Julian Pawlak

Measures Against the “Russian Shadow Fleet”

Only a Systematic Approach Can Ensure Effectiveness and Security

SWP Comment 2026/C 20, May 2026

Impressum

This work is licensed under CC BY 4.0

This Comment reflects the author’s views.

SWP Comments are subject to internal peer review, fact-checking and copy-editing. For further information on our quality control procedures, please visit the SWP website: https://www.swp-berlin.org/en/about-swp/ quality-management-for-swp-publications/

SWP

Stiftung Wissenschaft und Politik

German Institute for International and Security Affairs

Ludwigkirchplatz 3–4
10719 Berlin
Telephone +49 30 880 07-0
Fax +49 30 880 07-100
www.swp-berlin.org
swp@swp-berlin.org

ISSN (Print) 1861-1761

ISSN (Online) 2747-5107

DOI: 10.18449/2026C20

(English version of SWP‑Aktuell 24/2026)

The so-called Russian shadow fleet primarily serves to evade sanctions on oil exports and thereby finance its war of aggression against Ukraine. At the same time, it is increasingly emerging as a security risk with defence implications for Europe. Vessels associated with the shadow fleet are being linked with growing frequency to acts of espionage and sabotage, thereby posing a threat to German and European security as well as to the maritime environment. In close coordination with its partners, the German government should pursue a systematic approach to countering the shadow fleet effectively. The overarching objectives are to preserve the integrity of sanctions regimes, safeguard maritime security, and contain defence-related threats.

Measures Against the “Russian Shadow Fleet”

Only a Systematic Approach Can Ensure Effectiveness and Security

Julian Pawlak

The principal purposes of Russia’s shadow fleet are sanctions evasion and the direct financing of its war effort. Beyond this, however, it has evolved into a multifaceted security challenge. Vessels belonging to the fleet are increasingly being used as instruments of sabotage and espionage. Owing to inadequate safety and environmental standards, the fleet also constitutes a considerable risk to shipping and the marine environment. A systematic approach would enable Germany and its partners to contain this multidimensional threat more effectively and sustainably.

Lifeline of the Russian economy

The so-called Russian shadow fleet is neither an official fleet of the Russian Federation nor an exclusively Russian phenomenon. Rather, the term refers to the use of vessels for the purpose of transporting goods and, above all, oil from the Russian Federation by evading international sanctions, a practice similarly employed by states such as Venezuela and Iran. Since 2022, Russia itself is estimated to have operated between approximately 600 and 1,600 vessels in this context. The figures vary because the shadow fleet phenomenon is characterised by the continuous acquisition of additional vessels – many of them old and poorly maintained – the falsification or concealment of ownership structures and insurance arrangements, as well as the frequent reflagging of ships under so-called flags of convenience issued by states with weak or non-existent oversight mechanisms. Moreover, there is still a lack of internationally standardised definitions for such vessels and corresponding harmonised sanctions lists. Consequently, ship registries and sanctions lists must be regularly reviewed and coordinated at the international level, including within the European Union (EU). As part of its 20th sanctions package, adopted in April 2026, the EU placed 632 tankers on its sanctions list. Approximately 17 per cent of all oil tankers worldwide are now considered to be part of the shadow fleet.

In Russia’s case, almost half of its oil exports (48 per cent) are transported via the Baltic Sea. Approximately 1,000 vessels are deployed annually for this purpose. Through its oil exports, Russia generates more than €10 billion in monthly revenues, despite existing sanctions efforts. Consequently, the maritime routes through the Baltic Sea currently constitute the lifeline of the Russian economy.

The restrictions on shipping through the Strait of Hormuz resulting from the war waged by the United States and Israel against Iran are providing an additional boost to these oil exports. Rising oil prices, combined with the dependence of India and other Asian states in particular on energy imports, offer Russia an unexpected opportunity to strengthen its economy and further replenish state revenues.

Moscow uses the revenues generated from sales to states such as China, India, and Türkiye to finance its war against Ukraine. The measures taken thus far against the shadow fleet – for example in response to the use of false flags – have remained selective and temporary. They are not yet sufficient to significantly reduce Russia’s revenues derived from operating the fleet.

