Shadow Fleet Mercenaries

It was almost three o’clock in the morning on 11 April 2025. The Estonian Navy, together with the coastguard, deployed a minesweeper, a helicopter and patrol vessels.

In the Baltic Sea, the tanker Kiwala was slowly approaching from the west when the authorities moved in on the 244-meter-long dark fleet vessel. The Chinese captain was ordered to stop and follow the coastguard, which he did.

Much to Russia’s displeasure.

Through the international collaboration Shadow Fleet Mercenaries, Danwatch can for the first time reveal how, following the Kiwala incident, Russia has deployed covert soldiers on the dark fleet to monitor and control the crews on the ships.

At least 83 Russians with experience from the Russian military, as well as private military groups, the police and intelligence services, have sailed through Denmark 140 times on 65 different ships.

Almost all of these voyages took place from May 2025 to February 2026. In total, 58 of the 65 ships carried oil sold by the Russian state-owned company Rosneft.

Four soldiers now reveal in covert footage that their task is to persuade the captains to defy requests and orders from NATO, so that the ships are not detained.

”My direct task was to supervise the crew, the captain and the first mate. I identified who was telling, who they were working for, and what type of information was being sent from the ship to shore,” says mercenary Arkadiy on hidden camera.

He says he has eight years of experience as head of security for a “private military group” in Syria, where the Wagner Group in particular has operated.

The investigation Shadow Fleet Mercenaries is a European collaboration between Danwatch, Dossier Center, Follow The Money, The Times, Süddeutsche Zeitung, NDR, Delfi, OCCRP, SourceMaterial, Pointer, VRT NWS, Expressen, Helsingin Sanomat and De Tijd.

Projektet er baseret på skjulte optagelser af soldaterne og en gennemgang af mere end 2000 besætningslister fra den russiske skyggeflåde, som Dossier Center har anskaffet – et medie, der er ejet af Putin-kritikeren Mikhail Khodorkovsky.

The recordings were made by a Russian-speaking journalist from Dossier Center, but produced in ongoing dialogue with Danwatch and the other media partners.

An analysis carried out by Danwatch and our media partners of the soldiers’ backgrounds shows that more than half have worked for Russian private military companies (PMCs) such as Wagner, Moran Security and Africa Corps – or have served in the Russian army.

In addition, at least four are employed by a company that, according to an expert, is directly controlled by Russia’s military intelligence service, the GRU.

Former unit commander in the Wagner Group. Has fought in Syria and Ukraine and took part in the siege of Mariupol.

A bloodstained trail of human rights violations

Behind the figures are some of the most feared soldiers in the world.

According to Karen Philippa Larsen, a researcher in global security at DIIS and a leading expert on Russia’s PMCs, these groups are known for being extremely prone to violence and for glorifying torture and abuse.

“Wherever one of the PMCs has been somewhere, whether it’s Syria, Libya, Ukraine or elsewhere, they leave behind a trail of human rights violations and some of the worst crimes,” she says. She emphasises that, broadly speaking, the same can be said of the Russian army.

On the Russian social media platforms VKontakte and Odnoklassniki, as well as the messaging service Telegram, it has been possible to find photos from several of the men’s military service.

Here, among other things, one can see one of the soldiers, a man named Ruslan, posing with a weapon in Ukraine next to a bridge pillar on which is written “KILL THE UKRAINIANS”.

Several of the soldiers have fought in Ukraine, Syria and in Mali as part of the private military group Africa Corps, whose leader also heads the notorious sabotage unit GRU 29155, which is part of Russia’s military intelligence service.

GRU 29155 is responsible, among other things, assassinations, sabotage and cyberattacks in Europe.

The soldiers’ presence therefore increases the risk that the ships could be used to carry out sabotage operations against European countries – including Denmark.

This is the view of Commander Kenneth Øhlenschlæger Buhl, a military analyst and postdoctoral researcher at the University of Southern Denmark.

According to him, it is clear that the soldiers pose a risk of hybrid warfare actions against NATO countries in the Baltic Sea.

“Some of these people with a Spetsnaz background (Russian special forces, ed.) could, after all, launch a rubber dinghy late one evening and sail ashore to blow up a transformer station and sail back again without anyone noticing.”

Several of the ships with mercenaries on board have already been involved in suspicious incidents – including the alleged drone incident in Denmark, where airports across the country had to shut down after possible drone sightings over airfields.

The soldiers themselves claim in the hidden footage that they are unarmed. A key source in the German Ministry of Defence tells Danwatch’s NDR that the Germans have photographic evidence that they have been armed on several occasions.

