GRU on the Water: How Russia Turned Its Shadow Fleet Into a Baltic Spy Network

Wagner veterans and GRU Spetsnaz operatives are riding sanctioned oil tankers through the Baltic Sea. A joint investigation names 13 men with military intelligence backgrounds embedded across 20 voyages - gathering intelligence, deterring seizure, and potentially coordinating the undersea cable cuts plaguing northern Europe.

On the morning of December 27, 2025, the oil tanker Kira K sat loaded in the Russian port of Ust-Luga, preparing to haul 734,000 barrels of Lukoil crude into the global market. On paper, the vessel's crew list was unremarkable - a standard mix of sailors from Myanmar, China, and Bangladesh. Two additional names appeared at the bottom of the manifest under the category of "supernumeraries."

Next to their names, in the fields reserved for maritime diplomas and qualifications, appeared two letters: NA. Not available.

That is because Denis Enin, 48, and Aleksandr Kamenev, 45, are not sailors. Both are veterans of the Wagner Group, the Kremlin-linked mercenary organization responsible for atrocities across Syria, Ukraine, the Central African Republic, and Mali. Kamenev traveled through Russian-occupied Donetsk during Wagner's peak operations there. Enin's registered address is that of a military unit in southern Russia.

They had no maritime credentials. They had no documented maritime role. And yet they were there - riding a sanctioned tanker through NATO's eastern maritime corridor, logged only as "supernumeraries" with unclassified duties.

A joint investigation published today by OCCRP, Delfi, Helsingin Sanomat, and iStories reveals this was not an isolated incident. It is a system. Across 20 analyzed voyages on sanctioned Baltic Sea tankers departing Russian ports, reporters identified 17 Russian nationals who lacked any maritime credentials. Of those, 13 were confirmed to have ties to the Wagner Group or to Russian state security services, including the GRU - Russia's military intelligence directorate. The pattern emerged after July 2025 and appears specific to the Baltic route. Crew manifests for Black Sea and Pacific route vessels from the same period show no comparable pattern.

What Russia has built is not merely a sanctions-evasion fleet. It is a floating intelligence network, staffed by veterans of its most sensitive special operations forces, sailing through the waters of NATO member states on a daily basis.

From the Battlefield to the Cargo Hold

The men riding these vessels did not find their way there through conventional maritime employment. Ukraine's Foreign Intelligence Service, which provided employment records to the OCCRP investigation, identified two sanctioned security firms that have been supplying these "vessel protection teams": RSB Group and Moran Security Group.

RSB Group's own website describes it as having "protected tens of merchant and scientific Russian and foreign vessels." The company employs former Russian intelligence officers and has trained units deployed in the war in Ukraine, according to EU and U.S. sanctions records. Moran Security Group, similarly, has been sanctioned by the United States for providing services to Russian state enterprises. Neither firm responded to requests for comment from journalists.

The profiles of the men they deploy onto these tankers make clear that maritime security is a secondary function at best.

The Lebre, another sanctioned tanker in the Baltic fleet, carried men with documented ties to Russia's Ministry of Defense and to the Ministry of Defense of Transnistria - the Russia-backed breakaway territory in Moldova that serves as a forward military base along Europe's eastern flank. One crewman, when contacted, denied ever working for the Russian MoD but confirmed that the other Russian on board had indeed served as a guard. The ship's manager, Anchor Elite Shipmanagement, said the men's presence was "in no way connected with military or private military activities" and claimed they performed "galley duties" and "deck-related work."

What They Are Actually Doing Out There

The Kremlin's stated justification for embedding military veterans on these vessels is protection - deterring Ukraine-organized sabotage of high-value oil infrastructure. Colonel Ants Kiviselg, head of the Estonian Defense Forces Intelligence Center, accepts that partial framing while making clear it does not tell the whole story.

"The goal of this activity is to protect the Russian Federation's revenue base from potential threats, be it [Ukraine-organized] sabotage or other interference from the West. Placing ship protecting crews on these ships shows that the goods moved by the shadow fleet and the revenue derived from them are important to Russia." - Col. Ants Kiviselg, Estonian Defense Forces Intelligence Center

But multiple intelligence assessments reviewed or cited by the OCCRP investigation push well beyond the protection narrative. Glen Grant, a defense advisor and former UK defense attaché to both Estonia and Latvia, frames the Baltic shadow fleet operation as a systematic intelligence collection program.

"Collectively that gives them a complete idea of our strength, resolve, philosophy and our military capability. The fact that they're carrying oil and that they get money in [for Russia] as well is a bonus." - Glen Grant, former UK Defense Attaché to Estonia and Latvia

An analyst with Finland's Security and Intelligence Service (SUPO) told Helsingin Sanomat that the primary mission of these "guards" appears to be preventing other crew members - sailors from Myanmar, Bangladesh, and China with no loyalty to Moscow - from complying with orders from European maritime authorities attempting to board or inspect the vessels.

