The grounding of the sanctioned crude oil tanker Qendil off the Turkish coast near Bozcaada Island offers an important case study in understanding the evolving role of Russia’s so-called shadow fleet. Once viewed primarily as a mechanism for circumventing oil sanctions, these aging vessels are increasingly attracting the attention of intelligence agencies and security analysts due to concerns about their potential role in espionage, hybrid operations and broader geopolitical tensions. For maritime stakeholders, the incident highlights how commercial shipping is becoming intertwined with wider security challenges.
The grounding
On January 4, 2026, the Oman-flagged tanker Qendil drifted from its anchorage during severe weather south of the Dardanelles Strait and eventually ran aground near Bozcaada Island. The vessel was sailing in ballast condition after departing Port Said, Egypt, and heading toward the Russian Baltic port of Ust-Luga. Because the tanker was not carrying cargo at the time, the risk of a major oil spill was significantly reduced.
The grounding occurred only weeks after the vessel had reportedly sustained damage in a Ukrainian drone strike. On December 19, 2025, Ukraine’s Security Service (SBU) announced that it had targeted the tanker in the Mediterranean Sea, more than 2,000 kilometers from Ukrainian territory. According to Ukrainian officials, the strike caused a fire and structural damage that later required repairs in Turkey.
While no official investigation has publicly linked the grounding directly to the earlier attack, the sequence of events has raised questions among observers about the vessel’s seaworthiness and operational condition following the incident.
What do we know about MV Qendil?
The operational history of MV Qendil (IMO 9310525), according to maritime databases including MarineTraffic, VesselFinder and MagicPort, reflects many characteristics commonly associated with shadow fleet vessels.
Built in 2006, the tanker is 249 meters long, with a gross tonnage of 61,991 and a deadweight capacity of 115,338 tonnes. Throughout its service life, it has operated under several names, including Elia, Ionia, Oilstar and Spark, and has changed flags multiple times, including registrations in the Netherlands, Liberia, Greece, St. Kitts and Nevis, Gabon, Djibouti, Guinea-Bissau, Palau and Oman.
According to data published by the War & Sanctions portal, the vessel’s ownership and management structure has changed repeatedly. Since March 2024, the listed owner and commercial manager has been Narus Maritime Corp, a Seychelles-registered company whose only known vessel is Qendil. The ship’s ISM management responsibilities were reportedly transferred in August 2024 to UAE-based Oceanix Management FZE, a company linked by sanctions researchers to other vessels operating within Russia’s shadow fleet network.
Historical records have also connected the tanker to companies such as Gatik Ship Management and Ark Seakonnect Shipmanagement LLC, both of which have frequently appeared in investigations examining the transportation of Russian oil following the introduction of Western price-cap measures.
The vessel has repeatedly called at Russian ports, including Novorossiysk, Primorsk, St. Petersburg and Ust-Luga, and has been sanctioned by multiple jurisdictions, including the European Union, Canada, Australia, Switzerland, New Zealand and Ukraine.
Beyond oil: concerns over intelligence-gathering activities
In recent years, Western governments and investigative journalists have increasingly raised concerns that some shadow fleet vessels may be used for purposes extending beyond oil transportation.
A joint investigation by the Dossier Center and Norwegian broadcaster NRK reported that Russian citizens with military backgrounds were present aboard several shadow fleet tankers, including Qendil. According to the investigation, two Russian nationals who joined the vessel in 2025 were officially listed as security personnel despite having no known maritime qualifications.
The investigation identified the individuals as Aleksandr Malakhov and Viktor Aleksandrov and alleged links to Russian military and paramilitary structures. These claims have not been independently verified by international authorities, but they have fueled broader concerns about the possible use of commercial vessels for intelligence-related activities.
Both men left MV Qendil before the December drone strike, but their presence is consistent with a broader pattern identified by several investigations into Russia’s shadow fleet. CNN, citing European intelligence and security officials, reported that individuals with military and intelligence backgrounds have been deployed aboard some shadow tankers operating near European waters.
Journalistic investigations have also pointed to Moran Security Group as a potential source of such personnel. The Russian private security company was sanctioned by the U.S. Treasury in 2024, which alleged that Moran had provided armed security services to Russian state-owned companies, including Sovcomflot.
Similar concerns have appeared in reporting by other Western media outlets and security analysts, who have cited intelligence sources suggesting that some shadow fleet vessels may support surveillance, monitoring or reconnaissance activities in European waters. While the exact functions of such personnel remain unclear, their reported presence has drawn increasing attention from security agencies monitoring Russia’s maritime activities.
Grey-zone operations and regional responses
Some security analysts increasingly view parts of the shadow fleet through the broader lens of hybrid warfare.
Several Western intelligence services have warned that Russia is expanding its use of non-traditional methods to collect information and test Western responses. Within this context, some analysts argue that commercial vessels can provide useful platforms for observation, electronic monitoring and maritime reconnaissance.
At the same time, investigators have examined a series of incidents involving damage to underwater cables and other critical infrastructure in the Baltic Sea. While some Western officials have expressed suspicions regarding possible Russian involvement in certain cases, publicly available evidence remains limited and responsibility has not been conclusively established in every incident.
The debate intensified after reports connected another shadow fleet tanker, Boracay, to unusual activity near European coastlines. Media investigations noted that the vessel’s movements coincided with reports of drone activity near sensitive sites, although no direct operational link has been publicly confirmed.
These developments have contributed to growing concern among European governments regarding the potential security implications of the shadow fleet beyond its role in sanctions evasion.
A changing response
The strike on Qendil marked a notable escalation in efforts to disrupt Russia’s shadow fleet.
For years, international responses focused primarily on sanctions, financial restrictions and vessel blacklisting. However, Ukraine’s decision to target a tanker allegedly involved in transporting Russian oil demonstrated a willingness to employ direct military means against elements of the network used to transport Russian oil despite Western sanctions.
Whether such actions represent the beginning of a broader strategy remains unclear. Nevertheless, the incident reflects a significant shift in how some governments perceive the shadow fleet – not merely as a sanctions-evasion mechanism, but as a potential security challenge with economic, environmental and geopolitical dimensions.
The case of Qendil also illustrates a wider transformation in the maritime domain. As commercial shipping, intelligence gathering and geopolitical competition become increasingly interconnected, the distinction between civilian and strategic maritime assets is becoming more difficult to define. For European policymakers, regulators and shipping companies alike, managing the risks associated with this evolving environment is likely to remain a growing priority.
