DEEP DIVE – On January 10, the oil tanker Eventin was steaming westward from Russia along Germany’s Baltic coast, bucking eight-foot waves and biting winds, when its systems shut down in a total blackout. The 19-year-old Panama-flagged vessel, the length of three football fields, was drifting and declared “unmaneuverable.”
Germany's Central Command for Maritime Emergencies scrambled a team of specialized operators to rescue the 24-man crew, struggling to survive the lashing winter storm without heat or light, and to prevent the ship from crashing into rocks and disgorging its cargo – 109,000 tons of Russian crude oil destined for Egypt – onto the pristine beaches and chalk cliffs of Germany’s storied Rügen Island. The risks of environmental disaster and a shutdown of vital commercial shipping lanes loomed.
If the worst-case scenario happened, who would fix it? Who would pay?
Not Russia.
That’s because the Eventin is part of Russia’s “shadow fleet,” a collection of hundreds of aging, thinly-insured tankers owned and operated by layers of front companies, some with addresses in obscure corners of the developing world. They are therefore technically not “Russian.” The Kremlin assembled the fleet to evade Western sanctions imposed on Russia’s oil exports after Moscow launched its invasion of Ukraine in February 2022.
“The shadow fleet refers to a large group of oil tanker vessels that are operating outside of international supervision and are receiving maritime insurance and other maritime services outside of the traditional Western sources that reputable shippers and commercial agents use to move these cargoes around the world,” Clayton Seigle, Senior Fellow for Energy Security at the Center for Strategic and International Studies, told The Cipher Brief. “The shadow fleet has been employed particularly by exporting countries that have been hit by sanctions – namely Iran, Venezuela, and Russia.”
The shadow fleet ships are owned and operated by people willing to skirt maritime rules and conventions and hire out their vessels to pariah nations. Last December, the Maritime Sanctions Task Force of the Royal United Services Institute for Defence and Security Studies (RUSI), the UK’s leading security think tank, said that Russia had invested more than $10 billion to acquire and maintain its shadow fleet, which then generated “billions [of dollars] annually” for the Russian government since Western sanctions were imposed in 2022. The Centre for Research on Energy and Clean Air, based in Helsinki, estimates that since the beginning of the war, Russia has brought in 563 billion euros, or $585 billion, in revenues from crude oil exports – and much, if not most, of those exports are believed to have been moved by shadow vessels. The KSE Institute, an analytical arm of the Kyiv School of Economics, estimated last October that shadow fleet tankers carried close to 89 percent of Russian crude oil and 70 percent of all Russian seaborne oil exports.
Building the shadow fleet
Russia’s shadow fleet was organized to evade the price cap on Russian oil imposed by the U.S. and G-7 nations on Dec. 5, 2022, as punishment for Russia’s full-scale invasion of Ukraine. U.S. and European officials were unwilling to ban Russian oil sales outright, for fear of destabilizing world energy markets and creating shortages. Instead, they devised a novel scheme, hoping to deprive the Kremlin of windfall profits that could be used to underwrite its aggression in Ukraine. The resulting sanctions set a price cap of $60 a barrel for Russian crude – a deep discount from theworld price, which spiked above $100 immediately after Russia went into Ukraine and was hovering around $80 in early December of 2022. Recently the world price has been in the $70s.
The price cap rules forbade Western shipping, maritime service and insurance companies from having anything to do with ships moving Russian oil for transactions that would exceed the price cap. Russian oilmen countered by turning to older tankers that were less inclined to abide by maritime safety and insurance standards. Last month, the London-based RUSI estimated that Russia’s shadow fleet had grown to “1,000 poorly maintained and uninsured vessels” which it said not only undermined the western sanctions; “its risky practices of disabling navigation systems to avoid tracking and ship-to-ship oil transfers without adequate insurance pose grave risks to international shipping and the environment.”
Henri van Soest, a senior analyst at RAND Europe and an expert on energy and natural resources, told The Cipher Brief that the Russian shadow fleet may be even bigger – some 1400 vessels, or around 17% of the global oil tanker fleet. “A significant amount of the global oil tanker fleet could now be considered to be part of the Russian shadow fleet,” Van Soest said.
The Russians assembled the fleet over the past three years “by finding vessels that were otherwise being taken out of service at the end of their useful lives and had just a few years left before being scrapped,” Van Soest said. “Vessels that would otherwise not be at sea any longer…are now still sailing around the world, transporting Russian oil and therefore causing potentially quite hazardous conditions.”
Everyone needs a good nightcap. Ours happens to come in the form of a M-F newsletter that provides the best way to unwind while staying up to speed on national security. (And this Nightcap promises no hangover or weight gain.) Sign up today.
