How the Shadow Fleet Enables Russia’s Hybrid Warfare in Europe

Andrei Soldatov, Irina Borogan

At the October meeting of the Valdai Discussion Club, an annual forum for Russian policy talks that has in recent years become a platform for Kremlin ideology, Russian President Vladimir Putin was asked an unusual question. “Mr. President, why are you sending so many drones to Denmark?” Putin initially dismissed it, joking that he would not send drones to “France, Denmark, or Copenhagen.” But the Russian leader did not stop there. He went on to say that “many eccentric characters,” especially young people, were capable of launching those drones over Europe—an enigmatic assertion that recalled his veiled comments about the nonuniformed Russian soldiers who helped seize Crimea in 2014 or about Russian interference in the U.S. election in 2016. He added that those young people would belaunching these drones “every single day.

Even before the Valdai meeting, Russia had begun making good on Putin’spledge. In mid-September, a group of Russian drones, three of which werearmed, entered Polish airspace. In response, for the first time since WorldWar II, Poland scrambled fighter jets to defend its territory and shot downthe drones. Three days later, Romania reported a Russian drone incursioninto its airspace, the first of a series of such incidents in Romania this fall. Inlate September, several Danish airports, including Copenhagen’s, were forcedto close briefly in response to drone incursions.

In early October, just days after the Valdai Club meeting, multiple dronesightings were reported near military installations and airports acrossGermany. A few days after that, Norway briefly suspended flights from Osloairport after drones were spotted nearby. In November, Belgian authoritieswere forced to close Brussels Airport after multiple drones were sightednearby. And in the Netherlands, after drones were identified near Volkel AirBase, which houses a U.S. air force squadron assigned to NATO, the Dutch military used ground-based weapons to try to intercept them; air traffic wasalso briefly suspended over the south of the country.

Although the Kremlin has continually denied involvement in these incursions, few European officials are convinced. But what has been less noted is the logistics that are supporting this new hybrid warfare campaign.In many cases, Russia does not appear to be launching drones from its own territory. Instead, it appears to be relying on its so-called shadow fleet, the hundreds of Russian-controlled third-party boats that are used to evadesanctions and that often navigate waters around Europe. 

When drones were spotted in Danish airspace, for example, the oil tankerBoracay, a Benin-flagged vessel that had left the Russian port of Primorsk loaded with Russian oil in September, was tracked off the Danish coast. The ship had previously been blacklisted by the UK and the European Union for helping Russia evade sanctions. After the drone incursion, French naval commandos boarded the ship and briefly detained the ship’s captain, who was a Chinese national. French President Emmanuel Macron said thatFrance could not rule out a connection between the ship and the drone attacks, although definite proof has not yet surfaced. The Kremlin called theFrench allegations “hysteria.”

According to a new report by the Danish investigative outlet Danwatch,Danish maritime officials have also spotted Russian men in militaryuniforms aboard shadow fleet vessels this fall. As the report put it, such apresence indicates that Moscow “may be installing its own personnel aboardoutlaw merchant tankers.” Although many questions remain about howMoscow is deploying the shadow fleet, it is increasingly clear that the seasaround Europe have become a central arena of Russia’s pressure campaignagainst the continent. On November 19, UK Defense Secretary John Healyannounced that a Russian surveillance ship had entered British waters inrecent weeks and aimed lasers at UK military pilots. Healy called the ship’sactivities “deeply dangerous” and said that the UK was preparing variousmilitary options in case of an escalation

For Russia, a seaborne hybrid warfare strategy has multiple advantages.Using ships allows Russia to get much closer to Western Europe, andlaunching hybrid attacks from ships, rather than land, is less risky and more convenient, operationally, for Russian agents. The shadow fleet is also by itsnature murky, making it harder for European governments to link activities to Moscow. Moreover, for the Kremlin, such a strategy can draw on long  experience: going back to the Soviet era, Moscow has used ships as a keypart of its intelligence operations in Europe and elsewhere, and Russianintelligence agencies today have strong connections to the country’s maritime activities. If European leaders hope to curtail Putin’s increasingly bold hybrid warfare strategy, they will need to adopt a much firmer approachto the shadow fleet.

DRONES OVER DENMARK

Until the fall of this year, Western attention on Moscow’s hybrid warfarecampaign in Europe largely focused on land-based sabotage operations. As we documented in Foreign Affairs, multiple land-based attacks in WesternEurope in early 2024, including incidents of arson, sabotage, andcyberattacks in at least 15 countries, have been linked to Russia or Russian-affiliated agents. These attacks have continued, though at a slower pace,perhaps as a result of heightened Western security.

