In mid-June 2025, maritime GNSS spoofing in the Baltic Sea intensified sharply, extending beyond usual hotspots around Kaliningrad into the Kattegat region near Denmark and Sweden. Authorities responded with alerts to mariners due to navigation errors evidenced by AIS data showing erratic vessel movements and TOREC-pattern spoofing signatures. Detailed analysis identified multiple distinct spoofing units operating within limited line-of-sight zones consistent with doctrinal Russian spoofing tactics and hardware such as the Crown JS1-7. The spoofing caused vessel positions to deviate over 2.5 km from actual locations, creating operational hazards within 2 nautical miles of shore. Spoofed signals were localized using AIS heatmaps, geofencing, and node transition probabilities, further supported by aircraft ADS-B monitoring visible on gpsjam.org. This event signals a broadened geographical scope and operational sophistication of Russian maritime GNSS spoofing campaigns.

In mid-June 2025, maritime GNSS spoofing in the Baltic Sea intensified sharply, extending beyond usual hotspots around Kaliningrad into the Kattegat region near Denmark and Sweden. Authorities responded with alerts to mariners due to navigation errors evidenced by AIS data showing erratic vessel movements and TOREC-pattern spoofing signatures. Detailed analysis identified multiple distinct spoofing units operating within limited line-of-sight zones consistent with doctrinal Russian spoofing tactics and hardware such as the Crown JS1-7. The spoofing caused vessel positions to deviate over 2.5 km from actual locations, creating operational hazards within 2 nautical miles of shore. Spoofed signals were localized using AIS heatmaps, geofencing, and node transition probabilities, further supported by aircraft ADS-B monitoring visible on gpsjam.org. This event signals a broadened geographical scope and operational sophistication of Russian maritime GNSS spoofing campaigns.