Contract with the intelligence service

An analysis of the covert soldiers appearing on the crew lists shows that 16 people have fought for the Wagner Group.

Flere af de øvrige soldater deler billeder og videomateriale med stærk tilknytning til den berygtede militærgruppe på deres sociale medier. 

Leaked data also show that three of the men have tried to get work with the Wagner Group but had their applications rejected.

According to Karen Philipp Larsen, these are some of the most brutal soldiers in existence.

A Wagner mercenary who has fought in both Syria and Ukraine. He was deployed to Syria in 2017 and went to Ukraine following the invasion in 2022.

“The Wagner Group has made extreme violence its hallmark. It really worries me that so many Wagner soldiers are sailing around on the dark fleet, as the figures you have shown me indicate. It is very serious. I am concerned both for security here in Europe, but also for the crews on the ships,” she says.

Among the other Russians on the lists, five are, according to our research, linked to the private military group Moran Security. Four work for the private military organisation Redut, which according to Karen Philippa Larsen is de facto Russia’s intelligence service.

“If you sign a contract with Redut, it is a direct contract with the GRU. That is who you are working for,” she says. She also emphasises that all PMCs ultimately take their orders from Russia’s military and intelligence service.

In addition, 18 people have served in Russia’s armed forces, whilst the rest have backgrounds in Russia’s state or private security services.

The tasks the soldiers may be assigned therefore span a wide range, Karen Philippa Larsen believes.

“With these soldiers on the ships, the GRU has a weapon it can control 100 percent. They can commit all kinds of offences and acts of war on behalf of the Russian state,” she says.

When Jaguar refused to follow orders

One of the soldiers who could be used by the GRU is the Russian Nikolai. He has previously served in one of Russia’s elite units, the 331st Parachute Regiment, which has suffered heavy losses during the war in Ukraine.

He has also been sailing around the Baltic Sea on tankers in secret.

Nikolai was recorded on hidden camera explaining how the incident in Estonia involving the tanker Kiwala – where the captain obeyed the Estonians’ orders and had his ship detained – was the catalyst that led him and other soldiers to take control of the dark fleet.

According to him, the Russians are there to “prevent such inappropriate actions” by the ships’ captains.

One month after the Kiwala incident, on Tuesday 13 May 2025, the Estonians again tried to stop a ship. This time it was the tanker Jaguar, which was suspected of sailing under a false flag.

But unlike the Kiwala, the captain of Jaguar refused to stop and directly defied orders from the Estonians.

The ship suddenly received assistance from the Russian navy, which appeared with aircraft and ships and forced the Estonians away, allowing the Jaguar to escape.

There were no mercenaries on Jaguar, but according to the soldier Nikolai, the crew acted exactly as the Russians would have wanted:

“The captain behaved properly; he did not give in to the provocations,” says Nikolai.

The Estonians have not attempted to stop ships since and have even announced that they no longer dare to do so for fear of Russian escalation.

According to the soldier Nikolai, the two incidents in Estonia were among the reasons why Russian soldiers today “monitor and report” the crew’s behaviour to Russia and try “to prevent the ship from deviating from its course” like the Kiwala.

He has been at war in Ukraine since 2014 and until at least 2023. He has a chequered criminal record. In 2023, he received the Order of Courage, one of the highest honours a Russian soldier can receive.

The soldier Arkadiy explains that it is important to constantly pay attention to what the ordinary crew are doing.

“We have to keep an eye on this, because some captain might suddenly say something inappropriate,” he says.

Here he refers to information that NATO countries have begun collecting about ships sailing through the Baltic Sea – for example the ship’s insurance, owners, route, flag state and the like.

Arkadiy also claims that there are “endless requests” from NATO countries for the tankers to stop. Including allegedly from “submarines in the English Channel”.

Sudden increase in May

A data analysis of the thousands of crew lists confirms Nikolai’s statement that the mercenaries were deployed after the dramatic pursuit of Jaguar in May 2025.

Following the incident, the number of soldiers on the dark fleet rose significantly, a trend that continued for the rest of the year.

The large number of Russian soldiers on tankers in the Baltic Sea means that Russia has the potential to cause severe damage through hybrid attacks.

They could cause environmental disasters through deliberate oil spills or sail into the naval base at Korsør, sink the ship and thereby block the entrance and set fire to the cargo, Kenneth Øhlenschlæger Buhl believes.

