The danger looms in the shadows: NATO vs. the shadow fleet

The Baltic Sea is no longer just a quiet corner of Europe. With a rising activity of the so-called „shadow fleet,” the region is transforming into an emerging security flashpoint, generating economic, environmental, and even military risks. In parallel, transformation also occurs in the Allied threat perception, yet their responses remain uneven. Can NATO translate the growing threat awareness into a coherent and effective strategy? And if so, how?

The Russian shadow fleet?

The so-called „shadow fleet” refers to a network of vessels that operate outside of the formal maritime system, often to transport sanctioned cargo such as oil. Such vessels usually have opaque ownership structures, questionable insurance, frequent flag changes, and may conceal their movements by disabling tracking systems. Russia’s use of such vessels has expanded significantly since Western sanctions and price caps were imposed on Russian oil. As a result, the shadow fleet has become not only a tool of sanctions evasion, but also a growing maritime security, environmental, and geopolitical challenge.

Importantly, the shadow fleet should not be understood as an exclusively Russian phenomenon. Such vessels have long been used by states such as Iran, Venezuela, and North Korea to circumvent sanctions and maintain access to global markets. However, in recent years, Russia’s reliance on the shadow fleet has grown significantly, especially after the introduction of Western restrictions on Russian oil exports.

Therefore, while not every shadow vessel is Russian-owned or directly controlled by Moscow, an increasing share of this opaque maritime network is linked to Russian trade, Russian cargo, Russian-linked insurers, or Russian strategic interests.

Fueling Russia's war machine

The shadow fleet has, since the imposition of sanctions on Russian oil exports, become an economic lifeline for the Kremlin and an enabler for its War on Ukraine. According to CSIS, estimates of its scale range from 155 tankers (435 vessels including support ships) up to as many as 591 ships — together carrying 65% of Russia’s seaborne oil trade and generating an estimated $87 to $100 billion annually. Ships depart the oil export hubs of Primorsk and Ust-Luga, traversing the Baltic Sea, out to global energy markets. The vessels are often in poor condition, posing potential risks to the environment, and often lack both proper insurance and registration.

Revenue sourced from the shadow fleet is of critical importance for the Russian economy and war effort. Oil and gas revenue still underwrites Russia’s war — funding public spending, defence-industrial production, and military salaries. But its share of the federal budget has fallen to a two-decade low of roughly 23% in 2025, down from around a third a few years ago, as sanctions, low prices, and shadow-fleet enforcement squeeze the Kremlin’s energy take. The pressure, in other words, is already working, which is precisely the argument for sustaining it.

The EU sanctions imposed on ships attributed to the shadow fleet prohibit them from docking at port facilities belonging to member states, denying them maritime services. The strategy aims to constrain and disrupt the operations of the fleet in the EU and its territorial waters, imposing economic costs and weakening the Russian economy’s means to wage war.

Despite sanctions and significant cutbacks in Russian oil and gas imports, EU states continue to import substantial volumes of Russian energy. According to the latest data from the Centre for Research on Energy and Clean Air, in February 2026, Russia’s fossil fuel export revenues increased by approximately 7% month-on-month, reaching an average of 492 million euros per day. This growth was driven largely by higher revenues from seaborne crude oil exports, while export volumes rose only marginally.

At the same time, around 6.9 million tonnes of Russian crude reportedly remained at sea without a known buyer, underlining Moscow’s continued ability to sustain energy exports despite existing restrictions. The June 2026 Iran-Israel war and the temporary closure of the Strait of Hormuz further sent shock waves through the market, driving up purchases of Russian natural gas.

Militarisation of the shadow fleet

Alarmingly, the shadow fleet vessels also undergo an increasing militarisation. For example, in January 2026 a Russian Navy destroyer escorted the sanctioned cargo vessels SPARTA IV and MYS ZHELANIYA — Ministry-of-Defence logistics ships carrying military equipment to Syria and Libya — through European waters, pointing towards a more assertive use of military assets to shield sanctioned Russian shipping.

An investigation conducted by OCCRP indicated that tankers transporting Russian oil routinely sail with extra crew with military-related backgrounds on board. Investigators analysed crew lists from sanctioned tankers across 20 journeys and found that out of 17 men aboard these ships, lacking maritime credentials, 13 were linked to the Wagner Group or military intelligence, like GRU.

The increased militarisation of the shadow fleet is aimed at both protecting the vulnerable vessels and deterring NATO allies from seizing them. For example, even traditionally Russia-hawkish allies like Estonia are becoming increasingly wary of seizing Russian-linked shadow fleet tankers due to the growing militarisation of the Baltic Sea, particularly in the Gulf of Finland.

