![COLUMN | The Twelve Days of Christmas 2025: Seven investigators and the Dark Fleet, eight months and no US shipbuilding strategy, nine million for an 80-tonner in the Bourbon auction (part one of two) [Offshore Accounts]](http://media.assettype.com/bairdmaritime%2F2025-12-21%2F8cs9ojb2%2FUntitled.jpeg?w=480&auto=format%2Ccompress&fit=max)
If you are a regular reader, you know the score. If you are not, welcome, especially if you are working for a Russian-linked dry bulk company in Oslo.
We are running through the Twelve Days of Christmas, from an offshore perspective. On the first day of Christmas my true love gave to me… a partridge in a pear tree, as per the ancient English carol, so that's the hook for a dozen topical features about the offshore industry.
Last week, six geese-a-laying, five gold rings and four calling birds inspired features on the six jackups being a-sold by Noble, five million tons of LNG per year planned for Woodside in Timor-Leste, and a four per cent stock price rise for TotalEnergies as it bought big in Namibia from Galp.
Now we move on through the traditional nine ladies dancing, eight maids-a-milking and seven swans-a-swimming…
Probably the most famous quote to come out of the Scooby-Doo cartoons is the "Meddling Kids" line, where a defeated and unmasked villain complains that their nefarious plot has been busted by Shaggy, Scooby and the gang of sleuths: "And I would have gotten away with it too, if it weren't for you meddling kids!"
Now the head of the GRU, Russia's military intelligence directorate, is probably muttering similar lines, as seven German journalism students used open-source intelligence and public AIS vessel tracking to link two Russian-crewed cargo vessels in Northern Europe to suspicious drone activity off Germany and the Netherlands.
Maybe he’s not, because unlike the Scooby-Doo gang and their Mystery Machine, the Ukrainian opponents of the GRU use lethal force, and Major General Andrei Vladimirovich Averyanov was reportedly on board the Oman-flagged tanker Qendil when it was hit by an aerial hexacopter drone whilst in ballast in the Mediterranean on Friday.
One might wonder what a senior GRU officer and his colleagues were allegedly doing on board a "dark fleet" tanker, but, as we shall see, the boundaries between civilian Russian-linked vessels and the Kremlin’s campaign of hybrid warfare has become increasingly blurred in recent weeks.
According to Henk Van Ess of the digitaldigging.org website, seven German students at the Axel Springer Academy identified that a 32-year-old general cargo vessel, the 78-metre-long, Antigua and Barbuda-flagged HAV Dolphin, had been circling aimlessly in Germany’s Kiel Bay for ten days in May, directly after a shipyard stay in Russia.
Kiel is close to the German naval shipyards, where drone swarms had been spotted on three separate occasions during the vessel’s time sailing round and round at the anchorage. Then, in June, the ship was moored for three days in the Ems estuary, only 35 nautical miles away from where, surprise, another suspicious drone sighting was reported over a German defence facility at the same time.
Regular readers won’t be shocked to discover that all the crew were Russian. Professor Van Ess made further enquiries and discovered that the vessel had been inspected by German security officials, who noted that, “during personnel inspection, an additional watch officer was found on board who behaved conspicuously during the inspection.”
The captain claimed he was there for training purposes, the German authorities noted.
Within the penny-pinching world of European short shipping, such a story does indeed seem unlikely. The vessel’s managers are HAV Shipping of Oslo, a company that claims to be completely Norwegian-owned and utterly innocent of all wrongdoing.
The chair of the company claimed to the students that the vessel’s movements were perfectly legitimate, that HAV has no Russian customers, and that he knew nothing of the drone sightings.
European intelligence sources contacted by Herr Van Ess confirmed that the vessel’s movement profiles were “very conspicuous” and show “little evidence of commercial activity.”
Hmm...
Surprise, the German student sleuths then looked at a sister vessel under the same management, another HAV-owned and managed ship, 34-year-old, Bahamas-flagged HAV Snapper, an 88-metre-long general cargo vessel, another vessel with a completely Russian crew.
This ship sailed to a position off the Dutch island of Schiermonnikoog on May 16, and then, just two hours later, drones were spotted over the German Federal Police vessel Potsdam, which was shadowing the Russian flagged freighter Lauga through the North Sea. After several hours of close drone flights, the German vessel aborted its escort mission. HAV Snapper was within drone range at the time.
