Irregular Warfare at Sea: How Russia’s Shadow Fleet Undermines Maritime Security

The fusion of legitimate state power and organized criminal activity in the maritime domain creates a potent blend of hybrid threat activity and irregular warfare challenges that is as dangerous for those targeted as it is deniable for those who undertake it. In the liminal space between war and peace, these activities challenge the rules-based international system in ways engineered to erode trust in institutions and sow confusion among targeted nations. The criminal nature of the activity exploits loopholes in legal prosecution. The criminal nature of the activity deliberately exploits loopholes in maritime legal frameworks, effectively preventing definitive attribution of illegal activity to a state actor. This operational methodology insulates the government behind the activity from any diplomatic, legal, or military response, making existing national and international deterrence and response mechanisms paralyzed and inadequate. 

Criminal activities like these, especially in the maritime domain, mask far more malign intentions to intentionally destabilize with paramilitary activity. The recent Eagle S incident in the Baltic Sea that involved a vessel suspected of having ties to Russia’s Shadow Fleet and maritime sabotage activity provides a real-world example of this convergence, highlighting the legal and attributional challenges faced by nations seeking to defend the rule of law and maritime security. Beyond the specific circumstances of the Eagle S incident, the case raises unique questions about the vulnerability of critical maritime infrastructure, the effectiveness of existing legal mechanisms, and the broader strategic implications for NATO of Russia’s Shadow Fleet in the Baltic Sea region. 

The Shadow Fleet: A Tool of Russian Maritime Irregular Warfare 

Russia’s Shadow Fleet presents a unique challenge to maritime security and the international rules-based order. The Shadow Fleet operates in both international waters, particularly in remote areas like the eastern Mediterranean, Gulf of Oman, and off the coast of West Africa, and in strategic regions such as the Baltic Sea and between Syria and the Black Sea. These vessels utilize remote international waters, such as the Gulf of Laconia and the Gulf of Oman, for ship-to-ship transfers that avoid tracking, often operating near geopolitical chokepoints like the Turkish Straits. They transport goods along specific regional routes, for example, between Tartus, Syria, and Russian Black Sea facilities, as well as delivering sanctioned goods to global destinations like China and India. 

Shadow Fleet operations are intended to circumvent Western sanctions and the G7 oil price cap imposed after the 2022 Ukraine invasion. The Shadow Fleet allows Russia to maintain vital oil export revenues, directly funding the Kremlin’s war while simultaneously easing sanctions pressure. Russia sells its Ghost Fleet sanctioned oil to nations like China and India. These actions, and those of the purchasers, are in direct violation of international sanctions and represent a growing criminal evasion network used by the Russians that makes it increasingly difficult for enforcement operations to stop Russian criminal activity on the high seas. This circumvention is achieved through a network of aging and poorly maintained tankers that often lack verifiable Western insurance, opaque ownership structures, and leverage flags of convenience like that of the Cook Islands. These ships also employ deceptive attribution and identification tactics such as open ocean ship-to-ship transfers and the disabling of AIS transponders, allowing the vessels to hide or spoof their actual locations or transfer illicit cargoes to obfuscate origin and destination. These techniques effectively shield Russia from meaningful consequences. Through the Shadow Fleet Russia has fused criminal activity with its irregular warfare apparatus to generate strategic economic effects and sustain its war in Ukraine. 

Beyond the direct economic support to Russia, the Fleet’s involvement in suspicious activities includes links to mysterious undersea critical infrastructure like telecommunications cables and energy cable damage and other attacks in European waters, raising serious security concerns for NATO and EU countries. The Kremlin’s use of the Shadow Fleet demonstrates a deliberate willingness to operate outside established norms and to engage in hybrid warfare tactics in the maritime domain. Such activity transforms the Shadow Fleet from a simple economic tool into a broader instrument of strategic disruption, destabilization, and irregular warfare that the Kremlin can and does use to undermine the critical undersea infrastructure NATO and the EU rely on for communications and energy and by extension societal social cohesion. For example, Russia fully stopped gas exports through the Nord Stream 1 pipeline to Germany after the invasion of Ukraine. 

