From Wagner to GRU, Russian Military Men Are Manning Moscow’s Shadow Fleet

Cargo ships transporting sanctioned Russian oil through the Baltic Sea are routinely setting sail with two extra crew on board: a pair of Russian men with backgrounds in security organizations.

Banner: James O’Brien/OCCRP

Key Findings

• Crew lists obtained by reporters show that tankers carrying sanctioned Russian oil have been regularly departing the country's Baltic Sea ports with a pair of extra Russian crewmen.
• More than a dozen of these men were found to have links to Russian security organizations including the Wagner Group, paratrooper units, and Russia’s military intelligence service.
• European intelligence officers say these covert "vessel protection teams" have been deployed to deter authorities in the Baltic Sea from boarding or seizing the sanctioned ships.
• Russia relies heavily on the Baltic route to transport oil that remains a key income stream for its wartime economy despite Western sanctions.

On December 27, 2025, the sanctioned oil tanker Kira K was docked in the Russian port of Ust-Luga, deep within the eastern reaches of the Gulf of Finland. It was preparing to haul 734,000 barrels of crude oil belonging to Lukoil, the blacklisted Russian energy giant, out to the global market.

According to the ship's crew list, the vessel was manned by a mix of sailors from Myanmar, China, and Bangladesh.

But there were two other men on board as well. The tanker’s crew manifest lists Russian citizens Denis Enin and Aleksandr Kamenev as “supernumeraries” — a term for personnel who fall outside the standard operating crew.

In the data fields detailing each crew member’s seafarer diplomas and qualifications, only two letters appear next to the Russian names: NA. Not available.

That is because these men are not your normal sailors.

Kamenev, 45, and Enin, 48, are both veterans of the Wagner Group, the notorious Russian mercenary outfit that fought in conflicts around the world on Moscow’s behalf for nearly a decade until 2023.

Kamenev was in Syria and Russian-occupied Donetsk during the height of Wagner’s operations there, leaked border crossing data shows. Enin, for his part, has listed his registered address as that of a military unit in southern Russia.

The two men’s presence on the Kira K is not incidental. A joint investigation by Delfi, Helsingin Sanomat, iStories, and OCCRP has identified a systematic pattern of militarizing Russia’s so-called shadow fleet, the term used to describe the hundreds of aging and opaquely owned vessels that Moscow uses to circumvent Western sanctions on its oil.

Credit: Andres Putting/Delfi Meedia

The interception of the oil tanker Kiwala by the Estonian Navy in the Gulf of Finland (Baltic Sea) on 11 April 2025 as it sailed toward the Russian port of Ust-Luga.

Credit: Andres Putting/Delfi Meedia

The interception of the oil tanker Kiwala by the Estonian Navy in the Gulf of Finland (Baltic Sea) on 11 April 2025 as it sailed toward the Russian port of Ust-Luga.

By analyzing crew lists from sanctioned tankers across 20 journeys, reporters found that vessels departing Russia's Baltic Sea ports now regularly carry two-man teams with military backgrounds.

Of the 17 Russian men aboard these ships who lacked maritime credentials, 13 were found to have links to the Wagner Group or state security organizations such as Russia’s military spy service, the GRU. Reporters established these connections through an array of leaked Russian databases, a registry of Wagner mercenaries from 2021, and information gathered from European intelligence agencies and open sources.

These extra crewmen or “technicians,” as they are sometimes referred to, started appearing on vessels after July 2025, according to the crew lists obtained by reporters. They are notably absent from a limited sample of crew manifests for vessels traveling Black Sea or Pacific routes during the same period, suggesting a targeted presence in the Baltic Sea.

The findings add new evidence to warnings from Western intelligence agencies, first reported by CNN late last year, that Russians with security backgrounds were boarding Moscow’s shadow fleet tankers and engaging in spying near European shores. The crew manifests indicate the scale and systematic nature of the phenomenon, and provided names and other identifiers that allowed reporters to confirm the men’s military pasts.

Intelligence sources from multiple European countries told reporters that these so-called "vessel protection teams" have been deployed to deter authorities from Baltic Sea nations from boarding, inspecting, or potentially seizing the ships that form an economic lifeline for Moscow.

European authorities generally cannot stop such vessels solely for being sanctioned. But they have in the past year halted tankers belonging to Russia’s shadow fleet on a handful of occasions, often for flying a false flag or for being suspected of damaging undersea cables.

But with battle-hardened veterans on board, any such intervention could risk facing an armed resistance.

