French authorities discovered two Russian intelligence operatives working under commercial cover aboard an oil tanker intercepted last year, revealing Moscow’s use of merchant shipping for espionage activities.
Covert operatives aboard commercial vessel
The individuals were found on the Boracay tanker when French forces boarded the vessel in September 2025. Both men were employed by the private Russian security company Moran Security Group, which analysts believe maintains connections to Russian intelligence services. Their duties included vessel security, monitoring the crew, and collecting intelligence information during the ship’s operations in European waters. According to a recent disclosure, one operative previously served with the Wagner private military company before transitioning to maritime security roles.
Links to Russian security apparatus
Security experts note that Moran Security Group was founded by former officers of Russia’s Federal Security Service (FSB), creating a direct link between commercial operations and state intelligence structures. This pattern mirrors Moscow’s established model of using private contractors to conduct operations while maintaining plausible deniability. The arrangement allows the Kremlin to distance itself from direct accusations while advancing intelligence-gathering objectives through ostensibly commercial entities operating in international waters.
Shadow fleet’s dual purpose
The Boracay forms part of Russia’s so-called “shadow fleet” – older tankers operating under third-country flags with opaque ownership structures that circumvent Western sanctions on Russian oil exports. Beyond economic evasion, these vessels now appear to serve dual purposes, providing platforms for monitoring European port infrastructure, military activities, and coastal security procedures. The presence of intelligence personnel transforms civilian maritime operations into cover for hybrid warfare activities targeting European Union members.
European response and legal action
French maritime authorities detained the Boracay’s captain and first officer for questioning following the September boarding, though both were later permitted to resume operations. The captain now faces a court hearing in Brest, charged with refusing to comply with instructions from French coastguard officials. This legal action represents one of the first practical European responses to Russia’s shadow fleet operations, demonstrating that international maritime law can constrain such activities when political will exists.
Broader hybrid warfare strategy
Analysts assess that Russia’s shadow fleet constitutes an element of broader hybrid warfare architecture rather than merely a sanctions-evasion mechanism. Vessels may support intelligence operations logistics, transport dual-use equipment, or test European nations’ response protocols. Combined with cyber attacks, disinformation campaigns, and drone incidents, this creates comprehensive pressure mechanisms along EU borders. The European Commission has proposed extending sanctions to prohibit maritime services for shadow fleet tankers, though Hungary’s opposition has delayed implementation.
