The open war against the oil ‘phantom fleet’

To trace the path of the Skipper, a ship that was intercepted on December 10 by the United States off the coast of Venezuela, is to follow the trail of a piece of the illegal oil industry. This single cargo ship was representative of the many actors and practices involved in an illicit trade that keeps the crude oil flowing even where international sanctions are trying to shut it off.

The vessel, which has been operational for 20 years, was flying the Guyanese flag, although this South American country has denied having any records of it. Its last cargo was 1.8 million barrels of crude oil. Three years ago, the U.S. Treasury had already sanctioned the ship, then named Adisa, for smuggling cargo on behalf of the Iranian Revolutionary Guard and its Lebanese ally Hezbollah. The ship was the property of Triton Navigation Corp., owned by the 50-year-old oil magnate Viktor Artemov, who was born in Ukraine and now resides in Switzerland. Washington justifies its capture as part of an offensive against drug trafficking in the Caribbean Sea: it alleges that Venezuela finances the drug trade with money from oil.

According to data from the analytics service TankerTrackers.com, a few hours after the seizure of the Skipper, at least 38 of the 75 tankers located off the Venezuelan coast were included on Washington’s sanctions lists. This was not the case for the tanker Centuries, intercepted this Saturday in a similar U.S. operation when it was outside Venezuela’s exclusive economic zone. And it did the same with a third vessel this Sunday: the Bella 1, this one subject to sanctions, flying the Panamanian flag and heading to Venezuela to load cargo.

The Skipper was undoubtedly part of the thriving international “phantom fleet,” a vast and elusive network of aging vessels used to circumvent international sanctions generally imposed by the United States, the European Union and the United Nations against individuals, groups, or companies as coercive measures to prevent acts of war. These ships are used primarily for trading oil, but not exclusively. EL PAÍS has detected the use of these cargo ships to smuggle stolen grain from occupied Ukraine or transport scrap metal from war zones. The exact number of these ships at sea is unknown. The EU includes 597 on its list of sanctioned Russian vessels. These ships are prohibited from entering EU ports and receiving services within the EU.

According to data provided to EL PAÍS by the monitoring platform Kpler, around 3,300 vessels currently make up the “phantom fleet.” “In 2025, they transported approximately 3.6 billion barrels of crude oil,” notes analyst Ana Subasic, “representing between 6% and 7% of global flows.” Among the countries involved, Russia, Venezuela, and Iran are at the forefront, although others such as North Korea, Syria, and China (even for fishing in prohibited waters) have benefited from these practices.

“A few years ago, the phantom fleet consisted of just a couple dozen ships. But now it has grown enormously,” notes Yörük Isik, a Turkish maritime consultant. “Other players are also trying to take advantage of what it offers: a cheaper, albeit more dangerous, way to operate oil tankers. They use obscure insurance companies, old ships, and don’t question maintenance... It has become an industrial sector in itself.”

Opaque companies

This maritime network hides behind opaque corporate structures, rooted in places like the Marshall Islands or the United Arab Emirates, which afford protection for owners. They constantly change their name and flag. Isik explains that these “ghost” ships used to fly flags of convenience from countries with lax ship registration laws, such as Liberia, Bolivia, or Panama. Now they don’t even do that. “The latest ships attacked by Ukraine,” this expert continues, referring to the offensive launched against Russian smuggling vessels, “were flying false flags, and their entire registration was falsified.”

In fact, in recent months, Gambia, Benin and East Timor have written to the International Maritime Organization (IMO), a United Nations agency, to report that at least 113 ships are illegally using their flags.

The IMO maintains that these tankers continue to engage in risky practices, such as ship-to-ship oil transfers at sea, and employ evasive tactics like disabling their transponders—the Automatic Identification System they are required to use to pinpoint their location—to conceal their position. This is how the tanker Adrian Darya, detained for 44 days in Gibraltar in 2019 on suspicion of illegally trading Iranian crude, made its journey to the Syrian coast.

