The latest Annual National Security Report, published this week by the Department of Homeland Security (DHS) of the Cabinet of the Presidency of the Government, confirms an unprecedented increase in the activity of sanctioned Russian ships in seas and coasts near Spain. According to data collected by the Maritime Action Operations and Surveillance Center (COVAM), the average number of vessels linked to this network detected weekly in Spanish-influenced waters reaches 50 units during 2025, a figure that quintupled previous records.
The activity of this fleet is concentrated, as has been customary in recent years, in three strategic areas: the environment of the Canary archipelago, the Strait of Gibraltar, and the Alboran Sea, three of the most trafficked maritime corridors in the world. The phenomenon occurs in a geopolitical context marked by the war in Ukraine and the effect of international western sanctions on Russian crude, which have generated an extensive network of alternative routes to distribute the merchandise while evading the controls of international maritime trade.
According to the report, the ships of this shadow fleet that approach coasts near the Iberian Peninsula or the Canary Islands "are usually oil tanker vessels that engage in transshipping —from small ships to larger ones, usually— crude oil of Russian origin, although also Venezuelan and Iranian, to then be transported to Asian countries." In this way, the transport networks for this type of oil mask the origin of their cargo in international markets.
The so-called ghost fleet —also known as dark fleet or shadow fleet— is made up of hundreds of oil tankers and cargo ships used to circumvent the sanctions imposed by the European Union, the G7, and the United States after the invasion of Ukraine. In many cases, these are obsolete vessels acquired through complex networks of intermediaries and shell companies. These ships operate with opaque practices: they turn off their geolocation systems, frequently change flags and names, and engage in transshipments of cargo at sea, which greatly complicates their tracking. Moreover, they often sail without the usual marine insurances from large western insurers, increasing the risk in the event of an accident.
According to data from S&P Global, the sanctioned tanker fleet is now around 1,000 ships and includes vessels with flags or linked to Iranian interests, as well as Russian ones. In the case of Venezuelan vessels, control of this industry is currently in the hands of the United States following the intervention of this country earlier this year. Meanwhile, the list of vessels sanctioned by the European Union is now around 600 units.
The concern of the Spanish Government is twofold. On one hand, the risk of accidents in old or poorly maintained ships, which could lead to large-scale crude spills with direct impact on tourism, fishing, and the marine ecosystem. On the other, the possibility that these vessels may be used as a platform for hybrid warfare activities. The security report itself indicates that the ships of the ghost fleet are also potentially employed "in other illicit activities or even in sabotage actions against critical infrastructures." Among those infrastructures are pipelines and essential telecommunications cables that cross the Strait of Gibraltar and connect Europe with Africa and other points in the Atlantic.
Although the report clarifies that Spain constitutes a "secondary" target within the strategy of Russian hybrid activity, the Government admits that the increasing circulation of these ships near its coasts "adds risks" that cannot be ignored.
Despite the increase in activity, acting directly against these vessels on the high seas is legally complex. International and maritime law is restrictive regarding boardings in international waters, and most of these ships operate in transit areas where direct intervention is very limited. Additionally, the vessels of the shadow fleet maintain ties with the Russian state, which entails associated risks. The report itself acknowledges that "the legal possibility of acting against them at sea is a matter of difficult resolution."
Given this scenario, Spain has intensified surveillance through naval means and control systems such as the Integrated External Surveillance System (SIVE) of the Civil Guard, which allows for real-time detection and tracking of suspicious vessels. Cooperation has also been strengthened with the Spanish Navy and the European Maritime Safety Agency, along with the use of coastal sensors and oceanic patrols to monitor any anomalous activity in a context that the report itself describes as increasingly sensitive.