The investigators found that both HAV Snapper and HAV Dolphin had been serviced at the Pregol Shiprepair Yard in the Russian enclave of Kaliningrad in the Baltic, with Dolphin being there as recently as April of this year. HAV Shipping told the journalists that Pregol is, “a reputable shipyard used by many European shipping companies.”
Really? The yard claims on its website that it has more than 120 customers on a regular basis, including Femco, Rosatom, and sanctioned fishing company Norebo (a Murmansk company listed by the EU in the 17th sanction package as conducting espionage and, “activities that can facilitate future sabotage operations,” as per reports in the Barents Observer).
There appear to be no non-Russian companies listed apart from HAV, which I think we can agree seems to be a little unusual.
There’s no smoking gun here, but the body of circumstantial evidence seems, er, interesting.
In order to provide some context to the story, I wrote to HAV Shipping for their side, because certain aspects seem a little odd. I asked the following questions:
1. These two vessels have only Russian crews, which seems unusual in light of the sanctions on Russia in Norway and given the difficulties to make payments through the banking system to Russian individuals and companies. What crewing provider do you use in Russia, why, and what vetting do you undertake to ensure that the crew are not in the pay of Russian intelligence agencies?
2. Given that the researchers have provided credible circumstantial evidence to connect your ships to drone sightings in the North Sea in 2025, what additional measures have you taken to ensure that your vessels are not being used as platforms for drone operations?
3. How frequently do your managers and superintendents visit the vessels in person?
4. What is the reason for performing maintenance on the vessels in Russia, given the difficulties in obtaining spare parts and equipment in Russia, for foreigners to travel there, and the challenges of making international payments?
5. Your website states that the company is Norwegian-owned, but who are the ultimate beneficial owners of the holding company that controls HAV Shipping and HAV Chartering?
6. Who were the charterers of HAV Dolphin and HAV Snapper at the time of the incidents covered by the drone investigators?
7. What KYC have you put in place to ensure that the charterers are bona fide commercial entities and not individuals like Jan Marsalek or his associates?
If we receive an answer, we’ll happily publish it.
The drone flights are only one aspect of the hybrid war currently going in in European waters between Russia on one side and Ukraine and other European states on the other. When we look back at 2025, we see that the dark fleet of sanction-breaking tankers and other vessels are on the front line of escalating hostilities.
In October, we covered the unfortunate coincidences surrounding the 2011-built Oslo Carrier 3, a Russian-crewed vessel with an unfortunate tendency to be in the vicinity of suspicious drone sightings over strategic facilities like Copenhagen airport or near sinking Russian vessels reportedly carrying weapons.
Oslo Carrier 3’s manager said that it was all a big misunderstanding and just bad luck that their ship happened to be near to the drone flights. As with HAV, the evidence is circumstantial, and again, there is no evidence of wrongdoing by either company, their management or their Russian crews, just to be clear.
However, there are several similarities here between the Oslo Bulk and HAV Shipping situations. Both companies are small, private Norwegian players with small general cargo vessels operating in Europe, and all three vessels were fully Russian-crewed, even though Russian crewing is extremely inconvenient in the current era of sanctions.
Both companies have ties to Russia. Indeed, one of the few HAV staff studied Russian as per his Linkedin page.
There is also evidence of at least one Russian national in the management of Oslo Bulk, and both companies have connections to the Russian Baltic enclave of Kaliningrad. Associate Professor Åse Gilje Østensen at the Norwegian Naval Academy has said that she doubts that Russian seafarers have a choice if Russian authorities ask them to carry out missions for the Russian state. This is, “because Russia has an authoritarian system of government with little legal protection for its own citizens, nor has it had strong distinctions between civilian and military missions.”
So even if the management might not be aware, Russian crewmembers have little choice if the GRU comes a-knocking on their door when they are on leave asking for some help, or if a “trainee” officer arrives onboard with a drone-flying hobby and an interest in Western security bases where he wants to practice his pilotage.
Malte Humpert in High North News has documented how Russia's FSB security service managed to interrogate and intimidate the European officers on the 15 LNG ships transporting the (un-sanctioned) gas from the Yamal LNG plant and have them systematically replaced by Russian nationals.