Apart from reinforcing the economic dimension and deterrence, the vessels can also engage in intelligence gathering, especially with military-related crew members and sensor equipment on board. This dimension is closely associated with Russia’s Main Directorate of Deep-Sea Research, known by its Russian acronym GUGI — a shadowy military body subordinate to the Russian Navy responsible for underwater research, submarine operations, and the mapping of critical seabed infrastructure.

Many NATO countries fear not only the potential for military escalation but also the economic and environmental consequences of destroying shadow fleet vessels. One could therefore argue that we are dealing with a dual deterrence effect — one pillar rooted in environmental concerns, the other in military considerations.

The Nordic-Baltic Eight+ front vs. the shadow fleet

Despite this dual deterrence dynamic, allied attitudes toward shadow fleet vessels are shifting, with a generally more proactive approach emerging, particularly among the Nordic-Baltic Eight (NB8) states and Poland — the Nordic-Baltic Eight+ (NB8+).

Finland has adopted a pragmatic, yet restrained method of dealing with Russian-linked vessels, not seeking to escalate while enforcing suspected acts of sabotage and subterfuge. Notably, the Eagle S ship was boarded by the Finnish coast guard in December 2024, after a suspected cable sabotage in its territorial waters.

On the other hand, the growing militarisation of the Baltic Sea has made Estonia increasingly cautious about direct action against Russian-linked shadow fleet vessels. This decision has roots in Estonia’s failed attempt in May 2025 to stop an unflagged Russia-bound tanker that was met by a Russian fighter jet entering NATO airspace.

Since then, Russia has reportedly increased its naval presence along key tanker routes, including permanent patrols by armed vessels. As a consequence, Estonia now appears more likely to intervene only in cases of immediate danger, such as damage to undersea infrastructure or a major oil spill, rather than routinely detaining suspected sanctions-evading tankers.

In comparison, Sweden has taken a forward-leaning posture and one unprecedented on a national level. The Swedish Navy’s operational doctrines have extended its scope of protection to cover the shipping of Baltic allies with the goal of reinforcing Baltic allies by ensuring operational control of the sea. This is evidenced by the Swedish Coast Guard’s (Kustbevakningen) recent seizures of shadow fleet vessels, found to be improperly registered and in poor condition.

Poland’s approach reflects a growing recognition that the shadow fleet is not only a sanctions-evasion problem, but also a direct threat to national energy security and critical infrastructure. In May 2025, Poland averted the shadow fleet’s damage to the power cable owned by the Polish Power Grids connecting Poland and Sweden. Prime Minister Donald Tusk recognised that these vessels pose a real threat to Polish national security, pointing out that they primarily belong to Russia, albeit under various flags.

Denmark occupies a particularly exposed position, as its straits remain one of the main transit routes for Russian-linked shadow fleet vessels moving in and out of the Baltic Sea. According to Danish Maritime Authority data, 292 voyages by EU-sanctioned shadow fleet tankers were recorded in Danish waters in 2025 alone, making Denmark an especially vulnerable and valuable area.

In October 2025, Denmark was subjected to drone incursions linked to Russian shadow fleet tankers. The event caused major disruptions in Danish air traffic, subsequently putting national and allied air defence systems on high alert.

Notwithstanding, despite the apparent security threat, Denmark has been reluctant to seize shadow fleet vessels. This is partly due to concerns over potential repercussions for Maersk — a major Danish shipping company — highlighting how the economic interests of major private-sector actors can at times limit political action.

Despite these divergences, the NB8+ countries remain well-positioned to tackle the shadow fleet. Their geographic exposure, dependence on open sea lanes, and direct experience with Russian grey-zone activity give them a clear operational and strategic stake in the issue. The key challenge is therefore to turn national approaches into a coordinated regional framework.

What about the Western allies?

While the Nordic-Baltic countries and Poland share a coherent threat perception, the policies of other allied nations — France, the UK, Belgium, and Germany — are also shifting toward greater proactiveness, though they pursue countermeasures to varying degrees.

France has recently shown increased assertiveness toward the shadow fleet by seizing the tanker Deyna — a Mozambique-flagged vessel that had sailed from Murmansk — in a Western Mediterranean operation in March 2026.

The UK oscillates in ambiguity. On the one hand, by January 2026, the UK government had requested proof of insurance from more than 600 suspected shadow vessels. Reportedly, the government faced doubts over legal concerns and high costs associated with maintaining the seized vessels at ports.

However, on 14 June 2026, the UK shifted decisively from document checks to physical enforcement, with Royal Marine Commandos — supported by the Royal Navy, the RAF, and the National Crime Agency — fast-roping onto the sanctioned, Cameroon-flagged tanker Smyrtos in the English Channel in the first such boarding ever conducted by British armed forces.