It Was an Accident: The Estlink 2 Incident 

The Estlink 2 undersea power cable, operational as of (date), connects Estonia and Finland, running roughly 170 kilometers across the Baltic Sea. This cable infrastructure connects Baltic and Nordic energy sectors and markets, enhancing the energy resilience and efficiency of both. Strategically, Estlink 2 dramatically decreased the Baltic nations’ historical reliance on Russian energy resources because disaggregation eliminated Kremlin’s ability to weaponize energy as a means of exerting geopolitical pressure.  

On December 25, 2024, the Estlink 2 cable experienced a major failure in the Baltic Sea. The immediate consequences of the cable failure were economic, triggering major price spikes in Estonia. The undersea cable was cut, triggering a shutdown of power transmission. The immediate aftermath was a loss of power supply, leading to a shortfall in capacity. The inability to meet demand triggered scarcity-induced price spikes. Simultaneously, several other undersea telecommunications cables were also cut or damaged, leading to cascading internet connectivity and communications problems in the region.. In the wake of Baltic disintegration from the Russian grid, immediate concerns about deliberate sabotage and energy vulnerability and security arose, especially with the event taking place during the cold winter months when power demands are at annual highs as citizens seek to heat their homes during the cold winter months. 

After the Estlink 2 failure, suspicion quickly fell upon the Eagle S, a vessel registered to the UAE-based Caravella LLC-FZ and flagged in the Cook Islands. Eagle S departed the Russian port of Ust-Luga, bound for Port Said, Egypt. However, on Christmas day, Eagle S began acting erratically and made several unnecessary and implausible course changes that brought the vessel directly over the Estlink 2 cable and several others. Open source maritime tracking detected Eagle S turning back toward Russia at 1350 Finnish time and reversing course for approximately one kilometer and then turning back again at 1420 Finnish time. 

On December 26, 2024, the Finnish Border Guard boarded and seized the Eagle S in Finnish territorial waters on suspicion of deliberate sabotage. The initial inspection of the vessel revealed that one of the Eagle S ‘s anchors was missing, suggesting that the vessel’s anchor may have been deliberately dropped and dragged to damage or destroy the undersea cable. Finnish authorities subsequently initiated a criminal investigation based on accumulated evidence and suspicion of deliberate sabotage. 

The ongoing Finnish investigation produced additional evidence supporting the criminal case brought against the crew. On December 29, 2024, Finnish investigators, using undersea survey equipment, located a distinct drag mark along the Baltic seabed near the Estlink 2 cable. The drag mark stretched for several kilometers, offering additional evidence that a heavy object, like an anchor, had been deliberately dragged across the seabed. The length and direction of the drag mark were also consistent with the Eagle S ‘s observed anomalous course deviations, amplifying the link between the vessel, its anchor, and the cable damage. 

On January 3, 2025, the Helsinki District Court rejected a request from Caravella LLC-FZ, the UAE-based owner of the Eagle S , to release the vessel from Finnish custody. The court cited the ongoing Eagle S investigation alongside growing evidence that suggested an increasingly clear connection between the ship and the cable damage. A noteworthy development in the Finnish investigation occurred on January 7, 2025 when a Swedish naval vessel located and attributed the Eagle S’s missing anchor in the Baltic. The anchor had visible signs of damage, fueling suspicions that the anchor had been used in an act of sabotage as it was dragged across the sea floor. 

