REPORTS

Top 9 U.S. Maritime Security Risks From Q2 2026

Request a demo

What’s inside?

Executive Overview

Q2 2026 was one of the deadliest and most disrupted quarters for commercial shipping since the tanker wars of the 1980s — and the United States was not observing it. U.S. forces ran a 66-day blockade of Iranian ports, coordinated a military-protected export corridor through Omani waters, disabled sanctioned tankers at sea, and released strategic reserves to hold global oil markets together. The maritime domain is now a contested arena, and for the first time in decades, U.S. maritime operations are the variable determining whether the world’s most important energy chokepoint functions at all.

The quarter’s numbers describe an environment U.S. agencies will be operating in for years. Military forces from eight countries — Russia, Ukraine, Iran, the UK, France, Sweden, Belgium, and the U.S. — attacked or boarded dozens of commercial vessels. More than 800 ships and, at peak, 20,000 seafarers were trapped as Hormuz traffic fell by as much as 88%; an estimated 7,500 seafarers remained stranded at quarter-end. Ukraine now defines more than 700 Russia-trading tankers as military-affiliated assets. Russia is operating tankers for cable surveillance, espionage, and drone operations, embarking mercenaries to guarantee transit, and escorting shadow fleet ships through the English Channel and the Baltic with frigates.

Underneath the kinetic picture, the intelligence picture degraded. Dark activity rose sevenfold. 3.35 million false ship-to-ship meetings have been generated by GPS spoofing since Operation Epic Fury began. 275 tankers broadcast fraudulent flags. Deceptive shipping practices remained at all-time highs — zombie ships, false flags, IMO identity fraud. The gap between what AIS shows and what is happening on the water is widening at exactly the moment U.S. enforcement and force-protection decisions depend on closing it.

The human cost was severe: 14 seafarers died in 46 attacks on commercial vessels in the Middle East Gulf between January 1 and June 11, per the United Nations, plus two deaths following Russian attacks in the Black Sea.

This report, produced by Windward’s Maritime Intelligence Operations Center (MIOC), assesses the quarter’s nine defining risks through the lens of U.S. missions: force projection and chokepoint access, intelligence integrity, enforcement, and homeland and economic security.

1. Strait of Hormuz Transits

Traffic rebounded in the final weeks of Q2 after a U.S.–Iran Memorandum of Understanding and the scaling up of the U.S.-military-supported southern corridor. Daily transits rose from an average of nine in the first two weeks of June to 32 in the third week and 43 in the final week. June transits were still only around one-sixth of pre-war traffic.

AIS-visible monthly transits totaled 3,750 ships in February, before collapsing to 450 in March, 630 in April, 450 in May, and 640 in June. Sporadic IRGC drone and missile attacks continue to deter shipowners. Observed transits peaked at 61 vessels on June 24, the day after the IMO announced an evacuation corridor along the southern route; it was suspended two days later following Iranian attacks. In those two days, 3,400 of an estimated 10,000 stranded seafarers were evacuated, per the IMO secretary-general.

Tankers led the uneven return: their share of Hormuz traffic rose from 15% in early June to 41% in the final week. Three drivers:

Removal of the U.S. blockade, which freed up as many as 150 sequestered Iranian-trading vessels
Consolidation of the U.S.-coordinated southern corridor for ship-to-ship transfers off Fujairah
The brief IMO evacuation corridor, June 24–26

Assessment for U.S. operational planning: the quarter ended not with a recovering strait but with a partitioned one. While the 58-year-old Traffic Separation Scheme is cleared of mines, all traffic runs through two politically controlled corridors. The northern corridor is permissions-based and Iran-administered, used mostly by China-, Iran-, India-, and Pakistan-affiliated ships under bilateral agreements — meaning Tehran now operates an access-control regime over a portion of Hormuz traffic, with the vessel-level visibility that implies. The southern corridor exists because U.S. forces protect it, and much of its traffic transits with AIS off where permitted.

Two consequences follow. First, Hormuz access is now a function of U.S. force posture: withdraw the protection and the corridor’s traffic and Gulf energy exports go with it. Second, neither corridor is legible through AIS. The adversary-administered corridor is opaque by design; the U.S.-protected corridor is dark by necessity. Verifying who is actually transiting Hormuz now requires independent detection, not broadcast data.

