Russia’s oil tankers double as spy platforms in Europe Intel sources tell CNN

Russian personnel with ties to the country’s military and security services have been covertly operating aboard oil tankers sailing in European waters, using Russia’s so-called “shadow fleet” as a platform for espionage and potentially sabotage, according to an in-depth investigation by CNN citing Western and Ukrainian intelligence sources.

Since Russia’s full-scale invasion of Ukraine in 2022, Moscow has assembled a shadow fleet of hundreds of tankers to bypass Western sanctions and continue exporting oil from Baltic and Black Sea ports, generating hundreds of millions of dollars annually for the Kremlin.

Intelligence officials told CNN that, in recent months, some of these vessels have quietly taken on additional Russian crew members shortly before departure, despite being otherwise staffed almost entirely by non-Russian sailors.

According to Ukrainian intelligence documents reviewed by CNN, crew lists for several tankers show one or two Russian nationals added at the bottom of rosters dominated by Chinese, Southeast Asian and South Asian crews. These individuals, often listed as “technicians,” hold Russian passports and are believed to have backgrounds in security or military services.

Western and Ukrainian intelligence sources told CNN that several of these men are linked to Moran Security Group, a private Russian firm with deep ties to military and intelligence structures and past connections to the Wagner private military company. Moran was sanctioned by the US Treasury in 2024 for providing armed security services to Russian state-owned enterprises. Intelligence officials say Moran personnel are frequently the only Russians aboard shadow fleet vessels and are tasked with monitoring foreign captains and ensuring compliance with Kremlin interests.

The Boracay oil tanker off the coast of the western French port of Saint-Nazaire, France, October 2, 2025. Stephane Mahe/Reuters

European security agencies have grown increasingly alarmed. One Western intelligence source told CNN that Moran personnel had, on at least one occasion, photographed European military installations from aboard a tanker. Intelligence sources also said these operatives have been involved in sabotage activities, though no details were provided.

CNN closely examined the case of the Boracay, a sanctioned tanker that has repeatedly changed its name and registration. Two Russian men boarded the vessel in September at the port of Primorsk near St. Petersburg. Satellite imagery and shipping data confirmed the timing. Ukrainian intelligence identified one of the men as a former Russian police officer with ties to Wagner.

The Boracay passed near Denmark in late September, coinciding with unexplained drone sightings near Copenhagen airport and Danish military bases. While no direct link has been proven, a Western intelligence source described the overlap as “suspicious.”

Days later, French authorities boarded the vessel off Brittany for failing to provide valid registration documents, discovering the two Russians among the crew. No drones were found, but the ship’s Chinese captain was arrested for disobeying instructions.

Danish sea pilots and Swedish authorities told CNN they have repeatedly observed Russian men aboard shadow fleet ships behaving as de facto commanders, sometimes wearing military-style uniforms and photographing sensitive infrastructure. Intelligence officials warn that the use of private armed operatives on civilian tankers represents a form of hybrid warfare, exploiting plausible deniability while operating just below the threshold of open conflict.

As Europe weighs how to respond, CNN reports that officials face a growing dilemma: how to confront the expanding shadow fleet without triggering direct escalation with Moscow.

By Tamilla Hasanova