Shadow navigation

The Skipper acted similarly in the past. According to monitoring by MarineTraffic and TankerTrackers.com, this cargo ship turned off its transponder for 83 days at the end of 2024. Satellite images of the vessel also confirm that its crew spoofed the radio frequency signal to appear on digital maps in a location where it was not. A few days before the Skipper was targeted, the transponder placed the ship off the coast of Guyana. Satellite photographs located the vessel in mid-November in the Venezuelan port of San José, at coordinates that the ship never transmitted. The Centuries, recently intercepted, also loaded cargo in San José during the second week of December.

The IMO estimates that more than 300 ships sail the world’s oceans under false flags, although the long-established London-based trade publication Lloyd’s List believes the number is even higher. This publication has uncovered numerous websites selling fake flags while impersonating nonexistent institutions, such as the Maritime Administration of the uninhabited Matthew Islands or the General Directorate of Marine Service of Malawi, where more than 40 Russian vessels have registered.

These vessels also lack adequate insurance. According to the Kyiv School of Economics (KSE), Russian oil tankers, for example, do not have policies accepted by the International Group of Protection and Indemnity Clubs, which poses a serious threat in the event of an accident. “It’s a problem. Not only in the Bosphorus and the Black Sea but also in the Baltic. There are just as many oil tankers passing through the Danish straits and sometimes the English Channel,” Isik emphasizes.

Battle in the Black Sea

Faced with the lack of clear results through sanctions, it is not only the U.S. Navy that has gone on the offensive in the Caribbean Sea; Ukraine has also joined the offensive to strike at the Russian invader. According to a confidential report from a country allied with Kyiv, Moscow is using its “phantom fleet” to “fund” the offensive against Ukraine launched in February 2022. This same source indicates that the Kremlin’s fleet of pirate ships, estimated at between 600 and 1,400, is responsible for 69% of Russia’s oil exports. Crude oil sales cover 40% of the funds needed to maintain Russia’s war machine, according to these calculations.

Furthermore, the report states, there is a risk that Moscow could use these ships for espionage or sabotage. It was the latter that France suspected in early October when it detained the Boracay. After a boarding operation, Paris had to release the vessel due to a lack of evidence.

The Ukrainian government of Volodymyr Zelenskiy has kept the fight against this illegal trade at the top of its list of demands to Brussels and Washington. According to the Center for Strategic and International Studies, Russia receives around $100 billion a year from the illegal sale of its crude oil on the high seas.

The latest example of Ukraine’s battle on the high seas against this “phantom fleet” took place on Friday, when an aerial drone struck the deck of the tanker Qendil as it sailed through the Mediterranean Sea, south of Greece. There is no precedent for an attack from so far from Ukrainian territory (1,240 miles or 2,000 kilometers). The tanker was traveling from India, one of Moscow’s main trading partners, to the Russian port of Ust Luga on the Baltic Sea. In 2025 alone, the Qendil has changed flags five times, its name three times, and its ownership twice. “This is just the beginning, as it is with the attacks on Russian energy facilities,” notes Ukrainian military analyst Oleksandr Kovalenko. “Even if someone disagrees with it or feels compromised,” he continues, “Ukraine will continue to do it.”

This has been the case, with particular intensity, in recent weeks: on November 28, barely an hour apart, underwater drones exploded near the oil tankers Kairos and Virat, which were sailing in the Black Sea toward the Russian port of Novorossiysk. The Turkish coast guard, the country closest to the attack, launched a rescue operation to bring the crews to safety, although the ships did not sink. On December 2, aerial drones damaged another tanker, this one from Russia and loaded with sunflower oil, which sought refuge in a Turkish port. The following day, the Romanian Navy had to detonate a Sea Baby naval drone that was adrift, probably after a failed operation. Seven days later, the oil tanker Dashan was attacked as it approached Novorossiysk after delivering crude oil in India.