Q2 2026 Strait of Hormuz transits. Windward Risk Report

2. Global Dark Activity

2,157 unique cargo ships and tankers over 10,000 DWT conducted at least one dark activity event lasting more than three days in Q2 — almost five times the 449 vessels in Q1. Prolonged dark events rose even more sharply, from 451 in Q1 to 3,137 in Q2, a sevenfold increase.

Not every AIS gap is illicit. Operational, safety, and security factors explain many. But sustained outages of more than three days can conceal movements, cargo transfers, or port calls, making them a primary lead-generation indicator.

Russia recorded the highest concentration overall, with nearly 4,000 individual events. One in four extended dark events took place off Saudi Arabia, Oman, Iran, or the UAE. Indonesia, China, and Vietnam also ranked among the busiest locations, a decisive shift from Q1, when Indonesia, China, and Romania led and Russia ranked fourth.

Assessment for U.S. operational planning: dark activity migrated to exactly the waters where U.S. forces operate and U.S. sanctions apply. The complication is that the same behavior now has two populations: evasion (dark loading at Kharg, dark corridor transits) and self-protection (stranded vessels going dark for survivability, southern-corridor traffic dark by design). AIS absence alone cannot separate them, which means dark activity has stopped functioning as a standalone risk flag in conflict zones. Distinguishing a sanctions violator from a frightened merchant now requires correlating the gap with SAR/EO detection, ownership, and voyage behavior.

3. Slow-Speed Activity Over Subsea Cables

Windward recorded 3,667 loitering events exceeding 12 hours above subsea cables in Q2, involving 2,206 cargo and tanker vessels — 1.66 events per vessel on average, one vessel logging 20. The median event lasted 21.7 hours; the 37-hour average reflects a long tail reaching 1,337 hours.

Activity held steady across the quarter — 1,241 events in April, 1,204 in May, 1,222 in June, roughly 40 per day — with one clear spike on June 15 at 68 events, nearly double the daily average. Cargo vessels accounted for 54% of events, tankers 46%.

The Red Sea and Gulf of Aden alone recorded 784 events — 21% of the total and nearly double the next-largest zone, Malacca and Singapore (422). Indonesia/Java Sea (313), Gulf of Oman and Hormuz (308), and the Persian Gulf (293) round out the top five, together 58% of all events. A further 407 fell outside the 14 tracked zones.

Assessment for U.S. operational planning: given Russia’s documented use of tankers for cable surveillance, loitering over undersea infrastructure is a homeland-defense indicator, not a shipping curiosity. The data backbone of U.S. commerce, finance, and military communications runs through these corridors. The steadiness of the numbers is itself the finding: roughly 40 events per day, every day, is a standing pattern of presence over critical infrastructure, sustained by ordinary-looking commercial vessels rather than dedicated intelligence platforms.

4. Sanctions Designations

Regulators worldwide made 486 vessel designations in Q2, down from 851 the previous quarter, involving 274 unique vessels. The decline reflects fewer announcements from Australia, Canada, and Switzerland after catch-up rounds between October 2025 and March 2026, not reduced focus on Russia or Iran.

The U.S. designated 63 vessels, all Iran-related; the U.S. has not sanctioned a Russian vessel since January 2025. The EU’s 20th package designated 46 ships; the UK made 27 specifications. Collectively, the UK and EU have sanctioned around 650 ships, and regulators are increasingly focused on Russia’s dark fleet LNG carriers, with four sanctioned during the quarter.

Assessment for U.S. operational planning: two structural facts stand out. First, the transatlantic divergence: roughly 650 UK/EU-sanctioned ships against a U.S. Russia-designation freeze now 18 months old, means a large population of vessels is targetable by allies but not by U.S. authorities, complicating combined enforcement operations and creating arbitrage the dark fleet exploits. Second, the waiver cycle (three Russian-oil waivers, one Iranian-oil waiver issued June 22 and revoked July 7) turned the target set into a moving object: vessels lawful one week were enforcement priorities the next. Both facts argue for maintaining continuous behavioral tracking of the full high-risk population regardless of current designation status.