The shadow fleet as a security challenge

Russia is transforming the shadow fleet from a system for evading sanctions into an instrument of hybrid warfare, driven both by opportunity and constraint. This is because the maritime domain is the arena in which Russia is both weakest and most vulnerable. Its naval capabilities for the projection of military power are limited, and Russia remains economically dependent on sea lines of communication. Nevertheless, the country has turned necessity – the need to continue exporting oil to sustain its war economy – into a questionable “virtue”: alongside ongoing exports, difficult-to-attribute disruptions and damage to maritime critical infrastructure increase the uncertainty within European societies.

The damaging potential of the shadow fleet exposes European vulnerabilities and allows Russia to exploit existing dependencies through a posture of intimidation. In doing so, Moscow is demonstrating its capacity for sabotage in the grey zone below the threshold of open warfare.

Since the beginning of Russia’s full-scale invasion of Ukraine, the link between vessels of the shadow fleet and acts of sabotage (particularly damage to critical maritime infrastructure) as well as espionage and the mapping of key installations on the seabed has become increasingly evident. In the North Sea, this is primarily significant due to the expansion of offshore energy infrastructure, which is expected to account for a substantial share of German and European energy supply in the coming years and decades. In the Baltic Sea, a series of incidents involving damage to multiple subsea cables within a short period at the end of 2024 led NATO to launch Operation Baltic Sentry in January 2025 to protect critical underwater infrastructure. The objective of this mission is to increase the military presence and deter potential saboteurs.

In practice, however, it is difficult to unequivocally attribute all instances of damage, for example to subsea cables, to intentional acts by a specific perpetrator. As a rule, those accused offer unconvincing explanations, such as the alleged accidental loss of a ship’s anchor.

Beyond documented damage incidents and correlations between shadow fleet vessels and acts of sabotage, inspections of such ships by national authorities have also raised concerns. Authorities have increasingly discovered technical equipment on board that is atypical for commercial shipping and may be used for surveillance and reconnaissance purposes. The crews encountered on inspected vessels are, in some cases, larger than is customary for merchant ships and include individuals with links to the Russian military or to mercenary groups. This increases the risk that crew members may resist inspections, or encourage others to do so, when confronted by law enforcement and other security authorities such as customs officials and the police. Moreover, Russian naval units occasionally escort shadow fleet vessels in order to deter Western authorities from taking enforcement action. Additional risks to maritime security and heightened navigational hazards also arise from disruptions to the Global Navigation Satellite System (GNSS) through “jamming” and “spoofing” – that is, the interference with or falsification of navigation data, affecting thousands of vessels – as well as from the manipulation of the Automatic Identification System (AIS) by shadow fleet vessels and others.

A threat with defence implications

The defence-related dimension of the shadow fleet is of central importance but has so far received insufficient attention. Acts of sabotage, at sea and on land, have become a central instrument of Russian activity in Europe. Numerous drone overflights across European territory also appear to correlate with shadow fleet vessel movements. As a result, the fleet expands the overall threat spectrum and becomes relevant to defence policy. It cannot be ruled out that acts of sabotage and espionage are employed as preparatory measures or in support of potential military operations (the so-called shaping of the environment). Espionage and sabotage conducted via the shadow fleet may therefore provide the adversary with valuable information and operational insights, for example regarding procedural workflows and response times in the event of damage to critical maritime infrastructure.

One such case was the damage to the Estlink 2 subsea power cable in the Baltic Sea. The cable connects Finland and Estonia and was damaged on Christmas Day 2024 by the anchor of the tanker Eagle S. The vessel, which has been linked to Russia’s shadow fleet, dragged its anchor across the seabed and damaged four further subsea cables in addition to Estlink 2. During such significant holidays, it may be of additional interest to potential adversaries to observe response times and procedures in dealing with such incidents. Following its detention, the captain of the Eagle S was reportedly instructed via radio to destroy evidence of its activities in the form of charts depicting local subsea cables.

However, the threat is not limited to shadow fleet tankers, their anchors, and alleged accidents. Cargo ships, container vessels, and fishing boats may also pose security and defence-related risks. The deployment of drones or container-based weapons systems and electronic jamming systems is possible both in the lead-up to or during an armed conflict and enables the asymmetric use of such vessels, for example in a first-strike scenario at the outset of hostilities. Given the large number of ships in European waters, preparing for such contingencies is difficult. For potential adversaries, low-threshold options are also conceivable, including deliberately induced maritime accidents in straits, canals such as the Kiel Canal, or key shipping routes such as the Elbe River as the access route to the Port of Hamburg.

