The Cyber Tanker Hunters

In June 2026 US Coast Guard Cyber Command had already described some of the unusual digital tools that today’s shadow fleet tankers rely on, in its annual CTIME report[1]. The DEF CON talk, “Taking on the Dark Fleet… in Cyberspace!”, was given by Commander Kenny Miltenberger, who leads the Coast Guard’s 2003rd Cyber Protection Team, and the team’s network engineer Shane Cancilla. It added a number of mechanisms that are especially interesting from an engineering point of view[2]. Sanctions-busting shipping, it turns out, runs on a whole set of engineering and digital fixes: spoofed coordinates, remote access software, attempts to wipe drives from afar and pirated navigation software.

Meanwhile, the same thing is happening off Europe’s coasts. In early March 2026 the Belgian Navy, supported by French helicopters, seized the tanker Ethera in the North Sea. It was sailing under a false Guinean flag, and its ship’s papers turned out to be forged[3]. On 6 March Swedish police boarded the cargo ship Caffa, and a crew member is suspected of using a forged document[4]. On 20 July forces of the EU’s Operation IRINI verified the flag of the tanker South Star in the Mediterranean[5]. Every such team boards a ship whose computers may still be in the hands of someone ashore.

The harder the shadow fleet is pursued, the more inventive it gets, including in a field as complex as the international law of the sea. What exactly the Americans found, how it works and what European teams should expect is set out below.

§ 00 · The campaignCyber operators on the rope ladder

The shadow fleet is the name given to tankers that carry oil from Russia, Iran and Venezuela around sanctions. Most are old ships with opaque owners, doubtful insurance and frequently changing flags[5]. The US Congressional Research Service, as cited by the speakers, counted about 1,600 ships carrying sanctioned oil in 2024[2]. An investigation by the Dutch outlet Follow the Money in early 2026 counted more than 1,300 tankers, at least a third of them, over 500, sailing under false flags[6].

In December 2025 the United States began seizing such ships on the high seas. The first, on 10 December, was the tanker Skipper. It flew the flag of Guyana, although Guyana itself did not recognise its registration. Centuries followed on 20 December and Sophia on 7 January[7]. The campaign targeted mainly Venezuela-linked tankers[6]. After the US, India, Belgium, France, Sweden, the United Kingdom, Finland, Estonia and Germany also began seizing shadow fleet ships[2].

That Coast Guard cyber teams board these ships alongside armed special forces had not been publicised before[15]. Cyber Command drew dedicated Cyber Control Teams from its Cyber Protection Teams and, for the first time, sent them aboard together with assault and law enforcement teams[1]. Their job is to take control of the ship’s digital environment as fast as possible, to cut off interference from outside and bring the ship into port in the state in which it was seized. Time permitting, the team hunts for threats in the network on board and closes them down[1]. The Coast Guard calls this procedure cyber positive control, or POSCON[2].

For cyber operators used to corporate networks it was unusual work. As their talk shows, they climbed aboard by rope ladder or were winched down from a helicopter, and ate army field rations on the seized tanker[2].

“We’ve known for years that the dark fleet posed significant physical risks, because we knew they were operating old ships, they weren’t maintaining them. But what we didn’t know until these boardings was what type of cyber risks were aboard these ships,” Tama told The Wall Street Journal[17].

Neither the report nor the talk names the ships behind individual findings, except for one example, the tanker Sophia, seized in the Caribbean[2]. The Wall Street Journal writes that they were mostly ships carrying Iranian and Russian oil[17].

§ 01 · AISThe art of teleportation

Every merchant ship in the world reports where it is through the AIS. The transmitter on board continuously broadcasts the ship’s name, identifier, position, course and speed. Nearby ships, shore stations and satellites pick up these signals, and from there the data flows into public ship-tracking services.

The transmitter does not know its own position. It gets coordinates from the satellite navigation system, usually a GPS receiver, over an ordinary serial line. Instruments on the bridge exchange data in the NMEA 0183 standard, the same language spoken by the GPS receiver, the AIS, the radar and other navigation equipment[1]. The ship’s name and identifier are entered into the transmitter when it is set up.

The inspections showed that some shadow fleet tankers carried several AIS transmitters, and the name under which the ship appeared to the world was changed with a single switch[1].

The position was faked through the data line. The scheme the Cyber Control Teams saw most often was this: a custom-made CAT6 cable was soldered to the data port of the AIS unit, and at the other end sat a laptop running marine instrument testing software. The software generates the same NMEA 0183 strings that normally come from the GPS receiver, and the transmitter broadcast an invented position as if it were real[1]. On bridges the teams also found spliced serial connections between the GPS receiver and the navigation equipment[2].