These actions have been attributed to joint operations by the Security Service of Ukraine (SBU) and the Navy. The Kairos, Virat, and Dashan were sanctioned by the EU, the United Kingdom and other countries. “The goal is to block illegal Russian trade in the Black Sea,” Kovalenko continues. This analyst states that Kyiv wants to curb the smuggling not only of crude oil but also of military components.

Moscow has been taking measures against this maritime battle for months. Since July, ships entering Russian ports have had to obtain permission from the FSB, the intelligence service, which has taken over entry controls previously handled by the Ministry of Transportation. On December 16, the Swedish Navy’s Chief of Operations, Marko Petkovic, also reported the presence of Russian military personnel aboard ships of the “phantom fleet.” Some of these vessels are sailing off the Scandinavian coast toward Russian ports such as Ust Luga.

Beyond the seas

A special case is that of the Turkish oil tanker Mersin. Anchored in late November about ten miles from the port of Dakar, the capital of Senegal, awaiting the delivery of the 39,000 tons of Russian crude it was carrying, it was rocked by four explosions. The vessel was rendered unusable and partially submerged. It is unknown whether it was an attack bearing the signature of Ukrainian espionage, but the Turkish shipping company Besiktas Shipping, owner of the tanker, announced that it was ceasing all “routes related to Russia.”

“Perhaps as a precautionary measure, fearing these attacks will continue,” a company source said. “But we don’t belong to the ‘phantom fleet.’ Before loading any cargo, we carry out all the necessary checks regarding potential sanctions. And it’s important to remember that not all products exported from Russia are sanctioned.”

The list of damage suffered by large Russian ships continues to grow. At the beginning of summer, the Eco Wizard was attacked while loading ammonia in Ust Luga, as was the Vilamoura, which departed from Zueitina, Libya, with one million barrels of crude oil. Previously, between the end of January and mid-February, four other vessels experienced explosions: the Seacharm, off the coast of Ceyhan, Turkey; the Grace Ferrus, off the coast of Libya; the Koala, after completing its loading in Ust Luga; and the Seajewel, in the port of Savona, Italy.

Of these ships, only the Koala is considered part of the ghost fleet. However, all of them had loaded oil or other chemicals in Russian ports, and all suffered attacks with the same method: “Explosives were placed on the ship’s hull, but in a way that would damage the vessel and render it unusable without causing an oil spill,” says Tomas Alexa, senior analyst at the maritime risk management company Ambrey, who has participated in the investigation of these incidents: “These are very sophisticated and professional operations. They had to be carried out outside of port, because it is very risky inside, especially in Russian ports, and when the ships were at anchor or sailing at less than two knots, by approaching them in smaller boats and after that with divers.”

Although there is no evidence directly implicating any government, there is little doubt about who is responsible. “Those who perpetrated them are, most likely, the Ukrainian state or actors aligned with the state,” wrote the maritime security consultancy Vanguard Risk in a statement.

Consequences

One thing is clear: there is a strong correlation between the surge in these attacks and the peace negotiations in Ukraine. The wave of attacks around February occurred in the weeks leading up to the first and highly publicized meeting between Washington and Moscow envoys in Saudi Arabia. According to Lloyd’s List, U.S. authorities asked Kyiv to cease these acts of sabotage, and this was the case until the end of June. Then, two more attacks took place while, at the Istanbul negotiations, the Russian delegation refused to discuss a ceasefire. The attacks resumed in late November, just before Donald Trump’s envoy to the region, Steve Witkoff, traveled to Moscow to present his proposed peace plan, which was highly favorable to the Kremlin’s interests.

“The Biden administration was much more reluctant to allow Ukraine to carry out attacks on oil ships or infrastructure, for fear of the shocks it could cause to oil prices. But right now, with the United States as an exporter and with what’s happening around Venezuela, Trump is much more ambivalent,” Alexa argues. “I think the attacks will continue until a ceasefire is achieved,” she concludes.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition