According to a CNN exclusive, Russia has turned its “shadow fleet”—created after the full-scale invasion of Ukraine to circumvent Western sanctions—into a tool for intelligence operations targeting Europe. Western and Ukrainian intelligence sources say Russian personnel on board these vessels have monitored military facilities, taken photographs, and engaged in sabotage activities.

What Is the Shadow Fleet and Why Does It Matter?

Following its full-scale invasion of Ukraine in 2022, Russia assembled a shadow fleet consisting of hundreds of oil tankers. Often registered under foreign flags, these vessels transport Russian oil from Baltic and Black Sea ports, generating hundreds of millions of dollars annually for the Kremlin despite sanctions.

Intelligence sources now say the fleet has evolved beyond commercial purposes and is increasingly being used for military and intelligence operations.

Covert Russian Personnel and Moran Security Links

Ukrainian intelligence reports that additional crew members have been quietly added to some tankers shortly before departure. Crew lists reviewed by CNN show ships largely staffed by nationals of China, Myanmar, and Bangladesh, with one or two Russian names—complete with Russian passport details—appearing at the bottom of the roster.

Multiple intelligence sources told CNN that these individuals are linked to the secretive Russian private security company Moran Security. The firm is believed to have close ties to Russian military and intelligence services, and some of its personnel previously worked for Russian private military contractors, including the Wagner group.

Moran Security was sanctioned by the U.S. Treasury in 2024 for providing armed security services to Russian state-owned enterprises.

Espionage and Sabotage Allegations

A Western intelligence source said Moran personnel were observed photographing European military installations from one of the shadow fleet vessels. While further details were not disclosed, intelligence officials described these actions as part of Russia’s broader hybrid warfare strategy.

Oleksandr Stakhnevych of Ukraine’s Foreign Intelligence Service said the Russian personnel are also tasked with monitoring ship captains, most of whom are not Russian nationals.

A Western intelligence official echoed this assessment, stating:
“They are not engaged in direct combat. They ensure that operations align with the Kremlin’s interests.”

The Boracay Tanker Case

CNN reconstructed Moran’s activities aboard one sanctioned tanker, the Boracay, using Ukrainian intelligence assessments, Western intelligence analysis, satellite imagery, and maritime data. The vessel has frequently changed its name and flag over the past three years.

Records show that on September 20, two Russian men boarded the Boracay at the Baltic port of Primorsk near St. Petersburg. They were listed simply as “technicians” and were the only Russians on board a ship otherwise crewed by Chinese, Myanmar, and Bangladeshi nationals.

Ukrainian intelligence identified the two men, and CNN confirmed their identities with Western intelligence sources. One was a former police officer with previous ties to the Wagner group. Their precise activities on board remain unclear.

Growing Alarm in the Baltic Sea

Many shadow fleet vessels transit the Baltic Sea, a critical maritime corridor bordered by NATO members such as Denmark and Sweden. Danish sea pilots report frequently encountering Russian men on board who appear to exercise authority and show hostility toward inspectors.

Bjarne Caesar Skinnerup, a senior officer with Denmark’s state pilot service DanPilot, said:
“I have personally seen several shadow fleet vessels where the crew is mostly non-Russian, but one or two Russians appear on the list and seem to be in charge.”

In some cases, he added, the Russians were wearing what appeared to be Russian Navy camouflage uniforms.

In July, DanPilot warned Denmark’s Emergency Management Authority that reports were increasing of ships carrying extra crew members—likely Russian—wearing military uniforms and actively photographing bridge areas.

Similar Concerns in Sweden

Sweden’s coast guard confirmed it had previously observed individuals aboard shadow fleet ships who did not appear to belong to merchant crews. A senior Swedish navy commander said last year that some Russian-linked tankers in the Baltic Sea were carrying antennas and masts not typically found on commercial vessels.

A Strategy of Plausible Deniability

Former Danish intelligence official Jacob Kaarsbo said placing armed personnel with military backgrounds on shadow fleet vessels reflects a classic Kremlin hybrid warfare tactic.

“Everyone with even half a clue knows these men take orders from the Russian state, but it is difficult to prove,” he said, noting that this provides Moscow with plausible deniability.

CNN presented its findings to Alexey Badikov, identified by the U.S. Treasury as Moran Security’s CEO. Reached by phone, Badikov said he is the company’s deputy director and declined to comment on the espionage and sabotage allegations.

European security officials increasingly agree that Russia’s shadow fleet now represents not only an economic tool but also a serious and evolving security threat.