“It’s also possible that they might suddenly open the cargo hold and send a swarm of drones towards Karup, Aalborg or Copenhagen. Only imagination sets the limits,” he says.

In September, the Kiwala – which had been renamed to Boracay – sailed from Russia with two mercenaries on board and was suspected of involvement in the alleged drone incident in Denmark.

One of the soldiers had previously fought for the Wagner Group.

Crew member: None of us liked them

The crew lists show that the Russian soldiers board the ships in teams of two. Most often they are simply listed as “extra crew”, but in a few cases they are described as “security guards” or “radio engineers”.

The rest of the ships’ crews are usually from countries such as India and the Philippines.

An ordinary crew member from India, who has sailed on one of the ships with mercenaries on board, has agreed to describe the surveillance carried out by the Russians.

He is speaking anonymously for his own safety, but Danwatch is aware of his identity.

Sergei has served in Russia’s air force and has been employed by the Russian police. In addition, he has a number of convictions for criminal offences. He has fought in Syria.

“Every day at eight o’clock they check the ship’s position and then report it to their headquarters,” the person says, stressing that “they work for the Russian Federation and constantly report on the ship”.

The crew member explains that it was not their wish to have the soldiers on the ship.

“None of us liked them […], we don’t need them, and they don’t help us. They just contact their headquarters and report everything they see and everything the captain does.”

Normally, the captain makes the final decisions on a ship, but the soldiers nevertheless routinely gave the captain orders on what to do.

If the captain refused, they would get angry and sometimes contact the ship’s owners and the captain’s employer directly, the crew member explains.

The crew member also states that the soldiers were in contact with the Russian navy, and that it was the crew’s perception that the navy was ready to assist the ships against NATO.

Disappeared from the crew lists

In 2026, the number of mercenaries on the dark fleet’s crew lists suddenly dropped drastically. Since March, it has no longer been possible to find soldiers on the lists.

A European intelligence source, with whom the media behind Shadow Fleet Mercenaries has spoken, says Russia may have concluded that it should not further fan the flames in the Baltic Sea.

“Russia has some need to prevent the situation in the Baltic region from escalating too much, for its own sake. The Baltic Sea is, in practice, a lifeline for Russia, through which a significant proportion of the country’s energy exports pass. If the situation in the Baltic Sea escalates very significantly, all the coastal states will of course suffer, but Russia will certainly be among those hit hardest,” the source says.

Several of the ships are now sailing under the Russian flag rather than those of third countries, as the dark fleet normally does, and therefore they may have been concealed on the lists. This is the view of Michelle Bockmann, a senior analyst at the maritime data company Windward and a leading expert on the dark fleet.

“I wonder if the reason you’re seeing fewer (soldiers, ed.) is because these ships are sailing under the Russian flag and there is tighter control over their names and numbers, so you can no longer find that information,” she says.

An analysis of data from MarineTraffic shows that 30 of the 65 mercenary vessels have sailed through Denmark since March. More than half of these voyages took place in May and June.

However, it is not possible to tell from the crew lists whether they have “extra crew” on board.

The analysis also shows that the captains on the dark fleet are increasingly Russian nationals. Since March, at least three out of four of the ships have had a Russian captain.

Most recently, France boarded a tanker on 3 June and arrested its Russian captain for refusing to follow orders. Exactly the same as the Russian soldiers on the ships’ mission.

Soldiers claim the story is a fabrication

The soldier Nikolai was confronted with the fact that he appeared on hidden camera. Follow-up questions were put to him. He did not wish to respond, but instead writes that “all the information” about him that we are publishing “is false”.

As for the soldier Arkadiy, he has not answered any questions, but instead writes that he “have never been on board a tanker, I know nothing about the dark fleet, and I consider all of the above to be fabrication”.

The other two soldiers who were recorded on camera have not responded to the enquiry.

Danwatch has asked various authorities for their assessment of the security situation following this revelation.

In addition, Danwatch has attempted to ascertain whether Denmark will raise the issue with other European allies.

It has not been possible to obtain a response from either the Ministry of Foreign Affairs, the Ministry of Defence or the Prime Minister’s Office under the interim government.

Nor has it been possible to obtain a response from the Danish Armed Forces.

The Danish Defence Intelligence Service tells Danwatch that it cannot comment specifically on this matter, but refers to its latest threat assessment. In it, the service states, among other things:

“Russia’s aggressive military behaviour may have several purposes, including testing the responsiveness of NATO countries and creating concern in NATO countries that NATO is heading towards war with Russia.”