Ukrainian attacks on the Russian shadow fleet
Ukrainian 'attacks on Russian vessels', including oil tankers from the "Russian shadow fleet", are actions conducted by the Security Service of Ukraine targeting Russia-linked ships. Primarily carried out in the Black Sea and Mediterranean Sea, these strikes represent a significant escalation of Ukraine's maritime warfare strategy. Among their targets are vessels allegedly used to circumvent international sanctions on Russian energy exports.
Background
Ukraine has conducted maritime operations against Russian forces since the 2022 invasion. However, 2025 marked a dramatic shift in scale and geographic scope, with Ukraine developing and deploying advanced unmanned naval systems known as "Sea Baby" and "Sub Sea Baby" drones. The campaign focused on two primary objectives: degrading the Russian Black Sea Fleet and disrupting Russia's "shadow fleet" — a network of roughly 1,000 vessels used to transport Russian oil in violation of Western sanctions and the G7 oil price cap.According to a report by The Atlantic, citing U.S. and Ukrainian officials, the Trump administration did not object to the Ukrainian strikes on the "shadow fleet", and approved assistance for the strikes, with the US considering the strikes an "important tool" to put pressure on the Kremlin to negotiate peace. The publication details that Donald Trump did not object to attacks on Russian oil logistics in international waters and, in several instances, approved sharing intelligence with Kyiv. This intelligence was subsequently used to target Russian oil infrastructure.
Maritime sabotage
Multiple vessels which had recently called at Russian ports have been attacked with limpet mines or underwater explosives in the Mediterranean, many operated by Athens-based shipping company Thenamaris.A report from the security company Ambrey concludes that the attacks were perpetrated by "an unnamed state actor targeting ships calling at oil ports" likely using limpet mines with delay action planted by divers using small submarines. Two vessels were sunk, the 9500 ton freighter Ursa Major off Spain on 24 December 2024 and the 164000 ton super tanker Koala while moored at Ust-Luga, Leningrad Oblast, on 9 February 2025 and three others, Seajewel, Seacharm and Grace Ferrum were damaged.
Despite the lack of concrete evidence or official results from investigations, the repeated targeting of ships associated with Russian trade has led security analysts and maritime industry bodies to privately assess a probable link to the ongoing war in Ukraine. Despite the fact that the Ambrey report attributed the attacks to an unspecified state actor without naming Ukraine, private discussions among security professionals from both private firms and government agencies have frequently identified Ukrainian actors as the most likely perpetrators.
According to Lloyd's List, U.S. is believed to have used diplomatic backchannels to convey a warning to the Ukrainian government in early 2025. The message reportedly indicated that if Ukraine had any involvement in the attacks, such operations should be halted immediately.
Former Royal Navy officer Tom Sharpe believes that the series of targeted explosions on tankers exporting Russian oil is very likely carried out by Ukrainian special operations forces using limpet mines as a tool of precise sabotage. He assesses these operations as a form of highly effective unconventional warfare that hits the infrastructure supporting Russia's oil revenues without causing direct escalation to open conflict with the West.
Military operations
Black Sea
On November 29, 2025, Ukraine claimed responsibility for striking two Russian "shadow fleet" tankers, the Kairos and Virat, using Sea Baby naval drones equipped with enhanced warheads. Both vessels, flagged to Gambia and previously sanctioned by the United States, European Union, and United Kingdom, were en route to the Russian port of Novorossiysk when struck approximately 28 to 35 nautical miles off Turkey's northern coast. The Kairos sustained critical damage and caught fire, with its 25-member crew evacuated safely. The Virat was struck again the following morning, suffering minor damage above the waterline. Neither vessel was carrying cargo at the time of the attacks.On December 2, the tanker Midvolga 2 came under attack approximately 80 nautical miles off the coast of Turkey. The vessel was en route from Russia to Georgia, carrying a shipment of sunflower oil. Regional security sources cited by Lloyd’s List reported that the tanker was likely struck by a shrapnel-equipped drone, an attack which injured the master and the second engineer. Ukraine’s Ministry of Foreign Affairs stated that the country "has nothing to do with this incident" and accused Russia of staging it.
On 10 December, Ukrainian forces attacked the tanker Dashan in the Black Sea, while it was on its way to Novorossiysk with its transponders turned off. The vessel was apparently damaged in the stern section by several naval drones. On 17 December 2024 the tanker was put under sanction by the EU.
A spokesman for Ukraine's SBU stated: "The SBU is actively pursuing measures to diminish petrodollar income to the Russian budget. This is the third tanker from the shadow fleet rendered inoperative in the last two weeks, which had been aiding the Kremlin in bypassing international sanctions".
On 8 January 2026, a Russian ″shadow fleet″ oil tanker, the Elbus, was struck by a drone off the coast of Turkey. According to the ASTRA Telegram channel the tanker was headed to Novorossiysk. The Elbus "sustained damage, but no crew members were injured.″
Other seas
On 2 December, the Turkish company Besiktas Shipping said that it was "ceasing all shipping operations involving Russian interests" after one of its vessels, Mersin, was damaged by four explosions the previous week near Dakar. The cause of the explosions were reported as unclear.In an Ukraine claimed on December 18 2025, its first attack on a Russian vessel in the Mediterranean Sea. The target was the Qendil, an Omani-flagged "shadow fleet" tanker allegedly used by Russia to circumvent sanctions. The strike, conducted using aerial bomber style drones around was, according to Lloyd’s List Intelligence, most likely carried out between Crete and malta at a point 930 miles from Ukrainian territory. The attack reportedly caused critical damage, rendering the vessel inoperable. The SBU confirmed the Qendil was not carrying oil at the time of the attack, mitigating environmental risks.
