A personal Russian with ties to the army and security services in Russia spied in European waters while working undercover aboard ships carrying Russian oil, Western and Ukrainian intelligence sources claim.
Since the invasion of Ukraine in 2022, Moscow has created a so-called phantom fleet, consisting of hundreds of oil tankers. These ships transport Russian oil from its ports on the Baltic Sea and the Black Sea, despite Western sanctions, bringing hundreds of millions of dollars to the Kremlin each year.
In recent months, some of these ships - often registered in other countries - have received new crew members shortly before departing from port, according to Ukrainian intelligence services.
The addition of experienced Russians in security to the crews of the phantom fleet is causing concern in European capitals and illustrates how bold the Kremlin's tactics have become, reports CNN.
The only Russians on board pose strategic targets
Sources from intelligence services have stated that many of these men are employed by a Russian company, Moran Security. Some of them are mercenaries who have previously worked for Russia's private military contractors, such as the Wagner Group.
Moran is a private security firm with connections to the Russian army and intelligence services, according to Western intelligence sources. The company was sanctioned by the US Treasury in 2024 for providing "military security services" to Russian state companies.
Moran employees have been placed on several tankers in Russia's phantom fleet and are often the only Russians on board, according to Ukrainian and Western intelligence sources.
The Ukrainians noticed the introduction of these Russians on board the phantom fleet about six months ago.
A source from Western intelligence services said that Moran personnel took photographs of European military installations from one of Russia's phantom fleet ships.
The Russians on board also have the task of supervising the ship captains, as most of them are not Russian citizens, said Oleksandr Stakhnevich from Ukraine's Foreign Intelligence Service.
Security officials say that placing armed individuals with military experience on these ships is another tool in the Kremlin's arsenal of hybrid warfare techniques designed to cause trouble in Europe. Intelligence sources also told CNN that these individuals have engaged in acts of sabotage, but did not provide further details.
"Anyone with even a slight idea knows that these guys receive orders from the Russian state, but it's hard to prove," said Jacob Kaarsbo, a former Danish intelligence official, to CNN.
Perfect cover for spies
One of the ships where Russian spies were deployed is the tanker Boracay, which has changed its name and has been officially registered frequently in the last three years.
On September 20, two Russian men boarded in the port of Primorsk on the Baltic Sea, near St. Petersburg, according to records obtained by CNN. Satellite images and ship tracking data showed the vessel in port on that date.
The men were not sailors but appeared on the crew list as technicians. They were the only Russians on board the ship, which otherwise had citizens from China, Myanmar, and Bangladesh, according to the list.
Ukrainian foreign intelligence services identified the two men, and CNN confirmed their names with Western sources. One of them is a former police officer who previously worked for the Russian private military company Wagner, according to a Western intelligence source. Neither has a visible online profile, and their activities aboard the Boracay ship are unclear.
During another trip by Boracay in July, a man who had served in the special police regiment of the Russian Ministry of Internal Affairs was on board, and another had the Russian Ministry of Defense registered as his address, according to Ukrainian foreign intelligence services.
"Strange little men" have more power than the ship's captain
Many ships in the phantom fleet pass through the Baltic Sea, a key maritime chokepoint bordering several NATO states, including Denmark and Sweden, whose authorities pay special attention to ships.
Danish maritime pilots, who board tankers to help them navigate through straits, say there are often Russian men on board who appear very responsible and are hostile to inspectors.
"I personally have seen at least two phantom fleet ships whose crews are mostly non-Russians, but suddenly you see one or two Russians on the list," said Bjarne Caesar Skinnerup, one of the most experienced officers at Denmark's state pilotage service, DanPilot, to CNN.
Sometimes they wear Russian Navy camouflage uniforms. "On board, it seems like they run the ship - they have more power even than the captain," Skinnerup told CNN.
In July, DanPilot sent an email to the Danish emergency management authority, stating: "There are increasing reports of ships having a few additional crew members, probably Russians, wearing military uniforms and being very active in photography, among other things, of bridge areas."
A spokesperson for the Swedish coast guard said they had previously seen men on board shadow fleet ships who did not appear to belong to a commercial vessel. And a senior commander of the Swedish navy, Ewa Skoog Haslum, said last year that some Russia-linked tankers in the Baltic Sea had "antennas and masts that usually don't belong" to commercial ships.
Suspicious coincidence in Denmark
The Boracay ship stood out in September while carrying a load of Russian oil to India. Two days after leaving Primorsk on September 22, the ship was off the coast of Denmark just as several drones disrupted traffic at Copenhagen Airport. Other drones flew near Danish military bases.
At that time, the Copenhagen police said they were investigating whether ships in the area had launched the drones but did not want to name which ones.
"The coincidence between the incident and the presence of the ship in the area can be considered suspicious," said a source from Western intelligence services.
A few days after these incidents, the French military boarded the Boracay ship off the coast of Brittany, in northwestern France, but no drones were found on board. However, it was only then that the two Russians were discovered to be part of the crew. They were privately interrogated, according to sources.
"Our working assumption is that Russian ships have been involved in at least some of the unexplained drone incidents near European coasts," said a European intelligence official.
Ukrainian intelligence sources have provided CNN with the names of eight Russian men who were on board other ships in the phantom fleet and sailed on a similar route around Europe in the past year. Some had ties to the Russian army.
Links to Wagner
The Moran Security Group was founded in 2009 and had extensive ties to the Russian mercenary group Wagner, as well as Moscow's military and intelligence services, according to Western intelligence sources.
Two former Moran directors, Evgeny Sidorov and Vadim Gusev, founded the Slavic Corps in 2013, the private military company from which Wagner emerged. Wagner's Telegram channels featured Moran personnel aboard ships, and over a decade ago, the company was involved in combating piracy off the coast of Somalia.
Social media profiles of some Moran staff members also showed connections to the Wagner Group, a mercenary organization that was disbanded after its former leader, Yevgeny Prigozhin, launched a failed revolt in Russia in 2023.
On its website, Moran group says it is looking for "active or retired officers who have served in special forces units (GRU, airborne troops, naval commandos) and have completed at least two deployments." GRU is Russia's military intelligence service.
President Moran, Viaceslav Kalashnikov, is a retired lieutenant colonel from the Russian FSB intelligence service, while two of the managers listed on his website are former nuclear submarine commanders.
The group promotes a wide range of services: international logistics, maritime and land physical security, as well as intelligence operations. Like Wagner, Moran's personnel has been involved in Syria supporting the deposed Assad regime, according to Ukrainian intelligence services.
Moran Security is now registered in both Moscow and Belize, and the group seems to have a new and growing mission. Belize is a jurisdiction for setting up ghost companies that mask the true beneficiaries of a business.
A delicate dilemma for Europeans
As Russia's shadow fleet appears to expand in scope and ambition, Europe faces a delicate dilemma.
Danish maritime pilot Skinnerup believes there should be a tougher common international action to intercept vessels without proper insurance and registration, as is the case with many shadow vessels.
"Do we dare to do this? Then what would be Russia's reaction?" he asked. "That's why the Danish government hasn't done anything yet, because we are an extremely small country and if we have to do something, it has to be a common European issue," he added.
T.D.