Around the antennas on the wheelhouse of some tankers stood what appeared to be attenuation cages. In a photo from the talk an antenna is wrapped in foil and tape. The speakers believe this was done to cut off the genuine GPS signal so that it would not interfere with the spoofing[2].

Among the files on board, the teams also found several detailed guides to other ways of feeding false GPS data into the AIS[1]. Rear Admiral David Barata, the Coast Guard’s deputy commander for operational policy, told The Wall Street Journal about a ship whose signal placed it near Curaçao, while in fact it was off the coast of Venezuela, carrying oil there[18].

Russia uses the same tricks off Europe’s coasts when it moves military cargo. In April 2026 the tanker General Skobelev, the ro-ro ship Sparta and the replenishment tanker Akademik Pashin left St Petersburg, Kaliningrad and Murmansk. The first two are under sanctions; the frigate Admiral Kasatonov escorted them, and the ships declared Port Said in Egypt as their destination[19].

After the English Channel the ships switched off their AIS, and later the trackers showed the impossible. On 1 May General Skobelev’s signal placed it off Estonia. On 8 May Sparta broadcast that it was in Kaliningrad, sailing at 49.8 knots, a speed beyond any ship of its size. Two days later a satellite photographed all four ships south-west of Malta, and on 11 May the convoy was already in the Syrian port of Tartus. What it delivered is unknown, but Sparta has long served Russia’s military logistics[19]. We covered this voyage in detail in “The Syrian Express Changes Course”.

A year earlier, in June 2025, the Russian corvette Boikiy escorted two sanctioned shadow fleet tankers, Sierra and Naxos, also known as Selva, through the English Channel[20]. The corvette itself broadcast a false identity over AIS at the same time[21].

In June 2026 Bellingcat traced the bulk carrier Grumant, which took grain from occupied Feodosia to Benghazi in Libya. Near Feodosia its AIS positions were erratic, and some even placed it on land: satellite navigation has long been jammed in that part of the Black Sea. But the heading in AIS messages comes not from GPS but from the ship’s gyrocompass. All 29 messages between 7 and 19 February showed a heading of 267–268 degrees, and the berth at Feodosia is oriented at 267.5 degrees. No other ship nearby consistently broadcast such a heading[22]. Charlie Brown, a former US Navy officer with whom Bellingcat shared the method, called it sound but noted that some compasses may be vulnerable too, so the data must be checked against other sources[22].

PLITKA Analytics runs its own tool that tracks the voyages of Russian fleet ships and records cases where AIS shows a position other than the one the ship is actually in.

Anyone who knows where to look can spot a lie in AIS. But there is also a closed channel. Under International Maritime Organization rules, ships above 300 gross tonnage report their identity and position every six hours through the LRIT system. Only the flag state, the coastal and port states and search and rescue services receive these reports[2].

Spoofing LRIT is harder than spoofing AIS, and legally and in safety terms it is a far more serious offence. It requires either simulating an external GPS or altering the terminal’s firmware. On the ships the teams found shared firmware for Inmarsat-C terminals. When a ship began spoofing its AIS, its LRIT position changed too. In other words, the terminal took its coordinates from the same faked source, not from a GPS receiver of its own[2].

§ 02 · IMOThe art of disguise

Every ship keeps one International Maritime Organization number, its IMO number, for life, while its name and flag can change as often as it likes[23]. A flag means registration in a particular state, and it is the flag state that is responsible for the ship following the rules, from sanctions to safety and crew protection[6].

The tanker that Estonia detained in April 2025 because it was not in any registry was called Kiwala and flew the flag of Djibouti. Then it became Boracay under a false flag of Benin, and under that name it was stopped by the French military in September 2025[24]. Some shipping databases also list it as Pushpa[23]. According to Rear Admiral Barata, shadow fleet owners often take new names from ships that have already gone for scrap. That way the new name has at least some digital trail[18].

A new name needs new papers too. Aboard shadow fleet tankers the teams found a Russian program, Stamp 0.62 for Windows. It quickly draws images of ship’s seals so that the ship’s name and IMO number can be changed in official documents[2]. An IMO number cannot be changed lawfully, so a seal with a new number is good for one thing only: forgery.

The program is old. Its window title reads “Stamp 0.62 for Windows 95/98/2000/NT”, the author gave an address at mail.ru, and the Cyrillic interface shows up as garbled characters in the screenshot. To show how it works, the speakers used it to recreate a seal with the name SURPRISE and the port of Portsmouth[2].

It is the false flag that makes a ship vulnerable at sea. The UN Convention on the Law of the Sea allows a warship to visit a ship on the high seas that is reasonably suspected of being without nationality or of flying a flag it is not entitled to[5]. In October 2025 all the states bordering the Baltic and North Seas declared that a ship without nationality has no right of innocent passage, and on 15 December the EU confirmed the right to visit such ships[6]. The Belgians seized Ethera precisely for its false flag and forged documents[3], while South Star was boarded to verify its flag[5]. For a European boarding team, the ship’s papers therefore become the key evidence.

