Former Wagner mercenaries prevent tanker captains from co-operating with European enforcement

Kiwala, a rusty hulk nearly the size of the Titanic, was heading through the Baltic Sea to Russia to collect a cargo of sanctioned oil when it was surrounded by Estonian navy boats and helicopters.

The sanctioned tanker was sailing with no national flag—a breach of maritime law. Inspectors who boarded in April 2025 found 17 serious faults that made the vessel unseaworthy and impounded it for two weeks until they were fixed.

But any impression of a small victory in the battle against the ‘dark fleet’ that bankrolls Vladimir Putin’s war in Ukraine soon faded. Five months later Kiwala—now renamed Boracay—was again ordered into port off France. This time the captain refused to comply and was sentenced to a year in prison only after special forces stormed the ship.  

An investigation based on leaked data and undercover interviews obtained by the Dossier Center, a Russian investigative group, offers an explanation for the shift: Russia security personnel, including ex-combatants from Kremlin-backed mercenary groups like Wagner, stationed aboard dark fleet ships to control their non-Russian captains. 

Two Russian security agents were aboard the Kiwala to enforce compliance with “Russian interests” and gather intelligence when the French navy boarded, according to reports from the court case that followed.

Kiwala’s Chinese captain had “behaved incorrectly” by “giving in to provocations” from the authorities, one of Russia’s dark fleet guards, Nikolai, told an undercover reporter. He and his fellow operatives were there “to prevent such improper actions” he said. 

As Europe takes a tougher stance against the dark fleet, Russia has responded with “systematic countermeasures” to prevent captains from complying with coastal state demands, according to the Center for European Policy Analysis, a US think tank. There is “optical intelligence” that at least some of the guards are armed, said a German defence official who spoke under condition of anonymity. 

This week the European Union updated its naval mission’s mandate, allowing it to stop and board dark fleet ships. But the mere possibility that Russian mercenaries could be stationed on the tankers is deterring authorities from challenging them—and helping Russia to transport sanctioned oil with impunity, security officials say.

“If we know that there are armed people on board, we will avoid boarding,” said a European security service officer. “We still want to avoid an armed confrontation.”

Wagner veterans

Extra security began appearing on shadow fleet tankers from May 2025, shipping records and crewing data show. 

SourceMaterial’s analysis of 140 dark fleet voyages between May 2025 and April 2026 found 83 Russian guards aboard the ships. Two thirds of the trips were deliveries of oil from Rosneft, the Russian state oil company.

At least 24 of the guards were former mercenaries, including 16 who had fought for the Wagner Group in Syria and Ukraine. Another eight had ties to Redut, a paramilitary structure reportedly under the command of the Russian ministry of defence and widely viewed as a successor to the now disbanded Wagner.

Others were employed by Moran Security Group, a Moscow-based agency sanctioned by the EU in April for functioning “as a semi-official private military contractor tied to Russian government interests”.

Companies like Moran have a reputation for being “super-aggressive” and “shooting without really identifying the cause or the intent”, according to Dimitris Maniatis, the founder of Marisks, a maritime security company.

Moran and Redut did not respond to requests for comment.

Security duties aboard dark fleet ships involve monitoring the crew, the captain and first mate, four Russian security guards separately told an undercover reporter. 

Tankers are sometimes shadowed by submarines and Western authorities make “endless, endless requests,” for information, one guard, Arkadiy, said. “You have to keep an eye on all this, because some officer might blurt out something inappropriate.”

“Some officer might blurt out something inappropriate”

Other tasks include identifying any crew member sharing information outside the ship.

“I was finding out who was snitching, who they were working for, what information was coming from the ship to shore,” Arkadiy said. “To the Indian authorities, or maybe even to NATO countries.”

Most important, though, is ensuring that the ship is not impounded, said another guard, Evgenii, describing his job as “monitoring the vessel’s crew to ensure compliance with all instructions for countering the detention and seizure of the vessel”.

Guards would make clear to duty officers that any instructions from European authorities to dock must be met with “a clear refusal”, Evgenii said.

All but one of the 83 identified guards were Russian nationals, unlike crew members, who are recruited globally. Security guards are more likely to be posted to ships with non-Russian captains, data suggests.

