# Russia's Shadow Fleet, the Tankers Spying on NATO From the Sea

> According to a report from the International Institute for Strategic Studies, the IISS, based in London, drones have overflown sensitive installations across

- Author: Maxime Marquette
- Publisher: MadMax (https://mad-max.co)
- Section: Profile
- Published: 2026-07-07
- Canonical URL: https://mad-max.co/en/article/la-flotte-fantome-russe-ces-petroliers-qui-espionnent-l-otan-depuis-la-mer

## Introduction: when a civilian tanker becomes a military platform

### A report documenting 144 suspicious overflights

According to a **report** from the **International Institute for Strategic Studies**, the **IISS**, based in London, **drones** have overflown sensitive **installations** across **13 NATO countries** at least **144 times** between August 2024 and February 2026. Some of these overflights are reportedly linked to **vessels** belonging to Russia's **shadow oil fleet**, aging **tankers** that skirt **Western sanctions** on Russian oil by frequently changing **flag** and ownership.

The American military outlet **Stars and Stripes** documented, on July 2, 2026, several specific cases in which suspicious **vessels** allegedly served as launch platforms for **drones** observed near sensitive **bases**, including some housing NATO **nuclear weapons** in Europe. This finding deliberately blurs the line between maritime commerce and disguised military operation.

### What this profile sets out to draw

This piece profiles this **shadow fleet**, which several **Western** analysts now describe as a tool of **hybrid warfare** serving the **Kremlin**, drawing on available reports and the **vessels** specifically named by Western investigations.

What stands out in this file is the apparent ordinariness of these merchant vessels, which masks a far more troubling military function than their declared oil-shipping activity.

*Using civilian **tankers** as disguised military platforms is the perfect illustration of the **hybrid war** **Moscow** has been waging against the **West** from the shadows. You can no longer look at a Russian tanker without wondering what it's really carrying.*

## What Russia's shadow fleet actually is

### A fleet born to dodge oil sanctions

Russia's **shadow fleet** refers to several hundred tankers, often old and poorly maintained, bought or leased through shell companies to keep exporting **Russian oil** despite **Western sanctions** imposed since the 2022 invasion of **Ukraine**. These vessels frequently change **flag**, disable their maritime tracking systems, and often operate without **insurance** that meets international standards.

This fleet allows **Moscow** to keep oil revenues flowing that are essential to funding its war effort, while formally sidestepping the price-cap mechanisms put in place by the **G7** and the **European Union**.

### A military use layered on top of the commercial function

What the **IISS** **report** reveals is that some of these vessels no longer merely transport oil: they reportedly also serve as discreet platforms for launching or logistically supporting observation **drones**, exploiting their legal presence in international waters to approach sensitive **installations** without raising the suspicion normally reserved for declared military vessels.

This dual function, commercial and military, illustrates a central feature of **Russian hybrid warfare**: using civilian infrastructure for strategic ends, making any Western **response** legally and diplomatically more complex.

*This blend of commerce and military espionage is no technical accident. It's a deliberate strategy that exploits gaps in international maritime law to shield operations **Moscow** could never publicly own up to.*

## The vessels specifically named by Western investigations

### Arctica, Boracay and Zhigulevsk under surveillance

Several **Western** reports, including the one relayed by **Stars and Stripes**, specifically name vessels such as the **Arctica**, the **Boracay** and the **Zhigulevsk** among the ships suspected of taking part in **surveillance** operations near **NATO** **installations**. These vessels, registered under flags of convenience, match the typical profile of the **shadow fleet** documented for years by researchers specializing in maritime **sanctions**.

The fact that these vessels are named individually, rather than mentioned generically, strengthens the report's credibility and allows **Western** **intelligence** services to track their movements more precisely in the months ahead.

### Trajectories that coincide with drone overflights

Western investigators have established temporal correlations between the presence of these vessels in certain maritime zones and the observation of unidentified **drones** near sensitive **bases** on land, without, however, being able to establish absolute causal certainty for each incident taken individually.

This methodological limit does not invalidate the overall finding: the repetition of these coincidences, over several months and several countries, far exceeds what chance could credibly explain.

*I remain cautious about each individual case, but the repetition of these coincidences across so many months and so many countries is no longer statistical chance. At some point, coincidence becomes a pattern.*

## The targeted bases, from the United Kingdom to France

### RAF Lakenheath, Volkel and Île Longue in the crosshairs

Among the sites mentioned in Western reports are the British base at **RAF Lakenheath**, the Dutch base at **Volkel**, and the French naval installation at **Île Longue**, which houses part of France's nuclear **deterrence** force. These three sites share one thing in common: their top-tier **strategic** sensitivity for **Western defense**.

The choice of these targets, should the links to the **shadow fleet** be further confirmed, would suggest a deliberate intent to map the defenses and operational routines of the most critical installations of Western **deterrence**, rather than random interest in arbitrary military sites.

### Psychological pressure as much as technical

Beyond gathering technical **intelligence**, these repeated overflights also serve a psychological purpose: demonstrating to **NATO** that its most sensitive installations are never entirely shielded from outside observation, even outside any context of open conflict with **Russia**.

This psychological dimension fits within the broader **hybrid warfare** **doctrine** the **Kremlin** has applied across Europe for years, seeking to maintain a climate of permanent uncertainty without ever crossing the threshold of an openly acknowledged act of war.

*Overflying the base that houses part of France's nuclear **deterrence** is not a trivial act. It's a message, silent but perfectly calculated, sent directly to Western military command.*

## Thirteen NATO countries affected by these incursions

### A geography spanning the Alliance's entire northern and western flank

The **144 incidents** documented by the **IISS** span thirteen **NATO** member states, a geographic spread suggesting a coordinated operation rather than a series of isolated, unrelated **incidents**. This wide distribution also complicates the **coordination** of a unified Western **response**, with each affected country initially handling the incident according to its own national procedures.

This fragmentation of the initial **response** illustrates a structural vulnerability of **NATO** against this type of diffuse hybrid **threat**: unlike a conventional military attack, these drone incursions do not automatically trigger a collective defense mechanism under Article 5.

### The challenge of a collective response still being built

Several European defense officials have called for better **coordination** of information-sharing between member states regarding these drone **incidents**, in order to build a fuller, faster picture of the **threat**, rather than treating each incursion as an isolated event unconnected to the others.

This **coordination** remains, to this day, largely a work in progress, leaving **Russia** tactical room to maneuver until **NATO** harmonizes its **detection** and response doctrine against unidentified drones.

*Thirteen countries affected is proof we're no longer talking about isolated **incidents** but a structured campaign. **NATO** must stop treating every overflight as a local anecdote and build a collective response worthy of the name.*

## What Moscow's relative silence reveals

### No claim, but no clear denial either

**Russia** has neither claimed nor formally denied using its oil fleet for military observation purposes near **NATO** installations. This calculated silence lets Moscow preserve a valuable **strategic** ambiguity: no confirmation that would justify a firm Alliance response, and no denial that would publicly commit it on ground it prefers to keep vague.

This deliberate ambiguity is a central feature of modern **hybrid warfare** operations, where the ability to plausibly deny remains as valuable as the operation itself.

### A well-honed strategy of plausible deniability

The **Kremlin** has, in the past, applied this same logic of plausible deniability to other sensitive files, from cyberattacks attributed to officially non-governmental groups to sabotage operations in Europe attributed to Russian military **intelligence** units.

This methodological continuity reinforces the credibility of Western suspicions, even absent a direct admission from Russian authorities regarding the military use of these civilian tankers.

*Russian silence on this file is not innocence. It's a method, applied with the same calculated coldness found in every other **hybrid warfare** file attributed to the **Kremlin** over the years.*

## The technical limits of certain attribution

### What Western reports cannot yet prove

It must be acknowledged honestly: attributing every drone overflight with absolute certainty to a specific shadow-fleet vessel remains, to this day, technically difficult. Maritime tracking systems, often disabled by these vessels precisely to evade **surveillance**, complicate formal, incontestable **attribution** for each incident taken in isolation.

This technical limitation does not, however, erase the value of the overall finding established by the **IISS**: the statistical correlation between the presence of these vessels and drone observations, repeated over more than eighteen months and thirteen countries, far exceeds what a purely coincidental explanation could justify.

### Why methodological caution remains necessary

This piece chooses to present these elements as **converging indicators** rather than definitive, individual proof for each incident, in order to preserve factual rigor on a file where the temptation of excessive certainty would be counterproductive to the credibility of the overall finding.

This rigor in no way diminishes the gravity of what these reports reveal about **Russia's** likely intentions toward **NATO's** critical infrastructure.

*I would rather clearly name the limits of what we know than give in to a certainty the current evidence cannot yet fully establish. Rigor protects the credibility of a finding; it does not weaken it.*

## The still-timid Western response to this threat

### Scattered national measures

Several European countries have independently strengthened their drone **detection** capabilities near sensitive sites, without a common **NATO** **doctrine** yet formally adopted for this specific type of maritime hybrid threat. This scattered response reflects the Alliance's structural difficulty in organizing quickly against threats that don't fit the mold of classic, immediately identifiable military aggression.

Some countries have also tightened port controls on vessels suspected of belonging to the **shadow fleet**, hoping to limit their access to the most sensitive territorial waters, without, however, being able to fully prevent them from sailing in adjacent international waters.

### What a common doctrine should include

Several maritime **security** experts advocate for a common **NATO** doctrine that would include systematic, rapid sharing of drone **detection** data between member states, along with a maritime sanctions mechanism specifically targeting vessels identified as belonging to the Russian shadow fleet.