The initial Finnish investigation concluded on August 11, 2025. Finnish prosecutors filed formal charges of aggravated sabotage and aggravated interference with telecommunications against the captain and two senior officers of the Eagle S. Not unexpectedly, the captain and crew of the Eagle S pleaded not guilty to the charges. Their defense claimed that the dragging anchor was purely accidental. On October 3, 2025, the Finnish court dismissed the case against the crew of the Eagle S, citing a lack of conclusive evidence that could prove beyond a reasonable level of doubt that the damage to the Estlink 2 cable was the result of intentional sabotage. The court’s decision raised major concerns about the ability of the existing legal systems to effectively address the challenges posed by acts of maritime irregular warfare. 

Timeline of the Eagle S incident (2024–2025) 

• December 25, 2024: The Eagle S departs from the port of Ust-Luga in Russia. Its route crosses the Estlink 2 submarine power cable. Finnish power grid operators report an outage. The vessel was observed to have made suspicious maneuvers and changed course in the area. 
• December 26, 2024: Finnish law enforcement seizes the Eagle S in Finnish territorial waters and launches a criminal investigation into the Estlink 2 cable incident. Notably, Eagle S is missing one of its anchors. 
• December 29, 2024: Finnish investigators locate a drag mark on the seabed extending for several kilometers. 
• January 3, 2025: The Helsinki District Court rejects a request from the vessel’s owner, Caravella LLC-FZ, to release the Eagle S from Finnish custody. 
• January 7, 2025: The missing anchor from the Eagle S is located by the Swedish Navy. The anchor is recovered and turned over to Finnish authorities. 
• August 11, 2025: Finnish prosecutors file charges of aggravated sabotage and aggravated interference with telecommunications against the captain and two senior officers of the Eagle S. 
• August 22, 2025: The captain and crew plead not guilty, claiming the incident was an accident. 
• October 3, 2025: Finnish court dismisses the case against the crew of the Eagle S., ruling that prosecutors failed to adequately prove malicious intent. The court also ruled that the supposed negligence must be pursued legally by the ship’s flag state or the crew’s home countries. 
• October 9, 2025: Finnish prosecutors are appealing the court’s ruling. 

The Challenge of Attribution and the Legal Gray Zone 

Proving criminal intent is difficult in any circumstance. In the case of the Eagle S, though, criminal prosecution was complicated for several reasons that all ultimately prompted the Finnish court to dismiss the case. When the incident occurred, the Eagle S was operating in international waters. That fact, while not a loophole for criminal activity, does give a potential adversary legal maneuvering room to exploit complex jurisdictional rules on the high seas. In addition, the flag state, and not the prosecuting state, of the vessel ultimately has jurisdiction over the vessel and its crew. 

Within the legal framework of the United Nations Convention on the Law of the Sea (UNCLOS), the Eagle S  was under the exclusive jurisdiction of its flag state, the Cook Islands. Regardless of what evidence Finnish prosecutors presented, the Cook Islands are responsible for enforcing its own laws and regulations on board. But even beyond UNCLOS, the case brought against the Eagle S and her crew was ultimately  built upon the unstable foundation of the crew’s word against that of Finnish prosecutors. That fact made this a case based on credibility in which the burden of proof was entirely on the prosecution. Adding insult to injury, Finland is now financially responsible for the defendants’ legal fees of about $200,000. 

Going beyond the immediate incident, if a coastal state like Finland or Estonia has no legal jurisdiction over subsea infrastructure like the Estlink 2 cable infrastructure outside of the 12-mile line of their territorial waters, those states are defenseless against hybrid activities such as sabotage and tapping. Further, a ship can deliberately flag with a highly permissive open registry knowing that that registry is ultimately responsible for criminal prosecution. In other words, there is no effective legal means of prosecuting sabotage or other irregular warfare activities in international waters, the way that UNCLOS is currently conceptualized. 

Henrik Ringbom, professor of maritime law at Åbo Akademi University stated: “As long as you have a flag state that doesn’t care, you can now count on the freedom of navigation to break cables without consequences. This means that no one can do anything about it. This is completely unreasonable.” Meanwhile, the punitive actions available to challenge flag registries like the Cook Islands amount to little more than a slap on the wrist and do nothing to deter or disrupt Russian Shadow Fleet activity. 

