Russia's Shadow Fleet: How 287 Sanctioned Tankers Keep Urals Crude Flowing (2024–2026)

At 12:26 EET on 25 December 2024, the EstLink 2 submarine power cable between Finland and Estonia failed, reducing cross-border transmission capacity from 1,016 to 358 megawatts. Within hours, Finnish coastguard aircraft had vectored toward a Cook Islands-flagged Aframax tanker called Eagle S, IMO 9329760, loitering off Porkkalanniemi after loading Russian-origin petroleum products at Ust-Luga. By the end of the day, Finnish police had boarded and seized the vessel on suspicion of aggravated sabotage. Investigators alleged the tanker had dragged its anchor nearly 90 kilometres across the seabed, severing the cable and damaging four telecommunications lines in the process.^[1][2] What made the Eagle S more than a single maritime incident was the paperwork behind it: a vessel ostensibly owned by a Marshall Islands single-ship LLC, flagged through a registry in the South Pacific, insured by an underwriter outside the International Group of P&I Clubs, and carrying Urals-grade crude into a market that had theoretically been closed by the G7 price cap two years earlier.

What the shadow fleet is, in regulatory terms

"Shadow fleet" is a colloquial term, not a statutory one. The underlying legal architecture it routes around is a specific one. On 5 December 2022, the G7, the EU, and Australia implemented a price cap on seaborne Russian crude oil, later extended to refined petroleum products in February 2023. The cap works indirectly: it does not prohibit non-G7 countries from purchasing Russian oil, but it prohibits service providers established in G7 jurisdictions — insurers, reinsurers, P&I clubs, tanker owners, banks, trade-finance providers — from servicing any cargo sold above a ceiling price (USD 60 per barrel for crude, with separate caps for refined products).^[5] Because the global marine-insurance market is concentrated in London, Oslo, and the International Group of P&I Clubs, a price cap on service provision is effectively a price cap on the trade itself — unless the trade routes around G7 service providers entirely.

That is the vacuum the shadow fleet occupies. OFAC's internal working definition, surfaced in its February 2024 designation of Sovcomflot and 14 associated tankers, treats a shadow-fleet vessel as one that exhibits at least two of: opaque ownership structures, flag-of-convenience registration in a jurisdiction with weak enforcement, absence of International Group P&I cover, pattern-of-life indicating AIS manipulation, and operational involvement in transporting crude priced above the cap.^[6] The EU's 14th sanctions package, adopted on 24 June 2024, took a narrower but more enumerable approach: it listed 27 specific vessels by IMO number and imposed port-access bans and service-provision prohibitions on each.^[7] The UK's approach under the Russia (Sanctions) (EU Exit) Regulations 2019, as amended through 2024 and 2025, sits between the two — it lists vessels individually but also empowers port authorities to refuse entry based on pattern-of-life inference.^[8]

The practical consequence: a single tanker moving Urals crude from Primorsk to Fujairah can be sanctioned in one jurisdiction, listed in a second, and entirely unlisted in a third. Compliance obligations depend on where the counterparty is incorporated, where the vessel's call is made, and whose flag it flies at the moment of inspection. This jurisdictional patchwork is the enforcement gap the fleet exploits.

Methodology: identifying a shadow-fleet tanker from open sources

The investigative question is rarely "is this vessel on a list." Automated screening answers that. The question is "is this vessel exhibiting the pattern of a shadow-fleet unit even though it has not yet been listed." The following workflow is what we apply in practice, and it is the same workflow used by KSE Institute, CREA, and Windward in their published identifications.

Case 1: Eagle S — the Cook Islands anchor-drag

The Eagle S is the public face of the 2024 inflection point. Built in 2006, IMO 9329760, 74,000 deadweight tonnes, the tanker is a conventional Aframax whose atypicality begins with its registry history. Equasis records list prior flags including Liberia and Marshall Islands before the vessel moved to the Cook Islands registry in 2024.^[1] The registered owner as of the seizure was a Marshall Islands single-ship LLC whose upper-tier parent has been traced, in subsequent press reporting and in the Finnish criminal investigation, to a UAE operator with prior links to Russian-origin cargo.^[13]