When the false flag stopped protecting it, part of the fleet found another shield. The tanker Bella 1 flew the flag of Guyana, although Guyana had already cancelled its registration[25]. In December 2025 it began running from the US Coast Guard, and on the way the crew renamed it Marinera, painted a Russian flag on its side, and the ship was re-registered in Russia. Moscow sent Washington a diplomatic note demanding an end to the pursuit[26]. According to The Wall Street Journal, as cited by USNI News, the tanker picked up a Russian Navy escort that included at least one attack submarine[27].

On 7 January 2026, 190 miles south of Iceland, a Coast Guard team with special forces seized the tanker. The US treated it as a ship without nationality[26][27]. The British Ministry of Defence, which supported the operation, said the ship had first flown a false flag, switched off its transponders and tried to reflag while it was being pursued[27]. Rob McLaughlin, professor of international law at Australia’s University of Wollongong, argued in Just Security, by contrast, that the seizure’s lawfulness is doubtful if the Russian registration was valid[25].

Marinera was not alone. According to Lloyd’s List, as cited by CNN, 17 shadow fleet tankers took the Russian flag in December 2025 alone[26]. Another 20 switched from false flags to Cameroon’s obscure but legitimate registry in a single week in early February 2026[6].

Law enforcement does have tools against false flags. The first is the consent of the flag state. Panama, whose flag Centuries and Sophia flew, has a long-standing boarding agreement with the US and usually agrees, because it wants such ships off its own registry[7]. States whose flags the shadow fleet favours are cleaning up their registries. Palau has already removed 29 of the 43 shadow fleet ships it identified, and Sierra Leone has promised to remove all sanctioned vessels[6]. And, as noted, a ship without nationality can be boarded on the high seas without anyone’s consent[5].

The Russian flag neutralises all three tools. Russia will not consent to a boarding, will not strike its own ship from its registry, and a ship under a valid flag is not a ship without nationality. Seizing it is no longer a document check but a confrontation with a state. With Marinera the US went that far, declaring the Russian registration invalid, and lawyers see this as the most vulnerable step[25]. Retired Rear Admiral William Baumgartner, a former Coast Guard Judge Advocate General, fears that the so far solid legal footing of the seizures could be undermined by US forces themselves operating at the edge of legal authority[7].

Europe is more cautious for now. “One question is: how willing are European countries to let the problem escalate?” says Yf Reykers of Maastricht University. “We are seeing Russia becoming more assertive, sometimes sending armed men on their ships and deploying drones”[6]. Nele Matz-Lück, professor of international law at Kiel University, points to the other side: if Europe starts reading the law of the sea more strictly, China and other states will read it the same way, including towards Western ships[6].

§ 03 · DataThe art of wiping

A modern tanker is constantly in touch with the shore. Internet reaches the ship by satellite, over Ku-band or Starlink, and is then distributed through the ship’s network: a modem, a core switch, user switches and Wi-Fi access points[2]. Through this link an ordinary shipowner monitors the ship’s condition, and its staff ashore can configure the onboard computers remotely.

Shadow fleet tankers are no exception here. Old and poorly maintained, they often have modern high-bandwidth satellite links[1]. On most computers the Cyber Control Teams found three remote access programs at once: AnyDesk, TeamViewer and ScreenConnect. They were set up to allow connections even when nobody was at the computer on board. Someone ashore could get into the ship’s network at any time[1].

According to Cyber Command, shadow fleet administrators attempted to delete data on board remotely[1], and The Wall Street Journal reports that at least once this happened after Americans had already boarded the ship[17]. Using remote access software, someone logged into a workstation on board and from there used PowerShell to zero-fill the servers’ hard drives[2]. A screenshot from the talk shows an image of such a drive: the file system is not recognised, and in place of data there are only zeros. Evidence, in other words, can vanish under the boarding team’s feet while the ship is still connected to the shore. That is why the cyber team has to take control of the network as fast as possible.

In December 2024 the shadow fleet tanker Eagle S, flagged in the Cook Islands, dragged its anchor across the bed of the Gulf of Finland and damaged five undersea cables, including the Estlink 2 power link[28]. Its voyage data recorder, the ship’s “black box”, failed to record the very moment the ship crossed the cable. Yet the ship got off lightly: Finland’s National Bureau of Investigation found no signs of tampering. An outdated GPS receiver from the early 2000s, on losing its signal, reset the date to 2005, and the recorder deleted files on its own to free up space[29].