Some 18% of dark fleet vessels list Russia as country of registered owner, up from 17%. Russia remained the leading flag state at 21% of dark fleet tankers, followed by Panama (9.8%), Cameroon (6.6%), and Sierra Leone (4.8%). Between April and June, 22 dark fleet tankers reflagged to Russia from fraudulent registries as European and UK forces interdicted stateless ships, down from 38 in Q1. Marshall Islands and Hong Kong remained the second- and third-largest countries of registered ownership. Dark fleet vessels favor jurisdictions and anonymized addresses that obscure beneficial ownership.

Internationally trading tankers over 150 meters LOA comprised 84% of sanctioned tonnage. Penetration among major classes: 18% of the global VLCC fleet, 16% of suezmaxes, 25% of aframaxes — the aframax share reflecting the class’s widespread use across Russian ports.

Assessment for U.S. operational planning: this quarter confirmed the fleet’s conversion from sanctions workaround to state instrument: cable surveillance, espionage, embarked mercenaries, frigate escorts. The escalation logic runs one way: every Western interdiction of a stateless tanker pushes more tonnage under the Russian flag, converting a law-enforcement problem into a state-to-state confrontation. U.S. planners should assume the enforceable (stateless) share of the fleet shrinks over time while the protected (Russia-flagged) share grows, meaning the window for low-escalation interdiction is closing, and beneficial-ownership attribution becomes the durable pressure point.

6. Vessel Interdictions

European forces boarded and detained seven sanctioned, stateless Russia shadow fleet tankers in their coastal waters during Q2, versus six in Q1 (plus one vessel turned away by Germany before entering the Baltic). Across H1 2026, France was involved in six of the 13 boardings in European or UK waters; Sweden in five, including one cargo ship detained for environmental reasons, the outlier, as the remaining cases involved stateless tankers. The UK seized a tanker in the English Channel at the end of June, and tankers are reflagging and rerouting to avoid naval forces in the Baltic, Black Sea, and Mediterranean.

Assessment for U.S. operational planning: allied interdiction tempo has now reached a level that is changing adversary behavior. Each adaptation increases both the operational cost and escalation risk of subsequent boardings. For U.S. forces, the key operational lesson from H1 is clear: the boardings that withstood legal scrutiny were those supported by verified flag-state data that contradicted a vessel’s broadcast claims. Incorporating that verification into the targeting cycle, before a boarding team is committed, is what distinguishes a lawful interdiction from an incident.

7. Falsely Flagged Vessels

275 internationally trading tankers were broadcasting the flag of a fraudulent registry via AIS in Q2, down from 290, even as flag-hopping accelerated following new sanctions on Russia- and Iran-trading ships. Windward has now identified 22 fraudulent ship registries, with Russia-linked tankers falsely claiming two new flags this quarter, Syria and Myanmar, neither of which operates an international registry. The IMO database listed 580 falsely flagged vessels, up from 550 last quarter and 470 at end-2025.

Around 90% of tankers using fraudulent registries were Western-sanctioned. Several were arrested over the past six months amid the flag governance crackdown — prompting Russia to move 60 tankers from fraudulent registries to its own flag in H1 2026 alone.

Assessment for U.S. operational planning: false flagging is the legal seam U.S. and allied enforcement is exploiting. A vessel confirmed as falsely flagged is stateless, loses the right of innocent passage, and can be lawfully boarded in international waters. That makes flag verification, checking broadcast claims against registry records, IMO data, and observed behavior — a targeting function, not a compliance chore. The countertrend is the same one seen in the dark fleet: each Russian reflagging removes a vessel from the lawfully boardable population. The 275-vessel fraudulent-flag population is, in effect, the current interdiction target deck, and it is being drawn down from both ends.

Oil Markets (in Collaboration with Vortexa)

U.S. exports rose 1.3 million bpd quarter-on-quarter, Russian exports 1.1 million bpd, and Venezuelan exports 300,000 bpd. Russian volumes rising as Ukrainian drone strikes on port and refinery infrastructure cut domestic throughput and freed crude for export.