Undermining of international law

Within the framework of the two core principles of the law of the sea, namely the freedom of navigation (Article 87 of the United Nations Convention on the Law of the Sea) and the right of innocent passage (Article 17), shadow fleet vessels operate within allied and German territorial waters and exclusive economic zones (EEZs). In these areas, they may interfere with critical infrastructure or, in the event of conflict, project effects into vulnerable population centres. At the same time, Russia seeks to delegitimise potential Western countermeasures through allegations of piracy and to justify possible responses (“lawfare”). Consequently, this reveals not only an operational risk but also a broader strategic erosion of key norms underpinning the international order. The deliberate instrumentalisation of shipping activities in these maritime areas for non-peaceful purposes runs counter to these international agreements.

Environmental risks

Environmental threats must also be emphasised. They arise from the advanced age and poor condition of the vessels, as well as from the working conditions of crews that spend extended periods at sea. The shadow fleet is regularly involved in accidents and maritime incidents, as illustrated by the case of the Eventin off the German coast, sinking oil tankers in the Black Sea, and multiple other examples in Europe and Asia. Further, potentially more severe accidents cannot be ruled out. Due to the almost enclosed geography of the Baltic Sea and its limited water exchange, a single tanker casualty in this region could severely impact the area for years or even decades, with far-reaching consequences for the marine environment, the economy, and tourism.

Military deterrence

In addition, Russia is increasingly employing military capabilities to protect shadow fleet vessels and its export system, thereby deterring Western interventions. The attempted interception of the tanker Jaguar by Estonian authorities in May 2025 on the grounds of false flag registration illustrates this dynamic. When Russia deployed an Su-35 fighter jet to overfly the vessel – allegedly associated with the shadow fleet – Estonian authorities, which had dispatched a patrol boat and a helicopter, abandoned their attempt. The tanker was then able to reach its destination unimpeded.

Apparently, Russia is succeeding in deterring Germany and many of its partners from adopting clearer and more robust measures against the shadow fleet by threatening military escalation. As a result, Moscow continues to rely on both rhetorical and military displays of intimidation. The Federal Republic and its partners are squandering the available room for manoeuvre below the threshold of armed conflict through inconsistent responses, protracted debates, jurisdictional and legal disputes, and self-deterrence driven by fears of military escalation. This behaviour is what enables Russia to deliberately exploit the grey zone, ranging from the shadow fleet to broader hybrid activities. The selective measures taken to date – and their resulting inadequacy – provide Russia with both operational freedom and strategic initiative. This allows Moscow to continue its extensive oil exports while simultaneously sustaining hybrid activities through both military and non-military means below the threshold of armed conflict.

Because countermeasures have so far targeted individual vessels and therefore produced only limited systemic impact, future measures must be designed as a coordinated system. If Europeans aim to act more effectively against Russian sanctions evasion and war financing, measures targeting the shadow fleet need to be implemented across multiple levels and in a significantly more coordinated manner. Only then can they achieve a lasting effect in containing the shadow fleet and reducing Russian revenue flows.

However, it is essential not to succumb to the illusion that this would make it possible to stop all shadow fleet vessels immediately. This is neither legally nor practically feasible. The following four measures together form an overarching approach aimed at making full use of the existing legal framework on the basis of international law. At the same time, concrete and sustainably deterrent methods can be applied.

Four measures to contain the shadow fleet

No single nation and institution alone is either responsible for, or capable of, bringing the shadow fleet phenomenon under control. International cooperation is required. On the German side, the authorities responsible for planning and implementing measures include, among others, the maritime component of the Federal Police, the German Navy, the states’ police forces, and German Customs Service, together with the respective ministries and departments. These include the Federal Ministry of the Interior, the Federal Ministry of Defence, the Federal Ministry of Transport, and the Federal Ministry of Finance.

