Covert Maritime Intelligence and Russia’s Shadow Fleet
[By Catherine Marie Abbott]
It is widely documented that Russia has leveraged various threat vectors to employ coercive and ancillary irregular tactics against allied nations, including the pervasive use of sanctioned shadow fleet vessels. Acting as a threat multiplier through decentralized and opaque ownership structures, these ships have operated in concert with Russian intelligence, reconnaissance, and surveillance (ISR) assets. Western and Ukrainian intelligence sources note that crew composition varies considerably. Some vessels reportedly operate with supernumerary Russian personnel with documented security or military credentials. This includes individuals affiliated with Russian private military companies (PMC) such as the Moran Security Group and the Wagner Group, as well as with the Main Intelligence Directorate (GRU).
To address Russia’s sanctioned fleet, many allied nations, including the United States, United Kingdom, and European Union have enacted legislation barring such vessels from entering their ports. However, despite proactive measures, the adaptive nature of shadow fleet networks sustains ships’ ability to evade detection and exploit enforcement gaps. At a systemic level, seaports generally serve as tangible operational conduits for the modus operandi of trafficking networks, enabling the smuggling of illicit goods through vulnerable entry points. Reportedly, 90% of the world’s cargo is transported via maritime corridors and containers, with only a segment of goods physically inspected by customs authorities, allowing for clandestine behavior from traffickers or Russian covert operatives.
At present, Russia is exploiting European seaports and maritime infrastructure. Despite port interception and seizure operations from allied nations, Russia’s acquisition of ghost vessels continues in an upward trend. While primarily used as a strategic tool to augment sanctions evasion and sustain defense expenditures, Russia’s irregular tactics, alongside vulnerable seaport ecosystems, create conditions that could facilitate covert human movement under commercial cover for the Russian Federation.
Russian Covert Human Intelligence in the Modern Era
Moscow’s use of clandestine human intelligence assets relies on deniable human networks embedded within state operations, an act synonymous with Cold War-era tactics. In 2022, the Slovenian Security and Intelligence Agency found Russian illegal spies, Artyom Dultsev and Anna Dultseva, masquerading as Argentinians and acting on behalf of the Kremlin. A fundamental espionage tool since the Soviet Era, illegal spies have reportedly remained a critical asset to Moscow’s intelligence architecture against the West, leveraging international vulnerabilities and infrastructure gaps to gain a strategic advantage. This is exemplified in the case of Maria Adela Kuhfeldt Rivera, a Russian illegal operative turned NATO-affiliate socialite.
Though not isolated incidents, Russia’s non-ephemeral strategy has leveraged irregular clandestine methods to infiltrate and destabilize the Western world. During the Soviet era, clandestine volunteer forces, state-run proxy units, and disguised military personnel conducted covert operations while maintaining plausible deniability. Today, PMCs have emerged within a similar structural framework in the Russian Federation, with syndicates such as the Wagner Group internationally executing state security objectives in the application of the Kremlin’s hybrid warfare doctrine. Although not officially recognized as acting under the Federation, PMCs maintain an intimate relationship with the GRU, supporting its intelligence and military agencies.
As a segment of Russia’s state-sponsored irregular operations, gray-zone activity has shifted toward more decentralized hybrid structures, integrating formal intelligence services with semi-commercial and proxy networks. Reporting on Russia’s wartime intelligence activity in Europe indicates increasing reliance by the Federal Security Service (FSB) and the GRU on intermediary facilitators and autonomous operatives to conduct surveillance, targeting, and influence operations across multiple jurisdictions. Parallel training pipelines within Russian academic and military structures institutionalize asymmetric warfare competencies, including cyber operations, disinformation, and reconnaissance tradecraft within distinctly identifiable recruitment pathways into intelligence services. These networks operate through formal state structures and semi-private intermediaries within permissive civilian environments, maintaining plausible deniability for Russia’s intelligence apparatus.
