In December 2025, U.S. Coast Guard personnel and Marine Corps special operations forces fast-roped from helicopters onto the deck of the Skipper, a sanctioned tanker leaving Venezuelan waters with 1.8 million barrels of uninsured crude oil. The vessel had been sending out false GPS coordinates for months. A few weeks later, the Coast Guard chased the Bella-1, later renamed the Marinera, across the North Atlantic through winter storms. During the pursuit, the ship changed its name, painted a Russian flag on its hull, and resisted boarding. Russia even sent a submarine to escort it, but the United States seized the vessel anyway (The War Zone, 2026; Fox News, 2025). These actions were not isolated incidents. They were the most visible signs of a maritime security crisis that has been growing since 2022 and is now too large to be seen as just a sanctions compliance issue. The global shadow fleet, made up of loosely connected but coordinated aging, uninsured, and falsely flagged tankers moving sanctioned oil for Russia, Iran, and Venezuela, has tripled in size since Russia invaded Ukraine. It now includes over 1,000 vessels, or about 17 to 20 percent of the world’s oil tanker fleet (Fox News, 2025; The Week, 2026). In 2025, this fleet moved around 3.7 billion barrels of crude oil, making up six to seven percent of global crude flows (The Week, 2026). This essay argues that the phantom fleet is no longer just a tool for evading sanctions. It has become a weapon of irregular warfare, a constant environmental risk, a systematic threat to seafarer welfare, and a direct danger to the safety of legitimate maritime trade, all while operating openly under the label of “commercial shipping.”
The shadow fleet began after Russia’s invasion of Ukraine in February 2022, when new sanctions were put in place. In response to Western oil price caps and the ban on Russian crude in Europe, Moscow quickly built up a fleet of old tankers bought through anonymous middlemen and registered under flags of convenience in countries with little oversight. By the end of 2022, Russia had about 600 shadow vessels. By December 2023, the fleet had grown to between 1,100 and 1,400 ships (The Week, 2026). Western countries responded with more than 900 sanctions against these vessels and their networks in 2025 alone, but the fleet kept growing because the financial rewards for operators, flag states, and buyers were too strong to resist (Kharon, 2026).
What transformed the shadow fleet from a Russian logistical workaround into a multi-state security problem was the gradual change. The shadow fleet changed from being just a Russian workaround to a wider security problem when Russia’s and Iran’s evasion networks started working together. According to a February 2026 policy analysis by the Middle East Institute, sanctioned crude now makes up about 18 percent of global tanker capacity. About half of the shadow fleet carries Russian oil, 20 percent carries Iranian crude, and much of the rest comes from Venezuela (Middle East Institute, 2026; The Week, 2026). These networks do not act as separate national fleets. As analyst Kharon Barresi puts it, they are “a shared sanctions-evasion services ecosystem that advances the converging interests of these three states,” with ships, insurers, flag registries, managers, and financial intermediaries all serving multiple sanctioned clients at once (Kharon, 2026, para. 6). The Panama-flagged Themis, sanctioned by the United Kingdom, conducted documented voyages for both Russian and Iranian oil networks. UAE and Seychelles-based management firms handled tankers linked to both regimes, exploiting AIS manipulation, layered corporate ownership structures, and ship-to-ship transfers in jurisdictional blind spots to obscure the cargo’s origin and destination (Irregular Warfare Journal, 2025).
The CSIS analysis of the Marinera’s journey, documented through AIS data from Optix, traced a voyage that began in Iran, traversed the Strait of Malacca, made for South America, went dark off the coast of Sri Lanka, and reappeared in the Iranian Exclusive Economic Zone on July 1, 2025, where the vessel registered 379 rendezvous pings and switched off its AIS 17 times before ultimately heading for Venezuela with no cargo, likely having completed a series of ship-to-ship transfers designed to launder the crude’s origin through multiple ownership layers (CSIS, 2026a). Windward AI’s analysis of Iran’s shadow fleet found that of approximately 430 tankers engaged in Iranian trade, 62 percent are falsely flagged and 87 percent are under sanction, yet Iranian crude exports reached approximately 2.0 million barrels per day in September 2025, the highest level since mid-2018, demonstrating definitively that sanctions have altered how oil moves, not whether it moves (Windward AI, 2026; ORF Middle East, 2026).
The security risks from the phantom fleet go well beyond sanctions enforcement. The most urgent and often overlooked threat is environmental. About 72 percent of shadow fleet vessels are more than 15 years old and require constant maintenance, but their uninsured and often anonymous owners have no legal or financial incentive to keep them in good condition (CSIS, 2026b). Sixty percent of these ships have no insurance, so if there is a major spill, the clean-up costs, estimated between $859 million and $1.6 billion, fall on the coastal states or European taxpayers where the spill happens (CSIS, 2026b). The CSIS “Ghost Busters” analysis summed it up: “as profitable as the ghost fleet is to Moscow, it is just as dangerous to the global commons” (CSIS, 2026b, para. 4).
