The Cold War might be over, but the cables beneath the Baltic Sea suggest otherwise. In a world increasingly dependent on digital connections and undersea infrastructure, Russia’s maritime behavior feels less like routine navigation and more like a game of cloak-and-dagger warfare. The culprit? Russia’s elusive “shadow fleet”—a murky network of commercial-looking vessels suspected of covert sabotage.
What may look like ordinary maritime traffic masks a dangerous trend: deliberate attacks on undersea infrastructure that carry enormous implications for Europe’s security and global communications. While the world watches Russia’s land invasions and cyber operations, another war is quietly unfolding below the surface.
Assembled initially to circumvent the enforcement of Western sanctions, Russia’s “shadow fleet” was not born a weapon. Rather, the fleet includes hundreds of aging oil tankers, cargo ships, and support vessels operating under false flags or vague ownership. The fleet gained notoriety for secretly moving sanctioned Russian oil through international waters, using tactics like location spoofing and identity-switching. These methods, while clearly deceptive, were primarily financial in intent, with the goal of keeping Russian oil flowing and revenue coming in.
However, as the war in Ukraine escalated and NATO’s influence expanded into the Baltic region, the fleet’s mission transformed. Recent intelligence suggests parts of the Russian fleet have evolved into tools of covert sabotage. Some are outfitted with surveillance equipment. Others operate under secrecy, blending into civilian shipping lanes while carrying out espionage missions and physical attacks on undersea infrastructure.
Russia does not require missiles when they have metal and momentum. Anchor-dragging sabotage is as crude as it is clever: a ship drops its anchor near an undersea cable or pipeline and slowly “drags” it across the seabed to rupture or sever the line. The result is weeks of outages and millions of dollars in damages, disrupting everything from internet access to energy supplies. Additionally, sabotage is difficult to distinguish from an accident, which gives the attacker plausible deniability.
In late 2024, a subsea data cable between Finland and Estonia was severed. Maritime satellite tracking placed a Russian-linked vessel directly above the damage zone at the time. Was it an accident? Maybe. And that is precisely the point. The ambiguity of Russia’s intentions is strategic. To the international community and global leaders, it is not just about damage—it is about uncertainty and distrust, which complicates and erodes relationships. Cable damage was also flagged near Swedish pipelines and sensitive NATO communication lines. While none of these incidents were officially declared acts of war, they follow a clear pattern, with all signs pointing to a coordinated gray-zone campaign.
This isn’t just maritime mischief: it is a wartime strategy. Russia sees the Baltic Sea as a hostile geopolitical hotspot after Finland and Sweden joined NATO. However, launching missiles and mobilizing troops risks a NATO response, with the international organization having the ability to directly cite their Article 5: an attack against one is an attack against all. Thus, instead, Moscow leans into what the international community recognizes as its specialty: gray-zone warfare.
In this form of conflict, attacks rely on being ambiguous in reference to the principles of NATO by operating just below the threshold of conventional warfare. In doing so, Russia can harass, disrupt, and intimidate without technically violating any NATO charters. Cut a cable here, disable a pipeline there—Russia’s unconventional warfare serves as probes to test NATO’s limits while avoiding mass escalation. At its core functionality, this is a form of psychological warfare, with every incident of infrastructure sabotage fostering doubt in affected nations in the alliance. The uncertainty these attacks create is a weapon in and of itself.
The stakes of these recurring disputes extend far beyond the lines of the Baltic. Undersea cables carry 95% of global internet traffic. They are the unseen scaffolding holding the global economy together. Disruptions can, therefore, paralyze everything from financial transactions and military coordination to air traffic control and Netflix streaming.
The Baltic region, in particular, is sensitive to these attacks. It is one of the world’s most densely packed infrastructure zones—gas pipelines, data cables, and power connectors link the Nordic and Baltic countries to the remainder of Europe. With countries like Estonia, Latvia, and Finland facing rising pressure to harden these systems and scrambling to formulate temporary solutions amid already limited naval capacity, the confidence and trust between NATO member nations is withering. Considering that Russia can achieve all of that while maintaining plausible deniability, leaders in Moscow are likely quite satisfied with the shadow fleet’s accomplishments.
In the short term, Russia’s actions serve as strategic distractions from the ongoing war in Ukraine, stretching the West’s military support thin and creating new fronts of conflict and concern. Through targeting critical areas of infrastructure, Moscow is able to gauge response times, NATO’s vulnerabilities, and the thresholds at which NATO is willing—or more importantly, unwilling—to escalate. Without triggering any open warfare on this front, Russia is able to undermine NATO’s cooperation and reinforce the narrative of NATO’s inability to entirely protect its members.
The Western answer has been swift but fragmented. Both Finland and Estonia launched formal investigations into the recent cable rupture, with Finland calling the act “deliberate” and pledging stronger surveillance. At the same time, Estonia’s president, Alar Karis, hinted on X about Russian involvement but refrained from directly accusing Moscow. NATO has begun joint naval patrols in the region to deter future incidents. However, the alliance stopped short of calling the sabotage an attack under Article 5. Instead, it’s treating these incidents as intelligence threats, signaling a careful, calculated reaction. In contrast to NATO, Sweden has accelerated its maritime monitoring systems and strengthened alliances with other Nordic nations for collective defense. The overall response remains largely defensive, playing into Russia’s hands. After all, the Kremlin does not need to win this war militarily; they just need to force the West to hesitate.
Stopping Russia’s covert maritime sabotage won’t be easy, but it’s not impossible. Indeed, there are steps NATO and regional allies can take, but they require commitment and coordination. Deploying seabed sensors, underwater drones, and satellite vessel tracking can help monitor critical zones in real time. After all, the shadow fleet’s activity should trigger alerts and responses, not action in hindsight. NATO can accomplish this by supplementing infrastructure with collaborative defense. By creating a Baltic Infrastructure Defense Pact modeled after existing air defense agreements in the region, the alliance could strengthen regional retorts and streamline countermeasures. Finally, NATO should expand its definition of threats to include maritime infrastructure sabotage. Ambiguity is Russia’s primary weapon; clarity and comprehensiveness should be NATO’s ultimate defense.
Yet, despite the required urgency, countries have been slow to implement such defenses. The reasons are political and logistical. For one, NATO members remain wary of provoking Russia directly, fearing a retaliation in other fields like cyberspace or energy. Additionally, the costs and technical challenges of completely monitoring the vastness of the underwater infrastructure networks are significant and nearly impossible, especially for smaller member nations with limited naval resources. Collectively, these difficulties have fostered the fragmentation of NATO’s response. Until the alliance embraces a unified doctrine that treats infrastructure as a direct strategic threat that can warrant the threat of an Article 5 level response against Russia, Moscow’s leaders will encourage the shadow fleet to continue its provocative operations in the Baltic Sea.
The anchor might be old-fashioned, but its use in today’s conflicts is anything but. Russia’s shadow fleet represents a dangerous new dimension of geopolitical competition—one that uses maritime ambiguity to quietly weaken adversaries. With the battlefield shifting underwater, disruption is invisible, attribution is murky, and the consequences are enormous.
Therefore, nations must adapt to this evolving threat landscape. After all, the next major confrontation may not come from a missile or a cyberattack—but from a ship drifting silently over a cable, dragging war behind it.
Featured Image Source: Adobe Stock
Comments are closed.