Russia uses shadow fleet for espionage — CNN

Russia is using its so-called shadow fleet not only to circumvent Western sanctions but also as a tool of intelligence gathering and hybrid warfare against Europe. Russian military and security services have been conducting espionage operations in European waters while working undercover on oil tankers belonging to the shadow fleet. The fleet consists of hundreds of vessels that Moscow began actively deploying after its full-scale invasion of Ukraine in 2022.

CNN reports this exclusively, citing sources in Ukrainian and Western intelligence.

Russia uses shadow fleet not only to transport oil but also for spying

According to CNN, the tankers transport Russian oil from ports in the Baltic and Black Seas despite sanctions, generating hundreds of millions of dollars for the Kremlin every year.

Ukrainian intelligence has documented that in recent months additional crew members have appeared on some of these vessels shortly before departure from port. Although most sailors are not Russian citizens, crew lists reviewed by CNN journalists included the names of two Russians with details from their Russian passports. Intelligence sources say these individuals have backgrounds in security or law-enforcement agencies.

During conversations with multiple intelligence officials, CNN learned that some of these individuals are linked to the private security company Moran Security.

Western intelligence sources say Moran is a private security firm closely connected to the Russian military and intelligence services. In 2024, the company was added to the U.S. Treasury Department’s sanctions list for providing armed security services to Russian state enterprises in the context of the war against Ukraine.

According to Ukrainian and Western intelligence, Moran personnel have also been deployed on several shadow fleet tankers and are often the only Russian citizens on board. Ukraine’s Foreign Intelligence Service said it has been observing this practice for at least six months.

One Western intelligence source told CNN that Moran personnel aboard one tanker photographed European military facilities, though no further details were provided. Oleksandr Stakhnevych, a representative of Ukraine’s Foreign Intelligence Service, said another task of the Russians on board is to monitor ship captains, most of whom are not Russian nationals.

Western intelligence assessments indicate that Moran personnel do not take part in direct combat operations but ensure that crews act in line with Kremlin interests. Their presence — given the scale of the shadow fleet and its activity near European shores — is causing growing concern among security services.

Intelligence cannot yet prove Russia’s involvement in sabotage

Former Danish intelligence officer Jacob Kaarsbo described the presence of private armed groups aboard tankers as an example of "plausible deniability," where it is formally difficult to prove state involvement despite clear coordination.

CNN closely examined Moran’s activities through the case of the sanctioned tanker Boracay, which has repeatedly changed its name and flag state over the past three years. According to Ukrainian intelligence, on September 20 two Russians boarded the vessel in the port of Primorsk near St. Petersburg. Satellite images confirm the tanker was in port that day.

These individuals were listed as technicians and were the only Russians on board, while the rest of the crew were citizens of China, Myanmar, and Bangladesh. Ukrainian intelligence identified the men, and Western sources confirmed their identities to CNN. One of them, according to intelligence, is a former police officer who previously worked with the Wagner private military company.

During another voyage in July, Ukrainian intelligence reported that one of the Russians on board Boracay had served in a special-purpose unit of Russia’s Interior Ministry, while the other was linked to the Russian Ministry of Defense. The tanker drew additional attention in September when it was transporting oil to India. While the vessel was off the coast of Denmark, a series of mysterious drone incidents were recorded in the Copenhagen area and near military facilities. Western intelligence officials consider the timing suspicious, although no direct link has yet been proven.

Later, French military forces stopped Boracay off the coast of Brittany due to missing documentation confirming the vessel’s nationality. It was then that the two Russians among the crew were discovered. The Chinese captain was arrested, and French authorities are investigating violations related to the vessel’s registration and flag.

Russia transfers oil through companies linked to the Wagner PMC

According to Western intelligence, the Moran Security Group was founded in 2009 and has close historical ties to the Wagner Group, the Russian military, and security services. Former Moran executives were involved in creating the Slavonic Corps, which later evolved into the Wagner PMC. The company advertises maritime security, logistics, and intelligence services, and lists the state-owned shipping company Sovcomflot among its clients.

European security services now view the use of the shadow fleet with armed personnel as an element of Russia’s hybrid war aimed at destabilizing the region. At the same time, some European governments acknowledge the difficulty of responding to such actions without coordinated, EU-level decisions.

Read also: 

EU agrees mechanism to fund Ukraine through 2027

Zelensky says Ukraine’s EU accession could be accelerated