Introduction
Since Fall 2024, actors affiliated with the Russian state have been responsible for, or associated with, a growing series of disruptive incidents near the Baltic Sea. The incidents, conducted by an increasingly militarized shadow fleet of commercial vessels, involve various forms of territorial violations, disruptions in commerce, and acts of intimidation directed against countries bordering the sea. The increasingly aggressive maritime “grey zone” operations have become more sophisticated in recent months and have coincided with a more militant Russian posture toward Baltic members of the North Atlantic Treaty Organization (NATO). While Russia has a long history of hybrid warfare operations in the Baltic region, the newest campaign bears striking similarities to the “maritime insurgency” tactics China has employed over the past decade to assert its dominance over the South China Sea.
A maritime insurgency occurs when a nation attempts to contest the freedom and security of international waterways using coercive methods short of war to reshape regional order. For China, this maritime insurgency has been waged primarily by its maritime militia, a vast network of thousands of fishing vessels coordinated by regional governments and deeply integrated into the operations of the China Coast Guard and People’s Liberation Army Navy. China has used the maritime militia to harass foreign mariners and seize disputed islands in an effort to exert greater control over the South China Sea and prepare for an invasion of Taiwan.
While the Chinese campaign has its own unique character, Russia appears to have translated and adapted some of China’s insurgent tactics to its own institutions and purposes. Chief among these is the use of its shadow fleet as civilian paramilitary vessels to conduct disruptive operations and support conventional naval power.
This essay suggests that the shadow fleet, rather than just serving as a means of moving sanctioned oil, appears to be increasingly serving as a platform for conducting covert maritime operations such as sabotage and intelligence collection, as well as advance guards for conventional naval forces. Trends in Russia’s use of the shadow fleet in the Baltic since 2024 further suggest that it may be organizing these activities as part of a coordinated campaign of aggressive maritime operations below the threshold of war to test NATO’s cohesion and shape the conditions for a potential future invasion of the Baltic States.
Shadow Fleet Vessels as the Instruments of Covert Russian Maritime Operations
On December 25th, 2024, the tanker Eagle S dragged its anchor over the Estlink-2 submarine power cable, disrupting the supply of energy from Estonia to Finland. This incident was one of about a dozen known or suspected cases of shadow fleet vessels using anchor drags to damage underwater critical infrastructure. However, the Eagle S incident was unique in that it prompted the first boarding and seizure of a Russian shadow fleet vessel. The capture of the Eagle S provided a window into Russia’s use of its civilian tanker ships for sabotage and intelligence collection.
When the Eagle S was seized in Finnish waters, it was found in the possession of advanced transmitting and receiving devices enabled for electronic surveillance, as well as an unauthorized Russian national serving as the equipment’s operator. Unlisted Russian crewmen, or “technicians,” as they are often referred to, have since started appearing on shadow fleet vessels in greater numbers through the summer of 2025. Corroborating reports from Ukrainian and European intelligence sources in late 2025 confirmed that several private Russian security companies have supplied the additional personnel.
The influx of military contractors and intelligence officers onto shadow fleet vessels roughly corresponds with a pronounced increase in drone incursions into the airspace of NATO member states along the Baltic littoral region during the fall of 2025. While European officials have been reluctant to directly attribute the incursions to Russia, plausible evidence has emerged linking the drone launches to the Russian military and security personnel identified aboard shadow fleet vessels.
On the night of September 22nd, 2025, three large, fixed-wing drones surveilled the Copenhagen airport for several hours. Two days later, a similar drone incident closed the Aalborg airport, alongside many other civilian airports and military sites across Denmark. These incidents occurred while a shadow fleet tanker named Boracay loitered off the coast nearby. The rash of incidents prompted a boarding of the ship by French naval forces on October 1st, 2025, which revealed two Russian “technicians” on board from the Moran Security Group, a private military company with extensive ties to the Russian military and intelligence services. While the Boracay interdiction notably did not turn up any drones, it appears to have contributed to a working assumption among European intelligence organizations that Russian shadow fleet vessels were being used to facilitate drone incursions against NATO states situated along the Baltic Sea. This assumption has been substantiated over time. A July 2nd, 2026, report by the Institute for International Strategic Studies (IISS) concluded, using a combination of open-source information and interviews with European defense and intelligence officials, that Russian shadow fleet vessels likely served as the platform for some drone incursions in 2025.
Shadow Fleet Vessels as a Vanguard for Conventional Military Operations
Since mid 2025, Russia has begun using the shadow fleet not only for covert intelligence and sabotage operations but also to prepare ships for use as paramilitary vanguards in support of the conventional military. Primarily, this has been done through providing armed escorts for shadow fleet tankers, while also re-registering ships from flags of convenience to the Russian ship registry.
