The shadow fleet’s evolving threat.
With its 17th round of sanctions on Russia, the EU has cast a spotlight on Moscow’s “shadow fleet” — a network of aging oil tankers transporting oil in circumvention of the G7 price cap and, as recent events suggest, serving as a vector for hybrid conflict and sabotage. Apparent sabotage actions by shadow fleet vessels in the Baltic and North Seas have escalated concerns, revealing how these operations could significantly impact European security and economic stability.
There is no comprehensive or universally accepted definition of the shadow fleet, complicating both enforcement and risk assessments. The EU lists 342 vessels (264 tankers); the U.S. lists 470 (143 tankers); the UK has sanctioned 73. This ambiguity allows actors to operate in a grey zone between legality and strategic subversion — and makes it nearly impossible to hold operators accountable when sabotage or surveillance is suspected.
The Eventin case.
The Panama-flagged Eventin, secured by German authorities in January 2025 after temporarily losing maneuverability, was carrying Russian crude oil and is believed to be a member of Moscow’s shadow fleet. Sayari maritime records identify its registered owner, Laliya Shipping Corp, located in the United Arab Emirates. Its only disclosed address is in care of the Eventin’s commercial manager, Vaigai Lines, registered in Ajeltake, Marshall Islands — an address Sayari previously linked to multiple shadow fleet vessel registered owners.
At least nine Marshall Islands-registered companies list addresses in care of Koban Shipping LLC. Of these, at least five served as commercial managers for Panama-flagged vessels, including Eventin. These vessels previously shared an ISM manager — Wanta Shipping LLC-FZ — located in the same office tower in Dubai as Koban. Wanta has served as ISM manager for at least 22 vessels, all crude oil tankers, at least three confirmed shadow fleet participants. Koban Shipping is itself an alias of UAE-registered Marshall Shipping LLC, whose beneficial owners include Russian national Ekaterina Rakhbarmadani — also a 49% shareholder in Petrochemix General Trading LLC, a UAE-based company with a documented history of trading oil on behalf of Iran in evasion of sanctions.
The Eagle S and Black Pearl network.
In December 2024, Finnish authorities seized the Eagle S, a Cook Islands-flagged crude oil tanker sailing from St. Petersburg to Port Said, on suspicion it had damaged the Estlink2 undersea cable between Finland and Estonia. The ship’s registered owner — UAE-based Caravella LLC FZ — shares its address at the Meydan Hotel in Dubai with about a dozen companies, including Conrad Management Company LLC FZ and Black Pearl Energy Trading LLC. Both were sanctioned by OFAC in January 2025 for enabling Russia’s war effort.
These companies are linked to Latvian national Aleksejs Halavins, described by OFAC as a “prolific buyer of above-price cap Russian oil since 2023” and connected to Russian national Mikhail Silantiev, former head of OFAC-sanctioned Promsyrioimport. Halavins’s Cyprus-registered Sparta Shipmanagement shares an address with Lagosmarine Ltd., which OFAC sanctioned in January 2025 for serving as technical manager of a Russian shadow fleet vessel. Sayari trade data shows Black Pearl received at least 30 shipments of Russian crude from sanctioned PJSC Surgutneftegaz between September and December 2023, then shipped Russian-sourced crude to at least four buyers — three in India — throughout 2024.
Five operational risk indicators.
The complex networks uncovered in this assessment reveal recurring patterns that can serve as early warning indicators for stakeholders in maritime logistics, insurance, energy, and infrastructure security:
- Shared physical or corporate addresses across multiple vessel managers, especially in secrecy jurisdictions like the UAE, Marshall Islands, Cyprus, or Panama.
- Rapid turnover of commercial managers or ISM managers, particularly when linked to previously sanctioned entities.
- Inconsistent vessel histories — gaps in AIS data, sudden flag changes, or long periods of registry under flags of convenience.
- Recurrent links to sanctioned entities such as SUN Ship Management, Petrochemix, or Black Pearl Energy Trading.
- Use of intermediary companies to receive or ship Russian crude, especially in jurisdictions with weak transparency standards.
Flagging these indicators during compliance reviews, due diligence, or port inspections can help organizations avoid entanglement in state-enabled hybrid operations and reduce both reputational and operational exposure.
The Sayari Graph platform links maritime, trade, and corporate data to reveal operational overlaps, entity relationships, and commercial patterns. Bright Bird’s geopolitical and behavioral analysis interprets these connections through the lens of intent, state strategy, and hybrid threat modeling. Together, this fusion enables identification not just of vessels and their owners, but of the patterns of behavior, ownership obfuscation, and risk indicators that define shadow fleet operations — moving from raw data to action-oriented intelligence.