 hours between September 23 and 25, the second for approximately 45 hours between September 28 and 30.

Both behaved identically, drifting for 6 to 24 hours, steaming a few miles back, then drifting again. The second vessel stopped on the edge of the FLAGS pipeline corridor, then spent approximately 11 hours within 1 nautical mile of the Alwyn-Frigg pipeline and drifted inside its corridor for approximately 2.5 hours. The first began one of its drifts inside the Alwyn-Frigg corridor and later crossed FLAGS on its way out. Neither went dark or met another vessel during the loiters, and the two were never in the box at the same time.

The second vessel is the former tanker of that Russian state shipping company under a previous name. Ukraine’s military intelligence says the operator moved it to its current registered owner through related companies to circumvent sanctions.

FLAGS, owned by Shell and ExxonMobil, carries gas approximately 450 kilometers from the Brent field to St Fergus in Scotland. The Alwyn line, owned by TotalEnergies, feeds the FUKA pipeline, which brings gas from UK and Norwegian northern North Sea fields to the same terminal. St Fergus supplies 25 to 50% of Britain’s gas.

This fits a wider pattern. After the UK said in March it could board sanctioned tankers, two shadow fleet tankers halted off Shetland near North Sea pipelines, and tankers moved from the Channel to the route north of Scotland, the same route the first vessel took on its way out. In the Baltic, a Chinese-owned vessel’s anchor damaged Balticconnector in 2023, a second Chinese vessel was suspected over two cable cuts in 2024, and a shadow fleet tanker was held over the Estlink 2 cable in December 2024. Russia’s spy ship YANTAR, which the UK says maps its undersea cables, operated north of Scotland in November 2025. Two sanctioned tankers with different owners but the same load port, destination and route running the same station-keeping routine over pipelines carrying a large share of Britain’s gas appears to be a set routine rather than coincidence.

Russian Tugs Work the Kattegat and Skagerrak Cable Corridors

A Russian-flagged tug has spent the past month in the undersea cable corridors of the Kattegat and Skagerrak, joined on September 18 by a second tug from the same operator towing a barge fitted with an excavator capable of reaching and working the seabed.

The tugs loitered directly over the power and fiber cables supplying the Danish island of Læsø, prompting the municipality to activate its crisis group and alert the navy and police. Windward EO imagery on September 22 confirmed a 63m Russian-flagged tug in the Kattegat cable corridor, matching its AIS position. By September 25, SAR imagery confirmed a 40 m Russian-flagged tug loitering above the Norwegian branch of Havfrue/AEC-2, a transatlantic cable, in the Skagerrak.

Both vessels are now heading northwest, with Murmansk declared as their AIS destination. With no commercial activity observed and a shift from regional links to a transatlantic cable, Windward assesses the pattern as consistent with a deliberate task, not vessel wandering.

A Russian Trawler With an IUU Record Works Over Transatlantic Cables Off Canada 

A Russian-flagged fishing vessel has been trawling just outside Canada’s EEZ since late August, directly above the Hibernia Express, Hibernia Atlantic, TAT-14, AEConnect and Midgardsormen cables. It is currently approximately 35 nautical miles from the Hebron oil field over seabed 46 to 1,000 meters deep. Its AIS track shows a normal trawling pattern with no gaps or meetings, and a group of Russian fishing vessels regularly trawls this area. Until July, however, the vessel fished the South Atlantic off Uruguay, making the Grand Banks a new area for it this year. Its Russian owner and operator bought it from a Spanish fishing company in August 2024.

Fishing gear and anchors cause 70 to 80% of cable faults worldwide, and most of that damage occurs in water shallower than 300 meters. The entire 46 to 1,000 meter seabed under the vessel’s track is within reach of bottom-trawl gear, and its shallowest parts fall in the range where cables are damaged most often. Trawl doors dig approximately 0.5 meters into soft seabed, while cables on the shelf are usually buried only around 1 meter to protect them from trawlers, so repeated passes over the same route can wear down that cover or snag the cable. Russian fishing vessels have been linked to this before. In January 2022, the Svalbard cable broke after a Russian trawler crossed it approximately 130 times, and an underwater drone later found deep trenches over the cable that could have been dug by trawl doors. Russian trawlers were again tracked repeatedly crossing Svalbard cables this month.

The area is the NAFO Regulatory Area, where Russia holds quotas for redfish, cod and Greenland halibut. The vessel has an IUU record there. Canadian NAFO inspectors cited it three times for directed cod fishing in Division 3L, a serious infringement, in March 2011, for mislabelled product in May 2011, and for harvesting redfish after a fishery closure in August 2013. Its owner’s other vessel has a longer record, cited five times between 2007 and 2018, including for keeping cod after Russia’s quota closed and, in 2017 and 2018, for misreporting redfish catch as serious violations. That vessel has also operated with AIS off near the Canadian EEZ. A new area for the vessel, its risk indicators, its own IUU history and its owner’s record make its presence above five transatlantic cables and a producing oil field moderately suspicious.

An Oil Slick Off the Musandam Tip Reaches the As Salamah Archipelago 

EO imagery from September 29 at 06:46 UTC shows an oil slick of approximately 13 by 20 kilometers off the northern tip of Oman’s Musandam Peninsula, between Kumzar and the As Salamah Archipelago at the entrance to the Strait of Hormuz. It was detected a day after UKMTO reported a vessel struck by a projectile in the Strait on the evening of September 28, which set it on fire. The slick may originate from that strike, though UKMTO gave no exact position and reported no environmental impact.

