Two Men Linked to Russian Military Were Aboard Shadow-Fleet Tanker Qendil
Suspicious men with military bearing have been spotted on shadow-fleet tankers many times in the Baltic, giving Western security experts the impression that the Russian government is directing operations of the underinsured, anonymously-owned fleet that carries most of Russia's oil. It is widely suspected that some of these vessels have been used as launching points for Russian "hybrid warfare" harassment and espionage efforts in European waters, like the drone incidents over Denmark in September 2025. That concerning pattern continues: according to Norwegian broadcaster NRK and investigative outlet Dossier Center, two security operatives with a history in Russia's military intelligence/paramilitary community were posted aboard the tanker Qendil, the shadow fleet ship that was attacked by Ukrainian drones in December.
Dossier Center obtained the crew roster for Qendil's September 6 departure from Ust-Luga, Russia. On the roster, it identified two persons of interest: Alexander Malakhov and Viktor Alexandrov, both listed as "security" supernumeraries without mariner credentials. It was the first and only voyage the ship made on this route with security personnel on board; on the subsequent voyage, when Qendil was attacked, the ship did not have such guards on the roster.
Dossier Center specializes in deep-dive investigations into Russian intelligence operations, and it was able to access data on the two guards' military backgrounds. Malakhov, 51, had served in a special forces brigade attached to Russia's Main Intelligence Directorate (GRU), the espionage division of Russia's military. He served for a while in a civilian security role, then spent some time in Syria, where Russia once had a large military and mercenary presence to prop up the regime of dictator Bashar al-Assad (since deposed). Aleksandrov, 61, was a convicted criminal who later joined the notorious mercenary company Wagner Group, traveling to Syria and later to occupied areas of Ukraine, according to Dossier Center.
The two men were not on board when Qendil was attacked by Ukrainian drones in the Mediterranean, nor when it grounded on the rocky shores of Bozcaada, Turkey in early January. The vessel remains aground as of January 13.
At least 10th tanker attacked in the Mediterranean in the past year ????
In the past hour, #Oman-flagged sanctioned Crude #Oil Tanker MT QENDIL (IMO 9310525) was attacked in the #Mediterranean with multiple #drones.
MT QENDIL is listed under #EU/#UK sanctions and associated with… pic.twitter.com/PC4Oo5AnKV
— Martin Kelly (@_MartinKelly_) December 19, 2025
Based on Russian doctrine, it is likely that shadow-fleet tankers are used as espionage platforms, Russian history professor Kari Aga Myklebost told NRK.
that matters most
Get the latest maritime news delivered to your inbox daily.
"It is . . . reasonable to assume that Russia uses the shadow fleet not only to circumvent Western sanctions and carry out sabotage against undersea cables, as we have seen many examples of in the last couple of years, but also for intelligence," she said. "The Russian maritime doctrine, which was updated in 2022, points in the same direction, in that it explicitly allows for the use of civilian vessels for military purposes."
NRK and Reuters have determined that Qendil was also insured by Ro Marine, an unlicensed insurance provider based in Norway with links to the shadow fleet. Ro Marine has since taken down its website and dissolved its operations.
Content Original Link:
" target="_blank">
