How an estimated 600 tankers systematically circumvent Western oil sanctions through dark maritime logistics, AIS manipulation, and layered corporate shell networks.
Published March 2026•OSINT · AIS · GEOINT · FININT•18 min read
Updated April 2026: A full forensic walkthrough of the methodology summarised here — AIS gap analysis, flag-of-convenience cycling, STS transfer detection, the insurance fiction, and three named case studies (Eagle S, Sovcomflot designation, EU 14th package) — is now published as a follow-on briefing: Russia's Shadow Fleet: How 287 Sanctioned Tankers Keep Urals Crude Flowing.
Since the introduction of the G7 oil price cap in December 2022, Russia has built one of the most complex maritime sanctions evasion systems in modern history. A fleet of approximately 400–600 ageing tankers — operating under flags of convenience, with opaque ownership chains and substandard insurance — now transports the majority of Russia’s seaborne crude exports beyond the reach of Western enforcement.
This report examines the structure, scale, and operational methods of the shadow fleet, identifies key corporate actors and jurisdictions, and maps the primary export corridors and ship-to-ship transfer hotspots. All findings are drawn from open-source intelligence, AIS tracking, vessel registries, and corporate filings.
Compliance & LegalSanctions screening, due diligence on vessel counterparties, price cap attestation gaps.
Russia’s parallel maritime export infrastructure now rivals the capacity of many national fleets.
~600
Shadow Tankers
Estimated active fleet
$37B
Annual Revenue
Above-cap crude sales
18.7 yr
Avg. Vessel Age
vs. 11.2 yr mainstream
The fleet is distributed across more than 20 flag states, with concentrations in jurisdictions offering minimal oversight. Approximately 90% of these vessels lack coverage from International Group P&I Clubs, instead carrying policies from Russian or unknown insurers with coverage limits orders of magnitude below industry standard.
More Than Half the Fleet Flies No Traceable Flag
Liberia~80
Gabon~60
Cameroon~45
Palau~35
Marshall Islands~50
Other / Unknown~330
Insurance & Safety Risk
Mainstream tankers carry $1B+ in P&I coverage. Shadow fleet vessels carry as little as $5–50M — insufficient for cleanup costs of a major spill.
A single Aframax-class spill in the Danish Straits could cause €10B+ in environmental damage.
Multiple shadow tankers have been detained for hull corrosion, inoperative safety systems, and expired class certificates. The fleet represents a systemic environmental threat to European waterways.
Analysis
Key Findings
Six primary intelligence findings, scored by impact and confidence.
F1
CriticalHigh Confidence
Russia operates an estimated 400–600 shadow fleet tankers to circumvent the G7 $60/bbl price cap. These vessels transport approximately 70% of Russia’s seaborne crude exports outside the Western-regulated insurance and shipping framework.
Sources: OSINT, AIS tracking, FININT
F2
CriticalReported
Shadow fleet vessels are disproportionately aged (15–25+ years), lack valid P&I insurance from IGPANDI members, and operate under flags of convenience with minimal regulatory oversight, creating significant environmental and maritime safety risks.
Sources: OSINT, Lloyd’s List Intelligence
F3
HighHigh Confidence
Ship-to-ship transfers in international waters off Ceuta, Kalamata, and Laoag serve as primary laundering nodes, obscuring Russian crude origin before delivery to end buyers in India, China, and Turkey.
Sources: OSINT, AIS tracking, GEOINT
F4
HighHigh Confidence
Sovcomflot (SCF Group) has transferred dozens of tankers to newly incorporated shell companies in UAE, India, and Hong Kong, which continue to operate on sanctioned routes using opaque ownership chains.
Sources: OSINT, FININT
F5
CriticalReported
AIS manipulation — including transponder deactivation (“dark sailing”), GPS spoofing, and MMSI manipulation — is systematically deployed across the fleet, with dark intervals of 3–14 days during loading and STS operations.
Sources: OSINT, AIS tracking, SIGINT indicators
F6
MediumModerate
Denmark and Sweden have reported increasing shadow fleet transits through the Danish Straits, with at least three near-miss incidents in 2025, raising the probability of a major oil spill in one of Europe’s most ecologically sensitive waterways.
