Russia is using “shadow fleet” vessels not only to evade sanctions but also to wage hybrid warfare targeting NATO members, according to the monitoring firm ACLED.

Since the start of Moscow’s full-scale invasion of Ukraine in 2022, Russia has been accused of stepping up hybrid warfare maneuvers to destabilize the alliance, particularly on its eastern flank through cyberattacks, disinformation campaigns and drones. ACLED, which stands for Armed Conflict Location and Event Data, has now released a report linking these operations by shadow fleet vessels to the cutting of cables and drone flights over critical infrastructure in the Baltic and North Seas.

The monitor told Newsweek that what is worrying is the recently increasing Russian readiness to deploy military ships and jets to provide protection for shadow fleet vessels, possibly diverting attention and intelligence assets from them. It predicts more cable damage and drone activity enabled by the shadow fleet will likely continue against Nordic and Baltic states over the next two years.

“We may also witness deniable acts of sabotage aimed at surveillance and communications infrastructure set up to monitor shadow fleet movements, as well as intimidations aimed at naval capabilities of Nordic countries and their allies,” ACLED told Newsweek.

What Is Russia’s Shadow Fleet?

The ownership of shadow fleet vessels is reorganized, often through shell companies, to obscure their connections to Moscow, and the vessels are often older with less stringent insurance, posing safety risks to the coastal countries they pass by.

The Ukrainian government said last month that there were 1,392 vessels in Russia’s shadow fleet, which transports up to 80 percent of Russia’s seaborne crude oil exports, allowing it fund its military machine and wartime economy.

ACLED said the shadow fleet’s threat is concentrated in the Baltic Sea and flourishes because of the opaque nature of the vessels’ ownership, the infrastructural density of the sea and legal restraints on what states can do about suspicious vessels.

The maritime intelligence company Windward said 2,313 Russian-affiliated vessels visited the Baltic Sea between February 2024 and February 2025, with only 436 sailing under the Russian flag.

Marine Incidents Linked to Shadow Fleet

The European seabed carries a dense network of electricity, gas and telecommunications links that underpin daily life and financial markets. The European Union Agency for Cybersecurity notes that more than 97 percent of global telecommunications traffic passes through submarine cables, supporting an estimated $10 trillion in financial transactions each day.

Damage to even a single cable can therefore disrupt energy supplies, internet connectivity or cross‑border electricity flows, making these assets attractive targets for coercive pressure. According to ACLED, there has been a series of recent incidents that have been linked to the shadow fleet.

In December 2024, a subsea electricity transmission line, Estlink 2, was ruptured in an incident that cut two-thirds of the electricity transfer capacity between Estonia and Finland and took seven months to repair. Helsinki suspected this was caused by the shadow fleet vessel Eagle S. However, a Finnish court dismissed the case over lack of jurisdiction and proven intent.

Since 2025, four undersea cables have been damaged in the Baltic Sea, ACLED said. Sweden seized the Vezhen cargo ship in January 2025 although prosecutors ruled that the damage to the Sweden-Latvia telecom cable was accidental.

In February 2025, damage to the C-Lion1 cable between Germany and Finland could not be attributed to any vessel. In May 2025, Polish authorities observed the shadow fleet tanker Sun circling the SwePol cable before being driven off by a Polish aerial patrol.

Last New Year’s Eve, Finnish special forces descended onto the deck of the Fitburg vessel as it traveled across the Gulf of Finland, heading from St. Petersburg to Haifa in Israel.

The Turkish vessel, registered in Saint Vincent and the Grenadines, had caused an outage on the optical fiber cable linking Helsinki and Tallinn by dragging its anchor along the seabed.

Sanctioned Russian steel was found aboard the vessel. While Helsinki has not said the cable damage was intentional and an investigation is ongoing, ACLED said the case “offers an unusually clear window into the role of Russia’s shadow fleet.”

Drone Threats Linked to Russia

Over the past two years, Russian-attributed drone activity over critical European infrastructure has raised alarm among NATO members. ACLED listed 54 suspected drone incidents in 2025 across Europe’s coastal waters and inland within a range of 90 miles from the coast. These included overflights of airports and naval and military bases.

ACLED said while these incidents were tricky to categorically pin on Russia, “strong circumstantial evidence of shadow fleet drone launches exists.”

In September, Germany seized the Scanlark after allegations that it had launched a reconnaissance drone over a German navy frigate at the Kiel naval base. Meanwhile, the sanctioned tanker the Pushpa, which sailed between Russia and India, was tracked off the Danish coast in the same month and seized by French naval forces during a wave of drone incidents that closed airports in Denmark.

How Has Europe Reacted?

NATO has launched the Baltic Sentry to counter the Russian drone threat, and there have been eight European enforcement actions against shadow fleet vessels—three in 2025 and five in the first four months of 2026, ACLED reported.

Russia responded with military ships such as the corvette Boikiy, which escorted sanctioned tankers Selva and Sierra through the English Channel in June 2025.

The previous month, a Russian Sukhoi Su-35 violated Estonian airspace to escort the Gabon-flagged tanker Jaguar, which Tailinn tried to intercept. In March, the Kremlin said Russia was considering escorting shadow fleet vessels with naval warships.

In March, the British government said it would board shadow fleet vessels that had been sanctioned by the U.K. and were transiting through U.K. waters. ACLED told Newsweek that Baltic Sentry missions and developing surveillance capabilities would require intense cooperation between NATO allies, long work hours for patrols, and innovation through unmanned and even autonomous vehicles.

The export capacity in the Baltic Sea is under danger amid repeated Ukrainian drone strikes on Russian oil terminals in the ports of Ust-Luga and Primorsk.

But ACLED said the actions of Russia’s shadow fleet were “likely to continue as long as Russia’s export capacity is unharmed and demand for oil remains high worldwide.”