By Eric Vandenbroeck and co-workers

How the Shadow Fleet Enables Russia’s Hybrid Warfare

At the October meeting of the Valdai Discussion Club, an annual forum for Russian policy talks that has in recent years become a platform for Kremlin ideology, Russian President Vladimir Putin was asked an unusual question. “Mr. President, why are you sending so many drones to Denmark?” Putin initially dismissed it, joking that he would not send drones to “France, Denmark, or Copenhagen.” But the Russian leader did not stop there. He went on to say that “many eccentric characters,” especially young people, were capable of launching those drones over Europe—an enigmatic assertion that recalled his veiled comments about the nonuniformed Russian soldiers who helped seize Crimea in 2014 or about Russian interference in the U.S. election in 2016. He added that those young people would be launching these drones “every single day.”

Even before the Valdai meeting, Russia had begun making good on Putin’s pledge. In mid-September, a group of Russian drones, three of which were armed, entered Polish airspace. In response, for the first time since World War II, Poland scrambled fighter jets to defend its territory and shot down the drones. Three days later, Romania reported a Russian drone incursion into its airspace, the first of a series of such incidents in Romania this fall. In late September, several Danish airports, including Copenhagen’s, were forced to close briefly in response to drone incursions.

In early October, just days after the Valdai Club meeting, multiple drone sightings were reported near military installations and airports across Germany. A few days after that, Norway briefly suspended flights from Oslo airport after drones were spotted nearby. In November, Belgian authorities were forced to close Brussels Airport after multiple drones were sighted nearby. And in the Netherlands, after drones were identified near Volkel Air Base, which houses a U.S. Air Force squadron assigned to NATO, the Dutch military used ground-based weapons to try to intercept them; air traffic was also briefly suspended over the south of the country.

Although the Kremlin has continually denied involvement in these incursions, few European officials are convinced. But what has been less noted is the logistics that are supporting this new hybrid warfare campaign. In many cases, Russia does not appear to be launching drones from its own territory. Instead, it appears to be relying on its so-called shadow fleet, the hundreds of Russian-controlled third-party boats that are used to evade sanctions and that often navigate waters around Europe.

When drones were spotted in Danish airspace, for example, the oil tanker Boracay, a Benin-flagged vessel that had left the Russian port of Primorsk loaded with Russian oil in September, was tracked off the Danish coast. The ship had previously been blacklisted by the UK and the European Union for helping Russia evade sanctions. After the drone incursion, French naval commandos boarded the ship and briefly detained the ship’s captain, who was a Chinese national. French President Emmanuel Macron said that France could not rule out a connection between the ship and the drone attacks, although definite proof has not yet surfaced. The Kremlin called the French allegations “hysteria.”

According to a new report by the Danish investigative outlet Danwatch, Danish maritime officials have also spotted Russian men in military uniforms aboard shadow fleet vessels this fall. As the report put it, such a presence indicates that Moscow “may be installing its own personnel aboard outlaw merchant tankers.” Although many questions remain about how Moscow is deploying the shadow fleet, it is increasingly clear that the seas around Europe have become a central arena of Russia’s pressure campaign against the continent. On November 19, UK Defense Secretary John Healy announced that a Russian surveillance ship had entered British waters in recent weeks and aimed lasers at UK military pilots. Healy called the ship’s activities “deeply dangerous” and said that the UK was preparing various military options in case of an escalation.

For Russia, a seaborne hybrid warfare strategy has multiple advantages. Using ships allows Russia to get much closer to Western Europe, and launching hybrid attacks from ships, rather than land, is less risky and more convenient, operationally, for Russian agents. The shadow fleet is also by its nature murky, making it harder for European governments to link activities to Moscow. Moreover, for the Kremlin, such a strategy can draw on long experience: going back to the Soviet era, Moscow has used ships as a key part of its intelligence operations in Europe and elsewhere, and Russian intelligence agencies today have strong connections to the country’s maritime activities. If European leaders hope to curtail Putin’s increasingly bold hybrid warfare strategy, they will need to adopt a much firmer approach to the shadow fleet.

A suspected Russian “shadow fleet” vessel near Saint-Nazaire, France, October 2025.

 

Drones Over Denmark

Until the fall of this year, Western attention on Moscow’s hybrid warfare campaign in Europe largely focused on land-based sabotage operations. Multiple land-based attacks in Western Europe in early 2024, including incidents of arson, sabotage, and cyberattacks in at least 15 countries, have been linked to Russia or Russian-affiliated agents. These attacks have continued, though at a slower pace, perhaps as a result of heightened Western security.