Maritime Shadow Networks and Port Vulnerabilities
Operating under opaque and decentralized ownership structures, shadow vessels have since emerged as an adaptation to international energy sanctions following the onset of the Ukrainian-Russo War in 2022. Though a maritime security threat across all sectors, they elude maritime detection through highly coordinated concealment tactics. Among the most salient of these obfuscating tactics are AIS data manipulation, ship-to-ship transfers, frequent reflaggings and name changes, and falsified vessel documentation, including shell corporations and a lack of P&I insurance. Notably, reports indicate that over 70% of sanctioned vessels changed flags in 2025, complicating allied interdiction and seizure efforts. The synthesis of these arrangements, as well as the Russian Federation’s acquisition of new tankers, has impeded allied nations’ effectiveness in addressing shadow vessels.
Transgressing beyond vessel identification ambiguities, open-source reporting indicates discrepancies between declared crew manifests as well as individuals observed aboard shadow vessels in Northern European waters. For example, in December 2025, Danish maritime pilots reported uniformed Russian Navy personnel not reflected in official manifests in the Danish Strait. Three months prior, French authorities boarded Boracay (IMO 9332810), a Russian-affiliated sanctioned ship operating under multiple aliases and flags. Boracay aliases include Kiwala, Pushapa, and most recently, Feniks. Authorities observed two men with a background in the Wagner Group and the Moran Security Group, both of which are widely assessed to maintain links to Russia’s FSB.
Generally designed as controlled zones, seaports, aside from their vulnerable cyber landscape, remain tangibly susceptible to opportunistic threat vectors. Despite strengthening port security infrastructures and inspection methods, maritime smugglers continue to pursue adaptive concealment measures by hiding illicit cargo in anchors, vents, hull compartments, fuel systems, and underwater attachments, with 85% of seizure events involving shipping containers and 80% of seized narcotics by volume linked to containerized cargo. Meanwhile, 68% of detected cases involve internal conspirators within the maritime cargo supply chain.
Earlier assessments of maritime security governance identified seaports as structurally constrained systems that have a fragmented authority apparatus and disjointed security standards across federal, local, and private actors, often relying on risk-based rather than comprehensive inspection regimes and selectively inspecting cargo. Given the role of seaports as high-volume logistical hubs embedded within urban infrastructure, ports must sustain the continuous movement of cargo, personnel, and vessels, limiting the feasibility of maintaining fully restrictive access control and comprehensive screening measures. Additionally, despite sanctions, some shipments coming from Russian ports have successfully docked and unloaded at ports in the European Union and allied coastal states.
Online reports have noted alleged infiltration by Russian covert operatives into the United Kingdom via commercial cargo ships and lenient border surveillance and security checks, which are reportedly less rigorous than other ports of entry. Although the vessels used were not Russian-flagged and were not listed in current sanctioned shadow fleet listings, access was obtained through ports including Torquay, Middlesbrough, and Grangemouth.
Synthesis: Mechanisms of Potential Covert Human Movement via Maritime Channels
Viewing itself as diametrically opposed to the West, the Russian Federation will capitalize on vulnerabilities to destabilize and polarize allied nations and has exploited sub-Article-5 thresholds using various modes, notably underwater infrastructure mapping, pre-emplacing explosives near subsea assets, and habitual drone incursion operations in allied airspace. Although operating outside standard maritime compliance, current observable indicators do not conclusively demonstrate a systemic, covert infiltration from Moscow through shadow fleet vessels. However, the fleet’s adaptive characteristic, in concert with existing vulnerable physical port security, creates exploitable conditions under which clandestine infiltration could very likely occur.
