From Shadow Fleets to Maritime Proxies: The Expanding Human Dimension of Hybrid Threats
Illustrative image of a port worker overlooking a container vessel and port cranes. Credit: SimonSkafar/iStock
25 September 2026
Maritime hybrid threats may increasingly depend less on shadow fleet vessels than on the recruitment, coercion, and exploitation of seafarers and port workers across the global maritime ecosystem. As state-linked actors adopt methods resembling “crime-as-a-service”, ordinary commercial vessels and personnel could provide access for intelligence collection, influence operations, and disruptive activity - creating a challenge that extends far beyond vessel ownership and sanctions evasion.
By Kristian Bischoff - Senior Analyst, Europe and Russia
The Russian-aligned shadow fleet has become a familiar feature of discussions surrounding sanctions evasion, energy exports, and maritime security. Yet the growing focus on vessels themselves risks obscuring a potentially more significant development. The future maritime hybrid threat may be defined less by the platforms involved and more by the ability of state actors to recruit, task, coerce, and exploit individuals like seafarers and port workers operating throughout the global maritime ecosystem.
For decades, maritime security professionals have viewed what is now labelled the “shadow fleet” primarily through an economic lens. The vessels facilitate trade, maintain export revenues, and reduce the impact of international sanctions. Recent Russian activity involving civilian shipping, however, demonstrates that its use of asymmetric and hybrid methods extends well beyond such economic functions. Against this backdrop, it is worth considering whether the true force multiplier is not the fleet itself, but rather the global network of people working in the maritime sector, who can potentially be leveraged to support intelligence collection, influence operations, or disruptive activity.
The Maritime Equivalent of "Crime-as-a-Service"
One of the defining characteristics of modern organised crime is the emergence of "crime-as-a-service" models. Criminal groups increasingly rely on decentralised networks of facilitators rather than maintaining extensive dedicated infrastructures themselves. Access to local knowledge, logistical support, forged documentation, cyber capabilities, transportation assets, or corrupt insiders can often be purchased on demand.
The maritime sector has been particularly exposed to this phenomenon. Drug trafficking organisations have for decades recruited port workers, customs officials, vessel crew members, logistics personnel, and other individuals with privileged access. These actors are often not ideological supporters of criminal networks. Rather, they are motivated by financial gain, opportunity, or, in some cases, pressure and intimidation.
The same principle is increasingly evident in the realm of hybrid threats. Europol’s 2025 Serious and Organised Crime Threat Assessment describes an emerging “shadow alliance” in which state-linked hybrid actors draw on criminal networks for capabilities, infrastructure, and global reach. Russia’s activity in Europe illustrates how this can resemble a crime-as-a-service model: rather than relying exclusively on trained intelligence officers, handlers can outsource compartmentalised tasks, including surveillance, arson, sabotage, cyber activity, and influence operations, to criminal facilitators or “disposable” recruits, reducing costs while complicating attribution.
Recruitment patterns documented in Europe since 2022 reinforce this comparison. Investigations and recent research indicate that Russian-linked handlers have used Telegram, social media, employment channels, personal ties, and organised-crime contacts to identify financially vulnerable or criminally connected individuals, frequently assigning limited tasks without revealing the wider operation. If maritime access can similarly be outsourced, purchased, or facilitated remotely - and payments moved through cryptocurrency, intermediaries, or illicit financial channels - state actors gain access to a vast pool of potential human assets across ports, terminals, vessels, offshore installations, and maritime supply chains worldwide. This model offers scalability and plausible deniability: individual acts may appear opportunistic or purely criminal even when they contribute to a coordinated hybrid campaign.
Looking Beyond the Shadow Fleet
Much of the current discussion focuses on vessels directly linked to Russia or Russian interests, including the potential for seafarers on vessels visiting Russian ports to be recruited by Russian intelligence. While such vessels undoubtedly warrant attention, an overemphasis on ownership and affiliation may create blind spots.
