Russia is using a new technique to hide the location of “shadow fleet” tankers by making vessels carrying oil needed by Moscow to fill its war coffers appear in two places at the same time.
The Kremlin has long sought to disguise the position of vessels in its ageing oil tanker fleet by interfering with the safety and navigation system used across the globe to identify the position and course of thousands of ships at any one time.
A new analysis suggests Russia is deepening its manipulation of the Automatic Identification System (AIS) as Moscow increasingly takes direct control of tankers within the shadow fleet, hundreds of which are subject to sanctions, to counter the risk of seizure by Western countries, including the UK.
The novel technique, which appears to be a response to increased Ukrainian attacks on Russia-linked shipping in the Black Sea, is one of several enhanced AIS “spoofing” strategies being deployed by Moscow for vessels which also frequently transit the English Channel and the UK coast.
How is Russia manipulating AIS?
Shadow fleet spoofing has previously tended to focus on manipulating a vessel’s AIS signal to make it appear in a different place from where it is.
Now it seems that Russia is equipping its vessels with technology which interferes with the AIS system to the extent that it makes it look like the same ship is in two places – often hundreds of miles apart – at the same time.
The technique, first catalogued by Ollie Ballinger, a researcher at University College London, and reported in the inancial Times, shows tankers in a single fixed or frozen position alongside their true location.
An analysis showed at least a dozen shadow fleet vessels – all but one of which was sailing under a Russian flag rather than a flag of convenience – have used a version of the technique in recent weeks.
The practise appears to be linked to the passage of Russian tankers through the Bosphorus Strait, the entry and exit to the Black Sea where ships could be vulnerable to attack. In one case, the Pirop, a Russian-flagged tanker, was showing itself to be both simultaneously in the Bosphorus Strait and a location on the Turkish coast some 800km to the west.
Moscow and Kyiv have in recent weeks targeted vessels in a tit-for-tat attacks designed to disrupt the flows of commodities – chiefly oil and grain – vital to the Russian and Ukraininan economies.
Ukraine has claimed to have hit more than 300 Russia-linked vessels in less than three months in the Black Sea and elsewhere as part of its strategy to inflict damage on Moscow’s ability to raise the tax funds needed to sustain the war.
What other spoofing techniques are being deployed?
The ability to make a ship appear in two different locations simultaneously is just one of several new tactics being deployed by Russia as it plays a high-stakes game of maritime hide and seek on the high seas.
The growth in another technique, known as an AIS “handshake”, was revealed by The i Paper last month.
This tactic involves a shadow fleet tanker sailing close to another vessel, often a fishing trawler, and at a given moment swapping AIS credentials with the second vessel. The tanker will then continue its journey while appearing to trackers as the fishing boat and vice versa.
After a period of time, the vessels can even cross paths again to swap back identities transmitted on the AIS system, which uses a combination of GPS satellite positioning data and VHF radio broadcasts every few seconds to alert other vessels to the location, speed and course of shipping.
Other techniques include simply switching off or blocking the AIS beacon and remotely accessing the computer systems of a vessel to interfere with positioning and identification data.
Experts believe the shift in Russian tactics is at least partly in response to the seizure of nearly a dozen shadow fleet tankers in UK and European Union waters since the beginning of 2026. They include the MV Smyrtos, a shadow fleet tanker seized by Royal Marines in June.
As well as bringing vessels under the Russian flag, which makes it far harder for Western states to carry out seizures, spoofing is designed to interfere with efforts to track vessels and potentially illicit activity such as ship-to-ship transfers of oil at sea to disguise the origin of shipments on the international market.
What is the risk to the UK?
Russian shadow fleet vessels are among the hundreds that transit the English Channel and British and Irish coastal waters on a daily basis.
The risk of interception means that the number of Russia-linked tankers passing through the Channel has reduced in recent months, while transits around Scotland have correspondingly increased.
In either case, any interference with the AIS system to disguise or alter the true location of a vessel represents a significant navigation risk.
The AIS network is designed to provide “visibility” of all shipping within a 40-mile radius, giving ships operating in congested waters like the Channel valuable information on the speed and heading of all surrounding craft. Ships use other tools, including radar, to provide alerts for risks to navigation but experts have warned that inference with satellite-enabled positioning systems like AIS is unacceptable.
In a report earlier this year, the Royal Institute of Navigation said such activity presents “a significant cyber security vulnerability and urgent risks to maritime safety”.
A second tier of risk comes from concerns that Russia is militarising civilian vessels including fossil fuel tankers, and could even use them to launch hybrid warfare attacks on Britain and its allies.
Pictures emerged earlier this year of heavy machine guns installed on the decks of Russian liquified natural gas tanker as it transited the Baltic Sea, prompting concerns of a miscalculation in the event of a confrontation with Nato naval vessels routinely patrolling the region.
Equally alarming is the belief in intelligence circles that Russia has weaponised shadow fleet vessels as launch pads for surveillance drones which have been seen overflying military and defence manufacturing installations in Germany, Denmark and Belgium, and may also have been used to carry out hostile reconnaissance in the UK.
European security services have been warned that drones armed with explosives could also be launched from civilian vessels as a way of avoiding long-range air defence systems when seeking to launch unattributable attacks.