“The goal of this activity is to protect the Russian Federation's revenue base from potential threats, be it [Ukraine-organized] sabotage” or other interference from the West, the head of Estonian Defense Forces Intelligence Center, Colonel Ants Kiviselg, told Delfi.

"Placing ship protecting crews on these ships shows that the goods moved by the shadow fleet and the revenue derived from them are important to Russia,” he added.

Russia relies heavily on the Baltic route to transport oil that generates millions in revenue for the state’s war chest on a daily basis. According to the Kyiv School of Economics, the country exports roughly 40 percent of its crude oil specifically through the Baltic Sea.

But some analysts believe the special crew members appearing on the Baltic route have been deployed to do more than secure Russia’s economic interests.

Glen Grant, a defense advisor and a former U.K. defense attaché to Estonia and Latvia, noted that by sailing through the Baltic unimpeded, these former military men are also able to gather valuable information, including how Western authorities engage with the sanctioned tankers.

“Collectively that gives them a complete idea of our strength, resolve, philosophy and our military capability,” he said. “The fact that they're carrying oil and that they get money in [for Russia] as well is a bonus.”

Russia’s Ministry of Defense, Lukoil, and the company managing the Kira K did not respond to questions sent by reporters. When reached on Telegram, Enin, one of the Russians listed as part of the Kira K’s crew, denied having been aboard the ship and did not answer further questions. His compatriot Kamenev did not respond to questions sent to his email.

A Paratrooper and an Intelligence Officer

The Russian crewmen identified by reporters are not just affiliated with the Wagner group, which is accused by the EU of carrying out grave rights abuses everywhere from Ukraine to Syria and the Central African Republic. (The organization was effectively disbanded after its leader Yevgeny Prigozhin staged a failed rebellion in June 2023, and then died in a plane crash two months later).

Credit: Feodor Larin/Anadolu Agency/Anadolu via AFP

Members of the Wagner Group in Rostov-on-Don, Russia, on June 24, 2023.

Credit: Feodor Larin/Anadolu Agency/Anadolu via AFP

Members of the Wagner Group in Rostov-on-Don, Russia, on June 24, 2023.

The shadow fleet crews also include Russians from a range of other military backgrounds, such as Aleksandr Malakhov, a "supernumerary" who rode on the Kira K in October 2025.

The 50-year-old is a veteran of the 22nd Spetsnaz Brigade, a special forces unit under the Russian military intelligence service known as the GRU, a European intelligence source confirmed to reporters. (Leaked data also shows Malakhov's registered address was listed as the Spetsnaz unit in southern Russia’s Rostov Oblast). He did not respond to questions sent to his email address.

Teaming Up On Other Tankers

Malakhov and his partner, a former Wagner mercenary named Viktor Alexandrov who uploaded a photo of himself in 2021 wearing camouflage gear in Syria, have also ridden together on other oil tankers.

As Russian investigative journalism outlet Dossier Center and the Norwegian Broadcasting Corporation (NRK) reported in January, and which a crew manifest obtained by OCCRP’s partners confirms, the men were aboard the Qendil in September 2025 as it began a journey carrying oil cargo in the Baltic Sea.

Though the men were not on board at the time, two months later the Qendil was the first tanker to be hit by a Ukrainian drone in the Mediterranean while it was transporting Russian oil from the Black Sea to India.

When reached for comment on Telegram, Alexandrov admitted to serving as a security guard on the Kira K but said it “was a very long time ago.” When asked about his duties, he replied, "I was purely an observer on the ship.” He did not respond to further questions about who had hired him.

In August 2025, the Kira K carried another Russian duo through the Gulf of Finland: 50-year-old Dmitry Frolov and 38-year-old Juri Tsvetkov. Reporters found these two men have been travel companions before. In both 2022 and 2023, the pair flew together on Russian Air Force aircraft, according to leaked Russian border crossing data.

When contacted on Telegram, Frolov denied having been at sea. After reporters said they possessed proof he was present on the Kira K, he wrote: “Forget it, don't write. Otherwise, I'll turn [you] in to the FSB.” His shipmate Tsvetkov did not respond to questions sent to his email address.

Another sanctioned tanker known as the Lebre, meanwhile, has carried "technicians" who worked for the Russian Ministry of Defense and the Ministry of Defense of the Russia-backed breakaway territory of Transnistria, according to information provided by the Foreign Intelligence Service of Ukraine, which said it was in possession of the men's employment records.

