Top 6 Maritime Threats to U.S. National Security

A New Geopolitical Reality at Sea

The final quarter of 2025 marked a decisive shift in the maritime operating environment. For U.S. agencies tasked with monitoring sanctions evasion, protecting maritime commerce, and assessing global security threats, the domain has become more fragmented, opaque, and contested.

Key Developments:

• Military involvement in commercial shipping escalated. Ukrainian drones struck four falsely flagged, Russia-trading tankers. The U.S. Coast Guard seized two stateless vessels in the Caribbean. And a quasi-naval blockade emerged off Venezuela, reshaping vessel behavior in the region.
• Enhanced interagency and coalition recognition that the dark fleet serves as the primary revenue stream for sanctioned regimes drove widespread naval interdiction and policy intervention across global trade lanes.
• Flagless and fraudulent registrations surged. By year-end, the number of sanctioned, flagless, or stateless tankers had doubled compared to 2024, with widespread use of 18 known fraudulent registries. This expanded the risk surface for U.S. and allied forces in international waters.
• GPS jamming and electronic warfare intensified. Disruption of marine navigation systems was reported in four major sea regions, including new interference off Venezuela for the first time. These tactics complicate both commercial safety and national defense efforts.
• The dark fleet became more exposed. 76% of Windward’s tracked dark fleet crude tankers are now sanctioned. A growing body of intelligence links these vessels to smuggling, sanctions evasion, and support to adversarial state actors.

This evolving environment signals a broader collapse in flag-state governance, legal accountability, and maritime norms, with direct implications for U.S. interdiction authority, forward-deployed maritime assets, and partner capacity-building efforts.

Targeting the Enablers of Global Sanctions Evasion

Q4 2025 saw the highest volume of maritime-related sanctions activity in recent history. Enforcement patterns reveal a shift from targeting individual tankers to disrupting entire ecosystems that enable sanctions evasion.

Key Q4 Developments

• 923 vessel designations were issued globally in the final three months of 2025, nearly all tied to Russia or Iran.
• 94% of sanctions were imposed on tankers, reinforcing the global effort to dismantle the dark fleet sustaining sanctioned regimes. 
• The EU, UK, and U.S. have now sanctioned more than 1,200 sanctions-evading vessels since 2023, a 14% quarter-on-quarter increase.

U.S. Action Highlights

• The U.S. imposed its first Venezuela-related maritime sanctions in December 2025, targeting entities and vessels linked to oil exports.
• Prior to October, no Russia-related maritime sanctions were issued by the Trump administration. That changed with the blacklisting of Rosneft and Lukoil, Russia’s two largest oil producers.
• U.S. seizures of two stateless tankers off Venezuela underscore a growing willingness to act proactively in international waters, setting legal precedent for intercepting vessels with fraudulent or invalid flags.

Beyond the Tankers

Sanctions are now expanding beyond vessels to the full network of facilitators, including:

• Banks.
• Maritime agents.
• Port terminals.
• Ship registries.
• Oil producers and traders.
• Tugs and service providers supporting dark fleet operations.

This reflects a more holistic enforcement strategy and creates both opportunities and requirements for interagency coordination across the U.S. government, particularly in financial intelligence, port security, and maritime interdiction.

Flag Hopping as a Primary Evasion Tactic

Flag-hopping reached unprecedented levels in 2025 and remains a defining feature of sanctions evasion as 2026 begins.

Over the year, nearly 700 ships changed flags between two and six times, with 367 vessels reflagging three times, 90 vessels four times, and a further 28 vessels five times. Four vessels even cycled through six different flags in pursuit of regulatory avoidance.

Most of these were sanctioned tankers, shifting from registry to registry – including fraudulent registries – after being deleted from open registries that once specialized in dark fleet business. These frequent registry changes compromise transparency and complicate enforcement by obscuring vessel identity and jurisdiction.

Falsely flagged vessels are often rendered stateless and legally vulnerable, a status that reduces legal protections and increases the likelihood of interception by U.S. and allied naval forces. This vulnerability was demonstrated in 2025 as enforced seizures targeted vessels rendered stateless through fraudulent flagging practices.  

The most commonly used flags were Comoros, Barbados, Gambia, Cameroon, and Sierra Leone. The average duration of flag registry for these vessels is approximately 70 days, underlining how transient and unstable these registrations have become.

