Tracking the Next Cocaine Trafficking Vessel: A UNITED S Comparative Analysis

This analysis was produced by Windward’s Maritime Intelligence Operations Center (MIOC) — a mission-critical operations center powered by Windward’s maritime intelligence experts, operating as a seamless extension of your team. This is a sample of what we deliver. For intelligence tailored to your operational theater, visit the MIOC page.

A 1963-built fishing vessel with no active classification society oversight, broadcasting the flag of a country that does not operate a ship registry, is likely being towed through a remote riverine stretch of the Brazilian Amazon estuary. 

In the five months preceding this position, the vessel executed a complete pre-voyage identity reset, sailed out of the Mediterranean for the first time in its history, staged in West Africa for three months, went dark on AIS for thirty consecutive days across the Atlantic crossing, and reappeared 450 nautical miles northeast of Belém — the operational core of the Amazon’s ‘Northern Arc’ cocaine trafficking corridor.

Windward’s Maritime Intelligence Operations Center (MIOC) surfaced the vessel through pattern-based fleet discovery, cross-referencing behavioral, geographic, corporate, and identity indicators against the profile of the UNITED S, the Cameroonian-flagged cargo vessel interdicted by Spanish authorities in January 2026 with ten tonnes of cocaine on board. MIOC assesses with confidence that the vessel currently positioned in the Amazon estuary is being prepared for a trans-Atlantic cocaine trafficking voyage in the near term.

What Happened

Pattern-Based Detection

Windward’s Maritime AI™ platform enables analysts to move beyond single-vessel lookups by conducting pattern-based fleet discovery, querying across more than 40 filters spanning behavioral, geographic, corporate, and identity dimensions to surface networks of vessels exhibiting coordinated evasion behaviors. Rather than waiting for a specific vessel to trigger an isolated alert, MIOC analysts can hunt for assets matching known illicit-activity signatures across the entire global fleet.

The vessel described in this report surfaced through a targeted query isolating vessels loitering below three knots in the maritime zone directly north of Belém, Brazil. That behavior on its own is a classic waiting-pattern anomaly, consistent with potential ship-to-ship transfers or staging ahead of an Atlantic crossing. Cross-referencing against identity-change history, first-time entries into the theater, and corporate opacity indicators narrowed the query to a small set of assets. This vessel matched on every dimension.

The Vessel Profile

The vessel is a 63-year-old fishing vessel. It carries no active classification society oversight. In February 2026, the vessel reflagged from Albania to Mali. Mali is landlocked and, per IMO reporting in early 2026, does not operate a ship registry. 17 vessels have been identified broadcasting the Malian flag fraudulently. A vessel broadcasting a Malian flag is not operating under an anomalous registry. It is operating under a legally impossible one, which under international law renders the vessel stateless.

The combination of an aging unclassed hull and a false flag is analytically significant. Vessels of this profile function as disposable assets that cartels can abandon or scuttle at the point of interdiction without significant financial loss. 

The Identity Reset

On February 19, 2026, the vessel underwent a complete identity reset while in Durres, Albania. It changed its name and its flag from Albania to Mali. One day later, on February 20, 2026, it departed Durres for the first time in the vessel’s recorded history of exiting the Mediterranean. The reset is a classic pre-operation security protocol. It severs the vessel’s prior track record from the next voyage and resets automated risk-scoring systems that rely on identity persistence across name, flag, and corporate management.

The West African Staging Phase

On March 13, 2026, the vessel arrived in Dakar, Senegal, its first-ever West African port call. Throughout April 2026, it made two trips between Senegal and Guinea. On May 1, 2026, it anchored off Conakry, Guinea, and remained at that anchorage for approximately six weeks. The staging phase is consistent with the documented ‘Atlantic Mirror’ logistics pipeline used by Balkan and West African criminal networks in the trans-Atlantic cocaine trade, where West Africa functions as an intermediate staging area between the Mediterranean origin and the South American loading zone.