Sources: OSINT, GEOINT
Geography
Export Corridors & Transfer Nodes
The shadow fleet operates across five primary export corridors, using ship-to-ship transfers to launder crude origin before final delivery.
STS Hotspot: Ceuta, Spain
35°54′N, 5°18′W
An estimated 8–12 STS operations per month. Russian-origin crude is transferred to non-Russian flagged tankers and relabeled as “Caspian Blend” to circumvent price cap attestation requirements.
STS Hotspot: Kalamata, Greece
36°30′N, 22°00′E
Approximately 5–8 STS operations monthly. Black Sea crude from Novorossiysk/CPC is re-routed to India-bound tankers. Proximity to Greek territorial waters complicates enforcement.
Export corridor map — node register (map data)
Node
Class
Lat, Lon
Detail
Primorsk
Port
60.36, 28.60
Baltic. ~1.2M bbl/day. High shadow fleet loading.
Ust-Luga
Port
59.68, 28.40
Baltic. ~700K bbl/day.
Novorossiysk
Port
44.72, 37.78
Black Sea. ~1.4M bbl/day.
Kozmino
Port
42.73, 132.88
Pacific. ESPO terminal.
Murmansk
Port
69.08, 33.05
Arctic. STS hub.
Ceuta STS
STS Zone
35.90, -5.30
~8–12 STS/month. Primary laundering node.
Kalamata STS
STS Zone
36.50, 22.00
~5–8 STS/month. Black Sea re-routing.
Laoag STS
STS Zone
18.50, 120.50
Pacific STS node.
Murmansk STS
STS Zone
69.00, 34.00
Seasonal (May–Nov).
Danish Straits
Chokepoint
55.95, 11.10
~600 shadow transits/yr. Environmental risk.
Bosphorus
Chokepoint
41.17, 29.08
Black Sea exit.
Suez Canal
Chokepoint
30.00, 32.30
—
Jamnagar
Destination
22.40, 69.70
India. Reliance complex.
Shandong
Destination
36.50, 118.50
China. Teapot refineries.
Turkey
Destination
41.00, 29.50
Dortyol/Ceyhan.
Map nodes/routes mirror the brief's sourced corridor register; coordinates are carried verbatim. Basemap is a bundled vector coastline (no third-party tiles).
Five Russian export terminals, two laundering anchorages, three buyers: every corridor on this map converges on a ship-to-ship zone before crude reaches India, China or Turkey with new paperwork.
Interactive — click markers for intelligence detail. Toggle layers via top-right control. With JavaScript disabled, a static node register is shown.
Tradecraft
How Sanctions Are Evaded
The shadow fleet employs a layered system combining maritime deception with corporate obfuscation.
“The typical cycle — Russian port loading with AIS off, dark transit through a chokepoint, STS transfer to a clean tanker, delivery with non-Russian bill of lading — takes 21–45 days and is designed to defeat both sanctions enforcement and price cap attestation at every node.”
Pattern analysis based on Kpler, Windward, S&P Global Commodity Insights, and CREA data
Maritime Deception
Dark Sailing
Complete AIS deactivation during loading and STS. Gaps of 3–14 days.
GPS Spoofing
False position broadcasts placing vessel in open ocean while at port berth.
MMSI Manipulation
Broadcasting false Maritime Mobile Service Identity to disguise vessel.
Slow-Zone Loiter
Near-zero speed in traffic areas to blend into anchorage noise.
Corporate Obfuscation
Shell Layering
Ownership routed through 3–5 shell companies in UAE, HK, Singapore, Turkey.
Nominee Directors
Local nominees with no maritime background as registered directors.
Flag Shopping
Vessels reflagged 2–3 times per year to break regulatory trails.
Parallel Naming
Renamed vessels retain hull markings from previous identity.
Actors
Corporate & Fleet Networks
State-adjacent entities, shell companies, and non-sanctioned facilitators that sustain the shadow fleet.
Sanctioned Entity
Sovcomflot (SCF Group)
100% Russian state-owned, headquartered in St. Petersburg. Pre-sanctions fleet of ~80 tankers. Designated by US OFAC (full SDN block Feb 2024; Directive-3 capital restriction Feb 2022), EU Council (Mar 2022), and UK OFSI (Mar 2022).