But throughout the war with Ukraine, Russian intelligence services have also been quietly developing seaborne capabilities as well. Geographically, this makes sense: most Western European countries have coastlines, and the sea represents a vulnerability that can be exploited. Russia also had new incentives to turn to offshore operations following the advent of European counterintelligence measures and the massive expulsion of Russian diplomats from Europe after Russia’s 2022 invasion of Ukraine. Undersea sabotage was the first to be activated: starting in 2023, a growing number of incidents involving merchant ships cutting or damaging undersea power and communications cables and gas pipelines in the Baltic Sea were linked to Russia. Several cases involved Chinese merchant vessels that appeared to have visited Russian ports shortly beforehand.

Since 2022, Moscow has also poured significant resources into acquiring hundreds of third-party ships, including aging oil tankers and other vessels, which it has used to evade Western sanctions. Some of these ships have openly used Russian ports. But since ships must use automatic identification system transponders to transmit their location in real time, Russia has made increasing use of ship-to-ship transfers at sea: vessels that have been tracked to a Russian port can switch cargo to waiting tankers offshore with their transponders switched off. Even large cargoes of oil can be transferred between ships quickly, in as little as 12 hours. Those offshore vessels, which have not been directly traced to Russian ports, can then blend in with other vessels that are legitimately anchored in international waters, where they may remain for months—waiting for market prices to go up before resale, according to the established commercial practice.                               

As the shadow fleet has rapidly grown, it has spurred a cat-and-mouse game with European officials. Thus far, the European Union has banned access to its ports for vessels engaged in ship-to-ship transfers if there are reasonable grounds to suspect violations of the embargo on Russian crude oil and petroleum products. Although such measures may complicate Russian oil and gas exports, they are unlikely to disrupt sabotage operations, which require no access to ports.

Indeed, advances in drone warfare have added to the advantages of the sea. With its low-technology land operations, such as its sabotage and arson attacks on the continent, Russia recruited untrained local proxies for one-off jobs. Drone operation, however, requires some degree of specialized training. In this sense, Russian-linked vessels can provide both effective cover for Russian agents and convenient launch platforms for drones of limited range. As a result, the shadow fleet has taken on new importance in Russia’s hybrid warfare in Europe.

In an October interview published by the Kremlin-controlled Interfax, Pavel Gudev—Russia’s leading expert on the Maritime Security and Ocean Policy at the Primakov Institute of World Economy and International Relations, or IMEMO—offered a defiant response to Western efforts to curb the Russian shadow fleet. His message was blunt: Ship-to-ship transshipment continues and cannot be stopped. Although the vessels are tracked and barred from European, U.S., British, and Canadian ports, he noted, “if they need to replenish provisions or refuel, they can call at other countries and other ports.”

 

Soviets At Sea

Moscow’s willingness to engage in aggressive seaborne operations has a long history. Throughout the twentieth century, the Soviets used nonmilitary ships in their intelligence activities, as well as for launching sabotage operations from the sea. From almost the beginning of the Bolshevik era, Soviet agents used merchant, cargo, and other civilian ships to move agents around Europe—or bring them back to Moscow if they had fallen afoul of the regime. 

In 1930, for example, Soviet agents snatched General Alexander Kutepov, the leader of the Russian All-Military Union (ROVS)—the military arm of the main anti-Soviet émigré organization—from a street in Paris. They drugged him, packed him unconscious into a car, drove to Marseille, and placed him in the hold of a Soviet merchant vessel bound for Novorossiysk, a port on the Black Sea. Kutepov never made it to Soviet Russia, dying in the ship’s hold. But Kutepov’s successor at ROVS, General Yevgeny Miller, in 1937 was also kidnapped in Paris and transported to Moscow in the hold of a Soviet steamship before being executed at Lubyanka.

Soviet intelligence continued to use the merchant fleet throughout the Cold War. That was one of the duties of Oleg Gordievsky, a KGB officer and later an MI6 double agent, when he was posted in Copenhagen, Denmark, in the late 1960s. “My task was to discreetly place [intelligence operatives] on one of the steamships plying between Le Havre and Leningrad. Each such transit operation was meticulously planned,” Gordievsky recalled in his memoirs: “It was necessary to negotiate with the ship’s captain or even recruit him as an agent.” The merchant fleet was also used for the exfiltration of compromised Soviet agents. This was how Kim Philby, the British double agent, escaped arrest in Beirut: he fled to the Soviet embassy and was subsequently transferred aboard the Soviet freighter Dolmatova, bound for Odessa.

During these same decades, the Soviets also laid the groundwork for sophisticated sea-launched sabotage operations. In 1938, a state-of-the-art Soviet submarine was submerged in a bay near Vladivostok in a top-secret exercise aimed at, according to the military order that described it, “landing troops for reconnaissance and carrying out sabotage operations on shore.” Soviet officials deemed the exercise successful. During World War II, Soviet intelligence made extensive use of submarines to deploy operatives in the Baltic region, although with mixed results. In 1941–1942, Moscow lost three submarines while attempting to land Soviet saboteurs onshore.

