The Return of the Dead: How Zombie Vessels Haunt Maritime Operations

A growing number of vessels are returning from the dead; resurfacing years after being scrapped, deregistered, or declared non-operational. These are known as zombie vessels, a term coined by Windward a few years ago to describe a deceptive shipping practice where a vessel reappears using the identity of a previously dismantled ship.

The phenomenon is not new. But in recent months, it has resurfaced as a pressing issue within the shipping ecosystem. In April 2025, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) formally acknowledged the tactic in a sanctions advisory, marking a turning point: what was once a niche concern is now firmly in the crosshairs of policymakers, regulators, and global insurers.

At its core, a zombie vessel is a ship that should no longer exist. It might have been scrapped in South Asia, deregistered from its flag state, or disappeared from AIS transmission. Then, it reappears; not because the original vessel has come back to life, but because its identity is being assumed by a different, operational vessel. This real-world vessel uses the defunct ship’s identity to mask its own while conducting activities such as sanctions circumvention. It often broadcasts under the same IMO number, possibly in a different location, under a different flag, and resumes operations as if nothing had happened.

This is identity laundering at sea: using a “clean” name to obscure a new actor and bypass compliance systems built to catch only known bad behavior.

Zombie vessels exploit a structural weakness in global maritime compliance: the industry’s overreliance on static identifiers like IMO numbers, vessel names, and flag registries. These data points were designed for uniqueness and permanence, but they weren’t built to withstand intentional manipulation.

In practice, IMO numbers are sometimes reactivated without validation. Flags can be switched with little scrutiny. Ownership structures are layered, opaque, and often housed in offshore jurisdictions.

This combination creates a perfect storm. When a ship reactivates using an identity that was thought to be retired, few systems catch it because most tools check only for known risk. A ship that’s “clean” on paper but behaves like a sanctions evader may pass unnoticed unless behavior is scrutinized.

A typical zombie vessel scenario follows a distinct pattern:

1. A legitimate vessel is scrapped. It’s last seen in a scrapyard, deregistered from its flag, and ceases AIS transmission.

2. The identity goes dormant. For a year or more, it vanishes from global maritime systems.

3. A new vessel adopts the identity. Often in a completely different geography, a ship begins broadcasting using the scrapped vessel’s IMO and name.

4. Operations resume – with a twist. The reactivated vessel now sails near sanctioned zones, conducts suspicious STS operations, or operates under flags of convenience.

5. Static compliance checks fail. Since the vessel has no negative history, it slips past most red-flag systems.

But behavioral models – such as those deployed by Windward –can detect the deception by analyzing behavioral patterns that surpass the “clean” slate of the scrapped identity. A sudden reactivation after years of silence, flag switches within days, or inconsistencies in vessel properties telltale signs.

The risks zombie vessels present go far beyond paperwork. These ships have been linked to:

• Sanctions evasion: Especially in trades involving Iranian or Venezuelan oil. 
• Illicit STS operations: Unregulated ship-to-ship transfers in international waters. 
• False flagging: Rapid registry switches to avoid detection. 
• Insurance fraud: Operating under expired or invalid policies. 

For financial institutions, insurers, and commodity traders, the liability is enormous. Facilitating trade with a sanctioned entity – even unwittingly – can trigger multi-million-dollar penalties.

The problem isn’t that there’s too little data; it’s that the data is often misread or incomplete. For example, flag registries may not update when a vessel is scrapped, and AIS data can be easily manipulated. Bad actors frequently take advantage of this. While some solutions rely on public sources to update when a vessel is scrapped, no solution today tracks when a scrapped vessel resurfaces again under a new guise. This gap creates blind spots in maritime monitoring.

Ship owners and operators often exist behind layers of corporate veils, whether intentionally or not, making attribution and tracking even harder.

Behavioral analytics offers an antidote. Instead of asking “Has this vessel been flagged before?” systems must ask “Is this vessel acting in a suspicious way that suggests it is attempting to circumvent sanctions?”

Windward’s platform addresses these challenges by tracking vessels through any identity changes and manipulation attempts. It flags them based on dynamic behavioral patterns such as route anomalies, registry switches, timing of reactivation, and more. Regardless of the method bad actors use to disguise their identity or hijack legitimate vessels, Windward’s models detect and flag the suspicious behavior that exposes users to risk.

Windward’s models have documented several zombie vessels that illustrate the deception in detail. Two examples highlight how these tactics unfold.

Case 1: A Return from the Scrapyard

A vessel flagged under the Marshall Islands registry was last seen arriving at the Gadani scrapyard on October 21, 2021. For years, it had operated in the Mediterranean and Gulf regions.

But on March 14, 2025 – 4 years after its final port call – the vessel’s identity reactivated near Iran and the UAE. It used the same IMO number and initially flew the Malta flag. Within days (March 19), it switched to the Comoros registry and set sail for Venezuela, where it has remained anchored as of April 28, 2025.

According to Windward’s platform, the vessel is now flagged as high risk due to its suspicious behavioral pattern paired with its new areas of operation. 

Case 2: A Clean Slate, Quickly Tainted

Another vessel, originally flagged to Palau, arrived at the same Gadani scrapyard on June 30, 2018. Prior to that, it had served major international routes: South Korea, Singapore, the U.S., and the Gulf.

Know Your Vessel (KYV™) is a behavioral compliance framework pioneered – and trademarked – by Windward. And based on OFAC’s 2025 advisory reflects the regulator’s reinforced baseline: compliance is no longer a matter of checking names against lists. It requires continuous assessment of how vessels behave, what affiliations they maintain, and what those patterns suggest about risk.

The foundation for KYV™ was laid back in 2020, when OFAC’s original maritime advisory introduced behavioral DSPs – like AIS spoofing, flag hopping, and STS operations – as red flags. But the 2025 update elevated those red flags into an operational imperative. Stakeholders are now expected not just to detect deception, but to understand it in real time.

KYV™ answers that challenge by delivering:

• Dynamic vessel risk scores powered by proprietary AI

• Continuous monitoring of flag, registry, and ownership changes

• Detection of deceptive behaviors like loitering, dark activity, and STS transfers

• Network-based analysis to surface hidden affiliations and shell structures

• Visual Link Analysis (VLA) to expose beneficial ownership across jurisdictions

In contrast to episodic screening, KYV™ provides proactive visibility; critical in a world where a vessel might appear legitimate one day and suspicious the next.

Understanding the zombie vessel threat is only the beginning. The operational challenge lies in adapting to it day to day. Here’s how to get ahead of the curve:

1. Audit your data sources. Are you relying solely on static databases? If so, you’re blind to behavioral risk.

2. Incorporate behavioral models. Look for platforms that analyze not just identity, but context and inconsistency.

3. Demand registry transparency. Push for real-time updates and clearer oversight from flag states.

4. Track reactivations. Maintain an internal watchlist of scrapped vessels and monitor for suspicious re-emergence.

Together with a KYV™-driven framework, these actions can drastically reduce your exposure, before ghost ships slip through the cracks of your compliance protocols.

Zombie vessels aren’t going away. In fact, as enforcement tightens and trade routes shift, identity laundering at sea is likely to increase. It’s cheap, effective, and hard to detect without the right tools.

But the real threat isn’t the ships; it’s the systems we use to manage them. Static sanctions compliance is no longer fit for purpose. The industry must evolve to prioritize dynamic intelligence, behavioral analysis, and context-rich decision-making.

The seas are not empty. They’re crowded with signals, transactions, and bad actors. And unless we rethink how we define identity, the next ghost ship may already be in port.