The number of vessel inspections has already increased at both the national and international levels. In particular, the absence of a flag or false flag registration has frequently served as a trigger for inspections of the shadow fleet, as international law generally grants all states extensive rights of access to stateless vessels. To date, only reactive measures have been employed to stop, inspect, and where necessary detain individual shadow fleet vessels, or at least temporarily prevent their onward voyage. Although this approach should be maintained, Germany and its partners have further opportunities to take more proactive steps to contain the shadow fleet – and with it associated financial flows, environmental risks, as well as security and defence-related threats.

Sanctions regime

First, the phenomenon of the Russian shadow fleet – and thus the sanctions regime – must be taken to its logical conclusion. On the one hand, sanctions lists maintained by the EU, the United Kingdom, the United States, and Canada must be continuously synchronised in order to achieve broad effectiveness. On the other hand, the mere sanctioning of vessels must be followed by further action. By now, almost every second tanker used for Russian oil exports has been sanctioned, yet this has had little impact on sales. Sanctions mechanisms therefore urgently need to be extended to include intermediary ports of call, refineries, and companies in third countries that facilitate transactions and trade flows. This would also imply that EU states cease importing oil indirectly via intermediaries such as Turkey and India. In this respect, national-level measures in particular are required.

The restrictions on maritime traffic in the Strait of Hormuz highlight this need for coordination. Rising oil prices, combined with a partial easing of US sanctions – such as exemptions for India – is generating substantial additional revenues for Russia as an exporting state. At the same time, the US rationale is based on the assumption that short-term sanctions relief will help stabilise global oil prices and thereby reduce Russian export revenues. While emergency measures for global market and oil price stabilisation can be justified, they should be realigned as soon as possible with the strategic objective of containing the shadow fleet, if the goal is to limit Russian revenues and war financing.

Flag states and ownership structures

Second, insufficient flag registration of shadow fleet vessels continues to offer room for manoeuvre that is not being fully utilised. Diplomatic and economic pressure on states offering “flags of convenience” must also be significantly increased. A suitable starting point is the open letter from the North and Baltic Sea littoral states, including Iceland, to the international community. It calls for compliance with the enforcement of general shipping standards and maritime safety within an international framework. As a result of growing pressure on the shadow fleet, some states have stopped making their flags available for such vessels. In this way, available options for operators of these ships are gradually being reduced.

In parallel, ownership structures and vessel sales should be scrutinised more closely. The actors involved should also face economic consequences at the EU level or at the level of individual nation states, as European and also German shipping companies continue to sell vessels that are subsequently used for the shadow fleet, thereby facilitating sanctions evasion. Restricting these onward sales represents another means of reducing the physical basis for exports and sanctions circumvention.

Environmental protection as an option for action

Third, environmental protection must also be used as a basis for action. In the North and Baltic Seas, the additional protection requirements of these sea areas – classified by the International Maritime Organization (IMO) as “Particularly Sensitive Sea Areas” (PSSA) – offer untapped scope for action. Under this classification, the North and Baltic Seas are considered especially vulnerable and, in this respect, are placed on the same level as well-known marine regions such as the Galápagos Islands and the Great Barrier Reef.

The numerous documented cases of unseaworthy tankers, as well as accidents and groundings, suggest that the deliberate use of vessels with minimal or no seaworthiness effectively amounts to an acceptance of environmental harm. Germany and its partner coastal states in the North and Baltic Seas should take this as grounds for meeting their responsibility towards these maritime regions and should more frequently stop, inspect, and, where necessary, deny passage to ageing tankers on account of their poor condition. This would protect sea areas from accident-related and environmental risks, while also further slowing and reducing shadow fleet operations.

For these two reasons, such measures should not be limited to the Russian shadow fleet but extended to all ageing vessels that may pose environmental risks. In its response to a minor interpellation in the Bundestag, the Federal Government has already stated its view that such measures can help curb the transit of the shadow fleet while also preventing accidents and environmental damage. It is therefore now crucial to put these findings into practice.

Defence dimension

Fourth, Russia’s further development of the shadow fleet from a predominantly economically motivated instrument into a tool of hybrid warfare must be recognised as a national security threat and, in certain constellations, as a militarily relevant challenge. If this is accepted, it opens up additional options for action vis-à-vis shadow fleet vessels. Spying, sabotage, the use of drones, and the presence of (para)military personnel on board appear to be increasing. This suggests that the shadow fleet no longer serves exclusively commercial purposes. There is considerable evidence that its activities are deliberately employed in the grey zone below the threshold of armed conflict. This is consistent with Kremlin rhetoric, which already frames relations with NATO as a structural conflict.

