Russian personnel with links to the country’s military and security services have engaged in spying in European waters while working covertly on ships carrying Russian oil, Western and Ukrainian intelligence sources exclusively told CNN.
Since the full-scale invasion of Ukraine in 2022, Moscow has built up a so-called shadow fleet of hundreds of tankers. These vessels carry Russia’s oil from its Baltic and Black Sea ports despite Western sanctions, earning the Kremlin hundreds of millions of dollars every year.
In recent months, some of these ships – often registered to unrelated countries – have acquired extra crew members shortly before leaving port, according to Ukrainian intelligence. CNN has seen two crew lists for these vessels in which the staff is predominantly non-Russian – but the documents also feature a pair of Russian names, and their Russian passport details, at the bottom of the roster.
The addition of Russians with security backgrounds to the crews of the shadow fleet is causing alarm in European capitals as it illustrates how brazen the Kremlin’s tactics have become.
Speaking to multiple intelligence sources, CNN has established that several of these men are employed by a secretive Russian company called Moran Security. Some of them are mercenaries, they said, who have previously worked for Russia’s private military contractors, such as the notorious Wagner group.
Moran is a private security firm with ties to Russian military and intelligence, Western intelligence sources said. The firm was sanctioned by the US Treasury in 2024 for providing “armed security services” for Russian state-owned enterprises to “intensify the pressure on Russia for its continued cruel and unprovoked war against Ukraine.”
Moran personnel have been placed on multiple tankers in Russia’s shadow fleet and are frequently the only Russians on board, according to both Ukrainian and Western intelligence sources.
Ukrainian intelligence said it observed the introduction of these guards on board the shadow fleet about six months ago.
One Western intelligence source added that, on one occasion, Moran personnel took photographs of European military installations from one of the shadow fleet vessels. The source would not provide further details.
CNN investigates alleged Russian spying on board shadow fleet
The Russians on board are also tasked with keeping an eye on the ships’ captains because most of them are not Russian citizens, according to Oleksandr Stakhnevych of the Foreign Intelligence Service of Ukraine.
One Western intelligence source echoed that assessment, saying that “in Moran’s case, they are not engaged in direct conflict. They ensure that their contractors act in line with the Kremlin’s interests.”
The presence and activities of the Russians on board these ships are of growing concern to Europe’s security services given the number of vessels in the shadow fleet sailing close to the continent’s coastlines and the potential for espionage.
Security officials say that putting armed men with military backgrounds on these vessels is yet another tool in the Kremlin’s arsenal of hybrid warfare techniques designed to cause disruption in Europe. Intelligence sources also told CNN that these men have engaged in sabotage but did not provide further details.
“Having private armed groups onboard shadow fleet vessels is this classic plausible deniability,” Jacob Kaarsbo, a former Danish intelligence official, told CNN.
“Everyone with even half a clue knows that these guys take their orders from the Russian state but it’s hard to prove,” he added.
CNN presented the findings of Ukrainian and Western intelligence that Moran operates in coordination with Russian intelligence and is involved in espionage and sabotage across Europe to Alexey Badikov, who the US Treasury had listed as the company’s CEO. Reached by phone Badikov told CNN he is the deputy director of the Moran Security Group and is based “mostly” in St. Petersburg, but declined to comment on either accusation.
CNN pieced together Moran’s recent activities on one vessel by reviewing Ukrainian intelligence and obtaining assessments from Western intelligence, as well as analyzing satellite imagery and maritime data.
That ship is a sanctioned tanker called the Boracay, which has changed its name and where it is officially registered frequently over the past three years.
On September 20, two Russian men boarded the Boracay at the Baltic Sea port of Primorsk near St. Petersburg, according to records obtained by CNN. Satellite imagery and ship tracking data showed the vessel at the port on this date.
The men were not traditional mariners but described on the crew roster simply as technicians. They were the only Russians aboard the ship, which was otherwise crewed by citizens of China, Myanmar and Bangladesh, according to the list.
Ukrainian foreign intelligence identified the two men and CNN confirmed their names with Western intelligence sources.
One of them is a former police officer who previously worked for the Russian private military company Wagner, according to a Western intelligence source. Neither of the men have much of an online profile, and their activities on board the Boracay are unclear.
When asked if he could confirm if the two men worked for Moran security, Badikov told CNN, “I am not in a position to confirm.” When prodded further, he said he has “no idea.”
During another voyage made by the Boracay in July, one man on board had served in the special police regiment of Russia’s interior ministry, and another held the Russian defense ministry as his registered address, according to Ukrainian foreign intelligence.
Many shadow fleet vessels travel through the Baltic Sea, a key maritime chokepoint bordering several NATO states, including Denmark and Sweden, whose authorities pay close attention to the ships.
Danish sea pilots, who board the tankers to help them navigate the straits, say there are frequently Russian men on board who seem very much in charge and are hostile toward inspectors.
“I have personally seen at least two shadow fleet boats where crew is mostly non-Russians, but suddenly you’ll see one or two Russians as part of the list,” said Bjarne Caesar Skinnerup, one of the most experienced officers at Denmark’s state pilot service DanPilot.
Sometimes, he said, they are wearing uniforms, which on one occasion appeared to be a Russian Navy camouflage uniform.
“On board, it seems they run the ship – have more power than even the captain,” Skinnerup told CNN.
In July, DanPilot sent an email to Denmark’s Emergency Management authority, saying: “There are more and more reports of ships that have a few extra crew members, probably Russian, who are wearing military uniforms and are very active in photographing, among other things, bridge areas.”
The email was shared with CNN by the investigative outlet Danwatch, which has reported extensively on Russia’s shadow fleet.