The Russian Maritime Register of Shipping is preparing to identify and re-register between 80–120 tankers to circumvent the “without nationality” clause in Article 110 of the United Nations Convention on the Law of the Sea (UNCLOS), which allows warships to board and inspect vessels suspected of operating without a valid national registry or flag. By putting its shadow fleet vessels under the Russian flag, Russia aims to deter, under threat of military escalation, future interdictions of tankers by Western navies, permitting them to more freely engage in activities that assist the Russian military, like intelligence collection or regional disruption.
Until mid-2025, Russia had not yet needed to claim shadow fleet vessels under its own national flag. This changed with the pursuit and attempted detention of the Jaguar oil tanker by Estonian forces in May 2025. In public comments by Estonian Defense Minister Hanno Pevkur, the Jaguar was suspected of posing a threat to Estonia’s undersea cable infrastructure. To prevent the tanker’s interception, the Russian Air Force scrambled a Su-35S fighter jet, resulting in a violation of NATO airspace. In an effort to avoid further escalation, Estonian authorities withdrew and escorted the ship out of Estonia’s exclusive economic zone, allowing it to return to port in Russia.
Since the attempted detention of the Jaguar, Russian military vessels have begun regularly escorting shadow fleet vessels through the Baltic Sea, English Channel, and North Atlantic. Escorts have included Russian military ships and submarines. While not yet accompanying every vessel, Russia is signaling that it may in the future, implying to NATO militaries that future confrontations may risk kinetic escalation.
The underlying logic of these operations resembles that employed by China in its use of its maritime militia. The maritime militia often serves as an advance guard and paramilitary skirmishing force that is the first to occupy disputed territory and confront foreign mariners to assert Chinese interests at sea. The maritime militia provokes conflict, which, if escalated, triggers a response by the China Coast Guard and People’s Liberation Army Navy. The tactic allows low-level civilian forces to operate aggressively below the threshold of war, putting the onus of military escalation on their adversaries. The maritime militia has been key to China’s strategy of enforcing its claims of sovereignty over the South China Sea.
Though fewer in number than China’s maritime militia, Russia’s shadow fleet of up to 591 vessels is nevertheless formidable. Moreover, as crude tankers, Russia’s shadow fleet vessels are also exceptionally large, making them much harder targets, capable of carrying greater numbers of weapons and more advanced military capabilities, and even employing their hazardous cargo as a weapon.
Changing the Balance of Power at Sea to Defend Sea Lanes and Prepare for War on Land
Russia’s use of shadow fleet vessels for both covert surveillance and sabotage operations and as a paramilitary auxiliary to conventional naval forces suggests a dual strategy inherent to its maritime insurgency. The militarized shadow fleet helps Russia secure maritime commerce and connection to Kaliningrad, while also providing it options for obstructing NATO’s own regional connectivity and setting favorable conditions at sea for a future land campaign against the Baltic States.
As a defensive strategy, Russia’s turn toward mobilizing its civilian fleet for greater force projection is a move designed to help it preserve its sea lanes of communication amid increasing economic pressure. The Kremlin has become increasingly concerned that seizures of its sanctioned shadow fleet tankers, along with Ukrainian drone strikes on its Baltic Sea infrastructure, are part of an escalating plot by the West to deny it access to key global trade routes for exporting oil and strangle its exclave of Kaliningrad. Nikolai Patrushev, head of the Russian Maritime Board, believed to be responsible for organizing the activities of the shadow fleet, has characterized Western enforcement actions against the shadow fleet as akin to a blockade and even a pretext for false-flag operations targeting underwater critical infrastructure.
Russia has ample incentives to protect its oil exports and engage in opportunistic harassment of NATO member states. However, the systematic militarization of the shadow fleet suggests considerations for its use in more offensive operations as well.
For Russia, the shadow fleet may provide additional asymmetric capabilities at sea to help alter the strategic balance in the Baltic region, compensating for conventional inferiority against a NATO whose borders now entirely circumscribe the Baltic.
The Kremlin is conducting its intensifying covert maritime operations amid aggressive military posturing and threatening political messaging. On May 25th, 2026, Putin signed a new law authorizing the use of the Russian military to be deployed abroad to protect Russian citizens facing legal prosecution in foreign countries. The new law was crafted amid growing tensions with the Baltic States over their support for Ukraine, which Moscow alleged in early May 2026 had come to include secret permissions for Ukrainian drones to operate in their airspace to conduct attacks on Russian cities and ports in the region.