Flag hopping often occurs alongside frequent changes of vessel name and registered ownership, further obfuscating vessel identity and complicating sanctions enforcement and maritime domain awareness. 

As part of a governance crackdown, Gambia and Comoros have collectively deleted 150 tankers from their registries since September 2025, citing fraudulent certificates issued by private contractors operating on their behalf. These actions reflect growing scrutiny on flag state governance, yet evasion patterns persist as vessels seek regulatory loopholes. 

The Erosion of Flag State Governance

By the end of 2025, 285 internationally trading tankers were broadcasting via AIS under the flag of a fraudulent or unknown registry, undermining the international legal framework that governs maritime activity.

Windward identified 18 fraudulent registries, as defined by the International Maritime Organization (IMO). These include newly observed entries in Q4, such as the Maldives, Zambia, Zimbabwe, Botswana, Samoa, and Tonga.

Critically, 91% of vessels using fraudulent registries were under Western sanctions, highlighting the increasing desperation of dark fleet operators to maintain access to global trade routes.

Top fraudulent registries by usage include:

• Guinea: 51 vessels.
• Netherlands Antilles: 45 vessels.
• Guyana: 44 vessels.
• Aruba: 24 vessels.

These registries provide no legal protection or oversight and are often used to mask vessel ownership, operator responsibility, and cargo origin. 

The IMO’s database listed 470 falsely flagged ships as of Q4 2025, including 340 tankers. These are vessels confirmed by a country’s maritime administration not to be flying its flag, making them legally stateless and increasingly exposed to enforcement actions. 

This risk materialized operationally in December 2025 with four falsely flagged tankers struck by Ukrainian USVs and two seized by the U.S. Coast Guard off Venezuela. The number of false‑flag ships doubled over the course of 2025 until October, then stabilized amid heightened naval and military scrutiny. 

These vessels operate outside international norms, invalidating their insurance and classification status and expanding enforcement opportunities for U.S. and allied maritime forces. These incidents underscore the security risks posed by falsely flagged vessels, especially as their use becomes more common in adversarial, state‑linked trades. They also highlight opportunities for the U.S. to exert maritime enforcement authority in contested areas when flag legitimacy is unverifiable.

GPS Jamming and Navigational Security Threats

Intentional disruption of maritime GPS signals remained a defining feature of 2025, with Q4 marking a dangerous expansion in both geography and frequency of interference. 

Key Observations in Q4 2025 

• 57% of incidents were concentrated in the Arabian Gulf; another 20% occurred in the Black Sea, aligning with known geopolitical flashpoints.
• First-time interference was reported off Venezuela, impacting nearly 90 vessels as the U.S. increased its maritime presence in the Caribbean.
• Jamming intensified around Russia’s eastern oil ports (Nakhodka and Kozmino), where nearly 750 ships were impacted, a 25% increase over Q3.
• These tactics not only endanger commercial shipping and port operations but also complicate U.S. and allied maritime surveillance, interdiction, and ISR (Intelligence, Surveillance, Reconnaissance) missions.
• Notably, GPS disruption triggered Qatar’s Ministry of Transport to temporarily halt maritime traffic for two days in early October – a rare move that highlights the operational consequences when navigation reliability is compromised.

Although vessels impacted by jamming fell by nearly 40% in Q4, activity persisted across all major trade and risk zones – from Russia’s oil export ports to the Red Sea – consistently disrupting positioning and complicating domain awareness. Despite this decline in absolute numbers, intentional disruption of GPS remained widespread in areas of geopolitical conflict throughout the year, significantly increasing navigation and marine safety threats.

These patterns underscore the need for resilient navigation and signal‑validation strategies, especially where adversarial actors may use GPS jamming as part of broader hybrid operations. Operational planning and maritime domain awareness systems should incorporate multi‑source intelligence, interference detection, and alternative positioning systems to maintain navigational certainty when GPS reliability is compromised.

Protecting Maritime Critical Infrastructure 

Drifting and low-speed activity near subsea infrastructure has long served as a gray-zone tactic for state and state-aligned actors. In Q4 2025, these behaviors increased, reinforcing concerns that global cables and pipelines are becoming targets in contested maritime zones.

Strategic Behavior Near Subsea Infrastructure

Global drifting and low-speed activity over strategic underwater cables and pipelines rose 11% quarter-on-quarter, reaching its highest level in 2025. 