The Thirty-Day Dark Crossing

On June 10, 2026, the vessel ceased AIS transmissions. It remained dark for thirty days. Windward’s platform records a transmission gap of 30 days, 20 hours, and 57 minutes, during which the vessel traveled approximately 1,790 nautical miles at an average speed of 4.5 knots. The straight-line distance would have required roughly 16 days at the vessel’s operational speed, leaving more than 14 days of transit time unaccounted for by the direct-route calculation. That delta is consistent with route deviation, mid-Atlantic loitering, or rendezvous activity during the crossing.

A thirty-day AIS blackout in open water far exceeds any plausible technical fault and removes the vessel from public tracking during the exact window when its true position, speed anomalies, and any ship-to-ship encounters would otherwise be visible.

Re-Emergence at the Amazon Estuary

On July 11, 2026, the vessel resurfaced approximately 450 nautical miles northeast of Belém, Brazil, and began sailing south. On July 16, it reached the Brazilian shore. On July 19, it arrived in the Belém area of interest and loitered at very low speed for two days at the mouth of the Amazon River. The Belém and Amazon River estuary area is the core of South America’s ‘Northern Arc’ cocaine trafficking corridor. Heavy enforcement across southern Brazilian ports has pushed transnational syndicates toward riverine networks that float bulk cocaine downstream from Andean production zones into the coastal waters of Pará. The island labyrinth, deep-water anchorages, and maritime blind spots around Belém make it a documented staging hub for deep-sea contraband transfers.

The Itaporanga River

On July 23, 2026, following low-speed transit and loitering episodes over the preceding two days, the vessel arrived in a small harbor in the Amazon estuary system northwest of Belém and remained anchored through July 26. On July 26, AIS records the vessel sailing side by side with a Brazilian-flagged tug, likely under tow. Both vessels entered the Itaporanga River and continued downstream.

The presence of a fishing vessel of this age being towed through a narrow riverine channel by a local tug is operationally significant. The vegetated Amazon estuary system lies outside standard international shipping lanes and is frequently exploited by regional cartels for blind-spot staging, informal boatyard operations, and unmonitored cargo transfers. Two operational rationales are consistent with the observed movement. The first is access to informal riverine ship-repair facilities where concealment compartments can be constructed within the vessel’s structure under the cover of legitimate maintenance work. The second is direct loading of illicit cargo in an area with limited law-enforcement oversight, again under the guise of repair activity.

What It Signals

The vessel currently positioned in the Amazon estuary should be assessed within the broader trans-Atlantic cocaine trafficking pipeline documented across recent European maritime interdictions, and not as an isolated anomaly.

The UNITED S Benchmark

The intelligence assessment is directly underpinned by comparative analysis with the UNITED S, interdicted by Spanish authorities and international partners on January 11, 2026, off the Canary Islands. That vessel carried ten tonnes of cocaine concealed under a shipment of salt, in what Spanish authorities described as one of the largest maritime cocaine seizures in European history at the time. 

The UNITED S was Cameroonian-flagged and had departed Brazil to receive the shipment before sailing toward a European port. It was on what open reporting described as its last voyage before being scrapped.

Applying identical pattern-based search criteria to the twelve months preceding the interdiction, MIOC identified a further eight vessels operating below three knots in the same geographical corridor north of Belém. 

The vessel described in this report exhibits an operational profile matching the UNITED S across five shared indicators: 

1. A shift in operational area, from Mediterranean regional deployment to a long-range trans-Atlantic route. 
2. A pre-voyage identity and ownership reset, executed immediately before the trans-Atlantic transit. 
3. A West African staging stop, in this case at Dakar and Conakry, mirroring the UNITED S‘s own African routing history. 
4. High-risk or fraudulent flagging from an African registry with a documented history of involvement in maritime narcotics operations, in this case a flag from a country that does not operate a registry at all. 
5. A prolonged AIS blackout during the days directly preceding arrival in the Belém area of interest, combined with suspicious loitering patterns in the transshipment zone.

The pattern is neither incidental nor sequential. It is a repeatable methodology.

