Analysts study incidents involving Russia's shadow fleet and drones in Baltic Sea

Four undersea cables have been damaged in the Baltic Sea since the start of 2025, while dozens of incidents involving flights over European coastal infrastructure, including military facilities, have also been recorded.

Source: Centre for Transport Strategies, an independent Ukrainian information and consulting centre, citing the Armed Conflict Location and Event Data Project

Details: Russia's so-called shadow fleet of oil tankers is functioning as an active platform for hybrid warfare against European nations.

It enables sabotage of undersea infrastructure and drone surveillance over military and critical facilities in the Baltic and North Sea, the Centre says.

The Centre for Transport Strategies, using data from 2025 and 2026, viewed incidents involving cable damage, drone activity, vessel seizures and Russian countermeasures as part of a single coordinated campaign rather than isolated events.

It notes that four underwater cables have been damaged in the Baltic Sea since the beginning of 2025. This follows the rupture of the Estlink 2 cable between Estonia and Finland in December 2024, which Finnish authorities suspect was caused by the shadow fleet vessel Eagle S. Repairs to Estlink 2 took seven months.

Before that, the Balticconnector gas pipeline, the only non-Russian gas interconnection between Finland and Estonia, was damaged in 2023, with repairs taking six months.

Regarding drone activity, the project documented 54 suspicious incidents involving flights over European coastal infrastructure in 2025, including airports, naval bases and military facilities in Belgium, Denmark, Germany and Norway.

The only confirmed case of drones being launched from a vessel concerned a Russian military intelligence ship rather than a shadow fleet tanker.

Separately, Germany seized the vessel Scanlark in September 2025 after prosecutors alleged that it had launched a reconnaissance drone over a German Navy frigate at the naval base in Kiel. Surveillance equipment was also reportedly found on board.

The sanctioned tanker Pushpa was tracked off the coast of Denmark during a wave of drone-related incidents that forced the closure of several Danish airports before being seized by French naval forces.

Russia responded to tougher European law enforcement measures with military escorts, airspace violations and a systematic flag-changing campaign.

Nearly 70 vessels have been reflagged as Russian vessels since May 2025, with another 120 expected to follow.

Ukraine has documented 1,392 shadow fleet vessels, which transport up to 80% of Russia's seaborne crude oil exports and account for nearly one-fifth of all active oil tankers worldwide.

According to the analysts, the institutional frameworks created to tackle sanctions evasion are fundamentally ill-suited to addressing this security threat.

Background:

• Earlier, the Security Service of Ukraine uncovered a scheme used by Russia to bypass international sanctions and replenish its so-called shadow fleet.
• The Kyiv Independent reported that Russia's shadow fleet transporting sanctioned oil actively uses modern Western technologies, including the Starlink satellite system.
• Earlier, Financial Times identified 48 companies that jointly worked to conceal the origin of Russian oil, including exports handled by Rosneft.
• The shadow fleet of oil tankers expanded following a series of Western sanctions imposed on Russia due to its war against Ukraine.

Support Ukrainska Pravda on Patreon!