Legally, the difference between these cases is fundamental. Drives wiped remotely point to intent to cover one’s tracks, while a failure of old equipment, seemingly accidental, proves no such intent. Only a specialist who gets into the ship’s network before it can be altered can tell one from the other.

§ 04 · SoftThe art of piracy

A tanker has two different networks. The first, information technology, serves office work: email, documents, accounting. The second, operational technology, runs the ship itself: the engine, cargo systems, navigation[1]. The design is meant to keep a virus on an office computer away from the ship’s controls.

On shadow fleet tankers, however, that boundary was crossed all the time. Software was carried across on USB sticks for updates, and laptops were plugged straight into navigation systems such as ECDIS and into engine room control systems[1]. A photo from the talk shows an adapter connecting Ethernet to the AIS serial line, and in the engine control room stand gateways linking the industrial CAN bus to an ordinary Ethernet network[2].

The software on these computers was mostly pirated, both for office work and for navigation. Crews downloaded it through uTorrent from a Russian maritime torrent forum offering maritime chats, technical literature, applications, training videos, tests and simulators. Windows and Office were activated without a licence. The Cyber Control Teams found AAct.exe and KMSAuto from the Ratiborus KMS Tools package, which trick Microsoft’s licensing system, as well as scheduled tasks that ran them again and again. They also found pirated ECDIS and route planning software[1].

Pirated software brought malware aboard. One computer picked up Lumma Stealer, a data-stealing program commonly rented out on Russian-speaking forums[1]. The speakers also describe an attempt to run MusaLLaT, a worm that spreads via USB sticks, the very route by which the boundary between the networks was crossed. It rewrites DNS records so that antivirus software cannot reach its servers, disables Task Manager, the command prompt, the registry editor and System Restore, opens a network port and hides an autorun file on the drive. Trojans turned up too, some of them aimed at Chinese users[2].

All of this spread easily thanks to weak, shared or entirely missing passwords, disabled antivirus, outdated operating systems and shared USB sticks[2]. Across the fleet the cyber teams inspected, they counted 17 confirmed malware detections and 2,268 configuration changes, and on 344 occasions someone had cleared the antivirus threat history[2].

On an ordinary office network this would be an unpleasant but routine incident. On a tanker the stakes are different. “For a vessel that’s carrying tens of millions of gallons of crude oil, which is highly volatile, there’s always a risk of fire explosion. The atmosphere in the tanks has to be very carefully managed. And then there’s always a risk of an oil spill”, Rear Admiral Tama told The Wall Street Journal[17]. As an example of a system the tanker’s safety depends on, the speakers point to inert gas generators[2], the very system that fills the empty space in the tanks with oxygen-free gas so that oil vapour cannot ignite.

August 2026 showed what happens when such a network is attacked from outside, although that ship had no trouble with the law. South Korea’s HMM managed the 333-metre supertanker VL Prosperity, bound for Galveston, Texas. Iran’s Mehr news agency claimed that on 7 August hackers took over the ship’s engine room systems: they reduced engine cooling, raised the revolutions and interfered with the fuel system, and communications were lost for 30 hours. The US confirmed only signs of a network compromise and gave no details[30]. On 21 August law enforcement officers and a Coast Guard cyber team, together with an FBI cyber team, boarded the tanker, and the agencies later said there was no disruption to the ship’s operations and no danger to the crew or the environment. The prompt response allowed the threat to be removed[31].

§ 05 · EuropeThe art of being ready

On 27 September 2025, off the island of Ushant, the French military stopped the tanker Boracay, which was sailing without a visible flag. The master refused to let them inspect it, and the sailors had to carry out a dangerous manoeuvre. On board were two employees of the Russian private security company Moran Security Group, reportedly there to monitor the crew and gather intelligence[24].

In May 2025, when Estonia tried to inspect a tanker suspected of having no nationality, a Russian fighter jet briefly appeared nearby, and the ship refused to enter Estonian waters. Finland’s defence minister Antti Häkkänen said at the time that tankers leaving Russia through the Gulf of Finland were escorted by warships[20]. Boikiy escorted tankers through the English Channel, Admiral Kasatonov led the convoy to Tartus[20][19], and according to The Wall Street Journal a submarine followed Marinera[27].

Europe therefore faces a harder version of the task: being ready for armed resistance. Private military companies and the Russian navy and air force already act as countermeasures. Their aim is to intimidate, provoke and buy time while Europeans look for a safe solution and agree on a plan for the case of resistance. That alone is a difficult task.

But the American experience is worth studying and applying now. The cyber team should always go aboard with the assault team, right away, rather than arrive in port a week later. The network has to be brought under control as early as possible, before someone ashore can wipe the drives. A specialist must be able to tell deliberate destruction of data from a failure of old equipment, because a prosecution will rest on it. Ship’s papers, seals and navigation data should be treated as possible forgeries until they have been checked.