Then, in 1953, the Soviet Navy and Soviet military intelligence, the GRU, established naval saboteur units within the Soviet fleets. The newly formed units, called Naval Intelligence Points, or MRP in Russian, were set up in the Black Sea and Baltic Fleets and were assigned to carry out sabotage operations on shore, among other tasks. Although it was never activated during the Cold War against Western targets, the sabotage program remained a focus of Soviet intelligence. The Naval Intelligence Point, headquartered on a small artificial island in the Black Sea near the town of Ochakov, became the main center for training naval special forces of military intelligence and was expanded in 1968.

In the 1970s, these twin long-standing Soviet practices—the use of merchant vessels for intelligence purposes and planning for naval sabotage—finally merged. As NATO member states—including Belgium, Denmark, the Netherlands, Norway, and the United Kingdom—began intensive oil and gas extraction in the North Sea, Moscow’s intelligence agencies saw new possibilities for covert deployment using civilian ships. A team of Soviet naval saboteurs was dispatched on a research trip, and its report concluded that civilian ships, alongside submarines, could now be used to insert saboteurs for operations against Western countries.

During the final years of the Soviet Union, the soldiers on the artificial island also began training operatives of the KGB’s special operations unit Vympel, which had a mandate to conduct covert missions abroad. The sea sabotage training was probably the only area in which military intelligence and the KGB didn’t compete.

 

Low Tech, High Angst

The collapse of the Soviet Union deeply disrupted Moscow’s sabotage capabilities. In 1992, GRU officer Stanislav Lunev defected to the United States and revealed KGB and GRU contingency plans for sabotage operations in the West. The end of the Soviet empire also took a heavy toll on Russia’s sabotage infrastructure. When Ukraine became independent in 1991, the Black Sea Fleet, stationed in Crimea, remained under Russian control, but the brigade of naval saboteurs on the artificial island came under the authority of the nascent Ukrainian naval forces—striking a blow to Russia’s sabotage capabilities.

But the training and institutional framework were not entirely lost. As Russian intelligence regrouped under Putin’s leadership, the sabotage option was reactivated. And with the full-scale war in Ukraine—which the Kremlin and its agencies see as an existential war with the West—Russian intelligence has put major resources back into the strategy. Today, the main base of Russian naval saboteurs is the Naval Intelligence Point in the Kaliningrad region, in the Baltic. A return to seaborne sabotage was likely given a further boost by the appointment of Igor Kostyukov, a seasoned navy admiral, to head the GRU in 2018, and Nikolai Patrushev, a long-standing ally of Putin and former head of the Security Council and the FSB, to chair Russia’s Maritime Collegium, the highest government agency coordinating maritime activities by the Russian state, in 2024.

Traditionally, Russian intelligence has suffered from poor coordination between separate agencies. But because sea operations are based on joint military-intelligence operations, they appear to have largely escaped this problem. Since Soviet times, Moscow’s different intelligence services, including the military intelligence and the FSB, have cooperated closely at sea. Moreover, the presence of official military boats, as the surveillance ship observed near the UK this fall, alongside shadow fleet ships, suggests the extent to which shadow tankers may be coordinating with the military and intelligence apparatus. Over the past six months, Russian warships have also been observed escorting shadow fleet vessels in the Baltic Sea and even the English Channel.

The final element in this return to sea-based hybrid warfare has been Russia’s rapidly growing drone program. These drones don’t need to be accurate, technologically advanced, or armed to achieve their purpose—the very sightings of drones disrupted the activities of airports for hours, if not days. At the same time, the large-scale and bloody battlefield in Ukraine provides excellent conditions to train substantial numbers of drone operators hardened by real combat.

Already, the results of Russia’s campaign have been significant. With a small number of drones, Moscow has disrupted civil aviation in multiple European countries, bringing the threat much closer to the European public. It can also disrupt important military installations by flyovers or surveillance, as the November incident at the Netherlands’ Volkel Air Base shows. To counter this tactic, Western governments have little choice but to intensify counterintelligence and counter-sabotage efforts and increase stop-and-search operations in the Baltic and the North Sea as well as investing big time in protection of airports and other national infrastructure.

Some encouraging steps are now in play. As Reuters has reported, following the November incursion near Brussels Airport, Belgian authorities requested assistance from British, French, and German anti-drone teams, including some 20 British Royal Air Force specialists with expertise in signal jamming. On November 20, European officials also discussed new measures that could be taken against shadow fleet vessels, including enhanced authority to board vessels as well as new forms of sanctions.

But these mysterious boats navigating close to European shores are no longer simply a means for Russia to sell oil to sustain its military-industrial base. They are also a military and intelligence threat in their own right. To truly address the threat, Europeans must recognize that the fleet is already destabilizing their countries and someday might serve to support and even provide a launch point for offensive operations in Europe.

 

 

For updates click hompage here