This risk is not just theoretical. An investigation by SourceMaterial, published in October 2025 using satellite images from SkyTruth and shipping data from Kpler, found at least five shadow fleet tankers leaked oil into European waters in the past year. Two of these ships were already under British sanctions at the time, but kept operating without consequences (The Moscow Times, 2025). Latvia’s Energy Minister called it a “huge problem” and warned that Europe has been “quite lucky at this moment that we don’t have any environmental catastrophe happening.” The Center for Research on Energy and Clean Air estimated that cleaning up a major spill could cost 1.4 billion euros (The Moscow Times, 2025). Michelle Wiese Bockmann of Windward AI told Fox News Digital that the Skipper alone, with its 1.8 million barrels of uninsured crude, was “a billion-dollar maritime disaster waiting to happen,” and described the whole fleet as “a billion-dollar oil spill catastrophe waiting to happen” (Fox News, 2025, para. 3). In the Persian Gulf, the ORF Middle East analysis warned that shallow waters, high salinity, and limited circulation would make oil pollution last much longer than in open seas, threatening fisheries, mangroves, and the desalination plants that provide drinking water to Gulf states (ORF Middle East, 2026).
The Irregular Warfare Journal’s August 2025 analysis argued that Russia’s shadow fleet is more than just a way to move oil around sanctions. It is a tool of irregular warfare, meant to create environmental risks, weaken maritime law enforcement, and make sanctions evasion seem normal. This strategy imposes ongoing strategic and economic costs on opponents without using direct force (Irregular Warfare Journal, 2025). The analysis also found that the fleet’s activities overlap with interference in Baltic infrastructure. Shadow tankers have operated near important undersea cables and energy pipelines in the Baltic and North Sea. In August 2025, the Danish outlet Danwatch reported that internal messages from the state-owned pilotage company DanPilot described uniformed “extra crew members” on Russian shadow tankers taking photos of bridge infrastructure, which Danish military sources believe was for FSB intelligence gathering (The Week, 2026).
The Atlantic Council’s April 2025 report highlighted that AIS manipulation by shadow vessels is especially dangerous for maritime safety. When these ships operate “dark”, with their transponders off or sending false locations, they are invisible to other vessels until they are seen by eye, making it almost impossible to avoid collisions (Atlantic Council, 2025). The collision between the Hafnia Nile and the Ceres I off Malaysia in 2024 showed this risk, as the investigation found that AIS manipulation by the shadow vessel contributed to the accident (Atlantic Council, 2025). For legitimate shipowners, the risks go beyond collisions. The Atlantic Council noted that if a legally operating ship is damaged in a collision with a shadow vessel, the owner could face sanctions if the investigation finds any accidental business contact with sanctioned networks (Atlantic Council, 2025).
The most significant Western action against the shadow fleet so far has been Operation Southern Spear. This U.S. campaign, launched in December 2025, combined a naval blockade of sanctioned tankers moving to and from Venezuela with direct seizures of vessels in international waters. The operation led to the capture of at least 10 tankers, including the Skipper and the Marinera, and sent what the Middle East Institute called “a deterrent signal” to the wider network (Middle East Institute, 2026, para. 2; Radio Free Europe/Radio Liberty, 2026). Former DHS Secretary Kristi Noem put it plainly: “The United States of America under this president is not going to tolerate” shadow fleet operations carrying sanctioned oil (The War Zone, 2026, para. 7).
However, the Middle East Institute found that Operation Southern Spear had only a “limited impact” on the shadow fleet. This is because Russian and Iranian sanctioned trade depends on complex networks of insurers, flag registries, port access, ship managers, financiers, and traders that cannot be disrupted by seizing ships alone (Middle East Institute, 2026, para. 1). The Kharon expert analysis agreed, noting that in Europe, foreign-flagged vessels in international waters are not breaking sanctions laws just by being there. As a result, seizures by Germany, France, Estonia, and Finland in 2024 and 2025 ended with the ships and crews released and the cargo left untouched (Kharon, 2026). The Munich court’s December 2025 decision to suspend Germany’s seizure of 100,000 tons of crude from the Eventin thehighlighted how legal fragility of these enforcement actions (The Week, 2026).
In 2025, more than 70 percent of sanctioned vessels changed their flags at least once to hide ownership and make enforcement harder. About 120 shadow fleet tankers were expected to reflag to Russia, since it was one of the few countries still willing to accept them (Kharon, 2026). Russia’s willingness to grant flag registration during a chase, while breaking Article 92 of UNCLOS, which bans flag changes without real ownership transfer, and to send a submarine to protect a vessel under a U.S. seizure warrant, shows that Moscow sees protecting the shadow fleet as a matter of national interest, not just business (CSIS, 2026a).