Germany, despite its traditionally cautious approach to foreign policy, has moved up on the proactiveness spectrum too. In July, Berlin announced additional measures requiring tankers passing through German waters to provide proof of oil pollution insurance, explicitly framing the effort as a response to Russia’s shadow fleet and the environmental risks it poses in the Baltic and North Seas. The approach bore fruit in January 2026, when Germany forced the Russian-linked tanker Arcusat to turn away from its Baltic waters.

Fear of potential repercussions, including military, economic, and environmental, seems to be hampering European actions of enforcement against the shadow fleet. But it is important to remember that the Western European states still possess significant conventional forces and resources compared to their Nordic and Baltic counterparts. Moreover, as seen in the recent examples, they too move toward increasingly proactive measures against the shadow fleet, despite risks and costs. Because of that, coordination against the shadow fleet should take a holistic approach to advancing operational responses in coordination with all NATO allies. It is not only necessary, but also warranted given the recent rise in active countermeasures of many allies against the suspected vessels.

Obstacles, obstacles, obstacles

A closer examination of allied threat perceptions reveals that detaining suspicious vessels is considerably more politically, legally, and operationally complicated than it first seems. First, seizing a suspicious vessel is one thing — maintaining it in port is another matter entirely, and the considerable costs involved actively discourage allies from detaining the vessels.

The environmental dimension adds a further layer of risk: given that a significant proportion of shadow fleet vessels are in poor technical condition and carry hazardous cargo such as crude oil, a failed or poorly executed operation could trigger an ecological disaster in one of Europe’s most strategically sensitive bodies of water.

Then there is the risk of escalation. Moscow has already demonstrated its willingness to weaponise the narrative surrounding detentions, branding countries that move against these ships as aggressors, labelling such activities as an act of piracy, while stepping up its vessel militarisation efforts.

Ultimately, countering the shadow fleet is not simply a military challenge but a political one as well. NATO allies must balance deterrence, legal uncertainty, environmental risks, and the danger of escalation, all while reinforcing allied cohesion in the Baltic Sea region.

So, what should the allied states do to become more effective in tackling the shadow fleet in practical terms, despite the risks presented?

Gear up your military

Stopping the shadow fleet entirely may be an unrealistic ambition — the legal grey zones it operates in are, by design, difficult to navigate. But that is no excuse for inaction. NATO members are in possession of tools to curb the shadow fleet menace more effectively.

First, no effective action against the shadow fleet will be possible without appropriate military equipment. Poland, for example, has initiated procurement of drones and monitoring equipment in response to recent incidents, while increased intelligence sharing and AIS monitoring — that is, flagging vessels that disappear from the system — are gaining traction across the region.

On the NATO-wide level, the Alliance operates the Baltic Sentry’s undersea infrastructure centre and the JEF-launched Nordic Warden system, an AI-powered tool integrating AIS data with additional sources to detect and alert on suspicious vessels, both of which enhance identification and attribution.

Additionally, to increase operational effectiveness in the event of a real crisis, NATO could conduct joint exercises simulating hybrid maritime incidents involving the shadow fleet, including sabotage of critical infrastructure, coordinated vessel interdictions, and rapid intelligence-sharing between allied navies and civilian authorities, for example, during BALTOPS.

Closing the political and legal gaps

While essential, equipment and monitoring systems alone will not stop the shadow fleet. The most significant gaps are not technological, but political, legal, and operational. NATO still lacks a clear definition of what constitutes a „shadow fleet threat,” as well as agreed red lines for responding to hybrid maritime activity. Nor does a dedicated coordinating body exist with the authority to act on intelligence generated by initiatives such as Nordic Warden or Baltic Sentry.

The UK-led framework of the Joint Expeditionary Force (JEF) offers significant potential for the construction of political and operational frameworks. JEF extends beyond the NB8+ and encompasses the armed forces of the UK and the Netherlands, providing a substantial platform for allied coordination in the North Atlantic. Furthermore, the capacities of JEF have the potential to extend enforcement operations to the Arctic region, providing a platform for responses to suspected sabotage and sanctions violations.

The question remains whether NATO currently needs a fully-fledged coordinating body. In the long term, such a mechanism could significantly improve operational coordination, intelligence-sharing, and decision-making across the Alliance, particularly in responding rapidly to hybrid incidents at sea.

In the short term, however, enhancing practical cooperation among countries, especially the NB8+ ones, appears more politically feasible than creating new institutional structures. Such cooperation can be enhanced through the general increased institutionalisation within NATO, joint exercises, and intelligence sharing.

In addition to enhanced multilateral frameworks, bilateral formats should also support efforts against the shadow fleet. A direct cooperation between the most exposed states, sharing similar threat perception, such as Poland and Sweden, Finland and Estonia, or Denmark and Sweden, can enable faster information-sharing, joint monitoring, and coordinated responses to suspected sabotage or sanctions evasion.

