How Russia systematically spies, through the phantom fleet, on the EU and NATO. Moscow has widely militarized the fleet with Wagner fighters and GRU agents - OCCRP Investigation

Russia has militarized its shadow fleet with former Wagner fighters and GRU personnel, turning the Baltic Sea into a high-risk area where commercial ships become platforms for reconnaissance and potential sabotage against European critical maritime and energy infrastructure, raising the stakes of any incident to a NATO-Russia crisis level, according to a journalistic investigation by the Organized Crime and Corruption Reporting Project (OCCRP).

Russia has sent teams of two unqualified personnel, with backgrounds in Wagner, GRU, airborne troops, police, or other security structures, on sanctioned oil tankers from the shadow fleet in the Baltic Sea. An analysis of crew lists for 20 voyages shows that at least 13 out of 17 such individuals have ties to Wagner or military services, being embarked especially after July 2025 on the Baltic route, not on other routes, indicating a named operation.

European intelligence officers describe them as undercover teams protecting vessels meant to discourage inspections, capturing ships under false flags or suspected of sabotaging submarine cables, raising the risk of confrontations with potentially armed personnel. For Moscow, protecting these shipments is vital: about 40% of oil exports pass through the Baltic and finance the war.

According to OCCRP, CNN already reported last year on the militarization of shadow ships and the spying on European shores, but the current investigation shows that this is a systematic phenomenon and widespread on a large scale.

In the past year, European authorities have stopped vessels belonging to Russia's shadow fleet, most often because they were sailing under false flags or were suspected of being involved in the destruction of underwater cables, but with these veterans on board, any intervention may be met with armed resistance.

A senior European intelligence officer, who spoke on condition of anonymity, stated that the presence of security officials on ships raises the stakes of any intervention efforts in Russia's oil trade.

"Two potentially armed individuals certainly changes our risk calculation when we have to decide whether to stop or seize the oil tanker. Russia believes this makes NATO member states along the Baltic Sea more cautious," said the official.

For Sean Wiswesser, a former senior CIA operations officer specializing in Russian intelligence and military, the trend suggests that Moscow is also using shadow fleet ships as platforms for "sabotage" and "other intelligence operations, such as potential drone deployments."

"It is certainly not just about protecting Russia's oil," he said. "No other place in the world has there been so many cable cuts in such a short time as there have been in the last two years in the Baltic Sea."

Thus, the involvement of former military personnel transforms these ships into hybrid platforms: their objectives seem to combine economic protection (securing revenue flows), intelligence missions (observing Western procedures, mapping military presence, possible reconnaissance/sabotage with drones), and disciplinary control of crews, to prevent collaboration with EU/NATO authorities.

Read also:

ANALYSIS What is and how does Russia's shadow fleet operate