Top 9 Maritime Risks From Q2 2026

Executive Overview

Shipping experienced one of its deadliest and most disrupted quarters since the tanker wars of the 1980s. The maritime domain is now a contested arena of influence, coercion, legitimacy, economics, information, and strategic persuasion.

Dozens of commercial vessels were attacked or boarded in Q2 by military forces from Russia, Ukraine, Iran, the UK, France, Sweden, Belgium, and the U.S. The war in Iran ran the length of the quarter, trapping more than 800 ships and, at its peak, 20,000 seafarers as Hormuz traffic fell by as much as 88%. An estimated 7,500 seafarers remained stranded at quarter-end.

From April 13 to June 18, a U.S. blockade on Iran’s ports redirected 142 ships and disabled nine more, shutting down the Islamic Republic’s oil and gas exports. As Iran attempted to assert control over Hormuz and impose tolls or maintenance fees, attention turned to chokepoint vulnerabilities and elevated risk at Bab el-Mandeb and the Red Sea, where Somali pirates seized two ships.

In the Black Sea, Ukrainian drones struck shadow fleet tankers, ports, and refinery infrastructure, while Russia targeted cargo ships calling at Ukrainian ports. Ukraine now defines more than 700 Russia-trading tankers as military-affiliated assets, as the line between commercial and military shipping continues to blur.

The shadow fleet has evolved from a sanctions-evasion tool into a state-directed hybrid warfare platform. Russia is using tankers for cable surveillance, espionage, and drone operations, while Russian mercenaries are now routinely deployed on tankers to ensure uninterrupted transit through coastal states. Russian frigates have also escorted ships through the English Channel and Baltic waters.

Deceptive shipping practices remained at all-time highs. Zombie ships, falsely flagged vessels, and IMO identity fraud were all observed during the quarter, reinforcing how concealment tactics are becoming embedded in commercial maritime activity.

The human cost was severe. Fourteen seafarers died in 46 attacks on commercial vessels in the Middle East Gulf between January 1 and June 11, according to the United Nations. Another two deaths on commercial vessels were recorded this quarter following Russian attacks in the Black Sea.

This report, produced by Windward’s Maritime Intelligence Operations Center (MIOC), a mission-critical operations center powered by Windward’s maritime intelligence experts, examines how these pressures converged in Q2, from Hormuz and the Black Sea to dark fleet behavior, deceptive shipping practices, and the rising cost of operating in contested waters.

1. Strait of Hormuz Transits

Traffic rebounded in the final weeks of Q2, after a Memorandum of Understanding between Iran and the U.S. and the scaling up of a U.S.-military-supported southern corridor through Omani waters improved security conditions and lifted transit volumes.

Still, the Strait remains far from fully functioning. Daily transits rose from an average of nine during the first two weeks of June, to 32 in the third week, and 43 in the final week. Overall, June transits were still only around one-sixth of pre-war traffic.

AIS-visible monthly transits totaled 3,750 ships in February, before falling sharply to 450 in March, 630 in April, 450 in May, and 640 in June. Sporadic and targeted drone and missile attacks by the Islamic Revolutionary Guard Corps, as Iran attempts to assert control over the Strait, continue to deter shipowners from entering or leaving.

Observed transits peaked at 61 vessels on June 24, the day after the International Maritime Organization announced an evacuation corridor along the southern route for vessels and seafarers stranded since the war began. The corridor was suspended two days later following Iranian attacks on ships. During those two days, 3,400 of an estimated 10,000 stranded seafarers were evacuated, according to the IMO secretary-general.

Iran’s attempts to redirect ships through a permissions-based northern corridor via Iranian waters are also deterring some shipowners from entering or leaving. The pace and scale of any recovery will depend on shipowner risk appetite, the durability of improved safety and security conditions, and the progress of negotiations between Iran and the U.S.