Credit: Screenshot/novostipmr.com

Reporters found one of the crewman who Ukrainian intelligence said had worked for Transnistria's Ministry of Defense pictured in a Russian news article (second from the left) about a weightlifting competition in which the ministry participated.

Credit: Screenshot/novostipmr.com

Reporters found one of the crewman who Ukrainian intelligence said had worked for Transnistria's Ministry of Defense pictured in a Russian news article (second from the left) about a weightlifting competition in which the ministry participated.

When reached for comment, the crewman linked to Russia’s defense ministry denied ever having been employed there, and said he had worked on the tanker as a cook. He confirmed that the other Russian on board who was also listed as a technician had, however, served as a guard. That crewman did not respond to requests to comment.

The ship’s manager, Anchor Elite Shipmanagement, said it was “not in a position to confirm the allegations presented” about the men, but that their presence on the ship was “in no way connected with military or private military activities,” and they were engaged solely in “galley duties” and “deck-related work.”

Another shadow fleet vessel, which made headlines when it was seized by French authorities in September 2025, has also carried a paratrooper serving in the Russian Army, according to an intelligence officer in the Baltic Sea region, who spoke on the condition of anonymity due to the sensitivity of information provided.

Reporters found that a Russian with the same name and date of birth, Stanislav Babichev, has a profile on a social media platform that lists a military training school — 332 Airborne Forces Warrant Officer School — as his education. He did not respond to questions sent to his email address.

Credit: Screenshot/Станислав Бабичев/ok.ru

The 332nd Airborne Forces Warrant Officer School is listed as his education on Stanislav Babichev’s social media profile.

Credit: Screenshot/Станислав Бабичев/ok.ru

The 332nd Airborne Forces Warrant Officer School is listed as his education on Stanislav Babichev’s social media profile.

An analyst with the Finnish Security and Intelligence Service (SUPO) said that these Russian security teams are likely tasked with preventing the rest of their ship’s crew from complying with foreign authorities.

"The guards are likely on board to ensure that other Baltic Sea countries do not take control of these ships too easily,” the analyst told Helsingin Sanomat on the condition of anonymity.

They also may act as “liaisons” for those who hired them, the analyst added. “It can be assumed that if, for example, Russian military forces and naval vessels are operating in the same area and escorting these ships, then the task of these men may be to facilitate communication.”

Ukraine’s Foreign Intelligence Service told reporters these men are typically hired by the Russian private security companies RSB Group and Moran Security Group.

RSB Group, whose website says it has “protected tens of merchant and scientific Russian and foreign vessels,” employs former Russian intelligence officers and other combatants, and has trained units for the war in Ukraine, according to EU and U.S sanctions notices. Moran Security, which also offers a variety of maritime protection services on its website, has also been sanctioned by the U.S. for providing services to Russian state enterprises.

The companies did not respond to requests to comment.

Raising the Stakes

The deployment of these covert security agents on commercial vessels comes amid a marked increase in Russia’s direct military presence in the Baltic.

Last May, the Estonian Navy escorted the EU-sanctioned oil tanker Jaguar out of Estonian economic waters after it was found to be sailing without a valid flag.

Russia responded by sending a fighter jet that violated Estonian airspace.

"Russia sees the shadow fleet as a very important economic lever,” said Estonian Navy Commander Ivo Värk, adding Russia's naval presence in the Baltic has quadrupled since 2022.

“For them, it is a matter of high national interest. Russia is prepared to protect this by all means.”

A high-ranking European intelligence officer who spoke on the condition of anonymity said the presence of security officials on the ships raises the stakes of any efforts to intervene in Russia’s oil trade.

"Two potentially armed individuals certainly changes [our] risk calculus when we must decide whether to stop or seize the tanker. Russia believes this makes NATO member states along the Baltic Sea more cautious," the official said.

For Sean Wiswesser, a former CIA senior operations officer with a specialization in the Russian intelligence services and military, the trend suggests Moscow is also using its shadow fleet vessels as platforms for “sabotage” and “other intelligence operations, like potentially deploying drones.”

“It's definitely not just about protecting Russia's oil,” he said. “Nowhere else in the world have there been as many cable cuts, and in a short time, as there have been in the past two years in the Baltic Sea.”

Additional reporting by Kaur Maran, Greete Palgi, Marta Vunš (Delfi).

Correction, March 13, 2026: The "key points" of this story were amended to reflect that Russia's military intelligence service was among the security organizations linked to the Russian crewmen.