• Flag states of concern: 17% of vessels involved were flagged to China, followed by Liberia (11%) and Panama (10%).
• Geographic hotspots: 33% of activity occurred in the South China Sea, and 26% in the Mediterranean, both zones with dense critical infrastructure and ongoing strategic competition. 
• Port of call trends: In 37% of global cases, China was the next port of call after drifting or low-speed activity, indicating possible logistical alignment or state-linked coordination.
• Baltic context: By contrast, the Baltic Sea saw less than 2% of global drifting or low-speed activity, a likely result of NATO’s Baltic Sentry operation launched in early 2025, following three suspected sabotage incidents in that region. 
• Vessel types: The composition of vessels remained consistent with previous quarters, as 56% were cargo vessels and 44% tankers.

These behaviors do not occur in isolation. In regions where naval presence is limited, or enforcement gaps persist, drifting near subsea infrastructure can serve as cover for surveillance, cable tapping, or interference with critical communications. 

The Evolving Structure of Dark and Gray Fleets

The dark and gray fleets now represent a multi-jurisdictional enforcement challenge, obscuring ownership, exploiting regulatory blind spots, and fueling sanctioned trades. Windward’s Q4 2025 analysis reveals not only the scope of the issue but also how both fleet types are engineered to avoid accountability.

The Dark Fleet: Sanction and Structured to Conceal

• 49% of Windward’s tracked dark fleet, out of 2,068 vessels, is now sanctioned.
• For crude oil tankers alone, that number climbs to 76%, highlighting the central role these vessels play in sanctioned energy exports.

Behind the scenes, vessel ownership and management are intentionally fragmented:

• 15% of registered owners are incorporated in Russia, the same share as the Marshall Islands.
• Other key jurisdictions include Hong Kong (10.5%), Seychelles (8%), and the UAE (6.7%).
• The use of single-ship special purpose vehicles (SPVs) is common, but in the dark fleet, these entities are deliberately structured to block beneficial ownership discovery.

ISM management is equally opaque:

• Russia, the UAE, and China are the top three countries of incorporation for dark fleet ISM companies.
• 26% of vessels in the dark fleet have no known ISM manager listed at all, undermining compliance accountability.

On the registry front:

• 21% of dark fleet vessels are flagged in Russia, followed by 9% in Panama, despite Panama’s 2023 commitment to delist sanctioned ships.
• Cameroon, Comoros, Palau, Gambia, and Barbados remain the top open registries of choice.
• Gabon, previously one of the largest flagging nations for these vessels, saw its numbers collapse after EU and UK sanctions in mid-2025.

The Gray Fleet: Trading Legally, Operating in the Shadows

Unlike the dark fleet, the gray fleet is not sanctioned, but its vessels frequently adopt similar obfuscation tactics. Structurally, the gray fleet maintains stronger ties to major commercial registries and Greek ownership:

• 22% of gray fleet tankers are flagged in Liberia, and 19% in the Marshall Islands, the world’s first- and third-largest registries.
• The largest jurisdictions for registered ownership of the gray fleet are the Marshall Islands (25%), Liberia (19%), and Greece (9%).

Many of these vessels are engaged in Russia’s price-cap-compliant trade, but their behavioral overlap with sanctioned vessels complicates enforcement efforts and erodes transparency.

Both dark and gray fleets operate at the edge of legality, but together, they form a fluid ecosystem that enables adversarial state actors to sustain revenue, mask activity, and undermine the global maritime order.

Risk Status and Windward’s Cleared Risk

This real-time distinction is critical for enforcement prioritization. In an environment dense with false positives and opaque behaviors, the ability to clear a behavioral alert saves time and redirects attention to the truly high-risk operators.

By integrating cleared risk signals into operational workflows, agencies can:

• Reduce alert fatigue.
• Focus resources on active threats.
• Strengthen signal-to-noise clarity across a contested maritime domain.

Tracking Deceptive Tactics Through AIS and Port Calls

In Q4 2025, 94% of sanctions-related AIS signal losses, or dark activities, were linked to Iran and Russia, underscoring their dominant role in driving global deceptive shipping practices. These persistent patterns continue to reflect the use of dark behavior as a core sanctions evasion tactic, often paired with complex voyage routing and high-risk port calls.