Meanwhile, a spokesperson for Sweden’s coast guard told CNN it had previously seen men on board shadow fleet ships who did not seem to belong to a merchant vessel.
A senior Swedish navy commander, Ewa Skoog Haslum, said last year that some Russian-linked tankers in the Baltic had been carrying “antennas and masts that typically do not belong” to merchant ships.
The Boracay made headlines in September as it carried a cargo of Russian oil to India.
Two days after leaving Primorsk, on September 22, the ship was off Denmark’s coast just as a series of drone sightings disrupted traffic at Copenhagen airport. Other drones flew near Danish military bases.
At the time, Copenhagen police said they were investigating whether ships in the area had launched the drones but would not name which ones.
Ship tracking data shows the Boracay traveled south along Denmark’s western coast on the evening of September 24, when other drones were reported flying north of the city of Esbjerg and near several nearby airports.
A Western intelligence source told CNN, “the coincidence between the incident and the presence of the vessel in the area can be regarded as suspicious.”
Days after these incidents, the French military boarded the Boracay off the coast of Brittany in northwest France, after it failed to provide proof of the boat’s nationality. No drones were found onboard.
It was only then that the two Russians were discovered to be among the crew, according to Western security sources. They were questioned in private, according to the sources.
The Chinese captain was arrested and subsequently charged by French authorities with “disobeying instructions.” The Boracay had been claiming to be sailing under the flag of Benin since September, but prosecutors in France said they were investigating the “lack of documentation of the ship’s nationality and flag affiliation.”
At the time, French and Danish authorities declined to comment on whether the French investigation into the Boracay was related to the drone incidents over Denmark.
Kaarsbo, the former intelligence official, said that while it’s not possible to prove whether the men are trained drone pilots, “these guys are not just innocent sailors… there’s a decent likelihood that they are capable of launching drones.”
Badikov, however, dismissed the premise, telling CNN “it’s completely crazy” that “the crude oil tanker would launch the drones over Denmark”.
“If you would like to use drones, you will use from fishing vessels… not from the big oil tanker,” he added, because “it is technically unsafe and nobody will do it”.
One European intelligence official told CNN: “Our working assumption is that Russian ships have been involved in at least some of the unexplained drone events close to European coastlines.”
The UK’s new foreign intelligence chief, Blaise Metreweli, said this week that “Russia is testing us in the gray zone with tactics that are just below the threshold of war,” such as “drones buzzing airports and bases, aggressive activity in our seas above and below the waves.”
Ukrainian intelligence sources shared with CNN the names of eight Russian men who had been on board other ships in the shadow fleet and had sailed a similar route around Europe in the past year. Several had links to the Russian military.
CNN was unable to reach the management of the Boracay.
After passing Europe the vessel continued to Vadinar port in western India, where it unloaded a cargo of Russian oil on November 1, according to Kpler, a global data and analytics firm.
Moran Security Group was founded in 2009 and had extensive ties with the infamous Wagner private military contractor, as well as Russia’s military and intelligence services, according to Western intelligence sources.
Two previous Moran directors, Evgeny Sidorov and Vadim Gusev, founded the Slavonic Corps in 2013, the private military company from which Wagner emerged. Wagner Telegram channels have featured Moran personnel at sea, and more than a decade ago the company was involved in counter-piracy off Somalia.
The social media profiles of some Moran personnel also show they were linked to Wagner, which was effectively liquidated after its then boss Yevgeny Prigozhin launched an abortive revolt in Russia in 2023.
On its website, the Moran group says it seeks “active-duty or retired officers who have served in special forces units (GRU, airborne troops, naval commandos) and who have completed at least two deployments.” The GRU is Russia’s military intelligence service.
Moran’s president Vyacheslav Kalashnikov is a retired lieutenant colonel of Russia’s FSB intelligence service, while two of the managers listed on its website are former commanders of nuclear submarines.
The group advertises a wide range of services: international logistics, maritime and onshore physical security, as well as intelligence operations. Moran personnel had a role in Syria in support of the now ousted Assad regime, as did Wagner, according to Ukrainian intelligence.
Last year’s US Treasury designation said the company “offers armed security services and has operated under contract to Russian state-owned enterprises.” One of these organizations is Sovcomflot, Russia’s state-owned shipping company, which is listed on Moran’s website as a client.
Ukrainian intelligence said it had observed the introduction of the teams on board the shadow fleet about six months ago.
Moran has had a checkered history. The company appears to have been closed in Russia in 2017 and then opened an office in the former Soviet republic of Georgia the following year, according to the country’s corporate register. That appears to have been a short-lived presence.
Now, however, Moran Security is registered in both Moscow and Belize and the group appears to have a new and growing mission. Belize is widely recognized as a jurisdiction for setting up shell companies that mask the real beneficiaries of a business.
As Russia’s shadow fleet appears to be expanding in scope and ambition, Europe is facing a delicate dilemma.
Danish sea pilot Skinnerup believes there should be tougher joint international action to intercept ships without insurance and proper registration, as is the case with many of the shadow fleet.
“Do we dare to do that? Because what would be the reaction from Russia?” he asked.
“That’s why Danish government has not done anything yet, because we are an extremely small country, and if we have to do something, it has to be a joint European thing.”
Credits:
Reporters: Victoria Butenko, Saskya Vandoorne, Katie Polglase, Pallabi Munsi,
Tim Lister and Darya Tarasova
Senior Investigative Editor: Ed Upright
Supervising Investigative Producer: Barbara Arvanitidis
Senior Video Editor: Oscar Featherstone
Managing Photojournalists: Christian Streib and Alex Platt
Associate Editor, Digital Video: Henry Zeris