The Shadow Fleet’s activity will remain a constant problem and a tool for strategic power for the Kremlin. As for the Eagle S, it maintains its records as primary ownership with a woman from Azerbaijan, an office in Dubai, management by a company in India on lease to a major Russian oil company that subsequently will continue to funnel money into the Russian war effort in Ukraine. The outcome of the Eagle S trial will only empower the Kremlin to increase its use of Shadow Fleet irregular warfare methodologies to undermine the critical infrastructure of NATO states and regional adversaries. 

Implications 

Erosion of Maritime Security and Critical Infrastructure: Shadow Fleet operations, and the demonstrable inability of existing maritime legal frameworks to deter nefarious activities, increase the risk of further sabotage against critical subsea infrastructure, including energy cables, communication lines, and pipelines. This poses a direct threat to the energy security, economic stability, and digital connectivity of affected nations, potentially leading to cascading disruptions across multiple sectors. Successful unattributed attacks will almost certainly continue to embolden malign actors to engage in similar hybrid threat activities, further destabilizing the region and the maritime domain. 

Shifting the Balance of Power in the Baltic Sea Region: The Shadow Fleet’s activities contribute to a slowly shifting balance of power in the Baltic Sea region. Russia’s demonstrated ability to operate aggressively in the region undermines the security and sovereignty of Baltic states, potentially deterring them from pursuing independent foreign and security policies. By exploiting weaknesses in international maritime law, Russia challenges the established order and asserts its dominance in the region. Ultimately, a more aggressive Russia will lead to increased militarization of the Baltic Sea. 

Impact on Transatlantic Relations and NATO Credibility: Unchecked, Shadow Fleet activities have the potential to undermine the credibility of NATO as a security guarantor. Failure to effectively deter or respond to these activities could lead to increased divisions among NATO allies, particularly if some allies feel that states not directly affected are not taking the threat seriously enough. If NATO is perceived as unable or unwilling to protect its members’ critical infrastructure, it will erode public and institutional trust in the alliances ability to field and enforce a credible deterrence capability. 

Difficulty Enforcing UNCLOS: The difficulty inherent in effectively enforcing UNCLOS has and continues to have profound implications for maritime security and international law. The exploitation of ambiguities within UNCLOS allows state-sponsored actors to freely conduct irregular warfare activities. This not only undermines the rule of law but also poses an increasing threat to critical subsea infrastructure. The lack of effective enforcement mechanisms only emboldens further aggression. These facts alone necessitate a meaningful reevaluation of how UNCLOS is read and interpreted and how collective security mechanisms like NATO’s Article 4 could work in concert with UNCLOS. In the case of the Finns and the Eagle S emerging methodologies are deliberately shaped to exploit weaknesses in existing law. In other words, Finland was unable to achieve a favorable result in court based on the “spirit of the law”, rather than the law itself. 

Recommendations  

Policy Opportunities 

Regardless of the mechanism, the objective of irregular warfare is to harm, weaken, and destroy a targeted nation or society. Subsequently, even though effective nations have not lost legal or military capability those actions become much harder to respond to, as evidenced by the case of the Eagle S. specifically because of character of the attack and the difficulty of proving anything malicious actually happened. Still, there are policy and legal opportunities for NATO and the UN to pursue that could help mitigate the threat posed by Russian irregular warfare and Shadow Fleet activities. The following recommendations focus on strengthening existing international legal frameworks and streamlining NATO Article 4 procedures to harden the maritime domain against these evolving threats. 

