What Is the Dark Fleet? How Shadow Tankers Fund Sanctioned Regimes

At a Glance

• The dark fleet refers to tankers that use deceptive shipping practices to move sanctioned oil outside international enforcement.
• These vessels rely on AIS manipulation, false flags, and opaque ownership to evade accountability.
• The shadow fleet is often used interchangeably, but typically refers to the operational subset actively trading sanctioned cargo.
• Dark fleet operations are designed to preserve oil revenue for sanctioned states, not merely to bypass sanctions.
• The scale and coordination of these networks place them firmly in the realm of gray-zone maritime activity.
• Effective response requires network-level intelligence, not vessel-by-vessel monitoring.

What Is the Dark Fleet?

The dark fleet is a loose but increasingly well-defined group of oil tankers and cargo vessels that engage in deceptive shipping practices to transport sanctioned oil and other restricted commodities. These vessels continue trading globally while deliberately complicating detection, attribution, and enforcement under international maritime regulation.

Unlike traditional illicit shipping, the dark fleet does not rely on secrecy alone. Its operators exploit the cooperative assumptions built into maritime systems, relying on the expectation that vessels will broadcast accurate positions, sail under legitimate flags, and maintain transparent ownership and insurance structures.

Windward has identified over 1,900 dark fleet vessels operating as of Q3 2025. While similar practices existed for years, the scale expanded sharply following the invasion of Ukraine, as Russia sought to sustain oil revenues under Western sanctions. Estimates suggest that around 10% of tankers globally are now involved in sanctioned or illicit oil trades.

Dark Fleet vs. Gray Fleet vs. Shadow Fleet: What’s the Difference?

The terms dark fleet, gray fleet, and shadow fleet are often used interchangeably in public discourse, but they describe distinct layers of risk within the same ecosystem. Treating them as synonyms obscures how sanctioned oil actually moves and makes enforcement, compliance, and due diligence less effective.

In Windward’s framework, the shadow fleet is the umbrella concept. It refers to the full ecosystem of vessels that rely on deceptive shipping practices to move sanctioned or high-risk commodities while concealing origin, ownership, or destination. Within that ecosystem sit two behaviorally distinct groups: the dark fleet and the gray fleet.

The dark fleet represents the highest-risk, non-cooperative core. These vessels deliberately hide activity through AIS-off behavior, GNSS manipulation, false or fraudulent flags, identity laundering, and covert ship-to-ship transfers. They are central to opaque and sanctions-linked commodity flows.

The gray fleet is a newer, behavior-based category that emerged after the Russia-Ukraine war. Gray fleet vessels are not necessarily sanctioned and are not automatically off-limits for business. Instead, they exhibit Russia-linked risk indicators such as irregular trading routes, rapid ownership changes, high-risk port sequences, or structural ambiguity designed to appear compliant while requiring deeper verification. Placement in the gray fleet is dynamic and behavior-driven, not a legal determination.

Together, the dark and gray fleets form what is commonly referred to as the shadow fleet. This layered structure explains how sanctioned oil continues to move at scale while distributing risk across vessels, registries, ownership entities, and routes.

This distinction is not semantic. It is operational.

The dark fleet provides the infrastructure of deception. The gray fleet provides scale, flexibility, and plausible compliance. Together, they form a shadow fleet capable of sustaining sanctioned oil flows despite sanctions, price caps, and insurance restrictions.

Understanding where a vessel sits within this structure determines whether the right response is interdiction, enhanced due diligence, commercial disengagement, or continued monitoring. Without this clarity, organizations either overreact and block legitimate trade or underreact and absorb avoidable risk.

Real-World Examples: How the Dark Fleet Operates in Practice

The dark fleet is not an abstract concept. Its impact is visible in recent enforcement and security incidents where deceptive shipping practices moved from theory to consequence.

One of the clearest examples is the U.S. seizure of the VLCC Skipper off Venezuela. At the time of boarding, Skipper’s AIS placed the vessel more than 500 nautical miles away, off the coast of Guyana. In reality, Remote Sensing Intelligence confirmed the tanker was nowhere near its declared position. The vessel had been conducting GNSS manipulation for weeks, broadcasting false coordinates while loading sanctioned Venezuelan crude at the José terminal.

Skipper was also falsely flying the flag of Guyana, a registry that has not existed since 2021, rendering the vessel effectively stateless. Sanctioned since 2022 for supporting Iran- and Hezbollah-linked oil smuggling, Skipper exemplified how dark fleet tactics combine AIS spoofing, false flags, and legal ambiguity to sustain sanctioned trade until enforcement intervenes.

Similar dynamics have played out in the Black Sea, where Ukrainian naval drone strikes targeted Russia-trading tankers such as Kairos and Virat. Both vessels falsely claimed registration under Gambia despite being removed from that registry for fraudulent certification. Their lack of legitimate flag-state protection complicated insurance, salvage, and jurisdictional responsibility after the attacks.

In the case of Kairos, Windward analysis showed the tanker being towed with AIS disabled across maritime boundaries before being abandoned near Bulgaria’s coast. The incident triggered a multi-state response and highlighted the environmental, legal, and security risks posed by falsely flagged, uninsured vessels.

These cases demonstrate how dark fleet behavior scales into gray-zone risk. Vessels appear commercial on paper yet operate outside regulatory safeguards, forcing governments to respond under legal and political ambiguity. What connects these incidents is not geography or cargo alone, but a shared operating model built on deceptive identity, manipulated location data, weak or fraudulent registration, and ownership structures designed to delay accountability.

How Sanctioned Oil Moves Globally

Sanctioned oil does not move in a straight line from producer to buyer. Instead, it flows through multi-leg, multi-vessel networks designed to obscure origin, custody, and control across the shadow fleet ecosystem.

In higher-risk cases involving the dark fleet, operations may include loading at sanctioned ports while spoofing AIS positions, conducting covert ship-to-ship transfers in loosely regulated waters, and using relay chains of tankers to distance cargo from its source.

Gray fleet activity often appears more compliant on the surface. These vessels may broadcast AIS continuously and call at legitimate ports, while still relying on ownership opacity, irregular routing, or high-risk port sequences that introduce ambiguity rather than outright concealment.

Across both categories, the objective is not invisibility but plausible deniability. Sanctioned oil continues to move because no single signal conclusively proves wrongdoing unless vessel behavior, identity, and network connections are analyzed together.

What the Data Reveals About the Dark Fleet Today

The dark fleet is no longer a marginal phenomenon. By Q3 2025, more than 1,900 vessels were operating as part of the dark fleet, reflecting how sanctions pressure has driven scale, coordination, and adaptation rather than deterrence.

More than 64% of dark fleet vessels identified by Windward are now sanctioned by at least one regulator, rising to 71% among large crude tankers over 80,000 DWT. Yet transparency has not followed. The beneficial ownership of roughly 60% of these vessels remains unknown, creating persistent attribution gaps that delay enforcement.

Flag usage shows rapid adaptation. Russia, Panama, and Comoros remain dominant registries, even as Panama-flagged vessels declined sharply quarter-on-quarter. Gambia and Sierra Leone have emerged as new hubs as other registries begin removing sanctioned ships.

Taken together, these patterns reveal an organized system rather than isolated actors. Risk is distributed across vessels, flags, ownership entities, and routes, ensuring that no single enforcement action halts the flow of sanctioned oil.

Why Dark Fleet Vessels Evade Accountability

Dark fleet vessels are engineered to fall between enforcement thresholds.

Many operate under false or fraudulent flags, rendering them effectively stateless. Ownership is hidden behind layered shell companies designed to complicate due diligence. Critically, these vessels often maintain “clean” AIS records that are consistent but inaccurate, allowing them to claim compliance while undermining transparency.

The result is a fleet that is legally ambiguous, operationally active, uninsured or improperly classed, and highly adaptive to new sanctions.

Why the Dark Fleet Is a Gray-Zone Maritime Challenge

Dark fleet vessels are engineered to fall between enforcement thresholds.

Many operate under false or fraudulent flags, leaving them effectively stateless at critical moments. Ownership is frequently obscured through layered shell companies and nominee structures that delay attribution and complicate due diligence. In parallel, these vessels often continue broadcasting AIS data that appears consistent on its own but does not reflect actual movements, creating a surface-level appearance of compliance while undermining transparency.

The result is a fleet that remains legally ambiguous yet operationally active, often uninsured or improperly classed, and able to adapt quickly as sanctions and enforcement measures evolve.

From Vessels to Networks

Understanding the dark fleet requires moving beyond individual ships.

What matters is how vessels connect over time through ownership structures, flag changes, ship-to-ship interactions, routing patterns, and shared operational behavior. Visual Link Analysis brings these relationships into view by mapping how ships, companies, registries, and events intersect across regions and time. Remote Sensing Intelligence strengthens this analysis by independently verifying where vessels physically operate, allowing network relationships to be grounded in confirmed activity rather than declared AIS data alone.

When examined in isolation, many dark fleet vessels appear compliant or ambiguous. When viewed as a network, patterns emerge. Repeated associations, coordinated behavior, and shared infrastructure reveal systems designed to move sanctioned oil at scale while delaying accountability.

The dark fleet has thrived by exploiting fragmentation across jurisdictions, data sources, and enforcement mandates. Closing that gap requires intelligence that connects behavior, identity, and relationships into a single operational picture.

This is the shift now confronting governments and regulators. The challenge is no longer identifying suspicious vessels one by one, but understanding how maritime networks function as instruments of gray-zone activity and acting accordingly.