On 25 December 2024, the Eagle S had loaded petroleum products at the Russian port of Ust-Luga and was proceeding westbound through the Gulf of Finland when EstLink 2 failed at 12:26 EET. By the time the Finnish coastguard vessel Turva reached the scene, Finnish investigators had already correlated AIS track data, seabed cable coordinates, and voyage timing to conclude that the vessel had trailed its anchor for extended distances. On 26 December, the Finnish police formally opened a criminal investigation for aggravated sabotage, aggravated vandalism, and aggravated interference with telecommunications.^[2] Subsequent reporting indicated that the vessel was found to contain surveillance equipment that the master and crew could not satisfactorily account for.^[14]

Two features of the Eagle S case are structurally revealing. First, the vessel was not on the OFAC SDN list at the time of seizure, and was not individually listed under the EU's 14th package. It was sanctioned by the UK in March 2025, months after the incident.^[15] That is: a tanker exhibiting every published shadow-fleet marker — Cook Islands flag, recent re-flagging, single-ship LLC ownership, uninsured or opaquely insured, and (as the incident demonstrated) willing or directed operational involvement in a hybrid-warfare activity — was not, at the moment of incident, subject to the specific sanctions designation that would have compelled a port or coastguard to refuse it service. The sanction followed the incident by approximately three months.

Second, the Finnish prosecution was ultimately constrained. In October 2025, the Helsinki District Court dismissed jurisdictional claims against the Eagle S crew on the grounds that the alleged acts occurred in international waters and that Finland lacked jurisdiction over a non-Finnish-flagged vessel outside its territorial sea.^[16] The vessel itself remained detained, but the criminal case collapsed along the fault line that every shadow-fleet operation is engineered to produce: the jurisdiction of the flag state, not the jurisdiction of the injured state, controls.

Case 2: The Sovcomflot February 2024 wave

The second case is a portfolio rather than a single vessel. On 23 February 2024, OFAC designated Sovcomflot — Russia's state-owned tanker operator — and identified 14 crude oil tankers as property in which Sovcomflot retained an interest.^[6] The designations were significant for three reasons. First, Sovcomflot was not a "shadow" operator in the sense of being a front for an obscured principal; it was the overt state shipping company. Its designation was OFAC's acknowledgment that the nominal distinction between the overt Russian tanker fleet and the shadow fleet had collapsed operationally: Sovcomflot tonnage was now routinely engaged in AIS-manipulation and STS-transfer conduct that OFAC had previously attributed only to the shadow fleet.

Second, the immediate response of several Sovcomflot-operated vessels was to re-flag. Ships that had been on the Liberian registry through late 2023 and early 2024 were deregistered by the Liberian authorities following the designation and were taken up by Gabon, whose registry — as noted above — is privately operated from the UAE.^[9] In at least one case, a Sovcomflot vessel subsequently re-flagged back to the Russian state registry, apparently on the basis that an overt Russian flag offered greater predictability than a flag of convenience subject to western diplomatic pressure.

Third, OFAC's February 2024 action was followed by a 45-day General License authorising the offloading of crude already in transit. That window — standard OFAC practice to prevent secondary disruption — was operationally exploited: several of the identified tankers completed their voyages, offloaded, and then disappeared from Kpler cargo tracking as they entered longer AIS-blackout cycles. The specific distribution of where those cargoes terminated is a subject the published investigations do not fully resolve.

Case 3: The EU 14th package list

The third case is the EU's 27-vessel list under the 14th sanctions package of 24 June 2024 — the first time the EU had individually named vessels rather than relying on service-provision prohibitions against named persons. Of those 27 vessels, 17 were tankers, of which 10 were specifically designated for carrying Russian-origin crude or products while engaging in "irregular and high-risk shipping practices."^[7]

The list was the product of cross-referenced OSINT work by EU member-state intelligence services, Kpler cargo tracking, KSE Institute's core-shadow-fleet identification methodology, and Windward's vessel-behaviour analytics.^[3][4] KSE Institute's June 2024 report identified 45 crude tankers and 41 product tankers as the "consistent core" of the Russian shadow fleet — vessels whose pattern of life, ownership history, and cargo trail were unambiguous.^[3] CREA's monthly tracker, for the same period, estimated that shadow tankers were moving roughly two-thirds of Russian seaborne crude and products — 86 percent of crude and 38 percent of petroleum products by September 2024.^[17]

The EU's 27-vessel list was therefore not a comprehensive designation — it was a pilot. Subsequent packages expanded the listings materially: the EU's 15th package (December 2024) added further vessels, and by the EU's December 2025 action, 41 additional vessels of the Russian shadow fleet had been designated in a single package.^[18] By Q1 2026, aggregated sanctions listings across OFAC, OFSI, and the EU covered approximately 287 tankers — the figure in the headline of this briefing, derived by cross-matching the three public lists and deduplicating by IMO number. (Counting note: this is a deliberately narrow figure — tankers only, deduplicated across the OFAC/OFSI/EU lists named here, as of Q1 2026. Broader tallies that include all vessel types, single-jurisdiction designations or sanctioned-trade activity run far higher — see our Dark Fleet 2026 brief for those wider-lens figures.) The aggregate fluctuates month-on-month as new vessels are designated, registrations are revoked, and tonnage is scrapped or re-flagged; the count should be treated as a point-in-time estimate, not a stable total.