This development implies that such vessels are no longer to be classified solely within the domain of maritime safety and security, but must additionally be situated within the framework of national security and defence. This broadens the scope for action: The non-peaceful use of vessels provides stronger grounds for legitimate measures such as stopping, inspecting, detaining, or ordering them to leave, since the right of innocent passage applies only to ships that do not pose a threat.

Political resolve and potential escalation dynamics

The decisive implementation of these measures by the German government and its partners in the North and Baltic Sea region will determine whether they are successful in the long term and whether they contribute to containing the Russian shadow fleet and the associated financial flows. On the one hand, the Federal Government should leave no doubt that it is serious about its intentions, in particular its willingness to impose sanctions, and that it is prepared to back them up with concrete action. On the other hand, it should firmly signal that international law cannot be arbitrarily misused to justify non-peaceful activities such as espionage and sabotage. Moreover, the measures proposed here, if carefully selected and implemented, demonstrate that the states involved are both willing and able to protect their infrastructure and the environment, while at the same time having no interest in triggering military escalation unnecessarily.

Managing threats and risks

Activities aimed at containing the shadow fleet must also be considered in the context of potential escalation dynamics and rules of engagement, that is, beyond the purely operational level. It is not sufficient for procedures to be rehearsed within police, military, and NATO frameworks. Decision-makers must also be familiarised with the escalatory risks of possible measures against vessels associated with the Russian shadow fleet and be prepared to address them. This requires, first, that states do not allow themselves to be intimidated by Russian accusations, threats, or military power projection. Instead, it is essential for states to stand together, and within an international framework, behind measures such as vessel inspections or denial of entry into certain maritime zones, and to implement them consistently and without hesitation. A coherent and resolute approach would render Russian threats ineffective.

In addition to the four measures, prudent and strategically oriented security policy preparation is therefore required. This involves anticipating in advance the possible actions of actors who may deliberately employ the risk of military or even nuclear escalation as a strategic tool. What if crews of shadow fleet tankers refuse to cooperate with German or Western authorities, or are prevented from doing so by (para)military personnel on board? Russia is exploiting its position and capabilities to keep such options available. Both vertical and horizontal escalation scenarios are conceivable. Vertical escalation refers to the use of military force, supported by threats and coercive rhetoric, whereby Russia does not exclude the nuclear dimension. Horizontal escalation refers to the possibility of multiple, simultaneously induced incidents of damage, such as the destruction of critical infrastructure, port blockades, or deliberately triggered environmental disasters. To prevent a recurrence of cases such as the Jaguar, such scenarios must be addressed not only at the operational and military levels, but also politically and legally among the federal and state authorities, ministries, and partner states, and as early as possible, rather than in the midst of an already escalating crisis.

It is necessary to analyse potential Russian options for escalation and coercion, to work through possible consequences, and to prepare concretely for such crises. In this way, courses of action for possible conflicts and prospective escalation dynamics can be developed. This helps to raise awareness of the underlying problem among decision-makers, to minimise friction between the relevant authorities in the event of a confrontation, and to assess and optimise one’s own response capabilities.

It should be noted that it is not necessarily the individual damaging incident that constitutes the serious problem. Rather, it is the cumulative generation of such events that can ultimately become part of an escalating dynamic and, when accompanied by (nuclear) signalling and threats, test the resolve of decision-makers. In this way, Russia repeatedly seeks to deter measures against its shadow fleet, given its dependence on maritime routes via the Baltic and North Seas.

The Federal Republic of Germany and its European partners must be prepared for provocations and attempts at coercion if they follow these recommendations and implement the four proposed measures. What matters is that they remain undeterred and implement this catalogue of measures in a determined, systematic, and sustained manner. If they do so, the prospects of containing shadow fleet shipping on a lasting basis are favourable.

Dr Julian Pawlak is an Associate in SWP’s International Security Research Division. This Comment was produced within the framework of the Strategic Threat Analysis and Nuclear (Dis-)Order (STAND) project.