Without this stronger coordination, each country will continue handling these incidents in isolation, which structurally benefits a **Russia** that clearly coordinates these operations on a far larger scale.

*NATO likes to present itself as a united alliance against **Russia**, but on this specific drone and shadow-fleet file, every country still seems to be acting alone in its own corner. That's exactly the kind of fragmentation Moscow hopes to exploit.*

## The link to the economic war against Russia

### The shadow fleet, a pillar of financing the war in Ukraine

It must never be forgotten that this fleet's primary function is to skirt **Western oil sanctions** so **Russia** can keep funding its war effort against **Ukraine**. Every barrel carried by one of these tankers represents revenue that escapes, at least partially, the price cap imposed by the **G7**.

This **economic** dimension makes the dual military function of these vessels even more concerning: the same ships financing Russia's war machine in **Ukraine** would also be spying on Western defenses, creating a dangerous convergence between **economic** warfare and **hybrid warfare**.

### Why sanctioning these vessels remains a legal challenge

Effectively sanctioning these vessels remains legally complex, since they frequently change **flag**, registered owner and **insurance** company, quickly rendering any sanction measure obsolete against the speed of this fleet's administrative reshuffling.

This constant race between Western measures and Russian adaptation illustrates the structural limits of classic maritime **sanctions** against an adversary with sufficient resources to continually renew its legal front structures.

*Every barrel of oil carried by these vessels directly finances the missiles falling on Ukraine. Treating them solely as a military surveillance problem, without also attacking them economically, would be a Western **strategic** mistake.*

## What Kyiv is watching from its own theater of war

### A threat that echoes Russia's own tactics in the Black Sea

For Ukrainian observers, this use of civilian vessels for military ends is nothing new: the **Ukrainian navy** has documented for years similar tactics used by the Russian fleet in the Black Sea, where civilian or paramilitary vessels have regularly served as observation platforms or logistical support for Russian military operations.

This tactical continuity, from the Black Sea to European waters near **NATO**, confirms that Russia's doctrine of hiding military activity behind civilian cover is not confined to the Ukrainian theater, but constitutes a widespread method of Kremlin action.

### Western vigilance that should draw on Ukraine's experience

Ukraine's accumulated experience since 2022 in identifying these dual-use vessels could usefully feed Western detection capabilities, on a file where intelligence cooperation between **Kyiv** and its Western allies benefits both sides.

This cooperation, already underway on other maritime **security** files, would be worth strengthening specifically on the question of the shadow fleet and its suspected military use near **NATO** installations.

*Ukraine learned, the hard way, to spot these two-faced vessels in the Black Sea. The **West** would be wrong not to draw more heavily on this hard-won expertise instead of starting from scratch on this file.*

## Scenarios for the coming months

### Between silent escalation and coordinated response

Several trajectories are possible for this file going forward. **Russia** could continue, or even intensify, this type of operation as long as the political and material cost remains low for it. Conversely, a more coordinated Western response, including targeted maritime sanctions and a common detection doctrine, could gradually reduce this shadow fleet's room to maneuver.

The most likely scenario, according to several European **security** analysts, remains a prolonged intermediate phase: neither immediate dramatic escalation nor a quick resolution of the problem, but gradual diplomatic pressure accompanied by scattered national measures, pending a possible common **NATO** doctrine.

### What should be watched most closely

The publication of new reports by the **IISS** or other security research institutes, along with any sanction decisions specifically targeting individually named vessels, will be the most reliable indicators of how this file evolves in the months ahead.

The absence of such concrete measures, conversely, would confirm that **NATO** remains, for now, better at documenting this threat than at effectively countering it on the ground.

*I'll keep watching the **IISS's** next reports on this file, but I have no illusions: without swift, concrete sanctions against individually named vessels, this shadow fleet will keep operating with the same relative impunity it enjoys today.*

## Why this file goes beyond a purely maritime question

### A test of Western cohesion against hybrid warfare

This file on the shadow fleet and drone overflights implicitly tests **NATO's** ability to respond collectively to threats that don't fit the mold of classic military aggression. If the Alliance fails to build a coordinated response on this relatively contained file, it raises questions about its ability to handle even more sophisticated forms of **hybrid warfare** in the future.

This test goes well beyond the question of Russian tankers alone: it concerns the entire Western collective security doctrine, at a moment when forms of conflict are evolving faster than the legal and institutional frameworks meant to contain them.

### A lesson for the entire authoritarian axis

How **NATO** handles this file will be watched not only by **Moscow**, but also by **Beijing**, **Tehran** and **Pyongyang**, who are closely observing Western capacity to respond to hybrid warfare tactics without triggering open military escalation.