The case of the Eventin
The Eventin is a case in point. According to The Maritime Executiveand Hansa.news,publications that serve the commercial shipping industry, the Eventin was built in 2006 for a reputable Norwegian tanker firm. After the invasion of Ukraine in 2022, Maritime Executive reported, it was sold to an “anonymous holding company” called Vaigai Lines, with an address in the United Arab Emirates. Its new operator was listed as a Dubai-based tanker firm named Fractal Marine DMCC, which, according toMaritime Executive,“was an early leader in providing alternative shipping services to Russian oil exporters.” Fractal Marine was sanctioned by the U.K. Foreign Office last March for helping Russia violate sanctions. Maritime Executive reported that the day the U.K. sanctions were issued, “Vaigai Lines took over as Eventin's operator, removing Fractal's name from the vessel's management record. Vaigai then resold the vessel to another anonymous single-vessel holding company, Laliya Shipping Corp, which has no listed address.” Currently, Hansa.news reported, “the owner is Laliya Shipping from the Marshall Islands, apparently a one-ship company.”
When the Eventin was stricken on Jan. 10, there was no sign that Russia or the vessel’s owner, whoever it was, would be sending help. European authorities were painfully aware that Russia’s oil tankers were old and poorly maintained. Three weeks earlier, Russia had suffered one of its worst environmental disasters in modern times, when, according to The Maritime Executive, two Russian oil tankers were caught in a ferocious storm in the Kerch Strait off Crimea and dumped 5,500 tons of fuel oil into the Black Sea. Toxic sludge spread for hundreds of miles, killing countless marine creatures and shore birds. By early January, cleanup teams had hauled away nearly 100,000 tons of contaminated dirt and sand. The publication, citing the Russian investigative news outlet IStories, reported that the ships that broke up had been built more than 50 years earlier, for use in rivers and bays, yet were sent into heavy seas in a flotilla that was refueling Russian shadow fleet vessels, including at least three deep sea tankers that had beensanctioned by the U.S.
The Eventin’s load of oil was nearly 20 times that of the tankers that broke up in the Kerch Strait. With a threat of such magnitude looming, German officials and seamen scrambled.
Braving near-gale-force winds, a police helicopter lowered four operators from the Havariekommando, Germany’s Maritime Emergencies command, onto the Eventin’s deck. They rigged lines to three tugboats, which towed the crippled tanker to a calmerspot. There it remains moored, according to the commercial ship tracking website MarineTraffic.com, awaiting repairs and resolution of its legal status.
“I and my colleagues from the Baltic Sea region have warned time and again of the threat of this scenario,” German Foreign Minister Annalena Baerbock said in a statement. “Russia is jeopardising our European security not only with its illegal war of aggression against Ukraine but also with severed cables, displaced border buoys, disinformation campaigns, GPS radio jammers and now also with dilapidated oil tankers.”
From oil traffic to sabotage
European authorities now suspect that some shadow fleet vessels are doing double duty for Moscow, not only moving Russian oil but carrying out sabotage as well.
“There's quite a dense network of subsea infrastructure on the sea floor of the Baltic Sea, and indeed in other waters around Europe,” Van Soest told The Cipher Brief. “In most incidents recently in the Baltic Sea, ships have been dragging their anchors, and then using the force of that anchor to snap a subsea infrastructure located on the seafloor.”
On Christmas Day, an alleged shadow fleet oil tanker Eagle S severed a power cable and several telecommunications cables connecting Finland and Estonia in the Baltic Sea. Accident or sabotage? That may never be resolved. Lloyd’s List, a venerable London-based shipping news and commercial intelligence outlet, reported that Finnish authorities seized the tanker Dec. 28 and discovered “transmitting and receiving devices installed that effectively allowed it to become a ‘spy ship’ for Russia.” Finland’s efforts to make a case against Russia is complicated by a murky paper trail: Van Soest wrote that the Eagle S was operated by a company based in the United Arab Emirates, managed by an Indian firm, and traveling under the Cook Islands flag.
“The fleet's size effectively extends Russia's naval and intelligence capabilities,” Van Soest wrote in a Jan. 16 article in The National Interest. “While these vessels lack conventional warfighting functions, they are well-suited for gray-zone tactics and hybrid threats. Operating under the guise of commercial activities and protected by international maritime law, shadow fleet vessels can navigate international waters largely unnoticed. Unlike Russian naval or research ships, which are closely monitored, commercial vessels are harder to track.”
The intersection of technology, defense, space and intelligence is critical to future U.S. national security. Join The Cipher Brief on June 5th and 6th in Austin, Texas for the NatSecEDGE conference. Find out how to get an invitation to this invite-only event at natsecedge.com
NATO’s answer
On Jan.14, NATO and the Baltic states stood up a new military initiative, Baltic Sentry, to patrol the Baltic with frigates, maritime patrol aircraft and naval drones to "enhance NATO’s military presence in the Baltic Sea and improve Allies’ ability to respond to destabilizing acts." NATO Secretary General Mark Rutte called the Russian shadow fleet “a big issue,” highlighting its multiple threats: the circumvention of sanctions, undersea cable cuts, and the environmental risks
It’s still early, but Baltic Sentry hasn’t stopped the problems the shadow fleet has created. Experts say that with so many older tankers available, that may be a mission impossible.