Arguably, Russia may not extensively use sanctioned vessels to conduct clandestine human operations given their compromised status, but with the acquisition of new auxiliary vessels, the Federation may increasingly rely on a secondary, more adaptable shadow fleet to do so. For example, targeting efforts by allied nations have highlighted frequent renaming and reflagging of select vessels, and despite these evasive tactics, allied states generally maintain a unified, restrictive port-access strategy toward known shadow fleet assets. In the case of the Feniks, while operating under the name Kiwala, the vessel was reportedly linked to Djibouti. However, when later sailing as Boracay, it was observed sailing under a falsified Benin flag and now sails as the Russian-flagged Feniks. Presently, reports indicate that Russia is re-registering and absorbing approximately eighty previously identified sanctioned vessels into its domestic registry. Concurrently, Russia continues to acquire additional auxiliary vessels that fall outside existing sanctions designations. This maritime restructuring may be linked to allied interdiction strategies targeting older Generation 1 sanctioned vessels, which have reduced their operational flexibility and maneuverability. This may also indicate the emergence of lower-signature adaptive configurations consistent with a Generation 2 shadow fleet architecture of newer vessels within Russia’s maritime network.
While Generation 1 vessels have restricted access to port infrastructure, the newly acquired Generation 2 fleet may provide the Kremlin with operationally clandestine flexibility and intangible, non-kinetic tactics required to gain access to allied ports until such vessels are identified, sanctioned, and barred from seaport entry. Preliminary reports already allege Russia’s intention and use of foreign-flagged vessels to gain entry in vulnerable ports varying in size and capabilities for covert motives, so the possibility of using unknown foreign-flagged vessels for such purposes remains considerably likely. Especially given that such vessels have been a notable mechanism for intelligence gathering and hybrid applications.
Conclusion
The Russian shadow fleet has transformed into a tool functioning outside the legal standards of maritime compliance and will almost certainly continue to do so with a new generation of shadow vessels. Though the development of a Generation 2 shadow fleet remains undetermined, the inherent restructuring and acquisition of various vessels indicate the likelihood that Russia may seek to operationalize newly acquired and lesser-known auxiliary vessels in a manner consistent with the evasive and irregular characteristics previously observed across the Generation 1 fleet. This strategic adaptation has been met with minimal resistance, signaling to the Kremlin that its actions carry few geopolitical penalties. The perceived permissiveness of allied states’ reluctance to definitively interdict on sub-Article 5 irregular tactics has incentivized adversarial states to escalate engagement of hybrid warfare strategies against allied nations, both within and outside of the maritime domain. However, under international maritime law, the United Nations Convention on the Law of the Sea (UNCLOS), port states have significant authority to regulate and intervene in the activities of shadow vessels.
Because port access remains subject to coastal state discretion under international maritime law, port states retain significant authority to condition or deny entry to vessels assessed as part of the Generation 2 fleet. Under such a context, port states may further condition clearance on pre- and post-berthing inspection access, enabling customs and maritime security teams to verify declared cargo against physical inventories and identify discrepancies indicative of sanctions evasion or covert logistical activity. Port authorities may also restrict or prohibit disembarkation of individuals not explicitly listed on the vessel’s official crew manifest, pending identity verification and security screening.
Notably, seaport heterogeneity in function, governance, and security structures creates varying operational conditions across maritime infrastructure. Allied states targeting Generation 2 shadow vessels can leverage historical context and preexisting navigational patterns associated with the Generation 1 fleet to determine which terminals contemporary ships will almost certainly use and prioritize enhanced monitoring and port security apparatus accordingly, including stricter inspection regimes and controls on disembarkation for individuals not verified against official crew documentation.
that matters most
Get the latest maritime news delivered to your inbox daily.
Catherine Marie Abbott holds a master’s degree in security policy studies from the George Washington University Elliott School of International Affairs, specializing in maritime security and intelligence analysis. Her research primarily focuses on maritime logistics, emerging technology, and intelligence processing. The views and opinions expressed by her do not reflect or represent those of her employer or affiliated organizations.
This article appears courtesy of CIMSEC and may be found in its original form here.
The opinions expressed herein are the author's and not necessarily those of The Maritime Executive.
