Russia’s so-called “dark fleet” has become one of the most important tools helping Moscow continue exporting oil and gas despite an unprecedented web of Western sanctions. Built from aging tankers, shell companies, deceptive shipping practices, and increasingly sophisticated digital technologies, the fleet has allowed Russia to keep billions of dollars in energy revenue flowing even as Western governments attempt to squeeze the Kremlin’s finances.
The concept sounds almost implausible. Oil tankers are among the largest moving objects on Earth. Many are hundreds of feet long and carry millions of barrels of oil. Yet despite their size, the vastness of the world’s oceans, gaps in international enforcement, and increasingly advanced concealment methods have enabled this shadow network to operate with surprising success.
What Is the Dark Fleet?
The dark fleet, sometimes called the shadow fleet or ghost fleet, is a collection of tankers used to transport sanctioned Russian, Iranian, and Venezuelan oil while avoiding international restrictions. Many of these vessels are older ships purchased through complex ownership structures and operated through layers of shell companies that obscure who actually controls them.
The fleet exists for one primary purpose: to keep energy exports moving and revenue flowing despite sanctions. Russia’s oil exports remain one of the Kremlin’s most important sources of income, helping finance government operations and its war effort in Ukraine. By disguising the origin, ownership, location, and cargo of tankers, operators attempt to bypass restrictions imposed by the United States, the European Union, the United Kingdom, and other nations.
Recent investigations by the U.S. Coast Guard, European authorities, maritime intelligence firms, and investigative journalists suggest that these operations are neither accidental nor isolated. Rather, they appear to be carefully organized systems designed specifically to facilitate sanctions evasion.
How the Fleet Circumvents Sanctions
Sanctions generally work by restricting the ability of vessels, companies, insurers, ports, and financial institutions to participate in the transport of sanctioned oil. The dark fleet attempts to break this chain through deception, concealment, and jurisdictional complexity.
The strategy relies on making it difficult for authorities to determine who owns a ship, where it is located, what cargo it is carrying, where that cargo originated, and who ultimately receives it. Even when authorities identify suspicious vessels, enforcement remains difficult because the oceans cover more than 70 percent of the planet and many activities occur in international waters.
As Rear Adm. David Barata of the U.S. Coast Guard noted, “These vessels are attempting to hide in plain sight.”
The Technologies and Tactics Behind the Dark Fleet
Multiple AIS Transmitters and Identity Switching
Automatic Identification System, or AIS, devices broadcast a vessel’s identity and position. Coast Guard investigators discovered some dark fleet ships carrying multiple AIS units and even physical toggle switches that allowed crews to electronically switch between vessel identities. This enables ships to appear as entirely different vessels while operating at sea and complicates efforts to track sanctioned cargo movements.
GPS Spoofing and False Location Broadcasting
Investigators found custom Ethernet cables attached directly to AIS systems, allowing crews to transmit fraudulent location information. One vessel appeared digitally to be operating near Curaçao while actually conducting oil transfers off Venezuela. Documentation found onboard included instructions for additional GPS manipulation techniques designed to conceal true movements.
Identity Theft of Retired Ships
According to Coast Guard officials, dark fleet operators sometimes assume the identities of vessels that have already been scrapped or dismantled. By reusing names that once legitimately existed in maritime databases, operators create confusion within tracking systems and make it harder for authorities to determine which vessel is actually being monitored.
Remote Desktop Control Systems
Coast Guard cyber teams discovered persistent installations of remote-access software such as AnyDesk and TeamViewer. These applications allow vessel owners and operators to monitor systems, access computers, and potentially alter information from thousands of miles away. Investigators found that unattended access was frequently enabled, allowing remote connections without crew involvement.
Remote Data Deletion
In at least one case, operators attempted to remotely erase digital information after U.S. personnel boarded a vessel. This capability allows evidence of routes, communications, operational decisions, and cargo information to be destroyed before investigators can fully examine shipboard systems.
Constant High-Bandwidth Communications
Unlike legitimate commercial operators that often minimize unnecessary costs, many dark fleet vessels carried sophisticated communications systems that maintained continuous internet connectivity. This constant connection enables coordination with remote operators, supports deceptive activities, and facilitates rapid changes in routing or operational instructions.
Pirated Software and Malware-Compromised Systems
Investigators found navigation and business-management systems running pirated software infected with malware. These compromised systems were often connected to operational and navigational networks. While useful for reducing costs, they also create vulnerabilities that could potentially be exploited by hackers, creating risks ranging from navigation failures to environmental disasters.
False Documentation and Flag Manipulation
Authorities report that dark fleet operators routinely use falsified paperwork and frequently change vessel registrations and national flags. One tanker intercepted by Belgian authorities was allegedly operating under a false Guinean flag. Such tactics complicate jurisdictional oversight and delay enforcement actions.
Ship-to-Ship Transfers at Sea
Authorities in India and other countries report that dark fleet operators frequently conduct mid-sea transfers between vessels. Oil can be moved from one tanker to another in international waters, making it far more difficult to trace the true origin of the cargo before it reaches buyers.
Onboard Security and Crew Monitoring
Investigations suggest Russia has increasingly deployed security personnel, including former Wagner mercenaries and individuals linked to Russian security organizations, aboard some vessels. Their role reportedly includes monitoring crews, preventing cooperation with authorities, gathering intelligence, and ensuring captains resist attempts by foreign governments to detain or redirect ships.
Military and State Coordination
Reports indicate that security personnel may serve as links between vessels and Russian state institutions. In one widely reported incident, a Russian fighter aircraft appeared after a tanker ignored requests by Estonian authorities to permit boarding. Such events highlight the possibility of state support extending beyond commercial shipping operations.
The Growing Scale of the Fleet
Despite increasing enforcement efforts, the dark fleet continues to expand and adapt. Bloomberg reported that Russia recently added four more LNG carriers to support exports from the sanctioned Arctic LNG 2 project. Analysts estimate that roughly twenty vessels are now supporting Russia’s sanctioned LNG exports alone, while the broader oil fleet is substantially larger.
The fleet has also evolved operationally. According to maritime intelligence analyst Michelle Wiese Bockmann, Russia has increasingly shifted toward Russian-registered ships and Russian captains, reducing the need for onboard security personnel while improving operational control.
“One thing about the shadow fleet and Russia is that they are very quick to adapt,” she observed.
International Efforts to Fight Back
The United States launched a major crackdown in late 2025, conducting seizures and interdictions around the world. European nations have followed suit. The United Kingdom, France, Germany, Belgium, and others have detained or inspected vessels suspected of participating in sanctions evasion. India has also increased maritime surveillance and seized several sanctioned tankers.
Yet officials acknowledge the challenge remains immense. Rear Adm. Jason Tama summarized the concerns after Coast Guard cyber teams examined several vessels.
“We’ve known for years that the dark fleet posed significant physical risks,” Tama said. “But what we didn’t know until these boardings was what type of cyber risks were aboard these ships.”
Barata offered perhaps the most realistic assessment of the challenge: “The ocean is big, but the ports where they deliver oil are known.”
The dark fleet demonstrates how modern sanctions evasion has evolved beyond forged paperwork and secret meetings. Today’s operators combine maritime experience with cyber tools, digital deception, remote communications, shell-company structures, and international legal complexity.
The result is a global network that has proven remarkably resilient. Although enforcement actions are increasing and international cooperation is expanding, the fleet continues moving sanctioned oil and gas across the world’s oceans. The ships may be enormous, but the oceans are larger still. For now, that reality remains one of the dark fleet’s greatest advantages.