On Jan. 26, an undersea fiber optic cable linking Latvia to Sweden was severed. The Swedish Security Service seized the Vezhen, a Maltese-flagged cargo ship, on suspicion of “gross sabotage.” The Vezhen had sailed to the area from the Russian port of Ust-Luga. Five days later, Norway briefly detained a second cargo ship suspected of playing a part in the incident. The Silver Dania, flagged in Norway but crewed entirely by Russians, had been sailing between the Russian ports of St. Petersburg and Murmansk. Both ships were released for lack of evidence. Swedish prosecutor Mats Ljungqvist said the Vezhen was responsible for the damage but added, "we can say with certainty that this is not a case of sabotage.” The Swedish statement added cryptically, “An investigation is continuing to find out whether other crimes may have been responsible for the cable break.”
In an effort to crack down on the shadow fleet, and other aspects of Russia’s energy industry that help finance the Ukraine war, on Jan. 10 the outgoing Biden administration issued sweeping new sanctions on 183 vessels believed to be in the shadow fleet or owned by Russian companies. The EU had already sanctioned more than 70 alleged shadow fleet ships, and together the U.S. and U.K. blacklisted Russia’s two major energy producers – Gazprom Neft and Surgutneftegas – and dozens of smaller companies, including “opaque traders” that ship and sell Russian oil, maritime insurance companies, oilfield service providers and Russian officials. The effect was to bar just about any transaction between a Western business and the Russian energy sector.
The latest rounds of sanctions cover only a fraction of the shadow fleet (the Eventin, for example, wasn’t on the do-not-trade-with list, though its numerous visits to Russian oil ports had been documented), but analysts say the new rules add significant difficulty for Russian oil companies. Bloomberg Newsreported that the January 10 actions could significantly disrupt Russia’s oil exports,since the tankers blacklisted that day moved more than a fifth of Russia’s seaborne oil.
CSIS’ Seigle believes that the January sanctions have sharp teeth, made sharper by the “Trump effect” – meaning fear. President Trump has not yet indicated how forcefully his administration will enforce anti-Russia sanctions, but Seigle says officials in China and India, the major consumers of exported Russian oil and gas, dare not take the chance of guessing wrong.
“The companies in China and India will flee from this trade with the shadow fleet tankers and will not allow them into their ports or to discharge cargos in those countries anymore because they're going to be afraid,” Seigle says. “China also does not want to run afoul of the U.S. Treasury and particularly of the new sheriff in town in Washington.”
Russian workarounds
Over the longer term, though, Seigle and others expect Russian oil companies and their middlemen will find creative new schemes to move Russian oil to the international market.
Shadow vessels have been documented turning off transponders or beacons known as Automatic Identification Systems (AIS), required by the International Maritime Organization to avert collisions. AIS data is routinely collected by maritime tracking services and can be analyzed to find ship-to-ship oil transfers. Going dark thwarts that kind of detective work.
Increasingly sophisticated AI-driven electronic tools are being developed to locate “dark” beacons. But bad actors are also at work on electronics to beat surveillance. There are now ways to spoof the AIS system by falsifying a ship’s position – analogous to popular virtual private networks (VPNs) that people use to mask their IP addresses.
Meanwhile, Russia’s need to beat sanctions has created a lively market for old ships, some of which are breaking down and creating hazards to navigation, while others are doing double duty in the gray zone as tankers, spy ships and for sabotage. An international investigation published this month by the European journalism consortium Follow The Money, concluded that European and American shipowners have sold at least 230 aging vessels into the shadow fleet for more than $6 billion since February 2022. Shipowners from 21 countries that sanctioned oil trade with Russia sold ships that ended up in the shadow fleet, the report said.
Earlier this month, experts at an international commercial shipping conference in New York City spread the happy news, for fleet owners, that even decrepit old scows were bringing top dollar. “This is a seller’s market for tankers,” shipping industry news outlet GCaptain reported, especially for the class known as “Very Large Crude Carriers.”
If not for Russian demand for these vessels, Follow the Money said, most of those old ships would have been sold for scrap.
“It reminds me of the arcade game Whack-a-Mole, where you're continuously trying to keep the bad guys down with your little foam mallet,” Seigle said.. “The U.S. Treasury Office of Foreign Asset Control, which is responsible for developing and enforcing the sanctions, is really going to have its work cut out for it. New tankers are going to join the shadow fleet. That's inevitable. Where there's a market demand they will find the supply of new tankers in order to fill the gap.”
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief
