Russia Is Planting GRU Spies and Wagner Killers on Its Illegal Oil Fleet

Sanctioned Russian oil tankers operate openly in Baltic Sea waters, protected by layers of corporate opacity and now - armed security personnel with military intelligence backgrounds. (Unsplash)

The Tanker Nobody Was Supposed to Inspect

December 27, 2025. The oil tanker Kira K sits at berth in Ust-Luga, Russia's primary Baltic Sea export terminal. Its hold is loaded with 734,000 barrels of crude oil - cargo belonging to Lukoil, the Russian energy giant blacklisted by the European Union.

The ship's crew list is a mix of sailors from Myanmar, China, and Bangladesh. Standard for vessels in this trade. But scroll down the manifest and two names stand out: Russian citizens Denis Enin, 48, and Aleksandr Kamenev, 45. Their listed role is "supernumerary" - nautical shorthand for people who are on board but are not part of the operating crew. Next to the seafarer qualification fields beside each of their names, just two letters: NA. Not available.

That notation means something specific here. Not available because these men have no maritime credentials whatsoever. Not available because they are not sailors at all.

Kamenev spent years embedded with Wagner Group operations in Syria and Russian-occupied Donetsk, according to leaked Russian border crossing data reviewed by OCCRP. Enin's registered address in Russia resolves to a military unit in the country's south. Both men are veterans of the Wagner Group, the Kremlin's private mercenary army responsible for documented atrocities across Ukraine, Syria, Mali, Libya, and Sudan - until its leader, Yevgeny Prigozhin, staged a failed rebellion in June 2023 and died in a plane crash two months later, with the organization effectively absorbed into the Russian state security apparatus.

Their presence on the Kira K is not a coincidence, an oversight, or an isolated case. It is, investigators now say, Russian policy.

A joint investigation published March 10, 2026, by OCCRP, Delfi, Helsingin Sanomat, and iStories has documented a systematic pattern: Russia has been quietly embedding military veterans, GRU intelligence officers, and Wagner alumni into the crews of its sanctioned oil tankers operating in the Baltic Sea. The operation serves multiple purposes simultaneously - protecting Moscow's oil revenue from Western interference, conducting intelligence operations in NATO waters, and potentially laying the groundwork for infrastructure sabotage.

A Systematic Military Presence - Not Random Individuals

The Baltic Sea - enclosed, shallow, and bordered by NATO member states on almost every shore. Russia exports roughly 40 percent of its crude oil through these waters. (Unsplash)

The investigation analyzed crew lists from sanctioned tankers across 20 separate journeys. The findings are methodical and damning.

Of 17 Russian men aboard these vessels who lacked any maritime credentials, 13 were confirmed to have links to the Wagner Group or state security organizations - primarily Russia's military intelligence directorate, the GRU. Reporters built these connections using leaked Russian databases, a 2021 registry of Wagner mercenaries, information from multiple European intelligence agencies, and open-source research.

The pattern has a start date. These extra personnel began appearing on crew manifests in July 2025. Before that month, their presence is not documented in the available records. The timing corresponds with an escalation in Western efforts to board and inspect shadow fleet vessels - including a French seizure in September 2025 and increasing Estonian and Finnish naval activity.

Critically, the deployment appears targeted. A review of crew manifests for shadow fleet vessels operating in the Black Sea and Pacific during the same period found no comparable presence of non-credentialed Russian military personnel. The Baltic route - which passes through Estonian, Finnish, Swedish, Danish, and German economic zones - is where these men are assigned.

This is not corporate security gone rogue. It is a coordinated state deployment using Russia's network of post-Wagner veterans and active intelligence operatives, funneled onto commercial vessels through two private security firms the Kremlin has long used for deniable operations at sea.

"The goal of this activity is to protect the Russian Federation's revenue base from potential threats, be it Ukraine-organized sabotage or other interference from the West." - Colonel Ants Kiviselg, Head of Estonian Defense Forces Intelligence Center, to Delfi

The Men With No Maritime Credentials: Who They Are

The investigation named names. This is who Russia has been placing on board its sanctioned tankers.

Also documented: a crew aboard the tanker Lebre that included men employed by both Russia's Ministry of Defense and the Ministry of Defense of Transnistria - the Russia-backed breakaway territory in Moldova. This was confirmed through employment records provided to investigators by Ukraine's Foreign Intelligence Service. The ship's manager, Anchor Elite Shipmanagement, claimed the men's presence was "in no way connected with military or private military activities" and that they performed "galley duties" and "deck-related work." One of the men confirmed to reporters that his travel companion on the tanker had, in fact, served as a guard.

The Private Security Conduit: RSB Group and Moran Security

Russia's shadow fleet security apparatus runs through private firms with deep ties to the FSB and Russian military - providing plausible deniability while deploying combat veterans into NATO waters. (Unsplash)

The men are not hired directly by the Kremlin - at least not in any traceable way. Ukraine's Foreign Intelligence Service told reporters they are typically contracted through two firms: RSB Group and Moran Security Group.

RSB Group presents itself as a professional maritime protection company. Its website boasts of having "protected tens of merchant and scientific Russian and foreign vessels." Behind that corporate veneer lies something else. The company employs former Russian intelligence officers and other combatants, and has trained units for the war in Ukraine, according to EU and U.S. sanctions notices. The EU sanctioned RSB Group explicitly for its role supporting Russia's war machine. Its website - still publicly accessible as of this writing - continues to advertise marine protection services.

Moran Security Group has a similar profile. Also sanctioned by the United States for providing services to Russian state enterprises, the company pitches itself online as a standard maritime security operation. In practice, it has served as a pipeline for placing former Russian military and intelligence operatives into roles that provide Moscow with deniable operational assets on commercial vessels.

Neither RSB Group nor Moran Security responded to requests for comment from the OCCRP-led investigation team.

The corporate structure provides critical insulation. These are private companies hiring individual contractors. The contractors have no maritime credentials because they do not need them - their job is not to sail the ship. When a boarding party from the Estonian Coast Guard or the Danish Navy comes alongside, there is a buffer layer of corporate paperwork between the men on board and the Russian Ministry of Defense. The legal ambiguity is the point.

"Two potentially armed individuals certainly changes our risk calculus when we must decide whether to stop or seize the tanker. Russia believes this makes NATO member states along the Baltic Sea more cautious." - Senior European intelligence official, speaking anonymously to OCCRP

Beyond Oil: Intelligence Operations and the Cable War

Russia's motivation for this program extends beyond protecting its oil revenue - though that revenue is substantial and strategically critical. The Baltic route accounts for roughly 40 percent of Russia's crude oil exports, according to the Kyiv School of Economics. That translates to hundreds of millions of dollars per month flowing into state coffers that directly fund the Ukraine war.

But intelligence professionals who spoke to the investigation believe the deployed operatives serve a second, equally important purpose: systematic reconnaissance of NATO coastal defenses, naval response capabilities, and infrastructure vulnerabilities.

Glen Grant, a former U.K. defense attaché to Estonia and Latvia and now a defense advisor in the Baltic region, was direct in his assessment. "Collectively that gives them a complete idea of our strength, resolve, philosophy and our military capability," he told OCCRP. "The fact that they're carrying oil and that they get money in for Russia as well is a bonus."

Grant's point maps onto a troubling pattern. The Baltic and North Seas have seen an extraordinary concentration of undersea cable damage over the past two years. Power cables and data lines running between Finland and Estonia, between Sweden and Lithuania, between Germany and Scandinavia - multiple incidents, most attributed by Western governments to shadow fleet vessels "dragging anchors" while transiting the region.

Sean Wiswesser, a former CIA senior operations officer who specialized in Russian intelligence services and military operations, told reporters the trend points unmistakably toward a dual-use program.

"It's definitely not just about protecting Russia's oil. Nowhere else in the world have there been as many cable cuts, and in such a short time, as there have been in the past two years." - Sean Wiswesser, former CIA Senior Operations Officer, to OCCRP

The Finnish Security and Intelligence Service (SUPO) contributed another dimension to this picture. An analyst who spoke to Helsingin Sanomat on the condition of anonymity noted that the security teams likely serve a communication function as well - acting as liaison officers if Russian naval assets are operating in the same area. "It can be assumed that if Russian military forces and naval vessels are operating in the same area and escorting these ships, then the task of these men may be to facilitate communication."

That interpretation positions the shadow fleet not merely as a sanctions evasion scheme, but as a distributed sensor and communications network embedded in NATO's most sensitive maritime corridor.

The Revenue That Fuels the War

Understanding why Moscow is willing to take these risks requires understanding how central the Baltic route is to the Russian war economy.

Russia exports roughly 40 percent of its crude oil specifically through the Baltic Sea, according to the Kyiv School of Economics. The Baltic terminals - primarily Ust-Luga and Primorsk - process enormous volumes daily. The Kira K's December 2025 cargo of 734,000 barrels was a single vessel's contribution to a daily flow that, at current oil prices, generates revenues in the range of $40 to $60 million every 24 hours from this route alone.

The sanctioned entities involved include Lukoil - Russia's second-largest oil producer, blacklisted by the European Union but still exporting through the shadow fleet to buyers in India, China, and Turkey. The ship that carried Lukoil cargo on the December voyage was the Kira K itself, a vessel on EU and U.S. sanctions lists whose ownership runs through a chain of opaque shell companies registered in jurisdictions that maintain minimal disclosure requirements.

The shadow fleet as a whole now numbers several hundred vessels, most of them older tankers purchased by Russia-linked interests after the 2022 invasion of Ukraine and the subsequent imposition of Western sanctions. They fly flags of convenience, change names frequently, and maintain ownership structures deliberately designed to resist forensic tracing.

What the OCCRP investigation has now established is that Moscow views this fleet as a strategic military-economic asset - not just a smuggling operation. And it is protecting that asset accordingly, with the same level of seriousness it applies to protecting conventional military assets.

Europe's Legal Trap

NATO member states patrolling the Baltic face a severe legal constraint: they cannot legally board or seize a foreign-flagged vessel simply because it is on a sanctions list. Maritime law under the United Nations Convention on the Law of the Sea (UNCLOS) limits interdiction rights primarily to vessels flying their own flag or to specific circumstances such as piracy, slave trading, or - in some interpretations - cable damage.

Western authorities have found workarounds. France seized a shadow fleet tanker in September 2025. Belgium seized one in March 2026 after it was found flying a false flag, according to Reuters. Estonia has intercepted vessels in its economic zone for related violations. But each of these seizures required a specific legal pretext beyond the mere fact of sanctions.

The deployment of armed veterans changes this calculus in a chilling way. When a boarding party from the Danish or Finnish coast guard prepares to inspect a vessel, the question is no longer just legal - it is tactical. Are there armed men aboard? Will they resist? The SUPO analyst's assessment - that the guards are "likely on board to ensure that other Baltic Sea countries do not take control of these ships too easily" - is not a paranoid interpretation. It is an accurate description of the design.

Estonia's response to earlier confrontations illustrates Russia's willingness to escalate. When the Estonian Navy escorted the EU-sanctioned tanker Jaguar out of Estonian economic waters in May 2025 after it was found sailing without a valid flag, Russia's response was immediate: a fighter jet violated Estonian airspace. "Russia sees the shadow fleet as a very important economic lever," Estonian Navy Commander Ivo Värk told OCCRP. "Russia is prepared to protect this by all means."

That willingness to use state military assets to protect commercial vessels running sanctioned cargo represents a significant escalation from the sanctions evasion playbook most Western governments had anticipated. The shadow fleet is no longer just a workaround. It is a defended military-economic infrastructure operating continuously in the middle of NATO's most critical sea lane.

Timeline: The Militarization of Russia's Shadow Fleet

What Comes Next: The Calculus Shifts

The publication of this investigation creates immediate political and operational pressure across multiple dimensions simultaneously.

For European governments, the documentation of armed operatives - multiple intelligence agencies have characterized these men as likely armed, though no weapons have been officially confirmed in seizures - transforms the legal and tactical question of shadow fleet interdiction from a sanctions enforcement problem into something closer to a low-level military confrontation at sea.

The Estonian Navy Commander's statement that Russia has "quadrupled" its naval presence in the Baltic since 2022 is the context in which these tanker interdictions now have to be evaluated. Boarding a ship knowing it may carry armed GRU-linked personnel, with Russian naval vessels potentially nearby and Russian fighter jets willing to violate NATO airspace in response, is an entirely different proposition from boarding a vessel flagged for paperwork violations.

For sanction designers and enforcement bodies, the investigation reveals a structural gap. Sanctions against specific vessels, against Lukoil, against RSB Group and Moran Security - none of these have stopped the program. The Kira K sailed in December with its Wagner-veteran supernumeraries. Lukoil's crude shipped as planned. The revenue reached Moscow. The operatives completed their transit through NATO waters and gathered whatever intelligence they gathered.

For Ukraine, the picture is grimmer still. The Kyiv School of Economics estimate that 40 percent of Russian crude moves through the Baltic translates directly to war funding. Every tanker that completes its run is a contribution to the budget that pays for Russian artillery, drone production, and the logistics of continued occupation. The Ukrainian drone strike on the Qendil in the Mediterranean - the first successful strike on a shadow fleet vessel - was likely a deliberate signal that Kyiv is willing to attempt to disrupt this supply chain. Whether it can do so at scale, and what the escalation risks are, remains an open and dangerous question.

The investigation confirms what intelligence agencies in Estonia, Finland, and several other Baltic states had been warning privately for months: Russia has transformed its oil smuggling operation into a military program. The ships are not just carrying crude. They are carrying soldiers. And those soldiers are watching, listening, and reporting back.

The Baltic Sea - enclosed, shallow, crossed by NATO power cables and data lines, and bordered on almost every shore by alliance members - has become the central arena for a hybrid confrontation that sits deliberately below the threshold of declared warfare. Russia designed it that way. It is now systematically staffing that arena with its most battle-tested operatives.

The question for NATO member states is no longer whether to treat the shadow fleet as a security threat. The crew manifests have settled that. The question is what to do about it, and how to do it without handing Moscow the escalation it may actually want.