The insurance fiction

A conventional blue-water tanker carries three layers of insurance: hull-and-machinery (H&M, covering the ship itself), protection-and-indemnity (P&I, covering third-party liability including oil-spill response), and war-risk cover. All three are provided, for virtually the entire global fleet, by underwriters based in G7 jurisdictions and reinsured through the Lloyd's and International Group syndicates.

The shadow fleet operates outside this perimeter by design. Russian operators rely on Ingosstrakh, AlfaStrakhovanie, and Sogaz as primary underwriters, with the state-owned Russian National Reinsurance Company (RNRC) providing reinsurance backstop.^[10][11] RNRC was itself sanctioned by the US, UK, and EU in 2022-2023. Ingosstrakh was sanctioned by the UK in 2024. AlfaStrakhovanie and Sogaz sit under various designations. The practical consequence is that a shadow-fleet tanker moving through the Danish Straits, the Bosphorus, or the Strait of Malacca carries insurance attestations that a G7 port-state control officer cannot verify in any meaningful sense: the certificate is issued by an entity that cannot transact with a western claimant, by a reinsurer that cannot settle with a western adjuster, and is backed by capacity that has never been audited to IG-club standards.^[19]

The under-publicised part of this picture is the "shadow P&I" tier — new-entity underwriters formed in various jurisdictions since 2023, offering P&I cover at rates materially below IG-club market. Some are legitimate entrants. Several, on investigation, have proven to be thinly capitalised or reinsured through RNRC at one or more removes.^[20] A 2024 KSE Institute study on oil-spill insurance and the shadow fleet documented that a significant share of shadow-fleet tankers carried P&I cover whose actual claims-paying capacity could not be established from public records.^[20] For a port state, this is operationally the same as no cover at all: in a casualty, the liability pool is unenforceable.

Enforcement gaps and recent wins

The enforcement picture as of Q1 2026 is mixed. The wins are real. The gaps are structural.

Wins

• Flag-state revocations. Since 2023, several registries have deregistered shadow-fleet tonnage under diplomatic pressure. Palau removed 29 of 43 identified shadow-fleet vessels from its registry; Cameroon publicly committed in 2024 to a crackdown on its register, which Windward had identified as flagging 13 percent of the dark fleet.^[21] Cook Islands authorities undertook deregistrations following the Eagle S incident. Gabon's registry continued to flag Russia-linked tonnage through 2024, but western diplomatic pressure on Libreville and on the UAE-based registry operator increased materially through 2025.
• UK Royal Navy powers. In December 2024 and through 2025, the UK published guidance empowering port authorities to refuse entry to vessels reasonably suspected of shadow-fleet activity, and in 2025 authorised the Royal Navy to board and inspect vessels in UK waters suspected of shadow-fleet conduct.^[8]
• EU listings by IMO number. The 14th package (June 2024) and subsequent packages (December 2024, December 2025) established a template of individually-listed vessels by IMO number — more enforceable at the port-state level than service-provision prohibitions against parent entities.^[7][18]
• OFAC Sovcomflot. The February 2024 designation of Sovcomflot and 14 tankers was the first time OFAC had listed a Russian state shipping entity as an SDN alongside its vessels.^[6]