Any merchant vessel transiting near a naval base, offshore energy installation, military training area, or critical infrastructure corridor may possess opportunities for observation and intelligence collection that would have been highly valuable to traditional intelligence services. The same applies to vessels with port calls in strategically significant locations.
Theoretically, a recruited individual aboard an otherwise ordinary merchant vessel could be tasked with collecting imagery, recording vessel movements, monitoring security procedures, documenting infrastructure layouts, or reporting unusual activity. Even relatively low-value information can become significant when aggregated across multiple sources and locations.
The importance of such activity lies not in any individual observation but in the cumulative intelligence picture that can emerge from repeated collection efforts conducted across hundreds of vessels and voyages. In this sense, the distinction between a dedicated intelligence platform and an opportunistically exploited commercial vessel becomes increasingly blurred.
Examples from narcotics trafficking are sobering small groups of crew members, and in some cases entire crews have been recruited to support cocaine smuggling operations across the Atlantic. Intelligence services could potentially exploit similar forms of infiltration. This could enable activities extending beyond intelligence collection, which might require only a single seafarer with a camera, to include launching small drones or conducting other limited operations. Using an otherwise “clean” vessel as a base would further complicate attribution, particularly if attention remained focused on shadow fleet vessels operating in the same area.
The Overlooked Role of Coercion
Financial incentives, however, represent only part of the equation. The history of maritime narcotics trafficking demonstrates that many participants do not become involved voluntarily. Threats against family members, debt pressure, blackmail, exploitation of immigration status, or intimidation by criminal networks have all been used to compel cooperation.
When considering state-sponsored hybrid activity, similar dynamics cannot be ignored. Intelligence services possess capabilities that extend well beyond simple recruitment. Individuals with family ties, financial interests, property, or personal connections in countries where Russian influence remains significant may be vulnerable to varying forms of pressure. Seafarers are particularly exposed in some respects. They often operate far from home, work in multinational crews, spend extended periods away from support networks, and may have limited ability to seek assistance during voyages.
Importantly, this does not imply that maritime personnel should be viewed with suspicion. The overwhelming majority of seafarers perform their duties professionally and lawfully under challenging conditions. However, threat assessments should account for the possibility that individual crew members could be recruited, coerced, or otherwise exploited in support of hybrid activity.
Just as organised crime has long demonstrated an ability to coerce participation, state actors may also seek to exploit personal vulnerabilities where recruitment alone proves insufficient.
A Human-Centric Security Challenge
The maritime industry has spent decades adapting to physical threats, piracy, terrorism, organised crime, and cyber risks. Hybrid activity adds another layer of complexity because it can exploit legitimate access, proximity, and opportunity through individuals embedded within normal commercial environments.
As European governments continue to warn of increased Russian hybrid activity, organisations should be careful not to focus exclusively on identifiable platforms such as shadow fleet tankers. The more important trend may be the growing ability of threat actors to leverage decentralised networks of individuals, whether through recruitment, financial incentives, coercion, or a combination of all three.
This matters not only to understand threats to states and military forces, and the role that the merchant fleet may play, but also from a shipping-company duty-of-care perspective. As in narcotics smuggling, seafarers may themselves face recruitment, coercion, or other pressure from malign actors.
In summary, the shadow fleet may therefore be only one visible component of a much broader challenge. The future maritime hybrid threat environment is likely to be defined not simply by vessels, but by access to people. And in a globally interconnected industry built on trust, mobility, and access, that may prove to be the most significant force multiplier of all.
MARITIME SECURITY REPORTS:
Our Risk Intelligence reports provide valuable insights to assess the risks of specific routes and support decision-making with detailed threat assessments.
The Voyage Risk Assessment focuses on a vessel’s specific route and offers an independent third-party perspective on the necessary security measures. The Monthly Intelligence Report delivers comprehensive analysis of recent incidents and a threat assessment for three key regions, available via subscription.