WHITEPAPERS

Maritime Drug Trafficking in 2026: What Coast Guards Need to Know

Request a demo

What’s inside?

Introduction

In April 2026, a Panamanian-flagged general cargo vessel made an unusual series of port calls in the Eastern Caribbean — the only time in at least a year it had appeared anywhere in the region or the Americas. Before those calls, its history included two extended periods of AIS darkness, one during a transit through the Mozambique Channel, a well-documented drug trafficking corridor. Its ownership structure is opaque: a single-ship registered company in Panama with Turkish management, a configuration that Windward’s AI-driven risk analysis rates as “critical” based on identity changes, flag-of-convenience registration, and opaque ownership. Of the 17 vessels in the same fleet, Windward identifies 10 as carrying a “moderate risk” rating.

As of late April 2026, the vessel is mid-Atlantic, bound for Las Palmas in the Canary Islands, a well-established waypoint on cocaine routes from the Caribbean to Europe.

No contraband has been confirmed aboard. No charges have been filed. But the behavioral arc — the dark activity in a known trafficking corridor, the anomalous Caribbean calls, the opaque ownership, the route to a known transit hub — is precisely the kind of pattern that has preceded major seizures in recent months. A coast guard cutter dispatched on current position and flag data alone would have no reason to intercept it. The case for a second look rests entirely on the behavioral and ownership records behind the AIS feed.

That gap between what the data shows and what a vessel is actually doing is the central challenge this whitepaper addresses.

The central argument is straightforward: AIS-based monitoring alone is no longer sufficient. The vessels now carrying the most significant drug loads are specifically designed to be invisible to it. Defeating them requires behavioral intelligence fused with satellite imagery. A multi-source approach that examines what a vessel has done over time, not just where it claims to be right now.

The Scale of the Problem

The numbers from fiscal year 2025 are striking. The U.S. Coast Guard seized a record 510,000 pounds of cocaine — more than three times its annual average. European agencies report comparable pressure at their end of the pipeline, and in the first 17 days of 2026 alone, multilateral forces intercepted over 9 metric tons in French Polynesian waters, a record for that territory.

These figures are, in one sense, a measure of success. In another, they reveal the structural challenge coast guard agencies face: even record interdiction rates represent a fraction of total flows. The cocaine trade has not contracted under enforcement pressure, it has diversified, opening new corridors, reactivating dormant assets, and refining evasion techniques faster than enforcement infrastructure can adapt.

The Source: Ecuador’s Guayaquil Corridor

Any analysis of maritime cocaine flows begins in Ecuador. The Guayaquil corridor has by 2025 consolidated into one of the world’s primary exit points for industrial-scale cocaine, with local gangs acting as logistics brokers between Colombian and Peruvian producers and Mexican cartel and European/Balkan distribution networks.

What makes Guayaquil particularly difficult to address is the structural alignment between its legitimate and illicit trade. Ecuador is the world’s largest banana exporter, and the same reefer infrastructure, multiple terminals, and hinterland trucking networks that make it globally competitive in perishable commodities also lower the cost of cocaine insertion to near zero — from plantation packhouses and road corridors, to the terminals themselves, to offshore boarding by small craft known as “spidermen” who climb vessel hulls in the Guayas estuary to place cocaine inside containers.

Windward’s satellite imagery analysis from February 1, 2026, illustrates the problem at the Posorja deep-water terminal directly: of 19 vessels detected around the port, 13 were not transmitting AIS. This dense layer of non-cooperative small craft (precisely the vessel type used for offshore boarding operations) is invisible to any AIS-based monitoring system, yet fully visible to satellite. Posorja’s ocean-facing design compounds the risk: its straight channel to open water gives small boats short-run access to large container vessels just before or after departure, with a more diffuse enforcement environment than the inner terminals. By the time a vessel loaded offshore at Posorja appears on a coast guard radar screen mid-Atlantic, the drugs have been aboard for days.

Posorja Terminal, 1 February, 2026. Of the 19 vessels detected, 13 with no AIS transmission.
Source: Windward Maritime AI™ Platform

65–75% of Gulf crude exports go to Asia. India sits in the middle of that supply chain, and the disruption arrived without warning in the monitoring systems of organizations that depend on AIS to tell them what is moving and where.