Gaps

• Port-state complicity. The Fujairah and Mumbai anchorage complexes, and the Laconian Gulf anchorage south of Kalamata, are operational centres for STS transfers that convert Russian-origin crude into cargoes of non-Russian origin on paper. As of April 2026, none of the relevant port states has implemented comprehensive port-state control measures against shadow-fleet vessels. The incentive asymmetry is durable: the receiving states benefit economically from discounted Russian crude.
• Falsified bills of lading. Once a cargo completes an STS transfer in a permissive anchorage, the onward documentation — BOLs, quality certificates, certificates of origin — can be reissued to reflect a blended or renamed cargo. The G7 price cap regime does not reach this documentation, because the documents are generated by non-G7 parties.
• Sub-ice and sub-horizon transfers. A small but increasing share of 2024-2025 shadow-fleet conduct involves transfers in arctic waters, inside EEZs of non-cooperative states, or at night with AIS off. Sentinel-2 revisit is 5 days; sub-hourly events are outside its cadence, and commercial high-resolution imagery is expensive and not systematically tasked.
• Registry laundering. When one flag state deflags a vessel, it typically re-appears on another within weeks. The observed pattern has shifted from St Kitts (2022) through Gabon (2023-2024) to Comoros, Cameroon, and back to the Russian state flag (2025). Each new flag creates a new window of ambiguity for port-state control.

Limitations of this investigation

Five things this briefing cannot see, and an honest account of the uncertainty:

• Sub-ice and covert STS transfers. Arctic and high-latitude operations are outside the revisit cadence of free satellite imagery and outside the reach of port-state observation. The assertion in this briefing that the Laconian Gulf and Fujairah account for the majority of STS activity is supported by public reporting but is probably an underestimate of total STS volume.
• Falsified BOLs and origin certificates. Once a cargo is "laundered" through STS, the onward paper trail reflects the blended origin. We can observe the STS event from space; we cannot observe the paper.
• Port-state complicity in third countries. The degree to which UAE, Indian, and Turkish port authorities materially cooperate with the price-cap regime, as opposed to formally complying while operationally permitting, is not directly visible in open sources. Public reporting and press commentary offer indicators; the underlying enforcement practice is not transparent.
• Insurance claims history. A robust test of the shadow-fleet insurance stack would be a major casualty — a large oil spill, a collision with significant third-party damage — and the subsequent claims settlement record. As of April 2026, the fleet has had several smaller incidents (the Eagle S itself, Pablo in 2023, various anchor-drag events) but no major casualty that would force the insurance architecture into open litigation. The insurance fiction has not been stress-tested.
• Aggregate fleet size. Estimates range from KSE's 435 vessels (June 2024) to S&P Global's 591 (for the same period), to 271 specifically classified as "dark fleet" by S&P.^[3] The headline figure of 287 sanctioned vessels in this briefing reflects the cross-list sanctions count, not total fleet size, and is itself a point-in-time aggregate derived from cross-matching the published OFAC SDN, EU Official Journal, and UK OFSI lists by IMO number as of the publication date of this briefing.

What this means for compliance teams: five checks any bank, insurer, or port can run today

The methodology above collapses into five concrete checks that any counterparty can apply before accepting a trade, an insurance policy, or a port call:

1. Pull the AIS track. For any tanker involved in a transaction touching Russian-origin cargo, pull the last 180 days of AIS from MarineTraffic or VesselFinder. Flag any broadcast gap exceeding 12 hours that is not accounted for by documented port activity. A single unexplained 48-hour gap near the Laconian Gulf, Fujairah, or Ceuta is sufficient to require escalation.
2. Pull the flag history. Run the IMO number through Equasis. Flag any vessel that has changed flag more than once since 2022, and specifically flag current registration in Gabon, Cook Islands, Palau, San Marino, Cameroon, Comoros, Barbados, or Guinea-Bissau.
3. Verify the P&I cover. Check the International Group of P&I Clubs vessel-search tool. If the vessel is not listed in any of the thirteen member clubs, the vessel is not carrying conventional P&I. Flag and require a written attestation of the actual underwriter, reinsurance arrangement, and claims-paying capacity.
4. Run the ownership chain through OpenSanctions and OCCRP Aleph. The registered owner, the operator, and the group owner as disclosed on Equasis should each be run through the OpenSanctions consolidated dataset and the OCCRP Aleph investigative archive. Proximity to designated persons — shared registered agents, shared directors, shared addresses — is itself a material factor.
5. Document the file. If the transaction proceeds despite one or more of these flags, document the basis for proceeding. The documented file is the difference between a later OFAC response that treats the counterparty as negligent and one that treats it as complicit. The GVA Capital enforcement of 2025, discussed in our 50 Percent Rule briefing, is the baseline: compliance obligations are now evaluated on the adequacy of the analytic record, not on the adequacy of the automated screen.