Tankers are leading the uneven return. Their share of Hormuz traffic rose from 15% in early June to 41% in the final week of the month. This reflected three main factors:

• The removal of the U.S. blockade on Iranian ports, which freed up as many as 150 sequestered Iranian-trading vessels.
• The consolidation of a U.S.-coordinated southern corridor used by Arab Gulf states to move oil and gas for ship-to-ship transfers off Fujairah.
• The brief introduction, and subsequent suspension, of the IMO-sponsored evacuation corridor via the southern route from June 24-26.

The quarter ended with bifurcated routing through Hormuz, while the Traffic Separation Scheme, used for the past 58 years, is cleared of mines.

The first route is the permissions-based, Iran-controlled northern corridor, used mostly by ships affiliated with China, Iran, India, and Pakistan under bilateral agreements with the Islamic Republic.

The second is the U.S.-supported southern corridor through Omani waters, through which Gulf states are shipping energy commodities and vessels stranded since the war are exiting. Many are doing so with AIS turned off where permitted for security and safety reasons.

2. Global Dark Activity

Dark activity surged in Q2, as shipping found itself on the frontline of two wars, in Iran and Ukraine.

A total of 2,157 unique cargo ships and tankers over 10,000 DWT conducted at least one dark activity event lasting more than three days during the quarter. That was almost five times the 449 vessels recorded in Q1.

The number of prolonged dark activity events rose even more sharply, from 451 in Q1 to 3,137 in Q2, a sevenfold increase.

Not all AIS gaps indicate illicit activity. Operational, technical, safety, and security factors can all explain periods of AIS disablement. But sustained outages of more than three days can conceal vessel movements, cargo transfers, or port calls, making them a critical indicator for maritime risk monitoring.

Russia recorded the highest concentration of dark activity overall in Q2, with nearly 4,000 individual events. Prolonged AIS disablement also rose sharply in the Middle East Gulf, where elevated risk from the Iran war and the effective closure of the Strait of Hormuz led many stranded vessels to switch off AIS for safety and security reasons.

One in four extended dark activity events took place off Saudi Arabia, Oman, Iran, or the UAE. Indonesia, China, and Vietnam also ranked among the busiest locations for extended AIS disablement.

This marked a significant shift from Q1, when Indonesia, China, and Romania recorded the highest volumes of prolonged dark activity, while Russia ranked fourth.

3. Slow-Speed Activity Over Subsea Cables

Windward recorded 3,667 loitering events exceeding 12 hours above subsea cables in Q2 2026, involving 2,206 cargo and tanker vessels. An average of 1.66 events per vessel, with one vessel logging as many as 20. The median event lasted 21.7 hours; the 37-hour average reflects a long tail stretching to a maximum of 1,337 hours.

Activity held steady across the quarter: 1,241 events in April, 1,204 in May, 1,222 in June, averaging roughly 40 events per day throughout. The one clear spike came on June 15, with 68 events, nearly double the daily average. Cargo vessels accounted for 54% of all events, tankers 46%.

Geographically, activity concentrated heavily in one corridor. The Red Sea and Gulf of Aden alone recorded 784 events, 21% of the total and nearly double the next-largest zone, Malacca and Singapore (422). Indonesia / Java Sea (313), the Gulf of Oman and Hormuz (308), and the Persian Gulf (293) round out the top five zones, which together account for 58% of all recorded events. A further 407 events, 11% of the total, fell outside the 14 tracked zones, dispersed across other coastal waters.

4. Sanctions Designations 

Regulators worldwide made 486 vessel designations in Q2, down from 851 in the previous quarter. These designations involved 274 unique vessels.

The decline does not indicate reduced focus on Russia or Iran. Rather, it reflects fewer sanctions announcements this quarter from countries such as Australia, Canada, and Switzerland, following several larger catch-up designation rounds between October 2025 and March 2026.

The EU’s 20th sanctions package, released during the quarter, designated 46 ships. The U.S. designated 63 vessels, all related to Iran. The U.S. has not sanctioned any Russian vessels since January 2025. The UK made 27 vessel specifications.

The EU’s 21st package has not yet been promulgated. Regulators are also increasingly focused on Russia’s evolving dark fleet of LNG carriers, with four sanctioned during the quarter.

Collectively, the UK and EU have sanctioned around 650 ships.