In a great piece of investigative journalism that was barely covered at the time, Humpert reported the following:
“The FSB also established a network of informants among Russian officers. Their job was to relay information about Western crews to the security services. During subsequent FSB interrogation, Western officers found themselves confronted with 'evidence' about jokes they made about President Putin or comments they made about the Ukraine War.
"The interrogations could last hours, often stretching beyond the vessel’s planned departure time, leaving crewmembers in uncertainty if they would be allowed to re-board the ships.
"Within months, an increasing number of Western crewmembers had departed. Two British junior officers, during their first tour aboard an Arc7 LNG carrier, were taken ashore by the FSB for lengthy questioning against the wishes of the captain. The British crewmembers were told in no uncertain terms that they would be arrested if they returned to Russia. They disembarked from the vessel at the next European port, with two Russian officers waiting dock-side to take their place.
“It became clear that the FSB action was designed to pull out as many international officers as possible from the crew and try to force the vessel’s owner to replace the British, Romanian, Polish, Croatian officers with the Russian officers.”
"The ultimate goal was to push Western officers out from the fifteen Arc7 vessels.”
This campaign succeeded and Humpert reported that today close to 90 per cent of the officers and crew on the Yamal LNG carriers are now Russian. Departing Western officers reported how special packages would be handed to Russian officers at port calls in Europe and taken directly to their cabins outside of customs processes, and would then be handed over to an FSB guard or terminal agent at the Russian LNG terminal.
The challenge with hybrid warfare is that it is always grey and ambiguous. There is rarely a smoking gun, just coincidences and unusual situations. Nor is it in the interests of western intelligence agencies, scattered across different countries and operational silos, to present the full picture. Instead, we must collate multiple sources across multiple jurisdictions to get a more nuanced account.
When drones were spotted in Irish airspace during a visit by Ukrainian President Volodymyr Zelenskyy to Ireland on December 1, they were deliberately positioned on the edge of Irish territorial jurisdiction (12 nautical miles from the coast). The Irish Times claimed that they were launched from an unknown vessel in the Irish Sea.
This pattern of plausible Russian deniability and the use of merchant ships for what appear to be covert operations is well-documented from circumstantial accounts.
We know that several Baltic Sea cables were “accidentally severed” by various Russian-linked vessels at the end of 2024 – my summary here. We know that fires, sabotage, and airport closures due to drones have continued through the year in Europe, and even the deliberate destruction of a railway line in Poland in an attempt to derail a train has been attributed to Russian agents.
The Barents Observer has highlighted how a year ago, the Russian reefer ship Ocean 28 had been at sea for almost two months when it started to sail back and forth in the waters outside the island of Gossa off Norway. Surprise! The island is the site of the Nyhamna gas processing plant and the Langeled pipeline that transports Norwegian natural gas to the UK.
Other Russian vessels have been caught loitering over submarine data cables in Europe, including Yantar, operated by Russia’s directorate of deep-sea research, known as Glavnoye Upravlenie Glubokovodnikh Issledovanii, which has been observed in the Irish Sea and was the subject of a deep dive by the Financial Times.
So, perhaps it is no surprise that General Andrei Vladimirovich Averyanov was reportedly on board the Oman-flagged tanker Qendil.
There are close to one thousand dark fleet vessels, mostly fake-flagged or flying flags of convenience from the most dubious of open registries, which abuse the International Maritime Organisation’s light touch treatment of beneficial ownership and the regime of sovereign flag states.
The attacks by the Ukrainian armed forces on Qendil and the attacks on two dark fleet tankers fake-flagged to Gambia in the Black Sea earlier this month show that a new tanker war has opened up. Ukraine will attack dark fleet vessels to try to harm Russian oil exports and the funding that supports the Russian military’s brutal invasion.
If I had to choose a meddling kid, I would prefer Scooby, Shaggy and the gang, and even seven German journalism students, to Kyrylo Budanov, the chief of the Main Directorate of Intelligence of the Ministry of Defense of Ukraine. But whether you are a crewmember on a dark fleet tanker, or the fake Red Beard the Pirate on a faux Ghost Ship, a greedy shipowner who highjacked his own ships and stole the cargo, you don’t get to choose your nemesis.