A **Western** failure on this file would send a signal of weakness to that entire authoritarian axis, while a firm, coordinated response would strengthen the credibility of Western deterrence doctrine far beyond the sole question of Russian tankers.

*What Beijing and Tehran observe today in how the West handles this maritime file will partly shape their own calculations about what they can attempt tomorrow. NATO cannot afford to look disorganized on this specific point.*

## The human factor behind the technical reports

### Base security crews on permanent alert

Behind the overflight statistics and expert reports are security teams at the affected military bases, forced to treat every unidentified drone overflight as a potential threat, with all the vigilance and operational stress that implies over time.

This daily pressure, rarely mentioned in media coverage of this file, represents a real human cost for the personnel responsible for securing these sensitive installations, confronted with a threat that is difficult to anticipate and effectively counter with the means currently available.

### Vigilance that carries a human and material price

Strengthening detection capabilities, if eventually adopted at the **NATO** level, will also represent a considerable material and human investment, at a time when European defense budgets are already heavily stretched by support for **Ukraine** and the Alliance's broader rearmament goals.

This cost, real as it is, remains far lower than that of a serious incident arising from failing to take this hybrid threat seriously enough in time.

*I often think about these security teams who must treat every suspicious overflight with the same seriousness, week after week, never knowing whether it's a test, an intelligence operation, or a simple isolated incident.*

## The role of Western insurers in this file

### Insurance coverage growing harder to obtain

Several **Western maritime insurers** have tightened their acceptance criteria for vessels resembling the **shadow fleet** profile, particularly those that have disabled their tracking system or frequently changed flag in recent years. This insurance pressure represents one of the few genuinely effective economic levers against this fleet, since a vessel without **compliant insurance** becomes far more vulnerable in the event of a major maritime incident.

This insurance strategy, driven notably by markets such as **London's**, complements classic government sanctions by directly targeting the economic viability of these vessels rather than only their formal legality.

### An effectiveness still limited by Russian alternatives

**Russia**, however, has developed its own parallel insurance mechanisms to sidestep this Western pressure, partially reducing the long-term effectiveness of this insurance approach. This constant adaptation illustrates, once again, the **Kremlin's** ability to find economic workarounds for every new Western measure.

This perpetual race between sanctions and circumvention reinforces the idea that only a coordinated action, combining sanctions, insurance pressure and a military detection doctrine, can truly reduce this dual-use fleet's room to maneuver.

*Even insurance pressure, useful as it is, will never be enough on its own against a state ready to subsidize its own workaround mechanisms. Every available lever needs to be combined, not picked one at a time.*

## Conclusion: a gray-zone threat demanding a clear response

### A file that illustrates the new forms of warfare

Russia's **shadow fleet** and its suspected use for drone surveillance operations near **NATO** installations perfectly illustrate the new forms of conflict the **West** must now face: diffuse threats, hard to attribute with absolute certainty, but whose accumulation of converging evidence leaves little doubt about the strategic intentions behind them.

One hundred forty-four documented incidents, thirteen countries affected, individually named vessels: this file can no longer be treated as a series of isolated anecdotes. It demands a response equal to its systemic scale.

### What to watch in the coming months

The true measure of **Western** seriousness on this file will be seen in the adoption, or lack thereof, of a common detection and maritime sanctions doctrine specifically aimed at vessels identified as belonging to this shadow fleet.

Until that common doctrine emerges, **Russia** will retain a comfortable operating space between the threshold of an isolated incident and that of an openly acknowledged act of war, a space precisely designed to exploit the Atlantic Alliance's structural hesitations.

*I'll close this profile with one simple certainty: a fleet capable of financing a war and spying on its adversaries at the same time is never an ordinary fleet. The **West** must treat it for what it truly is, a weapon, not just a commercial problem.*

**By Maxime Marquette, columnist**

## Columnist's transparency note

### Editorial stance

I am not a journalist but a **columnist and analyst**. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. **I claim analytical clarity**, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

### Method and sources

This text keeps the basic distinction between **verified facts and interpretive analysis**. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under **Sources**, never here.

**Primary source families** used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

**Secondary source families**: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under **Sources**.

### Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a **critical, contextual synthesis** based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.

## Sources

### Primary sources

- Ministry of Defense of Ukraine — maritime security context, July 2026

- IISS — report on drone incursions near NATO installations

- Stars and Stripes — Russian drones near NATO nuclear bases, July 2, 2026

### Secondary sources

- The New York Times — drone incursions in Europe attributed to Russia, July 2, 2026

- Foreign Policy — analysis of Russian hybrid warfare in Europe

- Newsmax — Russian drones and European defense, July 2, 2026

---

Source: Maxime Marquette, MadMax. When citing, name the author and link https://mad-max.co/en/article/la-flotte-fantome-russe-ces-petroliers-qui-espionnent-l-otan-depuis-la-mer