{
  "id": "2cf0b65b-0629-4c10-b539-f6ea0ce5abfa",
  "url": "https://edition.cnn.com/2025/12/18/europe/russia-oil-tankers-spying-europe-intelligence-sources-intl-invs",
  "source": "extension",
  "status": "approved",
  "category": "Intelligence & Espionage",
  "subcategory": "Human Intelligence (HUMINT)",
  "incident_type": "Recruitment of locals",
  "country": "Russian Federation",
  "source_reliability": "A",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "shadow fleet",
    "Moran Security",
    "Wagner Group",
    "maritime espionage",
    "hybrid warfare",
    "Baltic Sea",
    "drone incidents",
    "NATO maritime security",
    "russian intelligence operations"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Maritime",
  "headline": "Russia’s shadow fleet doubles as spy asset with Moran Security personnel conducting espionage in European waters",
  "description": "Since the Russian full-scale invasion of Ukraine in 2022, Moscow has expanded a shadow fleet of hundreds of oil tankers that evade Western sanctions and generate hundreds of millions annually. Ukrainian and Western intelligence sources have revealed that several of these tankers, including the sanctioned Boracay, incorporate Russian security personnel from Moran Security, a company with ties to Russian military intelligence and private military contractors like Wagner. These operatives engage in espionage—photographing European military installations, monitoring non-Russian ship captains, and possibly involved in sabotage. The Boracay's movements in the Baltic Sea coincided with suspicious drone sightings disrupting Danish airports in late September 2025. After a French military boarding in October 2025, two Russian Moran-linked men were interrogated and the Chinese captain arrested. Moran Security's personnel include ex-Wagner mercenaries and Russian special forces veterans. European officials view the shadow fleet's militarization as a hybrid warfare tactic of plausible deniability to project Russian intelligence and sabotage capabilities near NATO borders. The Danish pilot association called for joint European action to regulate and intercept such unregistered vessels, though political caution prevails.",
  "summary_short": "Russian shadow oil fleet tankers, such as Boracay, carry Moran Security personnel linked to Russian military intelligence and Wagner mercenaries conducting espionage and likely sabotage in European waters near NATO since mid-2025.",
  "summary_extended": "Following Russia's 2022 invasion of Ukraine, Moscow has utilized a shadow fleet of tankers circumventing sanctions. Intelligence sources report that these ships now carry covert Russian operatives from Moran Security, a firm tied to the Russian military, intelligence and Wagner PMC. These operatives aboard ships registered to other countries oversee crews primarily of non-Russian sailors, conduct surveillance including photographing European military sites, and potentially sabotage activities. The tanker Boracay, active in late 2025, was linked to drone disruptions at Danish airports shortly after departing Russia’s Primorsk port. French military boarded Boracay in Brittany in October 2025, arresting the Chinese captain and questioning two Russians identified as Moran personnel. Moran Security originated with links to Wagner and employs former special forces and FSB officers. European security services consider such shadow fleet militarization an advanced hybrid warfare method, enabled by plausible deniability, to project Russian influence and espionage near NATO coasts. Calls for multinational European regulatory responses have met political caution due to the risks of Russian retaliation. This marks a notable escalation in Kremlin hybrid operations using commercial shipping assets.",
  "actor_primary": "Moran Security",
  "target_primary": null,
  "location_text": "Baltic Sea, Primorsk port, Denmark coast, Brittany coast (France)",
  "location_region": null,
  "location_coordinates_lat": 56,
  "location_coordinates_lon": 20,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly details Russian operatives with military and intelligence ties embedded aboard oil tankers engaged in espionage and suspected sabotage near European NATO borders, indicating clear hostile aggressor activity.",
  "event_time_utc": "2025-09-20T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-03-31T12:05:00.122Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

{
  "id": "2cf0b65b-0629-4c10-b539-f6ea0ce5abfa",
  "url": "https://edition.cnn.com/2025/12/18/europe/russia-oil-tankers-spying-europe-intelligence-sources-intl-invs",
  "source": "extension",
  "status": "approved",
  "category": "Intelligence & Espionage",
  "subcategory": "Human Intelligence (HUMINT)",
  "incident_type": "Recruitment of locals",
  "country": "Russian Federation",
  "source_reliability": "A",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "shadow fleet",
    "Moran Security",
    "Wagner Group",
    "maritime espionage",
    "hybrid warfare",
    "Baltic Sea",
    "drone incidents",
    "NATO maritime security",
    "russian intelligence operations"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Maritime",
  "headline": "Russia’s shadow fleet doubles as spy asset with Moran Security personnel conducting espionage in European waters",
  "description": "Since the Russian full-scale invasion of Ukraine in 2022, Moscow has expanded a shadow fleet of hundreds of oil tankers that evade Western sanctions and generate hundreds of millions annually. Ukrainian and Western intelligence sources have revealed that several of these tankers, including the sanctioned Boracay, incorporate Russian security personnel from Moran Security, a company with ties to Russian military intelligence and private military contractors like Wagner. These operatives engage in espionage—photographing European military installations, monitoring non-Russian ship captains, and possibly involved in sabotage. The Boracay's movements in the Baltic Sea coincided with suspicious drone sightings disrupting Danish airports in late September 2025. After a French military boarding in October 2025, two Russian Moran-linked men were interrogated and the Chinese captain arrested. Moran Security's personnel include ex-Wagner mercenaries and Russian special forces veterans. European officials view the shadow fleet's militarization as a hybrid warfare tactic of plausible deniability to project Russian intelligence and sabotage capabilities near NATO borders. The Danish pilot association called for joint European action to regulate and intercept such unregistered vessels, though political caution prevails.",
  "summary_short": "Russian shadow oil fleet tankers, such as Boracay, carry Moran Security personnel linked to Russian military intelligence and Wagner mercenaries conducting espionage and likely sabotage in European waters near NATO since mid-2025.",
  "summary_extended": "Following Russia's 2022 invasion of Ukraine, Moscow has utilized a shadow fleet of tankers circumventing sanctions. Intelligence sources report that these ships now carry covert Russian operatives from Moran Security, a firm tied to the Russian military, intelligence and Wagner PMC. These operatives aboard ships registered to other countries oversee crews primarily of non-Russian sailors, conduct surveillance including photographing European military sites, and potentially sabotage activities. The tanker Boracay, active in late 2025, was linked to drone disruptions at Danish airports shortly after departing Russia’s Primorsk port. French military boarded Boracay in Brittany in October 2025, arresting the Chinese captain and questioning two Russians identified as Moran personnel. Moran Security originated with links to Wagner and employs former special forces and FSB officers. European security services consider such shadow fleet militarization an advanced hybrid warfare method, enabled by plausible deniability, to project Russian influence and espionage near NATO coasts. Calls for multinational European regulatory responses have met political caution due to the risks of Russian retaliation. This marks a notable escalation in Kremlin hybrid operations using commercial shipping assets.",
  "actor_primary": "Moran Security",
  "target_primary": null,
  "location_text": "Baltic Sea, Primorsk port, Denmark coast, Brittany coast (France)",
  "location_region": null,
  "location_coordinates_lat": 56,
  "location_coordinates_lon": 20,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly details Russian operatives with military and intelligence ties embedded aboard oil tankers engaged in espionage and suspected sabotage near European NATO borders, indicating clear hostile aggressor activity.",
  "event_time_utc": "2025-09-20T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-03-31T12:05:00.122Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}