It isn’t always clear who the guards report to—but a Western intelligence official said that it is likely they act as liaisons with the Russian state and call for military back-up. In May 2025 one tanker, Jaguar, ignored Estonian requests to board it. Shortly after, a Russian Su-35 fighter jet appeared and escorted the ship into Russian waters.

Dark fleet vessels have had to reroute as Western nations restrict their movement, said Gonzalo Erausquin, a sanctions expert at the Royal United Services Institute. Some now avoid the English Channel, for example—a detour that brings extra time and costs. 

“If there are Russian security-related personnel on board these vessels, they may help incentivise non-cooperation with coastal states or assist in producing fraudulent documentation,” he said. “Their role may be to ensure missions continue smoothly while avoiding longer and more costly routes.”

Russia’s extra security measures are almost exclusively directed at European routes, according to crew members, guards and flight data. Guards tend to join vessels in Egypt as they enter European waters from the Red Sea and disembark there from ships leaving the Mediterranean. 

‘We don’t like them’

In August, Saraswati, a Cameroon-flagged shadow fleet tanker, was cruising Estonia’s main port in Tallinn when its Russian guard intervened.

“The Russian security guy told the captain to go inside the port directly but the captain disagreed”, said one crew member, who asked not to be named.

The captain protested, fearing a $25,000 fine for entering without permission.

“But the Russian security guys called the captain’s company” and the vessel docked, the sailor said.

Russian security men like the two who joined the Saraswati at Port Said in Egypt are sometimes unpopular with the crew. 

“We all don’t like them, because it is like they are on holiday, enjoying a picnic,” the crew member said, complaining that the Russians ate “ten times” their allocated rations, causing provisions to run out early.

“They think that the ship is theirs only,” he said.

When not in the mess room, the security men were usually to be found on the bridge, standing at the captain’s shoulder, he said. A Russian guard encountered by Danish pilots who boarded to steer the tanker through a busy strait last July was a former special forces soldier, according to Danwatch, the investigative journalism group.

Although the bridge is usually the exclusive domain of the captain and navigators, Western officials usually “do not ask questions” about the new arrangements, the crew member said.

But Arkadiy described a separate incident in November in which Danish authorities “rushed towards” him asking: “Who are you? Why are you on the bridge?”  Arkadiy lied and claimed to be a radio engineer.

“I stood there practically all night,” he said. “I thought some boarding groups would approach.”

Drone attacks

The Qendil was chugging slowly through the Mediterranean off Libya after delivering a cargo of sanctioned Russian oil when the first explosives hit. 

Russians call the Ukrainian drone squads ‘Baba Yaga units’ because they appear out of thin air like the child-chomping witch of Slavic mythology. As successive strikes lit up the chilly December night and sparked blazes on deck, Nikolai knew it was impossible to fight back. Instead, his job was to maintain discipline on board.

Under his watch, the damaged oil tanker reversed course only to run aground on the Turkish coast.  “Our anchor was ripped off, and we were washed ashore,” Nikolai said. 

The number of guards aboard tankers has dropped sharply since February, data shows. 

One reason for the change may be that the presence of Russian security personnel aboard dark fleet vessels could be used by Ukraine to justify more drone attacks, said Erausquin of RUSI.

“If Ukraine could demonstrate the presence of Russian personnel aboard these vessels, that could strengthen the justification for what Kyiv calls ‘kinetic sanctions’,” he said. 

Instead the dark fleet has moved away from using internationally flagged vessels towards Russian-registered ships with Russian captains, who now command 82 per cent of dark fleet ships—up from 36 per cent in 2023.

These Russian nationals are much less likely to require monitoring by onboard security, said Michelle Wiese Bockmann, a maritime intelligence analyst.  

“One thing about the shadow fleet and Russia is that they are very quick to adapt,” she said.

This article is part of The Shadow Fleet Mercenaries—an investigative project by Follow The Money, Dossier Center, Süddeutsche Zeitung, Norddeutscher Rundfunk, The Times, SourceMaterial, De Tijd, VRT, OCCRP, Danwatch, Pointer, Expressen, Delfi and Helsingin Sanomat.

Headline picture: James O’Brien/OCCRP