Policy divergence between the U.S. and its European and UK allies widened over the quarter. The U.S. implemented three 30-day sanctions waivers on Russian oil to stabilize global oil prices and support supply continuity while Hormuz remained closed. The final waiver expired on June 17.

A second 30-day sanctions waiver on Iranian oil was issued on June 22 as part of Memorandum of Understanding discussions. It was revoked on July 7.

5. The Dark Fleet

Windward’s tracked dark fleet expanded to 2,186 vessels in Q2, up from 2,108 in the previous quarter. Of these, 1,106 vessels, or 50%, are sanctioned.

These sanctions-circumventing gas carriers and tankers now form a bifurcated, parallel fleet, often with limited or no Western touchpoints. They are integral to a well-entrenched logistics network delivering energy commodities that continue to fund the Russian and Iranian regimes.

Russia’s role in the fleet continued to grow, though at a slower pace. Some 18% of dark fleet vessels have Russia listed as the country of registered owner, up from 17% in the previous quarter.

Russia-flagged vessels in the fleet increased by 1% quarter-on-quarter, a sharp deceleration from the 6% gain recorded earlier this year. Russia remained the leading flag state, accounting for 21% of dark fleet tankers, followed by Panama at 9.8%, Cameroon at 6.6%, and Sierra Leone at 4.8%.

Between April and June, 22 dark fleet tankers reflagged to Russia from fraudulent ship registries as European and UK forces interdicted stateless ships in their coastal waters. That was down from 38 in the first three months of 2026.

The Marshall Islands and Hong Kong remained the second- and third-largest countries of registered ownership, broadly unchanged from the previous quarter.

The use of single-ship special purpose vehicles for registered ownership is common in shipping. However, dark fleet vessels often favor jurisdictions and anonymized addresses that make beneficial ownership harder to identify.

Internationally trading tankers greater than 150 meters LOA comprised 84% of sanctioned tonnage, highlighting the role of larger vessels in dark fleet activity.

Dark fleet penetration is especially visible among major tanker classes. Some 18% of the global VLCC fleet is part of Windward’s dark fleet, alongside 16% of suezmax tankers and 25% of aframaxes. The high aframax share reflects the vessel class’s widespread use across Russian ports.

6. Vessel Interdictions 

European forces boarded and detained seven sanctioned, stateless Russia shadow fleet tankers in their coastal waters during Q2.

That compares with six in European waters in the first three months of 2026, plus one vessel turned away by Germany before it could continue its transit into the Baltic Sea.

Across the first half of 2026, France was involved in six of the 13 boardings in European or UK waters. Sweden was involved in five, including one cargo ship detained for environmental reasons. That vessel was the outlier; the remaining cases involved stateless tankers.

The more assertive stance against Russia’s shadow fleet is likely to continue into Q3. The UK seized a tanker in the English Channel at the end of June, while tankers are reflagging and changing routes to avoid naval forces in the Baltic Sea, the Black Sea, and the Mediterranean.

Falsely flagged vessels either use fraudulent ship registries or falsely claim to fly the flags of countries whose maritime authorities have confirmed they are not registered there. As stateless vessels, they can be boarded while sailing in international waters or transiting coastal routes, because they lose the right of innocent passage under international law.

7. Falsely Flagged Vessels

Some 275 internationally trading tankers were broadcasting the flag of a fraudulent registry via AIS in Q2 2026.

That was down from 290 in the previous quarter, even as flag-hopping accelerated following additional sanctions on Russia- and Iran-trading ships.

Windward has now identified 22 fraudulent ship registries. During the quarter, Russia-linked tankers falsely claimed to fly the flags of two new countries: Syria and Myanmar. Neither country operates an international ship registry.

The IMO database listed 580 falsely flagged vessels, up from 550 in the previous quarter and 470 at the end of 2025.

Around 90% of tankers using fraudulent registries were Western-sanctioned. Several have been arrested over the past six months, reflecting a broader flag governance crackdown and the seizure of stateless vessels by EU, UK, and U.S. regulators. This has prompted Russia to move 60 tankers from fraudulent registries to its own flag in the first half of 2026 alone.