Across the same geography, dark fleet activity continued to expand. Windward’s tracked dark fleet reached 2,108 vessels in Q1 2026, up 45 from Q4 2025, with 48% sanctioned and 1.77 million barrels per day of Iranian crude flowing through it daily. That fleet operates across the same sea lanes that connect the Gulf to Indian refineries and Indian Ocean ports. The vessels moving that crude have a demonstrated operational interest in not being accurately tracked.

The vessel’s voyage since its last call at Miami port.
Source: Windward Maritime AI™ Platform

Tahiti region vessel analysis (Feb 10, 2026): Non-AIS ("dark") vessels (red markings). Note enlarged "dark" vessels with connected wakes, suggesting post-STS transfer. — MSI analysis showing no vessel detected at the vessel’s reported location (left), and a matching non-transmitting vessel 16nm south-east (right).
Source: Windward Maritime AI™ Platform

The New Frontier: The Pacific Drug Highway

Intensified enforcement in the Caribbean and Atlantic has had a predictable geographic consequence. Transnational criminal organizations have opened a high-volume corridor through French Polynesia, exploiting its 5 million square kilometer EEZ as a transshipment node. Remote atolls in the Tuamotu and Marquesas archipelagos serve as ship-to-ship transfer points, with bulk cocaine moving from mother ships to smaller vessels for the final approach to Australian and New Zealand markets.

The MV RAIDER case defines this corridor’s operational profile. Windward’s behavioral analytics flagged the MV RAIDER as elevated risk within two weeks of its reappearance after nearly four years of dormancy in the Honduras EEZ, based on the combination of multi-year inactivity, a rapid MMSI change, and provisional Togo flag registration, and a first-ever Panama Canal transit heading west into the Pacific. French naval forces interdicted the vessel on January 16, 2026, seizing 4.87 tonnes of cocaine estimated at close to $150 million. The drugs were not detectable before the interdiction. The behavior was.

Windward’s satellite imagery of the Tahiti region on February 10, 2026, identified 18 vessels operating without AIS transmissions, including two exhibiting a “merged tail” signature: a behavioral anomaly consistent with post-ship-to-ship transfer separation. Neither vessel was visible to AIS monitoring. Both were visible to satellites. The French Polynesian EEZ covers an area comparable to the continental United States; no patrol asset roster can generate that coverage. Imagery can.

The Evasion Toolkit: What Agencies Need to Recognize

Across all three regions, the same techniques recur. Recognizing them as a system — not isolated anomalies — is essential for coast guard analysts building risk assessments and commanders making deployment decisions.

Dormancy and reactivation. Vessels inactive for years are reactivated for single trafficking voyages. With no recent behavioral history in enforcement databases, they are effectively new entities. Dormancy followed by abrupt reactivation, particularly when accompanied by identity changes, is a primary warning signal: the RAIDER after four years, the Caribbean vessel accumulating 33 dark events post-reflagging.

Identity manipulation and flag cycling. Clustered changes — name, MMSI, and flag simultaneously, followed immediately by a geographic pivot — are a recognized trafficking-preparation signature, distinct from routine administrative reflagging, which does not typically involve identity overhaul and route change together.

AIS suppression and position spoofing. The most significant trend is the combination: suppressing AIS while transmitting a false position. Windward’s February 2026 Caribbean case demonstrated this directly — the vessel’s AIS was active, and it was 16 nautical miles from where it claimed to be. Coast guard boarding teams increasingly encounter vessels whose AIS histories look clean but whose physical tracks, reconstructed through imagery, tell a different story.

Exploitation of legitimate trade flows. From banana reefers at Guayaquil to refrigerated containers transiting Polynesia, TCOs embed illicit cargo within commercial flows specifically to exploit enforcement constraints — limited inspection windows, liability concerns over spoiled perishables, and throughput pressure at major terminals.

At-sea transfers to non-AIS craft. Small, fast, non-transmitting vessels handle the final delivery leg — either offshore boarding of commercial ships or open-water transfers between mother and daughter vessels. By the time a patrol asset arrives, the transfer is complete and the small boats are gone.

The Intelligence Imperative: Behavior and Imagery

When a vessel suppresses its AIS, AIS-based monitoring stops seeing it. When it spoofs its position, monitoring sees the wrong location. For coast guard agencies, this means conventional surveillance leaves exactly the gap that modern trafficking has learned to exploit.