Experts from CSIS, the Middle East Institute, Kharon, and the Atlantic Council agree that the strategy against the shadow fleet needs to change. Instead of focusing on stopping individual ships, efforts should target the systems that keep the network running. The Middle East Institute suggests going after “insurers, flag registries, port access, ship managers, financiers, and traders” using secondary sanctions, tariffs, compliance pressure, and coordinated action among allies. They argue this would raise costs and slow down the fleet more effectively than just using naval forces (Middle East Institute, 2026). Kharon analysts add that the shadow fleet is not a fixed list of ships, but an adaptive system that can quickly change flags, insurers, managers, and ownership paperwork faster than sanctions can keep up. This means that broader measures are needed to increase costs across the whole evasion network (Kharon, 2026, para. 9).
The CSIS “Ghost Busters” analysis says the United States should use modern commerce raiding tactics, relying on open-source intelligence to support diplomacy, legal action, and sanctions that target the money flows behind adversary war economies, all without using force (CSIS, 2026b). Kharon’s analysts point out that the environmental and safety risks from the shadow fleet create a “broadening coalition for action.” This coalition goes beyond those focused on sanctions enforcement and includes the IMO, the International Labor Organization, coastal environmental agencies, and the insurance industry. Each of these groups has its own reasons to address the fleet’s impact, and their actions do not depend on the complicated legal issues of seizing ships on the high seas (Kharon, 2026).
The phantom fleet is the clearest example of the contradictions in today’s international system. It uses the rules of free navigation and commercial shipping to undermine the very legal, environmental, and safety standards those rules are meant to protect. The fleet helps fund a land war in Europe, creates environmental risks in the Baltic, North Sea, and Persian Gulf, exploits seafarers through misleading recruitment and unsafe ships, and provides cover for interference with infrastructure, all while appearing to be normal commercial traffic. The Marinera’s name change at sea, the submarine escort, and the legal fights over seized cargo are not rare exceptions. They are part of how this fleet operates and has grown because the international community has treated the problem as just a compliance issue, when it is actually a security crisis that needs a security response.
Atlantic Council. (2025, April). The threats posed by the global shadow fleet — and how to stop it.https://www.atlanticcouncil.org/in-depth-research-reports/report/the-threats-posed-by-the-global-shadow-fleet-and-how-to-stop-it/
Center for Strategic and International Studies. (2026a, March). What the Bella-1 teaches us about targeting shadow fleets.https://www.csis.org/analysis/what-bella-1-teaches-us-about-targeting-shadow-fleets
Center for Strategic and International Studies. (2026b, February 12). Ghost busters: Options for breaking Russia’s shadow fleet. https://www.csis.org/analysis/ghost-busters-options-breaking-russias-shadow-fleet
Fox News. (2025, December 15). US and Ukraine target 1,000-vessel dark fleet of rogue oil tankers.https://www.foxnews.com/world/us-ukraine-target-massive-vessel-dark-fleet-smuggling-sanctioned-oil-worldwide
Irregular Warfare Journal. (2025, August 5). Russia’s shadow fleet: The dangerous tanker network threatening global waters. https://irregularwarfare.org/articles/russias-shadow-fleet-floating-hazard-irregular-warfare/
Kharon. (2026, March 5). Why are so many countries now seizing shadow fleet ships? Four experts explain.https://www.kharon.com/brief/shadow-fleet-iran-news-russia-venezuela-oil-sanctions
Middle East Institute. (2026, February 26). How Iran, China, and Russia use the shadow fleet to evade US sanctions.https://mei.edu/policymemo/how-iran-china-and-russia-use-the-shadow-fleet-to-evade-us-sanctions/
ORF Middle East. (2026, January 11). Iran’s shadow fleet fuels maritime environmental risks.https://orfme.org/expert-speak/irans-shadow-fleet-fuels-maritime-environmental-risks/
Radio Free Europe/Radio Liberty. (2026). What happens to a shadow fleet ship when it’s sanctioned?https://www.rferl.org/a/shadow-fleet-explainer-sanctions-russia-iran/33626443.html
The Moscow Times. (2025, October 6). Russian shadow fleet tankers linked to oil leaks in European waters.https://www.themoscowtimes.com/2025/10/06/russian-shadow-fleet-tankers-linked-to-oil-leaks-in-european-waters-politico-a90730
The War Zone. (2026, January 7). U.S. forces seize fleeing Russian-flagged oil tanker in North Atlantic.https://www.twz.com/news-features/u-s-forces-seize-fleeing-russian-flagged-oil-tanker-in-north-atlantic
The Week. (2026, January 18). How oil tankers have been weaponised.https://theweek.com/world-news/how-oil-tankers-have-been-weaponised
Windward AI. (2026, February 26). U.S. Treasury expands pressure on Iran’s shadow fleet and weapons procurement networks. https://windward.ai/blog/ofac-targets-irans-shadow-fleet-and-weapons-networks/