These allegations also followed an information campaign promoting a “Narva People’s Republic” of Russian speakers in Estonia, suggesting Russia is interested in instigating a disruptive incident among Estonia’s Russian minority that escalates into arrests and subsequent military action. Underscoring this pretext, on May 25th, 2026, the day the law was passed, Russian state media outlet Izvestia reported that the Foreign Ministry announced it would appeal to the United Nations’ (UN) International Court of Justice to investigate actions by Estonia, Latvia, and Lithuania to oppress their Russian-speaking populations.
Russia is currently unable to launch such an invasion as its military is nearly fully committed to waging war in Ukraine. However, the Kremlin may be attempting to build capability for a future operation, perhaps as soon as 2029, as recently suggested by the Chief of the German Armed Forces, General Carsten Breuer. A new joint investigation released on June 10th, 2026, by state broadcasters in Norway, Sweden, Denmark, and Estonia has found evidence that the Russian military is massively expanding its garrisons along its Western flank near Finland and the Baltic States. According to the report, the new Russian garrisons could support a force of over 115,000 troops, more than a sufficient force to launch a land invasion into the Baltic States.
While Russia is not yet ready to mobilize for a new land invasion, the shadow fleet is a resource the Kremlin can deploy to set conditions at sea and make a future offensive plausible. The consistent deployment of military-linked personnel aboard commercial tankers, along with naval vessel accompaniment, is standardizing their use as potential platforms for future acts of sabotage and kinetic strikes. An attack launched from these dual-use vessels would benefit from plausible deniability that could confuse an initial NATO response and give Russian forces time to make deep advances and seize major population centers that would require great effort to be retaken.
In a worst-case, future scenario, where Russia decided on armed aggression against the Baltic region and NATO’s deterrence efforts fail, Russian shadow fleet tankers could be used to sever telecom cables and conduct electronic attack operations that disrupt communications between NATO member states. Similarly, the use of shadow fleet tankers to launch drones to surveil NATO military bases could be expanded into kinetic strikes to attack airfields and ports near the Baltic. Additionally, shadow fleet vessels could themselves be used as weapons, deliberately colliding with NATO vessels or destroying their highly explosive cargo to create fuel spills that wreak havoc on the congested waterways of the Baltic. Russia’s ongoing maritime insurgency in the Baltic Sea is actively shaping and rehearsing the conditions under which such an operation could be launched.
Contesting Russia’s Maritime Insurgency Through Greater Enforcement
NATO’s Baltic Sentry operation is a meaningful start for combatting the threats posed by Russia’s maritime insurgency in the Baltic Sea. However, current enforcement and monitoring efforts are still inadequate, as the vast majority of shadow fleet vessels continue operating uncontested in the region. Russia has sought to maintain the status quo by bringing these vessels under its flag to deter boardings and seizures. Boardings, seizures and other enforcement actions not only serve as an important means of stopping Russia’s illicit oil trade but also of deterring and investigating the shadow fleet’s use in covert paramilitary operations.
Concerns over escalation with the Russian military are understandable; however, lessons learned from maritime counterinsurgency operations by the US and regional allies in the South China Sea suggest that routine enforcement of international law can reduce the threat of military escalation over the long-term. While China has succeeded in establishing control over large areas of the sea, determined efforts at consistent patrols and international diplomatic pressure to uphold international maritime law have frustrated its attempts to permanently occupy certain strategic locations such as Scarborough Shoal.
While the South China Sea and Baltic Sea are distinct theaters of operation, a general lesson can be inferred: enforcement of international law by multinational allied coalitions can succeed in denying malicious actors time and space to build capacity and reshape regional order through covert maritime operations. Arguably, this type of maritime counterinsurgency may be better suited to the Baltic Sea against Russia than in the South China Sea against China. NATO is a much more cohesive military alliance than those in the Indo-Pacific, and it controls almost all strategic territory along the waterways of the much smaller Baltic Sea.
France and the U.K., two larger NATO powers active in the region, should take the lead in enforcement efforts against the shadow fleet. Routine operations by more powerful European NATO members, with US backing, will be essential to deny Russian-linked vessels uncontested maneuver through the Sea, while denying Russia opportunities to target smaller regional powers less able to resist its aggression.
To manage escalation while establishing firm red lines regarding behavior in the Baltic, interdictions should target vessels remaining outside of the Russian flag registry, with suspected dual-use purpose or capabilities aboard. Even if Russia begins taking more vessels under its own flag to circumvent this attempted sea denial, doing so will create additional burdens on an already overstretched Russian military to accompany and defend them.
In the long term, this will make Russian shadow fleet vessels easier to track, reducing the risk that they are used as platforms for strategic surprise attacks in the style of Ukraine’s Operation Spider Web against Baltic littoral targets in NATO member states.
