Russia's Shadowy Oil Export Network Shows Signs of Central Coordination
It is well understood that Russia uses a complex network of oil traders and "shadow fleet" shipping companies to evade restrictions and maintain exports of oil and gas. This network has disappeared further underground since sanctions were imposed on Rosneft and Lukoil, the two biggest Russian producers, in October last year. It has been an assumption that while coordinated by the Russian state, which owns most of the oil being exported, the constantly changing cast of companies involves a large number of independent entrepreneurs. An in-depth investigation by the Financial Times has discovered that far from being independent, the network of oil traders and shadow fleet shipping companies furthering the trade use a common architecture, with the bulk of the supposedly independent firms in fact utilizing the same IT infrastructure.
By way of background, in July 2025 Moscow’s Higher School of Economics began offering a Masters academic course in sanctions evasion, equipping students with the skills to "identify and assess the risks of sanctions and other measures imposed by supervisory authorities on companies", with 18 of the 20 student places reserved for Russians. This suggests that the Russians have an organizational concept for sanctions evasion.
The Financial Times investigators estimated that more than 80 percent of Russian crude produced for export by Rosneft was being exported through a single coordinated network of commodity brokers, a surprisingly high dependency on what could easily become a single point of failure.
The investigation based its conclusions on an analysis of names and addresses of known middlemen broker companies, some of them sanctioned, which found that these entities used a single private server “mx.phoenixtrading.ltd” for their email, showing that they had a common IT infrastructure and by implication shared back-office functions. When all 448 domains using the private server were identified, 48 were clearly identified as Russian-associated oil traders, and that these alone accounted for 80 percent of Russian crude produced for export by Rosneft. The investigation did not confirm but found strong indications that many of the remaining domains are associated with the other side of the business, namely the ownership and management of Russia-facing shadow fleet tankers. This deduction is based on the middlemen's propensity to charter tankers formerly associated with Russian state oil major Rosneft – a fleet now transferred to anonymous ownership vehicles in order to evade sanctions.
Within the network, there are constant changes in the names of companies involved. The time lag between a company’s date of registration and the time the detail appears on public company registers is exploited – so that by the time involvement in sanctions-breaking is identified, the broking company may once again have moved on and changed its name. Names are often chosen which can easily be confused with those of legitimate companies. Having a common infrastructure and administrative set-up of course makes it easy for companies to be created, dissolved and renamed at speed to keep ahead of sanctions investigators.
The investigation identified that the single largest exporter of Russian crude in the network is Redwood Global Supply FZ LLC, a company registered in Ras al Khaimah and sanctioned by the UK in December 2025. The rise in Redwood activities matches the decline of Lukoil and Rosneft exports, coincident with the imposition of sanctions. Oil is brought into the system by Redwood, then distributed amongst one set of purchasing brokers, and then sold on to another set of brokers for delivery. As oil is bought, transferred and sold within the network, specific oil source descriptors are replaced with generic descriptors, hiding the origin.
The Financial Times investigation had no conclusive evidence as to who controlled this middleman network with common traits, which it tentatively identified with the descriptor Coral Energy. It does however identify two linked Azeri businessmen as having central roles in the wider Coral Energy enterprise: Tahir Garayev, who is sanctioned by the UK, and EU-sanctioned Etibar Eyyub, a close associate of Igor Sechin, CEO of Rosneft. An Azeri mafia of racketeers is very active in Russian business dealings - a frequent source of conflict between the Russian and Azerbaijani governments.
How the Coral Energy organizational structure is linked back to Russian state control is not absolutely clear, but the Coral Energy network is clearly earning huge brokerage fees through this sanctions-avoidance scheme, and no doubt feeding funds to members of the Russian oligarchy. A continued flow of such corrupt payments is a powerful incentive for President Vladimir Putin’s associates to prolong the war in Ukraine.
Given that many of the entities identified by the Financial Times are already sanctioned, authorities are clearly aware of some - but not all - components of the network and how it works. But sanctions listings and EU sanctions packages take time to promulgate. Even then, the enforcement mechanisms lags far behind the designation procedures.