Closing note

The shadow fleet is not a clever evasion mechanism. It is an entire parallel maritime economy — separate insurance markets, separate flag administrations, separate cargo-document chains, separate STS anchorages — constructed and maintained at scale because the price cap made the economic rewards of constructing it sufficient to justify the cost. The fleet will not be dissolved by additional listings at the current cadence, because each listing produces a re-flagging, a re-ownership, and a re-insurance cycle that regenerates the targeted conduct under a new name. It will be reduced by flag-state reform, port-state control at the STS choke-points, and the eventual stress-test of a major casualty that forces the insurance fiction into open litigation.

In the meantime, the practical task for any bank, insurer, charterer, broker, or port authority remains the same as it was in 2023: reconstruct the vessel's pattern of life from open sources, reconstruct its ownership chain from public registries, verify its insurance against the International Group membership lists, and document the file. No screening tool produces this output. It is investigative work, and it is the work that the regulator expects has been done.

Methodology disclosure

This briefing relies exclusively on public sources: OFAC press releases and General Licenses, EU Official Journal listings, UK government statements, Equasis / IMO GISIS registry extracts, published research by the Kyiv School of Economics (KSE Institute), the Centre for Research on Energy and Clean Air (CREA), Windward, Lloyd's List Intelligence, and primary reporting by Reuters, the Financial Times, and the USNI News. Where a statistic could not be verified from a primary public source at the time of writing, we have either hedged the claim (for example, qualifying aggregate fleet counts as point-in-time and noting the underlying cross-list matching method) or omitted it. Where a case discussion relies on a contested fact (for example, the jurisdictional findings in the Eagle S criminal case), we have stated the finding and its source and noted the contest.

Sources and further reading

1. Finland police seize Russian-linked dark fleet tanker Eagle S in cable-cutting investigation. Lloyd's List, 26 December 2024.
2. Finland Seizes Russian Oil Tanker After Suspected Undersea Fiber-Optic Cable Sabotage. USNI News, 27 December 2024.
3. Assessing Russia's Shadow Fleet: Initial Build-Up, Links to the Global Shadow Fleet, and Future Prospects. Kyiv School of Economics, KSE Institute, June 2024.
4. The Eagle S and the Threat to Underwater Infrastructure. Windward, January 2025.
5. Russia-related Sanctions Program: Price Cap Guidance. U.S. Department of the Treasury, Office of Foreign Assets Control.
6. U.S. Treasury Designates Russian State-Owned Sovcomflot, Russia's Largest Shipping Company. Treasury press release JY2121, 23 February 2024.
7. Sanctions adopted following Russia's military aggression against Ukraine: 14th package. European Commission, June 2024.
8. Shadow fleet set to be interdicted in UK waters in latest blow to Russia. UK Government press notice, 2024.
9. Hundreds of shadow fleet ships sail under a false flag. Follow the Money, investigative report on Gabon and Panama registries.
10. Russian National Reinsurance Company. Profile and sanctions history.
11. The Secretive World of Russian Oil Tanker Insurance Revealed. EnergyNow / reporting on Ingosstrakh, AlfaStrakhovanie, Sogaz and the RNRC backstop.
12. Court of Justice of the European Union, Joined Cases C-37/20 and C-601/20 (WM and Sovim SA). Judgment of 22 November 2022.
13. 2024 EstLink 2 incident. Reference summary with citations to Finnish authorities.
14. Russia-linked cable-cutting tanker seized by Finland was loaded with spying equipment. Lloyd's List.
15. Finland Charges Russian-Linked Ship Officers Over Baltic Sea Cable Sabotage. Submarine Networks, 2025.
16. Finnish Court Dismisses Case against Eagle S — Alleged Sabotage of Cables in the Baltic Sea. Submarine Networks, October 2025.
17. Policy briefing: tackling the Russian shadow fleet. Centre for Research on Energy and Clean Air (CREA), August 2024.
18. Russia's war of aggression against Ukraine: Council sanctions 41 vessels of the Russian shadow fleet. Council of the EU, 18 December 2025.
19. Who's insuring Russia's shadow fleet? Reinsurance News.
20. Oil Spill Insurance and the Shadow Fleet. KSE Institute, February 2025.
21. Cameroon Pledges Crackdown on Ship Registry Flagging 13 percent of Dark Fleet Tankers. Windward.
22. Countering Shadow Fleet Activity through Flag State Reform. Royal United Services Institute (RUSI).
23. Russia's shadow fleet: Bringing the threat to light. European Parliamentary Research Service, 2024.
24. OpenSanctions consolidated sanctions dataset. Vessel and entity cross-reference.
25. OCCRP Aleph — investigative dataset and corporate records platform.
26. Equasis — IMO-backed ship information database.