"The guards are likely on board to ensure that other Baltic Sea countries do not take control of these ships too easily," the analyst said, speaking on condition of anonymity. The analyst added that these personnel likely also serve as communication liaisons, potentially coordinating with Russian naval vessels that may be operating in the same waters.

Sean Wiswesser, a former CIA senior operations officer who specialized in Russian intelligence services and military affairs, was blunter still. He told OCCRP the trend points toward these ships being used as platforms for active "sabotage" operations and "other intelligence operations, like potentially deploying drones."

"It's definitely not just about protecting Russia's oil. Nowhere else in the world have there been as many cable cuts, and in a short time, as there have been in the past two years." - Sean Wiswesser, former CIA senior operations officer

The Undersea Cable Connection

The Baltic Sea has become the world's most active theater for unexplained damage to undersea infrastructure. Telecommunications cables and gas pipelines connecting Finland to Estonia, Sweden to Lithuania, and Germany to Scandinavia have suffered repeated disruptions since 2023. European authorities have linked several of these incidents to Russian-flagged or Russian-connected vessels, including shadow fleet tankers dragging anchors across cable routes.

The timing is notable. The systematic embedding of GRU-linked operatives on Baltic shadow fleet vessels began after July 2025, according to the crew manifests obtained by OCCRP. This coincides with a period during which European nations - particularly the Baltic states - began more aggressively attempting to intercept and inspect shadow fleet vessels suspected of cable damage.

The Qendil represents the most operationally revealing data point. In September 2025, GRU Spetsnaz veteran Malakhov and Wagner operative Alexandrov were aboard the Qendil as it began a Baltic journey carrying Russian oil cargo. Two months later, the Qendil was the first shadow fleet tanker struck by a Ukrainian drone - in the Mediterranean, during a subsequent voyage transporting Russian oil from the Black Sea to India. Whether those on board retained any intelligence function during that journey remains unknown.

What is documented: the Qendil and other shadow fleet tankers operating in the Baltic are sailing through the exact corridors where European infrastructure cables run along the seabed. Former CIA officer Wiswesser's assessment - that these vessels can serve as drone deployment platforms - adds a dimension that European maritime authorities are now being forced to factor into every interception decision.

The Escalation Russia Wanted

The intelligence dimension of the shadow fleet operation is partly tactical. But it is also partly about deterrence - changing the risk calculus for NATO member states that might otherwise attempt to board, inspect, or seize these vessels.

European authorities generally cannot stop shadow fleet tankers solely because they are Western-sanctioned. Sanctions create financial and trading restrictions, but they do not automatically confer the right of maritime intervention under international law. Enforcement has required other pretexts: false-flag violations, suspected infrastructure damage, or technical maritime safety failures.

A high-ranking European intelligence officer, speaking anonymously because of the sensitivity of the information, told OCCRP exactly what having armed veterans aboard does to that calculus.

"Two potentially armed individuals certainly changes [our] risk calculus when we must decide whether to stop or seize the tanker. Russia believes this makes NATO member states along the Baltic Sea more cautious." - Senior European intelligence official, speaking anonymously

Estonia discovered in May 2025 exactly how seriously Moscow takes this. The Estonian Navy escorted the EU-sanctioned oil tanker Jaguar out of Estonian economic waters after the vessel was found to be sailing without a valid flag. Russia's response was immediate and deliberately provocative: a Russian fighter jet violated Estonian airspace.

Estonian Navy Commander Ivo Värk described that exchange in terms that explain why Moscow is investing in this strategy.

"Russia sees the shadow fleet as a very important economic lever. For them, it is a matter of high national interest. Russia is prepared to protect this by all means." - Ivo Värk, Estonian Navy Commander

Värk's observation on Russia's quadrupled naval presence in the Baltic since 2022 provides the broader context. The shadow fleet is not operating in isolation. It is operating within an increasingly militarized Russian maritime posture in European waters, with uniformed naval vessels providing what some analysts believe is active overwatch and escort capability for the most strategically significant tanker routes.

Timeline: The Militarization of the Shadow Fleet

The Sanctions Architecture That Made This Possible

Western sanctions on Russian oil were designed with a specific goal: reduce the revenue flowing into Moscow's war machine by cutting off access to Western shipping services, insurance, and financial systems. The "price cap" mechanism agreed by the G7 in late 2022 aimed to allow Russian oil to continue flowing to global markets - preventing a supply shock - while limiting Russian earnings per barrel.

The shadow fleet was the Kremlin's direct answer to that architecture. By acquiring aging tankers through opaque ownership chains in jurisdictions like the UAE, Hong Kong, and Turkey, Russia rebuilt a parallel logistics network that does not rely on Western insurance, Western shipping firms, or Western-controlled ports. Hundreds of vessels now move Russian oil under flags of convenience to buyers in India, China, and Turkey who are not bound by Western price caps.

Nothing in that sanctions framework addressed the question of who rides on these vessels. The legal gap is fundamental: maritime law grants flag states jurisdiction over their vessels. A tanker flying the flag of Gabon, Palau, or Cameroon - common shadow fleet registries - is legally under the authority of that flag state. European navies can board for specific violations (false flag, safety hazards, suspected cable damage) but cannot board simply because a vessel is carrying sanctioned cargo or because its owners appear in an OFAC list.

Russia identified that gap and filled it with veterans of its most sensitive security services.

The RSB Group and Moran Security Group - both now sanctioned themselves - serve as the corporate layer between the Kremlin's intelligence apparatus and the vessel manifest. When maritime authorities look at a crew list and see two "supernumeraries" listed as "technicians" or "cooks," there is no automatic legal mechanism to compel disclosure of their actual backgrounds. The NA next to their qualification fields is not a violation. It is a feature.

European governments are now wrestling with what legal tools exist to pierce this structure. Belgium's March 1 seizure of a false-flagged tanker provides one template. France's September seizure provides another. But both required specific pretextual violations - neither could have proceeded purely on the basis that the men aboard were GRU-connected security contractors.

Unless Europe expands its legal authorities to treat the presence of sanctioned private military contractors aboard vessels as a seizure trigger in its own right, the current framework gives Russia structural cover to continue.

The Corporate Cover Story

RSB Group and Moran Security have both built plausible commercial identities as maritime security providers. Their websites advertise services familiar to any shipping company operating in high-risk waters: anti-piracy protection, crew safety, vessel escort. In the Gulf of Aden, private armed guards on commercial vessels are standard practice and entirely legal under international maritime law.

The distinction Russia has exploited is that the Baltic Sea is not the Gulf of Aden. The vessels in question are not threatened by Somali pirates. They are threatened by Estonian and Finnish coastguard authorities attempting to enforce sanctions agreed by democratic governments.

When a former CIA officer with GRU credentials rides a tanker through NATO's most sensitive maritime corridor and an SUPO analyst says his job is to prevent other crew members from complying with European authorities, the term "maritime security" becomes something else entirely. It becomes an active counter-intelligence operation against NATO member states, conducted in their own territorial and economic waters, financed by oil revenue that those same states attempted to cap.

Anchor Elite Shipmanagement, the company managing the Lebre, told reporters that the men aboard were engaged in "galley duties" and "deck-related work." One of those men confirmed to reporters that his shipmate - whose name Anchor Elite declined to discuss - had, in fact, "served as a guard." The company said it was "not in a position to confirm the allegations presented."

These denials follow a pattern observed across sanctioned Russian entities: acknowledge nothing, categorize everything as commercial, and exploit the burden of proof required to take enforcement action.

What NATO Must Decide

The OCCRP investigation, taken alongside existing reporting by CNN and NRK and intelligence assessments from Estonia, Finland, and multiple unnamed European agencies, presents European decision-makers with a question that goes beyond sanctions compliance.

Russia has placed what amount to active intelligence operatives in the territorial waters and economic zones of NATO member states. Those operatives are riding under cover of commercial activity that European law cannot easily challenge. They are gathering information on NATO surveillance capabilities, enforcement response times, and maritime rules of engagement. They may be coordinating with Russian naval vessels operating in the same corridor. And they may be involved in the ongoing pattern of Baltic Sea undersea infrastructure damage that has disrupted civilian communications and energy supply for millions of people.

The legal response options are constrained. Military response is off the table absent a clear act of war. Diplomatic protest has been tried and ignored. The existing sanctions framework does not cover this specific activity effectively.

Several potential responses are under discussion in European intelligence and policy circles, according to background conversations with sources familiar with the deliberations. Expanding the legal definition of "sanctions violation" to include the presence of designated private military company personnel aboard vessels is one avenue. Treating shadow fleet vessels in Baltic waters as presumptively engaged in intelligence activities - triggering heightened border and port authority powers - is another. A multi-state coordinated interdiction program targeting specific vessels with confirmed GRU-linked crews, using accumulated evidence of flag fraud or technical violations as the legal hook, is a third.

None of these are simple. All of them carry escalation risk that Russia's fighter jet over Estonian airspace demonstrated it is willing to generate.

What the OCCRP investigation has established - definitively, with names, ship manifests, leaked databases, and intelligence agency confirmation - is that the shadow fleet is no longer merely an economic problem. It is a security problem. And the men Russia has chosen to deploy on it are not there to cook dinner.