But throughout the war with Ukraine, Russian intelligence services havealso been quietly developing seaborne capabilities as well. Geographically, this makes sense: most Western European countries have coastlines, and the sea represents a vulnerability that can be exploited. Russia also had newincentives to turn to offshore operations following the advent of European counterintelligence measures and the massive expulsion of Russian diplomats from Europe after Russia’s 2022 invasion of Ukraine. Undersea sabotage was the first to be activated: starting in 2023, a growing number of incidents involving merchant ships cutting or damaging undersea power and communications cables and gas pipelines in the North and Baltic Seas were linked to Russia. Several cases involved Chinese merchant vessels that appeared to have visited Russian ports shortly beforehand

Since 2022, Moscow has also poured significant resources into acquiringhundreds of third-party ships, including aging oil tankers and other vessels,which it has used to evade Western sanctions. Some of these ships have openly used Russian ports. But since ships must use automatic identification system transponders to transmit their location in real time, Russia has made increasing use of ship-to-ship transfers at sea: vessels that have been tracked to a Russian port can switch cargo to waiting tankers offshore with their transponders switched off. Even large cargoes of oil can be transferredbetween ships quickly, in as little as 12 hours. Those offshore vessels, which have not been directly traced to Russian ports, can then blend in with other vessels that are legitimately anchored in international waters, where theymay remain for months—waiting for market prices to go up before resale, according to the established commercial practice.

As the shadow fleet has rapidly grown, it has spurred a cat-and-mouse gamewith European officials. Thus far, the European Union has banned access toits ports for vessels engaged in ship-to-ship transfers if there are reasonablegrounds to suspect violations of the embargo on Russian crude oil andpetroleum products. Although such measures may complicate Russian oiland gas exports, they are unlikely to disrupt sabotage operations, whichrequire no access to ports.

Indeed, advances in drone warfare have added to the advantages of the sea.With its low-technology land operations, such as its sabotage and arsonattacks on the continent, Russia recruited untrained local proxies for one-offjobs. Drone operation, however, requires some degree of specialized training.In this sense, Russian-linked vessels can provide both effective cover forRussian agents and convenient launch platforms for drones of limited range.As a result, the shadow fleet has taken on new importance in Russia’s hybridwarfare in Europe. 

In an October interview published by the Kremlin-controlled Interfax, PavelGudev—Russia’s leading expert on the Maritime Security and Ocean Policy at the Primakov Institute of World Economy and International Relations, or IMEMO—offered a defiant response to Western efforts to curb the Russian shadow fleet. His message was blunt: ship-to-ship transshipment continues and cannot be stopped. Although the vessels are tracked and barred from European, U.S., British, and Canadian ports, he noted, “if they need to replenish provisions or refuel, they can call at other countries and otherports.”

SOVIETS AT SEA

Moscow’s willingness to engage in aggressive seaborne operations has a longhistory. Throughout the twentieth century, the Soviets used non military ships in its intelligence activities, as well as for launching sabotage operations from the sea. From almost the beginning of the Bolshevik era,Soviet agents used merchant, cargo, and other civilian ships to move agents around Europe—or bring them back to Moscow if they had fallen afoul of the regime. 

In 1930, for example, Soviet agents snatched General Alexander Kutepov, the leader of the Russian All-Military Union (ROVS)—the military arm of the main anti-Soviet émigré organization —from a street in Paris. They drugged him, packed him unconscious into a car, drove to Marseille, and placed him in the hold of a Soviet merchant vessel bound for Novorossiysk,a port on the Black Sea. Kutepov never made it to Soviet Russia, dying inthe ship’s hold. But Kutepov’s successor at ROVS, General Yevgeny Miller,in 1937 was also kidnapped in Paris and transported to Moscow in the holdof a Soviet steamship before being executed at Lubyanka. 

Soviet intelligence continued to use the merchant fleet throughout the ColdWar. That was one of the duties of Oleg Gordievsky, a KGB officer and lateran MI6 double agent, when he was posted in Copenhagen, Denmark, in the late 1960s. “My task was to discreetly place [intelligence operatives] on oneof the steamships plying between Le Havre and Leningrad. Each such transit operation was meticulously planned,” Gordievsky recalled in his memoirs: “It was necessary to negotiate with the ship’s captain or even recruit him as an agent.” The merchant fleet was also used for the exfiltration of compromised Soviet agents. This was how Kim Philby, the British double agent, escaped arrest in Beirut: he fled to the Soviet embassy and was subsequently transferred aboard the Soviet freighter Dolmatova, bound for Odessa.

During these same decades, the Soviets also laid the groundwork forsophisticated sea-launched sabotage operations. In 1938, a state-of-the-artSoviet submarine was submerged in a bay near Vladivostok in a top-secretexercise aimed at, according to the military order that described it, “landingtroops for reconnaissance and carrying out sabotage operations on shore.”Soviet officials deemed the exercise successful. During World War II, Sovietintelligence made extensive use of submarines to deploy operatives in theBaltic region, although with mixed results. In 1941–1942, Moscow lost threesubmarines while attempting to land Soviet saboteurs onshore.

Then, in 1953, the Soviet Navy and Soviet military intelligence, the GRU,established naval saboteur units within the Soviet fleets. The newly formedunits, called Naval Intelligence Points, or MRP in Russian, were set up inthe Black Sea and Baltic Fleets and were assigned to carry out sabotageoperations on shore, among other tasks. Although it was never activatedduring the Cold War against Western targets, the sabotage program  remained a focus of Soviet intelligence. The Naval Intelligence Pointheadquartered on a small artificial island in the Black Sea near the town ofOchakov became the main center for training naval special forces of militaryintelligence and was expanded in 1968.

In the 1970s, these twin long-standing Soviet practices—the use ofmerchant vessels for intelligence purposes and planning for naval sabotage—finally merged. As NATO member states—including Belgium, Denmark,the Netherlands, Norway, and the United Kingdom—began intensive oiland gas extraction in the North Sea, Moscow’s intelligence agencies sawnew possibilities for covert deployment using civilian ships. A team ofSoviet naval saboteurs was dispatched on a research trip, and its reportconcluded that civilian ships, alongside submarines, could now be used toinsert saboteurs for operations against Western countries.

During the final years of the Soviet Union, the soldiers on the artificialisland also began training operatives of the KGB’s special operations unitVympel, which had a mandate to conduct covert missions abroad. The seasabotage training was probably the only area in which military intelligenceand the KGB didn’t compete.

LOW TECH, HIGH ANGST

The collapse of the Soviet Union deeply disrupted Moscow’s sabotagecapabilities. In 1992, GRU officer Stanislav Lunev defected to the UnitedStates and revealed KGB and GRU contingency plans for sabotageoperations in the West. The end of the Soviet empire also took a heavy tollon Russia’s sabotage infrastructure. When Ukraine became independent in1991, the Black Sea Fleet, stationed in Crimea, remained under Russiancontrol, but the brigade of naval saboteurs on the artificial island came under  the authority of the nascent Ukrainian naval forces—striking a blow toRussia’s sabotage capabilities.

But the training and institutional framework were not entirely lost. AsRussian intelligence regrouped under Putin’s leadership, the sabotage optionwas reactivated. And with the full-scale war in Ukraine—which the Kremlinand its agencies see as an existential war with the West—Russianintelligence has put major resources back into the strategy. Today, the mainbase of Russian naval saboteurs is the Naval Intelligence Point in theKaliningrad region, in the Baltic. A return to seaborne sabotage was likelygiven a further boost by the appointment of Igor Kostyukov, a seasoned navyadmiral, to head the GRU in 2018, and Nikolai Patrushev, a long-standing ally of Putin and former head of the Security Council and the FSB, to chairRussia’s Maritime Collegium, the highest government agency coordinatingmaritime activities by the Russian state, in 2024.

Traditionally, Russian intelligence has suffered from poor coordinationbetween separate agencies. But because sea operations are based on jointmilitary-intelligence operation, they appear to have largely escaped thisproblem. Since Soviet times, Moscow’s different intelligence services,including the military intelligence and the FSB, have cooperated closely atsea. Moreover, the presence of official military boats, like the surveillanceship observed near the UK this fall, alongside shadow fleet ships, suggeststhe extent to which shadow tankers may be coordinating with the militaryand intelligence apparatus. Over the past six months, Russian warships havealso been observed escorting shadow fleet vessels in the Baltic Sea and eventhe English Channel.

The final element in this return to sea-based hybrid warfare has beenRussia’s rapidly growing drone program. These drones don’t need to be  accurate, technologically advanced, or armed to achieve their purpose—thevery sightings of drones disrupted the activities of airports for hours, if notdays. At the same time, the large-scale and bloody battlefield in Ukraineprovides excellent conditions to train substantial numbers of drone operatorshardened by real combat.

Already, the results of Russia’s campaign have been significant. With smallnumbers of drones, Moscow has disrupted civil aviation in multipleEuropean countries, bringing the threat much closer to the European public.It can also disrupt important military installations by flyovers or surveillance,as the November incident at the Netherlands’ Volkel Air Base shows. To counter this tactic, Western governments have little choice but to intensify counterintelligence and counter sabotage efforts and increase stop-and-search operations in the Baltic and the North Sea as well as investing bigtime in protection of airports and other national infrastructure.

Some encouraging steps are now in play. As Reuters has reported, followingthe November incursion near Brussels Airport, Belgian authorities requestedassistance from British, French, and German anti-drone teams, includingsome 20 British Royal Air Force specialists with expertise in signal jamming.On November 20, European officials also discussed new measures that couldbe taken against shadow fleet vessels, including enhanced authority to boardvessels as well as new forms of sanctions.

But these mysterious boats navigating close to European shores are no longer simply a means for Russia to sell oil to sustain its military-industrial base. They are also a military and intelligence threat in their own right. To truly address the threat, Europeans must recognize that the fleet is already destabilizing their countries and some day might serve to support and even provide a launch point for offensive operations in Europe. 

Originally published in Foreign Affairs

Agentura.ru 2026