From May 19, 2025, GPS spoofing attacks from western Russian Gulf of Finland waters disrupted tanker navigation including the vessel GREEN ADMIRER, forcing ships to avoid Russian waters and take riskier routes near Estonian waters.

Cyber & Information WarfareCyber AttacksUnknown

Aggressor

Summary

On May 19, 2025, signals showed AIS playback and GPS spoofing originating from western Russian parts of the Gulf of Finland. This spoofing affected the navigation of tankers, including the confiscated vessel GREEN ADMIRER, casting false positions and forcing tanker captains to avoid Russian territorial waters. Consequently, ships were compelled to navigate more complicated routes near Estonian waters. Visual evidence from maritime tracking systems illustrated a marked contrast between normal tanker routes through Russian waters and the more difficult alternative routes taken due to interference. Subsequent data indicates that the GREEN ADMIRER was released shortly after, interpreted as the delivery of a targeted operational message.

Classification

Confidence: High

The event describes clear GPS spoofing originating from Russian maritime areas causing navigational disruption to merchant vessels, including the GREEN ADMIRER tanker, evidencing hostile hybrid warfare tactics. No defensive or countermeasure actions by NATO/allies are described.

Source URL

https://skywriter.blue/pages/did:plc:d56aevbrhhknlxhjisuouofm/post/3lpkdqm7jlk2k

Open source

Provenance

Publisher: csv-import
Submitted: Feb 1, 2026, 00:14 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: May 19, 2025, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "9db00e05-b075-4e74-8999-cd4b2d54f161",
  "url": "https://skywriter.blue/pages/did:plc:d56aevbrhhknlxhjisuouofm/post/3lpkdqm7jlk2k",
  "source": "csv-import",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Unknown",
  "country": "Finland",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "GPS spoofing",
    "Gulf of Finland",
    "maritime security",
    "AIS manipulation",
    "Russian hybrid warfare",
    "GREEN ADMIRER",
    "Baltic Sea"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [],
  "where_text": "Maritime",
  "headline": null,
  "description": "AIS data playback from Russian areas in the Gulf of Finland shows ongoing GPS spoofing disrupting ship navigation. The tanker GREEN ADMIRER was notably affected by position spoofing, complicating safe passage and pushing tanker captains to avoid Russian waters in favor of trickier routes near Estonia. This activity, dated May 19, 2025, represents a non-discriminatory GPS spoofing campaign impacting maritime traffic in this strategic region. The release of the GREEN ADMIRER shortly after signals that the spoofing may be a deliberate pressure tactic or message.",
  "summary_short": "From May 19, 2025, GPS spoofing attacks from western Russian Gulf of Finland waters disrupted tanker navigation including the vessel GREEN ADMIRER, forcing ships to avoid Russian waters and take riskier routes near Estonian waters.",
  "summary_extended": "On May 19, 2025, signals showed AIS playback and GPS spoofing originating from western Russian parts of the Gulf of Finland. This spoofing affected the navigation of tankers, including the confiscated vessel GREEN ADMIRER, casting false positions and forcing tanker captains to avoid Russian territorial waters. Consequently, ships were compelled to navigate more complicated routes near Estonian waters. Visual evidence from maritime tracking systems illustrated a marked contrast between normal tanker routes through Russian waters and the more difficult alternative routes taken due to interference. Subsequent data indicates that the GREEN ADMIRER was released shortly after, interpreted as the delivery of a targeted operational message.",
  "actor_primary": "Russian military or state-backed actors",
  "target_primary": null,
  "location_text": "Gulf of Finland, Russian waters near Estonian waters",
  "location_region": null,
  "location_coordinates_lat": 61.92411,
  "location_coordinates_lon": 25.748151,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The event describes clear GPS spoofing originating from Russian maritime areas causing navigational disruption to merchant vessels, including the GREEN ADMIRER tanker, evidencing hostile hybrid warfare tactics. No defensive or countermeasure actions by NATO/allies are described.",
  "event_time_utc": "2025-05-19T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-01T00:14:41.898Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "unknown",
  "severity_band": "moderate",
  "attribution_confidence_band": "medium",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: MediumSingle sourceTime: UnknownLocation: Approximate

Source reliability

Info credibility

Event time

May 19, 2025, 00:00 UTC

Event time confidence

unknown

Location

Gulf of Finland, Russian waters near Estonian waters

Primary actor

Russian military or state-backed actors

Country

Finland

Tags

GPS spoofing, Gulf of Finland, maritime security, AIS manipulation, Russian hybrid warfare, GREEN ADMIRER, Baltic Sea

Nodes

Node 1: Borders

Loading signal...

{ "id": "9db00e05-b075-4e74-8999-cd4b2d54f161", "url": "https://skywriter.blue/pages/did:plc:d56aevbrhhknlxhjisuouofm/post/3lpkdqm7jlk2k", "source": "csv-import", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Unknown", "country": "Finland", "source_reliability": "C", "info_credibility": "3", "tags": [ "GPS spoofing", "Gulf of Finland", "maritime security", "AIS manipulation", "Russian hybrid warfare", "GREEN ADMIRER", "Baltic Sea" ], "nodes": [ "Node 1: Borders" ], "countries": [], "where_text": "Maritime", "headline": null, "description": "AIS data playback from Russian areas in the Gulf of Finland shows ongoing GPS spoofing disrupting ship navigation. The tanker GREEN ADMIRER was notably affected by position spoofing, complicating safe passage and pushing tanker captains to avoid Russian waters in favor of trickier routes near Estonia. This activity, dated May 19, 2025, represents a non-discriminatory GPS spoofing campaign impacting maritime traffic in this strategic region. The release of the GREEN ADMIRER shortly after signals that the spoofing may be a deliberate pressure tactic or message.", "summary_short": "From May 19, 2025, GPS spoofing attacks from western Russian Gulf of Finland waters disrupted tanker navigation including the vessel GREEN ADMIRER, forcing ships to avoid Russian waters and take riskier routes near Estonian waters.", "summary_extended": "On May 19, 2025, signals showed AIS playback and GPS spoofing originating from western Russian parts of the Gulf of Finland. This spoofing affected the navigation of tankers, including the confiscated vessel GREEN ADMIRER, casting false positions and forcing tanker captains to avoid Russian territorial waters. Consequently, ships were compelled to navigate more complicated routes near Estonian waters. Visual evidence from maritime tracking systems illustrated a marked contrast between normal tanker routes through Russian waters and the more difficult alternative routes taken due to interference. Subsequent data indicates that the GREEN ADMIRER was released shortly after, interpreted as the delivery of a targeted operational message.", "actor_primary": "Russian military or state-backed actors", "target_primary": null, "location_text": "Gulf of Finland, Russian waters near Estonian waters", "location_region": null, "location_coordinates_lat": 61.92411, "location_coordinates_lon": 25.748151, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The event describes clear GPS spoofing originating from Russian maritime areas causing navigational disruption to merchant vessels, including the GREEN ADMIRER tanker, evidencing hostile hybrid warfare tactics. No defensive or countermeasure actions by NATO/allies are described.", "event_time_utc": "2025-05-19T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-02-01T00:14:41.898Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "unknown", "severity_band": "moderate", "attribution_confidence_band": "medium", "attribution_basis": "single_source" }