The drift model shows oil washing onto the As Salamah Archipelago dive sites by the evening of September 29, passing within 2 kilometers of Umm al Ghanam Island and coming within approximately 6 kilometers of Kumzar, a boat-only village with its own desalination plant. Khasab and the rest of the Musandam coast are not reached. Tidal currents reverse approximately every six hours, but a steady south-southeast wind of around 9 meters per second then pushes most of the oil north-northwest across the Strait, reaching Larak Island by September 30 and Qeshm’s south coast by October 1, with most of the slick ashore on the two Iranian islands by October 2. This depends on the wind holding, and the model assumes oil reaching shore stays there and none evaporates. The direction is firmer than the volume, since the ECMWF, GFS and ICON weather models all forecast the same steady wind.

Oil can kill coral or slow its growth, putting the Quoin and Ras Musandam reefs, Musandam’s best-known dive sites, at risk. Kumzar depends on the sea for fishing and for its water, and oil in a harbour fouls boats, nets and catch and usually closes fishing. Desalination plants have to shut their seawater intakes when oil comes close. That matters on a coast where approximately 70 villages draw their water from four floating desalination units. Their positions are not public, but any unit moored near Kumzar or the northern islets would have to stop drawing seawater while the oil passes. The model cannot resolve currents right along the shore, inside Kumzar’s bay or between the islets, so Kumzar may be more exposed than modelled.

Saudi Gulf Crude Loadings Quadruple as Iran’s Hold on Hormuz Weakens

Saudi terminals in the Middle East Gulf loaded 3,911 kbpd of crude between September 1 and 27, more than four times the August figure, though still 39% below the January pre-war baseline of 6,385 kbpd. A tanker shuttle is moving Gulf crude through the southern route of the Strait of Hormuz under U.S. protection, and almost all vessels involved are doing so with AIS switched off. Only 4 of the 55 crude tankers that loaded at Saudi Gulf ports in September called with AIS on.

Windward MIOC assesses that Iran is less able to constrain southern-corridor traffic than it was in mid-summer.

The Largest High-Speed Craft Swarm Since June Forms Off Khasab 

Windward satellite imagery on September 26 showed roughly 75 high-speed craft swarming off Khasab in the Strait of Hormuz, the largest swarm tracked by Windward since approximately 100 craft mid-strait in late June.

The count is well above the norm of 13.6 craft per pass recorded since July across 44 satellite passes, and against a median of 9. No swarms were observed between September 7 and 25. The September 26 swarm follows unverified reports that Iran may be re-mining the strait.

Small craft can lay drifting mines, so a swarm this size could carry real mine-laying capacity if it is more than a show of force. The traffic data, however, shows south-corridor transits are up, not down, since the mining reports began: the south corridor rose from 17% of traffic in July to August to 39% since 7 September, per Windward Hormuz dashboard data combining AIS and satellite imagery.

Yanbu Restarts Exports After Pipeline Repairs 

Two VLCCs and two Suezmax tankers departed the Saudi Red Sea port of Yanbu on September 28, among the first cargoes detected leaving since the September 10 Houthi strikes on the East-West pipeline. The departures were captured with satellite imagery as the vessels called at port without transmitting AIS, and are the first signs that Aramco has made partial repairs to the pipeline.

On September 27, all seven of Yanbu’s crude berths were occupied, with three new tankers then arriving to take the berths that opened up in the north. Yanbu’s late-September export rate is roughly 2.6 mbpd, still below its 3.9 mbpd pre-attack pace per Vortexa, and likely includes stored crude rather than fresh pipeline supply alone. The coming weeks of berth activity will show whether Aramco returns Yanbu to full capacity.

Forty-Five Shadow Fleet Tankers Trace Back to a Single Hong Kong Nominee

Windward visual link analysis has identified 45 Russia-trading shadow fleet tankers connected through 45 single-ship Hong Kong companies to one beneficial owner, a nominee director who cannot be traced. Forty-two of the fleet are sanctioned. All but three share 19 different ISM managers with addresses in the same industrial cluster in the Azerbaijani city of Sumqayit, a former Soviet industrial city on the Caspian coast approximately 30 kilometers north of Baku.

The fleet comprises six Suezmaxes, 33 Aframaxes and six medium-range product tankers, with an average age of 22 years. Thirty-four are flagged with Sierra Leone and nine with Equatorial Guinea. Registered ownership addresses were tracked to 20 virtual offices across Hong Kong, with Kowloon hosting 19 of the 45 owners and a single room in Admiralty covering five tankers.

The tankers have changed names, flags, and companies as many as eight times since 2023, and only became linked as they shifted ownership from Seychelles and Marshall Islands special purpose vehicles to Hong Kong between January and August. The cluster underscores the accelerating shift in shadow fleet ownership and management structures to China, Hong Kong and Russia across 2026, with Windward analysis showing 12% of Russia-trading tankers now registered in China and 10% in Hong Kong, the largest and third-largest countries of incorporation respectively.

Outlook

Five separate theaters recorded vessels holding position over subsea cables or pipelines within the same reporting period, across the Pacific, the Red Sea, the North Sea, the Danish straits, and the North Atlantic. The vessels differ in flag, type, and operator, but the behaviour is consistent: prolonged station-keeping over infrastructure corridors with no port call, no cargo work, and no declared commercial reason. Several carry additional indicators, from a Chinese research vessel spoofing its position by more than 2,000 nautical miles, to two sanctioned tankers running the same routine over the pipelines feeding Britain’s main gas terminal, to a Russian tug pair bringing a seabed-capable excavator into Danish cable corridors.

In the Strait of Hormuz, the picture is moving the other way. Saudi Gulf loadings have quadrupled month on month, southern corridor traffic has risen from 17% to 39% of transits since September 7, and Yanbu has restarted exports after partial pipeline repairs. The 75-craft swarm off Khasab on September 26 is the largest since June, but transit volumes have not fallen in response.