Falsely flagged vessels are defined as ships confirmed by a country’s maritime administration as not being authorized to fly that country’s flag.

8. Oil Markets (in Collaboration with Vortexa)

Average global seaborne crude exports contracted by 3.71 million bpd, or 9%, from Q1 to Q2, driven by major reductions from Gulf producers, according to Vortexa data.

Declines from the Middle East Gulf were partially offset by increased shipments from the U.S., Russia, and Venezuela. U.S. exports rose by 1.3 million bpd quarter-on-quarter, Russian exports by 1.1 million bpd, and Venezuelan exports by 300,000 bpd.

Exports from Russian ports, which also include Kazakh grades, increased as Ukrainian drone attacks crippled port and refinery infrastructure, reducing domestic throughput and freeing up more crude for export.

Saudi Arabia was the biggest loser from the Iran war, Vortexa data show. Crude shipments fell 37% quarter-on-quarter, or 2.36 million bpd, even as the kingdom redirected record volumes by pipeline to the Red Sea port of Yanbu.

The biggest surprise was the UAE, where exports rose by 2.7%. This was partly explained by very low first-quarter volumes, dragged down by a weak March, when the Strait of Hormuz first closed. Volumes began recovering in April, with sustained increases through May and June.

The UAE’s national oil company not only increased pipeline exports to Fujairah, but also worked with the U.S. military to establish a secret southern corridor through the Strait via Omani waters. Tankers sailed to UAE loading terminals west of Hormuz with AIS turned off, then shuttled to and from Fujairah, transferring oil onto waiting vessels for onward shipment to Asia and India.

By June, monthly UAE exports had recovered to 3.6 million bpd, surpassing pre-war levels.

While the global oil market is recovering, the disruption remains material. June shipments from Gulf states west of Hormuz that lack significant pipeline alternatives were still only 32% of the January-February average.

Alongside the release of strategic reserves in Japan and the U.S., China also played a role in averting a global oil shortage. China’s seaborne crude imports totaled 7 million bpd in Q2, down from 11.1 million bpd in the previous three-month period.

9. GPS Jamming 

GPS interference has become a persistent feature of global shipping rather than an episodic one. In Q2 2026, 171,286 distinct vessels were jammed at least once worldwide, down 8% from the previous quarter and 35% below the Q4 2025 peak of 262,117, when interference reached its highest level in the 18 months Windward has tracked it.

The quarterly decline masks the intensity of what followed Operation Epic Fury. Since the operation began on February 28, Windward has detected 3.35 million false ship-to-ship meetings globally, in which spoofed positions made vessels appear to rendezvous when no meeting took place. Spoofing peaked on March 20 at 356,773 false meetings in a single day, while daily jammed-vessel counts topped out at 13,090 on March 7.

Activity subsided through April following the ceasefire and the imposition of the blockade, then resurged from mid-May. The second wave peaked at 190,515 false meetings on May 20, slightly more than half the March high, while daily jammed-vessel counts remained below their March peak throughout. Q2 as a whole recorded 1.24 million false meetings.

Looking Ahead

Q2 made plain there is no clear path back to the pre-war maritime order. Commercial shipping is no longer treated as neutral: navies from eight countries attacked or boarded merchant vessels, Ukraine now classifies more than 700 tankers as military-affiliated assets, and Russia is operating tankers for surveillance, espionage, and drone activity. These are unlikely to unwind as wartime exceptions.

The structures built under pressure this quarter are becoming standing features. Hormuz ended Q2 split into two politically controlled corridors, and any recovery will likely run through that architecture rather than around it. The shadow fleet has shifted from a sanctions workaround toward state-directed infrastructure, and Europe’s boardings are pushing it further under Russian protection. Dark activity, jamming, and identity fraud all point the same way: concealment is now routine operating behavior for a growing share of the world fleet.

Transit volumes, enforcement tempo, and freight rates will fluctuate in Q3. The underlying assumption that commercial shipping operates outside state competition will not return with them.

Get Ahead of H2’s Maritime Risks with Multi-Source Intelligence