Russian personnel with ties to the country’s military and security services are carrying out espionage in European waters while covertly working aboard ships that transport Russian oil, Western and Ukrainian intelligence sources told CNN.
Since Russia’s full-scale invasion of Ukraine in 2022, Moscow has built a so-called “shadow fleet” of hundreds of tankers. These vessels move Russian oil from Baltic and Black Sea ports despite Western sanctions, earning the Kremlin hundreds of millions of dollars annually.
In recent months, Ukrainian intelligence says, some of these ships—often registered in unrelated countries—have taken on additional crew members shortly before departing port. CNN reviewed crew lists showing predominantly non-Russian crews, but with one or two Russian names and Russian passport details added at the end.
Multiple intelligence sources confirmed to CNN that some of these men are employed by a secretive Russian company, Moran Security. Some are mercenaries who previously worked for Russian private military contractors, including the notorious Wagner Group.
Western intelligence sources say Moran is a private security firm with links to Russian military and intelligence services. The company was sanctioned by the U.S. Treasury in 2024 for providing “armed security services” to Russian state enterprises, as part of efforts to increase pressure on Russia over its ongoing war against Ukraine.
Moran personnel have been placed on several tankers in Russia’s shadow fleet and are often the only Russians on board, according to Ukrainian and Western intelligence. Ukrainian intelligence said it began observing their deployment around six months ago.
A Western intelligence source added that, in one case, Moran personnel photographed European military installations from a shadow fleet vessel. No further details were provided.
According to Oleksandr Stakhnevych of Ukraine’s Foreign Intelligence Service, the Russians on board also supervise ship captains, most of whom are not Russian nationals. Another Western intelligence source echoed this assessment, saying that Moran personnel are not engaged in direct combat but ensure operations align with Kremlin interests.
Their presence has raised growing concern among European security services, given the number of shadow fleet vessels operating close to Europe’s coastlines and the potential for espionage. Security officials describe the deployment of armed men with military backgrounds as part of the Kremlin’s hybrid warfare toolkit aimed at destabilizing Europe. Intelligence sources also told CNN that these men have been involved in sabotage, though details were not disclosed.
Jacob Kaarsbo, a former Danish intelligence officer, said the use of armed private groups aboard shadow fleet vessels offers Moscow “classic plausible deniability,” adding that while many suspect these men take orders from the Russian state, proving it is difficult.
CNN linked Moran’s recent activity to a sanctioned tanker called Boracay, which has frequently changed its name and flag over the past three years. On September 20, two Russian men boarded the vessel at the Baltic port of Primorsk near St. Petersburg. They were listed as “technicians” and were the only Russians among a crew otherwise made up of Chinese, Myanmar, and Bangladeshi nationals.
Ukrainian intelligence identified the two men, and CNN confirmed their identities with Western intelligence sources. One is a former police officer who previously worked for Wagner, according to a Western intelligence source.
The Boracay drew attention in September while carrying Russian oil to India. Shortly after leaving Primorsk, the vessel was off the Danish coast when drone sightings disrupted traffic at Copenhagen airport and near Danish military bases. While no direct link was proven, a Western intelligence source described the coincidence as “suspicious.”
Days later, French forces boarded the Boracay off the coast of Brittany after it failed to provide proper documentation. Two Russians were found among the crew and questioned privately, while the Chinese captain was arrested and later charged with failing to comply with instructions.
Many shadow fleet vessels transit the Baltic Sea, a key maritime corridor bordered by NATO states including Denmark and Sweden. Danish maritime pilots report frequently encountering Russian personnel aboard these ships who appear to wield authority and behave aggressively toward inspectors.
European intelligence officials told CNN their working assumption is that Russian vessels have been involved in at least some unexplained drone incidents near European coastlines. Britain’s new foreign intelligence chief, Blaise Metreweli, warned this week that Russia is testing Europe “in the gray zone,” using tactics just below the threshold of war.
Moran Security Group, founded in 2009, has long-standing ties to Wagner and Russian intelligence services, according to Western intelligence. Several of its leaders are former Russian intelligence or naval officers, and the company has previously operated in Syria in support of the Assad regime.
Intelligence sources say Moran is now registered in Moscow and Belize, a jurisdiction often used to obscure true business ownership, and appears to have taken on a growing role within Russia’s shadow fleet.
Danish maritime officials have called for tougher, coordinated European action against uninsured and improperly registered shadow fleet vessels, warning that individual states cannot address the threat alone.