New Areas of Concern

While Russia and Iran dominated in volume, Q4 saw notable upticks in deceptive activity in other regions:

• AIS signal losses tied to North Korea rose by 46%, renewing concerns around DPRK sanctions circumvention and illicit trade.
• Syria recorded a 48% increase in sanctions-related dark activity, a turn from Q3’s downward trend.
• Port calls to Syria jumped 41% quarter-on-quarter, coinciding with the gradual easing of restrictions on the Assad regime.

Dark activity paired with port calls to high-risk locations can signal early-stage risk well before a vessel is designated. 

Ship-to-Ship Hubs and Unregulated Transshipment

Ship-to-ship (STS) transfers remain a core tactic in maritime sanctions evasion, fragmenting supply chains, masking cargo origins, and complicating interdiction. In 2025, several key geographic hotspots emerged where high-risk or sanctioned tankers concentrated their ship-to-ship operations, often in international waters beyond port state control.

Key Observations in Q4 2025

• West Africa’s Lomé anchorage remained the dominant ship-to-ship location globally, with over 420 operations in Q4 alone, and nearly 1,650 over the course of the year.
• Port Said (Egypt) and Linggi (Malaysia) followed, with more than 110 and 250 ship-to-ship events respectively.
• In the Eastern Mediterranean, ship-to-ship activity surged:
  • Cyprus: +160 transfers.
  • Malta: +60 transfers.
  • Augusta, Italy: +30 transfers.
    Most of these operations occurred in international waters, underscoring both the lack of port state oversight and the tactical use of jurisdictional ambiguity.
• Hong Kong’s offshore waters emerged as a new ship-to-ship hub, with over 50 high-risk transfers in 2025, including more than 10 in Q4 alone, marking a notable development near a major global trading center.
• The Riau Archipelago (Indonesia) remained the top zone for dark ship-to-ship activity, particularly involving sanctioned and high-risk tonnage.
• Sohar, Oman, was the fastest-growing ship-to-ship hub of 2025, with activity rising 78% in H2, and over 40 transfers, signaling a strategic shift toward more discreet transshipment locations in the Gulf.

These transfer points represent critical enforcement chokepoints. While ship-to-ship activity is not inherently illicit, the combination of flag opacity, dark behavior, and high-risk routing requires continuous behavioral analysis.

A Turbulent  Q1 2026 Ahead

2026 begins with maritime order upended, commercial norms rewritten, and enforcement challenges escalating across every ocean theater. For U.S. agencies, this moment presents both complexity and clarity: the threat landscape is broader than ever, but so is the opportunity to act with precision.

As atypical trading routes become standard, freight indicators are skewed, and state-affiliated vessels are repurposed for non-commercial missions. In multiple regions, dark fleet tankers are now operating with embedded military personnel, signaling an overt merger of commercial cover and state defense.

Compounding this is growing misalignment among allies. U.S., EU, and UK policy divergence over Russian sanctions – especially the potential collapse of the Oil Price Cap – threatens to create legal and enforcement gray zones. In that vacuum, dark fleet operators are adapting faster than ever, exploiting jurisdictional gaps and testing the limits of maritime law.

Windward data shows this disruption is not isolated – it’s structural. From record-high flag hopping and fraudulent registry use to GPS jamming, stateless tankers, and the rise of ship-to-ship activity in contested waters, the risk map is dense and fast-moving. But it’s also traceable with the right tools.

As agencies prepare for a volatile Q1, the ability to quickly differentiate between deceptive patterns and cleared behaviors is no longer optional. The risk is not just in what’s hidden, but in wasted time chasing what’s not.

Windward’s Maritime AI™ platform is already supporting U.S. federal users by:

• Distinguishing high-risk actors from low-risk anomalies.
• Detecting emerging threats like new ship-to-ship hubs and spoofing clusters.
• Validating documents and vessel identities at the point of inspection.
• Mapping ownership, registry shifts, and behavioral changes in real time.
• Enabling cross-agency intelligence sharing with explainable Gen AI outputs.

2026 will demand sharper enforcement, deeper collaboration, and faster operational decisions at sea, in port, and across the policy stack. With coordinated intelligence and action-ready insights, U.S. agencies can move from monitoring maritime disruption to shaping its outcomes.

Maritime order may be contested, but clarity is within reach.

Discover the Intelligence Built for Today’s Maritime Threat Landscape