Putin’s Mercenaries in Danish Waters

Russian mercenaries linked to the Wagner Group are operating in Danish waters using the “shadow fleet” of oil tankers to mask their presence, according to reporting by Dagbladet. These operatives use tankers designed to bypass Western oil sanctions to conduct reconnaissance and potential sabotage against critical undersea infrastructure in the North and Baltic Seas.

The shadow fleet consists of aging tankers with opaque ownership structures and inadequate insurance, which Russia uses to export crude oil despite G7 price caps. Dagbladet reports that these vessels now serve a dual purpose, transporting personnel associated with the Wagner Group and other Russian intelligence services into NATO-controlled waters.

How is the shadow fleet hiding Russian mercenaries?

The shadow fleet operates by obscuring the identity of its owners and the nature of its crews. According to the report, Russia utilizes a network of shell companies to register these ships in various jurisdictions, making it difficult for maritime authorities to track the actual personnel on board. These vessels frequently disable their Automatic Identification Systems (AIS) or “spoof” their locations to avoid detection by coastal surveillance.

Dagbladet indicates that mercenaries are integrated into the civilian crews of these tankers. This allows the Russian state to move specialized sabotage units close to European coastlines without the diplomatic visibility or military scrutiny that would accompany the movement of the Russian Navy’s Baltic Fleet.

The use of these tankers facilitates ship-to-ship transfers of oil in international waters, which creates further cover for the movement of personnel between vessels. This tactical shift allows operatives to enter Danish territorial waters under the guise of commercial shipping.

What are the risks to Danish and NATO infrastructure?

The presence of these operatives in Danish waters poses a direct threat to undersea cables and energy pipelines. Denmark controls the strategic straits—the Great Belt and the Øresund—which serve as the primary gateways between the Baltic Sea and the Atlantic Ocean. Any disruption in these corridors would impact both commercial shipping and NATO’s ability to reinforce the Baltic states.

The report suggests that Wagner-linked operatives are specifically tasked with mapping the locations of fiber-optic cables and electricity interconnectors. This reconnaissance is seen as a precursor to potential “hybrid” attacks, where infrastructure is damaged in a way that allows the Russian government to maintain plausible deniability.

This pattern mirrors the 2022 sabotage of the Nord Stream pipelines, which occurred in the Baltic Sea. While that event involved explosions, the current threat involves the deployment of specialized divers and unmanned underwater vehicles (UUVs) launched from the hulls of shadow fleet tankers.

How does this differ from previous Russian naval activity?

The strategy represents a shift from overt military posturing to covert civilian-led operations. Traditionally, Russian intelligence activities in the North Sea were linked to the GUGI (Main Directorate of Deep Sea Research), which operates specialized submarines. However, the use of the shadow fleet is more cost-effective and harder to intercept.

While a Russian naval vessel entering Danish waters would trigger immediate alerts and potentially a NATO response, a dilapidated oil tanker is often viewed as a regulatory or safety issue rather than a national security threat. This discrepancy allows Russia to exploit the “gray zone” between peace and conflict.

Furthermore, the integration of Wagner personnel—who operate outside the formal military chain of command—provides the Kremlin with an additional layer of separation from these activities. Since the reorganization of the Wagner Group under the Russian Ministry of Defense, these mercenaries have functioned as a flexible tool for foreign intervention and covert operations.

What is the current response from Denmark and NATO?

Danish maritime authorities have increased surveillance of vessels exhibiting suspicious AIS behavior in the Baltic and North Seas. NATO has also expanded its “Maritime Centre for the Security of Critical Undersea Infrastructure” to better coordinate the monitoring of these assets.

However, enforcing sanctions or seizing shadow fleet vessels remains legally complex. Because these ships are registered to shell companies in third-party nations, Denmark and its allies face challenges in justifying the boarding of vessels in international waters without clear evidence of criminal activity.

The report concludes that the shadow fleet has evolved from a tool of economic evasion into a platform for intelligence and sabotage, turning commercial shipping lanes into a primary front for Russian hybrid warfare in Europe.