Adversary Intelligence — 2026-07-13

CIMSEC Analysis Identifies GRU and FSB Personnel Operating Through Russia Shadow Fleet Vessels Near NATO Straits

BLUFDocumented GRU and Wagner personnel aboard shadow fleet tankers confirm Russian intelligence exploitation of NATO's maritime chokepoints, yet allied governments remain unlikely to formally attribute the pattern within three months.

A joint investigation by Delfi, Helsingin Sanomat, iStories, and OCCRP found that sanctioned Russian oil tankers departing Baltic ports have carried two-man "supernumerary" crews since July 2025, with 13 of 17 identified Russians linked to Wagner Group or state security services including the GRU 1. Crew lists reviewed by reporters name individuals such as Wagner veterans Denis Enin and Aleksandr Kamenev aboard the tanker Kira K, and GRU Spetsnaz veteran Aleksandr Malakhov on the same vessel 1. CNN separately reported, citing Western and Ukrainian intelligence sources, that Moran Security Group personnel with Wagner or Russian security ties have boarded shadow fleet vessels including the Boracay, where two Russian men were discovered when French authorities boarded the ship off Brittany in September 2. Danish pilot service DanPilot documented uniformed men, some in what appeared to be Russian Navy camouflage, photographing bridge passages and strategic infrastructure during Baltic transits, and reported the pattern to Danish authorities 3. A CIMSEC analysis notes the Boracay has sailed under at least three names and flags, including a falsified Benin registration, and that Russia is re-registering roughly eighty previously sanctioned vessels domestically 4.

Analysis
Three independent open-source investigations naming specific GRU, FSB, and Wagner veterans aboard shadow fleet tankers document a militarized crewing pattern Moscow has sustained for at least 13 months without allied operational consequence. A NATO member state publicly confirming intelligence-linked personnel aboard a shadow fleet tanker in an incident distinct from Kira K or Boracay is unlikely within the next three months, given that governments including France have consistently routed attribution through journalist intermediaries rather than making formal state confirmations. Moderate confidence reflects convergence across OCCRP, Danwatch, and CNN investigations, though no allied government has yet attributed intent to the documented presence.

4 sources