Furthermore, the allied countries should also increase the public-private cooperation, given that the private actors play an increasingly important role in the Baltic Sea region, for example, undersea infrastructure operators and data providers. To facilitate this, governments should establish coordinating bodies and information-sharing channels between agencies and the enterprises that manage critical infrastructure.

Legal frameworks also remain fragmented. A vessel denied entry at one port can simply dock at another, while boarding rights in international waters continue to occupy a legal grey zone few allies are willing to test. At the same time, the insurance and shipping industries — which hold considerable leverage through vessel registration, certification, and servicing — remain largely outside coordinated Western efforts.

Here, the recent Caffa case offers a concrete template for closing some of these legal gaps. The Swedish Coast Guard detained the dry-cargo vessel Caffa — sailing under a fraudulent Guinean flag with a mostly Russian crew — on 6 March 2026; Ukraine submitted a mutual legal-assistance request days later; and on 4 June 2026 the District Court in Ystad ordered its confiscation and potential transfer to Ukraine, acting on the Ukrainian prosecutors« request as part of an investigation into the removal of grain from occupied territory. Ukraine called the move a game-changer, noting that such vessels had previously faced only inspections or brief detentions, and urged that the practice be scaled up at EU and G7 level.

The precedent’s value lies in its mechanism: an initial detention on maritime-safety and false-flag grounds, followed by a mutual legal-assistance request, court-ordered confiscation, and ultimately transfer through the courts. This sequence generates an enforceable judicial action and demonstrates that the legal tools to act against shadow-fleet vessels are in place. The only caveat worth noting is that Caffa turned on a stolen-cargo war-crimes hook rather than sanctions evasion alone — and that it is a dry-cargo vessel rather than an oil tanker — so its extension to tankers remains to be tested.

Indo-Pacific knowledge transfer

Shadow fleet’s significance lies beyond the Baltic region itself. In that vein, NATO members should also deepen cooperation with partners in the Indo-Pacific, particularly countries in the South China Sea region that face similar forms of maritime coercion and hybrid pressure. States such as Taiwan, the Philippines, and South Korea have long dealt with grey-zone tactics involving civilian and quasi-civilian vessels, maritime intimidation, and attempts to challenge freedom of navigation while remaining below the threshold of open conflict.

For Baltic Sea allies, this creates an opportunity not only for political dialogue but also for practical knowledge transfer in areas such as maritime domain awareness, coast guard coordination, civilian-military cooperation, and responses to hybrid maritime activity.

In doing so, NATO could establish dedicated platforms for knowledge exchange or further integrate Indo-Pacific partners into existing structures, such as NATO Centres of Excellence, to facilitate the sharing of operational experience and best practices in countering hybrid maritime threats.

As the Baltic and Indo-Pacific theatres become increasingly connected through broader geopolitical competition, closer cooperation between like-minded partners could strengthen resilience against maritime coercion across both regions.

Ambiguity does not excuse inaction

It is a strategic imperative that NATO allies take resolute action against the shadow fleet and Russian vessels that violate international law, circumvent sanctions, threaten ecosystems, and engage in malign activities. The ability to counter suspicious vessels signals credible deterrence against one of the foremost instruments of Russian greyzone aggression.

The cumulative actions of the shadow fleet consistently test allied resolve and response mechanisms. The shadow fleet has been attributed to the severance of data cables, jamming of GPS signals, and intelligence reconnaissance. The greyzone aggression may fall beneath the threshold of an armed attack; however, the costs of inaction risk signalling weakness and thus NATO’s inability to credibly defend its territory.

The economic dimension cannot be overstated, as it is crucial for the Russian economy and its war in Ukraine. In its attempts to circumvent sanctions, the Kremlin has become reliant on the shadow fleet for its seaborne energy exports. NATO’s crackdown on shadow fleet vessels would disrupt one of the primary enablers of the Kremlin’s war and military build-up.

The countermeasures against the shadow fleet should be coordinated within the operational frameworks of NATO, with respect to international and national law. A multinational front of enforcement, backed by a strong political mandate, would signal unified resolve against Moscow’s acts of aggression.

Recent examples of NATO countries, like Sweden, seizing shadow fleet vessels demonstrate that, despite the ambiguous and attribution-challenging nature of shadow fleet activities, countermeasures are possible. The necessary tools — both legal and operational — exist, and uncertainty does not justify inaction.

The Baltic Sea is not a „NATO lake.” It is a sea in the fullest capacity with equivalent meaning for regional security, encompassing military, economic, and environmental significance. While the Baltic Sea has been an area of „relative peace” before Russia’s full-scale invasion of Ukraine, it is now one of the world’s hottest conflict flashpoints, especially given the increased militarisation of the shadow fleet.

While the nature of the threat is ambiguous, such ambiguity should never become an excuse for inaction. The tools exist; they just have to be used.

Authors: Isidore Brommare & Karolina Kisiel