An unnamed SBU source told Business Insider: "Russia used the Qendil to circumvent sanctions and earn money that went to the war against Ukraine... The enemy must understand that Ukraine will not stop and will beat him anywhere in the world, wherever he is".
Weapons
Sea Baby Naval Drones
The Sea Baby is an unmanned surface vessel developed and operated by Ukraine's SBU. The upgraded variant unveiled in October 2025 features an operational range of 1,500 kilometers and can carry payloads of up to 2,000 kilograms. Specifications include a length of 6 meters, width of 2 meters, and maximum speed of 49 knots. The platform supports multiple weaponized variants, including a gyro-stabilized remote machine gun with automatic target recognition and a ten-tube Grad-class multiple rocket launcher. Advanced features include AI-assisted targeting systems, the ability to launch reconnaissance drones, and layered self-destruct mechanisms.The Sea Baby platform is designed for reusability rather than single-use attrition, with operations controlled from mobile command nodes. Development has been partially financed through the UNITED24 public fundraising platform, reflecting a distributed civil-military approach to wartime production.
Sub Sea Baby Underwater Drones
The Sub Sea Baby represents an evolution of Sea Baby technology for underwater operations. These drones executed the December 15 submarine strike, marking the first known use of underwater drones to attack a submerged or port-based submarine target.Reactions
Turkey
Turkey condemned the attacks, citing threats to maritime safety and environmental protection. Foreign Ministry spokesman Oncu Keceli stated that the November 29 attacks "have posed serious risks to navigation, life, property and environmental safety in the region," and noted that the strikes occurred within Turkey's exclusive economic zone. Turkish foreign minister Hakan Fidan characterized the attacks as "very scary" and warned that they demonstrated the war's expanding reach. Turkey emphasized the necessity of suspending attacks on port and energy infrastructure in the Black Sea.Russia
Russia's foreign ministry condemned the attacks as "acts of terrorism" that threatened maritime freedom of navigation. Russian president Vladimir Putin issued explicit threats in response, stating on December 2: "The most extreme measure would be to isolate Ukraine from the sea, which would fundamentally eliminate the possibility of piracy". Putin threatened to escalate strikes against Ukrainian ports and shipping infrastructure. However, Russia denied Ukrainian claims regarding the submarine strike, with Black Sea Fleet spokesman Alexei Rulev stating the underwater attack "failed".On December 11–12, Russia conducted retaliatory strikes, launching a Shahed kamikaze drone at the Turkish-owned cargo ship CENK-T in Chornomorsk port, reportedly in direct retaliation for Ukrainian attacks on Russian tankers. Although the strike caused minimal damage to the vessel, it demonstrated Russian willingness to escalate strikes on Ukrainian ports.
Ukraine
Ukrainian president Volodymyr Zelensky characterized Russian retaliation as evidence of Moscow's rejection of peace negotiations. In his statement following the CENK-T attack, he declared: "This demonstrates yet again that the Russians not only disregard the current diplomatic opportunities but also persist in their efforts to undermine normalcy in Ukraine". Ukrainian officials argued that attacks on "shadow fleet" tankers represent legitimate targeting of infrastructure used to fund Russia's war effort.Zelensky met with SBU director Vasily Maliuk on December 10 to discuss maritime operations, and in the official readout urged the SBU chief to continue delivering "maximum precision in our long-range operations and in dismantling Russia's logistics". An unnamed aide close to Zelensky stated: "The entire purpose of the sanctions dissipates if they are not enforced", justifying the attacks as necessary enforcement of international sanctions.
European and NATO
The European Union expanded sanctions on December 13, with nine shipping companies and individuals being sanctioned for involvement in "shadow fleet" operations. Ukraine itself signed sanctions decrees against 656 ships allegedly part of Russia's shadow fleet on December 13. NATO's response remained constrained by mandate limitations, with initiatives such as the program focusing on deterrence and critical infrastructure protection rather than sanctions enforcement.Implications
Analysts have characterized the campaign as part of Ukraine's broader "long-range sanctions" strategy, targeting Russia's primary revenue source during a period of difficult military circumstances on land. The expansion to the Mediterranean represents an unprecedented geographic escalation, suggesting Ukraine possesses technical capabilities and intelligence networks extending far beyond the Black Sea theater.According to Control Risks maritime security analyst Arran Kennedy, Russia is expected to soon launch retaliatory strikes targeting Ukrainian port infrastructure and commercial vessels in or near Odesa, as well as ships trading with Ukraine in the Black Sea outside NATO waters.
The operations have raised legal and diplomatic questions regarding the distinction between legitimate military targeting of sanctions-evasion infrastructure and potential violations of international maritime law. Turkish protest highlight concerns that the conflict is expanding into areas previously considered isolated from direct military operations.
The campaign has also prompted increases in maritime insurance rates in the Black Sea and prompted some commercial shipping firms, including Turkish operator Besiktas Shipping, to suspend operations related to Russian trade due to security concerns.
Legal debate
According to Wolff Heintschel von Heinegg of the European University Viadrina, Ukrainian strikes on vessels associated with Russia’s "shadow fleet" are assessed not under ordinary maritime law or sanctions enforcement, but under the law of armed conflict and the law of naval warfare, given the ongoing international armed conflict following the Russian invasion of Ukraine in 2022. Under these norms, belligerents may attack lawful military objectives and merchant vessels that make an effective contribution to the enemy’s military action outside neutral waters.Heintschel von Heinegg notes that while Gambian-flagged tankers like Kairos and Virat are prima facie neutral, they may be classified as enemy merchant vessels if they operate under the control or employment of the Russian government or serve Russia’s war-sustaining economic activities, such as transporting oil that funds military operations. This classification would render them lawful targets under recognized naval warfare doctrine.