Two capabilities close that gap. The first is behavioral intelligence: building risk profiles from months of vessel history rather than current position alone. The OCEANIC TUG had operated a consistent northbound corridor along the Pacific coast of Central America for over a year before, in late August 2025, it began making unexplained southbound loops 80 to 90 nautical miles offshore, stopping in open water with no port calls. Three such trips. No commercial explanation. Panamanian authorities interdicted the vessel on November 10, 2025, seizing 13.5 tonnes of cocaine valued at over $200 million. The behavior had been the signal throughout.

The second capability is satellite imagery — particularly SAR, which operates regardless of weather or time of day. In each of the cases documented here, SAR provided the verification layer that behavioral analysis alone could not: confirming the RAIDER’s location and activity independent of its AIS; finding the Caribbean vessel displaced from its reported position; detecting 18 dark vessels off Tahiti, two with post-transfer behavioral signatures. For coast guard agencies managing vast patrol areas with finite cutters, imagery is the force multiplier that extends effective coverage without additional physical assets.

Together, behavioral analytics and imagery convert maritime intelligence from a reactive tool into a targeting system — identifying which vessels among hundreds warrant priority attention before they enter a patrol zone, and building the evidentiary record that supports prosecution rather than release at the moment of boarding.

The Coast Guard Challenge: Prioritization at Scale

Coast guard agencies worldwide face a structural constraint that has no simple solution. The domain is too large; the assets are finite; each deployment creates exposure elsewhere.

The U.S. Coast Guard is responsible for over 4.5 million square miles of ocean, with roughly 250 cutters simultaneously engaged in search and rescue, law enforcement, border security, and national defense. European coast guard agencies face comparable imbalances across the Mediterranean and Atlantic approaches. In the Pacific, where the new drug highway is now established, the ratio of patrol assets to EEZ coverage is even thinner.

Sending a cutter to the wrong location is not simply a fuel cost. It is an unobserved area, a forfeited opportunity, and crew fatigue for a mission that produced nothing. In a domain where traffickers have learned to read patrol patterns and time their movements accordingly, misallocated deployments actively create the gaps that criminal networks exploit. The challenge is not presence — it is prioritization.

The trafficking vessels documented in this report were not identified through conventional position-based monitoring. They were identified because behavioral analysis caught what AIS alone could not: the RAIDER’s four-year dormancy followed by a sudden identity change and anomalous Pacific transit; the Caribbean vessel’s 33.5-day dark period and post-reflagging geographic pivot; the OCEANIC TUG’s unexplained open-water loops with no port calls. Each was a signal. Together, they formed a profile. A profile built before a vessel enters a patrol zone allows a commander to deploy with confidence rather than with probability.

Oceanic Tug anchored hours before departing on its last voyage (SAR imagery)
Source: Windward Maritime AI™ Platform — *Oceanic Tug* anchored hours before departing on its last voyage (SAR imagery)
Source: Windward Maritime AI™ Platform

Conclusion

The maritime cocaine trade in 2026 is adaptive, distributed, and increasingly invisible to conventional monitoring. It flows through Ecuador’s export infrastructure, through Haiti’s gang-controlled coastline, and across thousands of miles of open Pacific. The vessels carrying it are old, cheap, and built to evade — cycling identities, going dark for weeks, and exploiting the commercial constraints that limit port inspection.

For coast guard agencies, this is not an abstract intelligence problem. It is a daily operational one: which vessel warrants a cutter deployment, which AIS anomaly is signal and which is noise, which reflagging is administrative and which is preparation. Getting those calls wrong means wasted deployments, fatigued crews, and coverage gaps that criminal networks have learned to anticipate.

The vessel described at the opening of this report is mid-Atlantic. It has done nothing illegal that can be confirmed. But the story written in its behavioral data — the dark corridor transit, the anomalous Caribbean calls, the opaque ownership, the route to a known transit hub — warrants close attention before it arrives in port. Reading that story, and acting on it before a vessel clears customs rather than after, is what modern maritime enforcement demands.

🇮🇷 TRACK VESSEL ACTIVITY IN THE STRAIT OF HORMUZ 🇮🇷