The Ownership Layer

Ownership of the vessel transferred to a Marshall Islands-registered shipping entity in the weeks before the reflagging and first-ever transatlantic crossing. The corporate profile is consistent with a shell structure created to obscure Albanian beneficial ownership immediately before a high-risk operational deployment, characterized by no public presence, timing aligned with the pre-voyage reset, and a pattern of sequential single-vessel disposable assets. Several maritime databases list the entity’s registered address in Albania rather than the Marshall Islands.

Additional link analysis surfaced a second vessel previously transferred to an Albanian corporate counterpart in April 2026. That vessel was itself the same hull previously seized by Spanish authorities in 2020 with approximately 3.8 tonnes of cocaine on board. Transnational networks frequently re-acquire seized assets through straw buyers and blind government auctions, particularly attractive given such vessels often already carry purpose-built concealment compartments. The cycling of vessels between opaque shell companies across the Marshall Islands and Albania functions as an identity-laundering technique, severing historical ownership chains and preventing port authorities from linking successive vessels to the same beneficial owners.

The Albanian Network Hypothesis

Albanian criminal networks have emerged over the past decade as significant logistical architects in the trans-Atlantic cocaine trade. 

In August 2025 alone, Europol supported a coordinated takedown of a clan-based Albanian network moving multi-tonne cocaine shipments from Latin America to Hamburg and Rotterdam. These networks specialize in acquiring aging maritime assets, coordinating mid-ocean transshipment, and controlling end-to-end supply chains from South American ports to European entry points. 

High-level Albanian clans maintain a permanent operational presence in key South American export hubs, including Guayaquil, Ecuador, and Santos and Belém, Brazil. Their operational model combines equity investment in multi-tonne cocaine shipments, systematic acquisition of low-value maritime assets, and coordinated extraction operations into European landing points.

The vessel described in this report fits this model in every observable dimension. Its ownership structure originates in Albania. Its operational profile matches the UNITED S benchmark. Its current geographic position aligns with the Belém node of the documented Balkan-Atlantic pipeline.

What to Monitor

Three lines of follow-up are likely to define the analytical picture in the coming weeks:

1. The category of aging, unclassed fishing and cargo vessels broadcasting flags from African registries that either do not exist or have been identified by the IMO as fraudulently claimed. Vessels of this profile transiting between the Mediterranean, West Africa, and the Amazon estuary corridor, with pre-voyage identity resets and first-time entries into the theater, represent the operationally significant subset of the fleet in this pipeline. Identifying the next vessel in the chain, before it completes the loading phase and initiates the return crossing, is the analytical priority.
2. Enforcement posture at the Amazon estuary node. Whether Brazilian federal authorities, in coordination with DEA and European partners, act on vessels loitering below three knots in the maritime zone north of Belém, or on vessels being towed into remote riverine areas of Pará outside standard shipping lanes, will determine whether this leg of the pipeline continues to operate without operational friction at the loading phase. The UNITED S was interdicted at the delivery phase, off the Canary Islands. Interdiction at the loading phase, in Brazilian waters, would represent a materially different disruption to the network.
3. The trans-Atlantic corridor at the mid-ocean transshipment layer. The thirty-day AIS blackout documented in this case, combined with the fourteen-day transit-time delta unaccounted for by straight-line calculation, indicates that mid-Atlantic rendezvous activity remains an active phase of the methodology. Vessels crossing the Atlantic on similar profiles, with dark windows disproportionate to the direct-route requirement, warrant priority monitoring during the crossing itself rather than only at either endpoint.

Analysis and reporting by Manuel M.B. Assis Teixeira, Windward MIOC Maritime Intelligence Analyst.

Mission-Ready Intelligence, at Your Service

Detecting patterns like these requires more than static monitoring. Windward’s MIOC integrates multi-sensor intelligence with Agentic AI to detect, collect, and analyze threats in real time.

To discuss ongoing intelligence coverage or ad-hoc forensic deep dives tailored to your operational theater, get in touch below.