Post-sanctions, SCF has systematically transferred vessels to opaque entities in Dubai, Mumbai, and Hong Kong. These vessels continue operating on Russia–India/China crude routes under new names and flags.
Representative operational patterns documented through multi-source intelligence correlation.
Case C1
Dark Transit Through Danish Straits
An Aframax tanker flying a Cameroon flag was detected entering the Danish Straits with its AIS transponder deactivated. The vessel was identified via Sentinel-1 SAR imagery and matched to an ex-Sovcomflot tanker sold in 2023 to a Dubai shell company, carrying insurance from Ingosstrakh with an 8-day dark period following a Primorsk port call.
Assessment:High-confidence shadow fleet tanker conducting dark transit through EU waters. Environmental and navigational risk to Danish Straits traffic. Flagged to Danish Maritime Authority for port-state inspection targeting.
Case C2
Ceuta STS with Origin Switch
Two tankers detected in parallel formation at Ceuta anchorage for 36 hours, both broadcasting AIS but with cargo documents listing origin as “Caspian Blend.” The source tanker was traced to Ust-Luga loading 12 days prior with a confirmed AIS gap. The receiving tanker was India-registered, bound for Jamnagar.
Assessment:Classic origin-laundering STS operation. Crude relabeled to defeat price cap attestation. Both vessels flagged for enhanced scrutiny.
Case C3
Insurance Shell Game
A Suezmax tanker detained at an Indian port for invalid P&I documentation. Insurance certificate from an unknown entity registered in Vladivostok with no reinsurance treaty. Effective spill liability: approximately $8M versus the $1B+ industry standard. Vessel age: 22 years, class certificate lapsed.
Assessment:Insurance ecosystem for shadow fleet is systematically inadequate. Creates uninsured environmental liability for port states globally.
Monitoring
Early Warning Indicators
Trigger conditions for escalation and collection retasking across 14, 30, and 90-day windows.
Indicator
Window
Alert Threshold
Interpretation
Danish Straits dark transits
14 days
≥5 unidentified tankers
Shadow fleet throughput surge
Ceuta STS frequency
30 days
>15 STS events/month
Increased origin laundering
UAE shell registrations
30 days
>10 maritime incorporations
Fleet expansion / ownership rotation
Flag-state changes
90 days
>20 reflaggings
Sanctions evasion adaptation
Insurance provider shifts
90 days
New non-IGPANDI insurer
New state-adjacent backstop
Collection Requirements
Intelligence Gaps
Areas requiring further collection to close analytical gaps.
G1FININT/OSINT
True beneficial ownership of ~300+ shadow fleet tankers registered through UAE/India shell companies. Corporate registries lack UBO disclosure requirements.
G2FININT/HUMINT
Actual crude pricing on shadow fleet deliveries. Discount-to-Brent data is estimated (~$10–20/bbl) but exact contract terms remain opaque.
G3FININT
Russian state insurance backstop mechanisms. Extent to which Ingosstrakh and SOGAZ provide reinsurance guarantees to shadow fleet operators.
G4GEOINT/AIS
Full scope of Arctic/NSR shadow fleet activity from Murmansk. Seasonal patterns and dedicated fleet composition remain unknown.
Methodology
Source Register
Primary open sources referenced in this assessment.
S1Kpler (commodity tracking)AIS / FININT
S2Windward Maritime AIAIS / OSINT
S3Lloyd’s List IntelligenceOSINT
S4CREA (Centre for Research on Energy and Clean Air)OSINT / FININT
S5S&P Global Commodity InsightsFININT
S6Equasis (EU maritime database)OSINT
S7OFAC SDN List / EU Official JournalSanctions
S8Sentinel-1 SAR (Copernicus)GEOINT
S9Danish Maritime Authority reportsOSINT
S10OpenCorporates / Sayari GraphFININT
Related Research
Related Intelligence Briefs
Continue across the [0x]INT brief cluster on shadow tankers, sanctions evasion and Russian oil logistics.
[0x]INT provides bespoke sanctions intelligence, maritime risk assessments, and due diligence investigations for compliance teams, law firms, and government agencies.