Saudi Arabia was the war’s biggest commercial casualty: crude shipments fell 37% quarter-on-quarter, or 2.36 million bpd, despite record pipeline redirection to Yanbu. The UAE was the surprise, with exports up 2.7% — partly a base effect from a weak March, but substantially the product of direct U.S. military coordination. The UAE’s national oil company worked with U.S. forces to run the southern corridor: tankers sailed to loading terminals west of Hormuz with AIS off, then shuttled to and from Fujairah, transferring oil onto vessels bound for Asia and India. By June, monthly UAE exports had recovered to 3.6 million bpd, above pre-war levels.

The disruption remains material: June shipments from Gulf states west of Hormuz lacking pipeline alternatives were still only 32% of the January–February average. Strategic reserve releases in Japan and the U.S., plus reduced Chinese buying (seaborne imports fell to 7 million bpd from 11.1 million), helped avert a global shortage.

Assessment for U.S. operational planning: the quarter’s energy supply continuity was a U.S. military product. U.S. export growth partially backfilled Gulf losses, U.S. reserves buffered the market, and the corridor that restored UAE volumes existed because U.S. forces protected it. Energy security and maritime security are no longer adjacent problem sets but the same mission, and the market has now priced in U.S. force posture as an input.

9. GPS Jamming

GPS interference is now a persistent feature of global shipping. 171,286 distinct vessels were jammed at least once worldwide in Q2, down 8% quarter-on-quarter and 35% below the Q4 2025 peak of 262,117, the highest level in the 18 months Windward has tracked it.

The quarterly decline masks what followed Operation Epic Fury. Since February 28, Windward has detected 3.35 million false ship-to-ship meetings globally. Spoofed positions making vessels appear to rendezvous when no meeting took place. Spoofing peaked March 20 at 356,773 false meetings in a single day; daily jammed-vessel counts topped out at 13,090 on March 7. Activity subsided through April following the ceasefire and the blockade, then resurged from mid-May, peaking at 190,515 false meetings on May 20, roughly half the March high. Q2 recorded 1.24 million false meetings.

Assessment for U.S. operational planning: at Q2 volumes, an enforcement workflow built on unfiltered AIS generates false leads faster than any analyst cadre can burn them down, while real transfers hide inside the same distortion. The same applies to force protection and targeting: positional data in the Gulf, Baltic, and Black Sea corridors must now be treated as an adversary-influenced input until independently verified. The correlation between jamming intensity and U.S. operational tempo, peaks tracking Epic Fury’s opening weeks and the post-blockade resurgence, indicates this is a deliberate counter-ISR behavior, not ambient interference.

Implications for U.S. Operations

Q2 made plain there is no path back to the pre-war maritime order. Navies from eight countries attacked or boarded merchant vessels, Ukraine classifies more than 700 tankers as military-affiliated, and Russia is running tankers as surveillance, espionage, and drone platforms. None of this unwinds as a wartime exception.

Four judgments for U.S. planning:

Chokepoint access is now a posture question. Hormuz ended Q2 as two politically controlled corridors. One adversary-administered, one existing only because U.S. forces protect it. Any recovery runs through that architecture. So does any withdrawal.
The lawful-interdiction window is narrowing. Every boarding of a stateless tanker pushes tonnage under the Russian flag and Russian protection. The enforceable share of the dark fleet shrinks while the escalation cost of touching the rest grows. Attribution and beneficial-ownership work is the pressure that survives this shift.
The AIS layer is an adversary-influenced input. Sevenfold dark activity growth, 3.35 million spoofed meetings, 275 fraudulent flags — concealment and falsification are now routine operating behavior, concentrated where U.S. forces and enforcement operate. Decisions on targeting, boarding, and designation cannot rest on broadcast data alone.
Enforcement, force protection, and market stability converged. The blockade, the corridor, the waivers, and the reserve releases were one operation. Agencies should expect that convergence — and the intelligence demands it creates — to be the standing condition of Q3, not the exception of Q2.

🇮🇷 TRACK VESSEL ACTIVITY IN THE STRAIT OF HORMUZ 🇮🇷