Russian vessels operating in the Black Sea have been employing coordinated methods to spoof their Automatic Identification System (AIS) signals, transmitting false, static positions while sailing hundreds of miles away. This tactic, observed in at least 12 sanctioned tankers, appears to be part of broader efforts by Moscow to exert greater control over its so-called shadow fleet and protect these assets from Ukrainian drone attacks amid ongoing hostilities in the region.
Specialists tracking vessel movements, including Ollie Ballinger of University College London, noted that six of the tankers simultaneously broadcast two AIS positions, effectively making it appear that they were in two places at once. AIS is the satellite-based system ships use to broadcast their location, and spoofing of these signals has long been a tactic used by vessels seeking to circumvent Western sanctions aimed at disrupting Russian oil exports since the invasion of Ukraine in early 2022.
The new method involves ships broadcasting a legitimate satellite-tracked AIS position while passing through the Bosphorus Strait, which Turkey requires to be reported for navigation purposes. At the same time, these vessels sent a second, frozen position near the mouth of the Bosphorus to mislead observers and avoid attack while continuing their journey elsewhere in the Black Sea. Analysts pointed to repetitive and identical coordinates among multiple tankers, as well as reports frozen precisely at 08:13 UTC, as evidence that these ships were equipped with identical spoofing devices running the same software.
Most of the tankers observed adopting this method had reflagged to Russia within the past year, subjecting them to Russian maritime regulations. Many have also been retrofitted with protective measures such as nets and cages to guard against drone strikes. Additionally, over 30 tankers in the shadow fleet changed their names to Russian words for gemstones—including Gagat, Labrador, and Sapfir—after reflagging over the summer. One tanker involved in the spoofing remained flagged to Equatorial Guinea, which has become a proxy registry for Russian-controlled vessels certified by the Russian Maritime Register of Shipping.
Experts such as Bridget Diakun of Lloyd’s List Intelligence suggest this evolution in spoofing reflects Russia's increased emphasis on safeguarding its maritime oil logistics amid greater enforcement by European regulators and more assertive Ukrainian military actions. Kyiv has claimed to have struck over 300 Russian vessels in the past 11 weeks in its campaign against the shadow fleet, which consists mainly of older vessels often registered under opaque ownership structures and outside of Western insurance schemes.
Maritime intelligence firms estimate that the shadow fleet includes over 1,200 vessels exceeding 20,000 deadweight tonnes, with more than three-quarters under sanctions by the United States, United Kingdom, or European Union. Between July and September alone, more than 80 ships reflagged to Russia, signaling an apparent strategic move by Moscow to consolidate control over its shipping and logistics networks in the face of intensifying international restrictions.