Adapting UNCLOS 

Current international law, particularly UNCLOS, limit prosecution due to jurisdictional complexities and the difficulty in proving criminal intent. UNCLOS grants flag states, like the Cook Islands in the Eagle S case, primary jurisdiction over vessels operating on the high seas, regardless of the location of the incident or the nationality of the victims. This allows states with uneven regulatory oversight to shield vessels and crews engaged in suspicious activities. Furthermore, establishing criminal intent “beyond a reasonable suspicion” in cases of maritime sabotage is extremely difficult. The crew of the Eagle S successfully argued that the dragging of the anchor was accidental, creating sufficient reasonable doubt to undermine the premise of nefarious intent, ultimately leading to the dismissal of the case, despite the near overwhelming evidence to the contrary. 

The weaknesses of UNCLOS as it is currently conceived highlight the urgent need for amendments or reinterpretations which more accurately reflect the realities and challenges of the contemporary operating environment to better account for the modern operational environment subsea infrastructures located outside territorial waters, the proliferation of hybrid actors, novel acts of sabotage, and other malign activity. Giving coastal states greater authority to investigate and prosecute acts of sabotage to include legal amendments which name the flag state as the entity ultimately responsible for the acts committed by a ship and its crew, would better insulate states vulnerable to Shadow Fleet activity because the threat of legal or criminal action becomes much more effective. Legal liability would disincentivize states to act as a flag of convenience, forcing Russia to make their compensation more exorbitant, and thus more easily detected by intel agencies, or discontinue Shadow Fleet use in all but the most extreme necessity. 

Such clarification should involve establishing supplementary protocols to UNCLOS, specifically addressing subsea infrastructure protection and sabotage. In addition, sustained pressure must be exerted on flag states to strengthen their regulatory oversight and enforcement capabilities including far stricter economic penalties on flag states that fail to adequately investigate reports of suspicious activity or regulate vessels registered under their ​​flags. 

Streamlining Article 4 

The potential for Russia’s Shadow Fleet activities, including deliberate acts of sabotage against critical subsea infrastructure, to escalate into threats against NATO members warrants serious consideration under Article 4. Article 4 stipulates that “the Parties will consult together whenever, in the opinion of any of them, the territorial integrity, political independence or security of any of the Parties is threatened.” The broader implications for the security of the Baltic Sea region and NATO’s collective defense capabilities necessitate proactive engagement, especially considering an increasingly brazen Russia. Estonia could invoke Article 4 if it believes that the Shadow Fleet’s actions, including suspected sabotage, constitute a threat to its security or territorial integrity. This would trigger consultations among NATO allies to assess the threat and determine appropriate responses. 

Potential responses under Article 4 could range from increased maritime patrols in the Baltic Sea and enhanced intelligence sharing on Shadow Fleet activities to coordinated diplomatic efforts to address the issue with Russia. The invocation of Article 4 would also serve as a strong signal of NATO’s resolve to defend its members’ security interests and deter further aggression. 

However, invoking Article 4 is a weighty political decision that requires careful consideration. While the threshold for invoking Article 4 is lower than that for Article 5, such an invocation still requires a clear demonstration that the Shadow Fleet’s activities do pose a significant and ongoing risk to the security of the targeted nation and to the Alliance. Proactive consideration of Article 4 highlights the seriousness with which NATO should address this evolving threat and ensure the security of its members in the face of Russian irregular warfare. 

Conclusion 

The Eagle S incident and the broader activities of Russia’s Shadow Fleet reveal a deliberate strategy to exploit the legal ambiguities of UNCLOS such that state-sponsored actors can operate with near impunity. Combined with the existing vulnerability of critical infrastructure and the difficulty of attribution, the Shadow Fleet represents a potential lever for major escalation of Russian irregular warfare activities. UNCLOS, in its current form, struggles to address these modern challenges, particularly regarding subsea infrastructure protection and the prosecution of sabotage in international waters. This necessitates a reevaluation of collective security mechanisms, especially NATO Article 4. Ultimately, a failure to upgrade international legal frameworks like UNCLOS and leverage existing security alliances will embolden future acts of aggression and erode sovereignty, security, and the rule of law across the maritime domain