In any case, it is reasonable to attribute some of the dramatic fall recorded in Russian oil export volumes in recent months not just to additional sanctions listings, but to the U.S. political warnings to importing countries such as India. Ukrainian overt and covert attacks on Russian dark fleet operations and infrastructure and the physical interception of dark fleet tankers at sea have played a part. Some nations have stepped up interceptions, based on registration issues or safety and labor concerns. Others however are content to allow the dark fleet unimpeded access through their territorial waters, and overlook transshipments at sea.
Still, while Kpler estimates that Russian oil exports have fallen from 3.8 million bpd in December and are now running this month at 2.8 million bpd, more could clearly be done by leading allies of Ukraine – and more action could have a decisive effect on Russia’s ability to keep on fighting.
One issue is raised in particular by the Financial Times investigation. It identifies Redwood - based in Ras al Khaimah, formerly known as the Pirate Coast - as the export clearing house. Corroborated by collateral record searches, it also identifies a large number of UAE oil traders and brokers who then take the import-export process forward.
Alongside these brokers are also a substantial number of ship managers and owners based in the UAE, organizing ship-to-ship transfers and sending cargos to their ultimate destinations, primarily in China and up until recently in India. The UAE appears therefore to be acting as an open market place, and the co-location of so many of the components of the trade probably means that many of the arrangements can be made face-to-face without leaving an electronic paper trail.
Some of the network of brokers and dealers in the UAE make little attempt to hide their activities. For example, Atlantic Jiu Yu FZE, commercially registered in the Ajman Free Zone, openly advertises that it is a supplier of Russian oil to India.
Nonetheless, Western authorities - and individuals living in the UAE worried about maintaining their residency - have been reluctant to criticize the UAE for acting a safe haven for Russian sanctions evasion, for fear of upsetting the UAE authorities and their sovereign investment funds. But given the profits being made, this activity is spreading and unlikely to be ignored forever, risking the UAE’s return to the Financial Action Task Force (FATF) Grey List, from which it was only released in February 2024. Were this to happen, significant additional due diligence procedures and financial restrictions would be reimposed on the UAE’s substantial and growing maritime community, and not necessarily restricted to the tanker sector. This is not a theoretical risk: Kuwait was added to the Grey List only last month after the FATF determined that it lacked adequate controls to combat money laundering and terrorist financing.
Russian Military Cargo Ship Continues Mysterious Maneuvers
After having spent five days east of Sardinia, the Russian-flagged military cargo ship Sparta IV is again drawing attention, now maneuvering west of Portugal. The ship is drawing focus from the NATO allies for its unexplained behavior, which is also leading to broad speculation online.
The Sparta IV was well-known as a participant in the so-called “Syrian Express” and was used to remove military equipment after the fall of the Asad government. With its history of transporting military equipment, the NATO allies closely track its movements, but so far, no one can explain what the ship is doing during this trip.
While it was off Sardinia, the Italian Navy was observing the ship, which reports said was traveling with the Russian destroyer Severomorsk and the tanker Kama. There was also speculation that a Kilo-class submarine was below the surface with the ships.
It seemed unlikely that it was a weather-related detour, and then, as mysterious as its presence, the ship resumed its course west. At the end of last week, it was again seen sailing back and forth east of Gibraltar and Alicante on the southeast coast of Spain. The ship drew the attention of the Spanish Navy, which reportedly sent BAM Audaz, a patrol boat, to investigate. Itamilradar reports the ship remained beyond the 12 nautical mile limit in international waters. It speculates the delay might have been weather-related, with forecasts of storms west of Gibraltar.
The Sparta IV got underway again, but this time, Itamilradar reports the destroyer and tanker separated and sailed west. A Russian Navy landing ship, RFS Aleksandr Otrakovsky, however, appeared to be escorting her through the Strait of Gibraltar.
This drew the attention of the UK, which sent HMS Cutlass from the Gibraltar naval base to monitor the ship. A French Navy maritime patrol aircraft was also overhead, adding to the monitoring. Itamilradar reports the ship had gone dark for several days, but its AIS was switched back on before it approached Gibraltar.
The mystery, however, has deepened again after the Sparta IV started north. It stopped above Lisbon and is now being observed sailing back and forth west of the traffic lanes.
Portugal’s Lusa news agency made inquiries to the Portuguese Navy, and it says sources told them the ship was being monitored. The Sparta IV has been off the coast of Portugal since approximately 8:00 p.m. Sunday, February 15, and it remains going back and forth as of February 18.
"The ship is sailing from south to north along the Portuguese coast, currently remaining off the coast of Nazaré, outside the maritime traffic corridors, in areas with depths greater than 3,000 meters," the Navy reportedly told Lusa in response to the inquiry.
The AIS signal shows the vessel is heading to the Russian port of Kaliningrad on the Baltic. It says it is not due until February 27.
Speculation has been that the ship might be experiencing mechanical problems or attempting to avoid heavy weather. Espionage, of course, gets mentioned, as do possible deep-sea surveys. Others point to the potential presence of undersea cables in some of the locations the ship has been sitting for days.
The Portuguese Navy would only say to Lusa that it will continue to monitor the Sparta IV, which is classed as a merchant ship, until it leaves Portuguese waters. The news agency reports the Navy said last year it monitored 69 Russian ships in Portuguese waters, and well over 100 Russian ships have been tracked transiting Portuguese waters in recent years.
Denmark Detains Shadowy Boxship Linked to Iran Questioning Registration
The Danish Maritime Authority confirmed to local media that it has placed a detention order on a shadowy containership until the vessel can prove its registry and certifications. The vessel was sanctioned in July 2025 by the United States as part of a network including more than 50 vessels that the U.S. said were part of the vast shipping empire controlled by Mohammad Hossein Shamkhani, the son of Ali Shamkhani, a top political advisor to the Supreme Leader of Iran.
When the U.S. sanctioned the vessel, which at that point was identified as Cerus, the report said it was registered in St. Kitts and Nevis. In October 2025, the ship changed names to Nora and falsely claimed it was registered in Aruba and two months later in Comoros.
Built in 2003, the ship is 37,100 dwt with ownership listed in Dubai. Bureau Veritas lists that it withdrew the ship’s class certification in August 2025 for “non-compliance with conditions of class/recommendations.” Equasis lists its last known inspection in 2022.
Denmark’s TV 2 reports the vessel had gone dark while it was in St. Petersburg, Russia, in mid-January and then sailed west into the Baltic and reached Skagen, where it stopped on January 22. The following day, it anchored less than 20 miles east of Aalbaek, Denmark, where it has remained for the past 28 days.
A Danish patrol ship was spotted near the vessel along with a Danish Armed Forces sea drone. The Danish Maritime Authority reports it questioned the vessel’s registry in Comoros and was informed by the authorities that the ship was “not correctly registered.” Apparently, when they questioned the vessel further, it suddenly raised an Iranian flag, prompting the detention.
The Danish Maritime Authority told TV 2 in a statement, “The ship has been detained until a flag state proves to the Danish Maritime Authority that the ship is registered and fully certified.” In addition, Denmark said it plans to conduct a port state inspection on the vessel when weather conditions permit.
TV 2 reports that the Cerus/Nora has passed through Danish waters at least 10 times in the past year as part of frequent trips to Saint Petersburg. They report each time the vessel has stopped sending position data as it approached Russia.
The U.S. asserted last year that the fleet of ships controlled by Hossein was transporting oil and petroleum products from Iran and Russia, as well as other cargo, to buyers around the world, generating tens of billions of dollars in profit. The Treasury Department linked the containership to a company called Reel Shipping, which it said controlled six additional ships.
Top photo of Cerus in 2022 by Ida - courtesy of VesselFinder
No comments:
Post a Comment