EXCLUSIVE: The Sanctions Delisting They Hoped We’d Miss
The ships were dark, the data was falsified, and Treasury called it routine. That alone would be a story. It is not the story.
This morning, the U.S. Treasury published a routine sanctions delisting notice. PHANTOM WAKE flagged the vessel. I did the rest.
I spent the last eight hours confirming and re-confirming what I found. I needed to be sure before writing that a foreign head of government is implicated in a consequential decision made today by Treasury — and that the public record establishing that connection has been sitting there, openly, for sixteen years.
The delisting went through without a word. The responses to journalists have been unremarkable boilerplate. What follows is what I found, how I found it, and why it matters.
On the last day of March, the Treasury Department’s Office of Foreign Assets Control (OFAC) published a routine-looking administrative action: a batch of name removals from the Specially Designated Nationals (SDN) list. Buried among counter-narcotics delistings were three Russian-flagged vessels — FESCO Moneron, FESCO Magadan, and SV Nikolay.
Three lines of text on a government webpage made these three ships no longer subject to U.S. sanctions.
I had been watching all three.
For the past couple of weeks, I have been building and improving PHANTOM WAKE (phantom-wake.com), a maritime hybrid warfare intelligence platform I created primarily to track Russia’s shadow fleet.
It draws from various sources such as public sanctions data, real-time AIS vessel tracking feeds, Ukrainian military intelligence databases, and Global Fishing Watch’s historical behavioral records, running every vessel through a multi-factor behavioral scoring engine I developed. The tool was directly inspired by Andrei Soldatov and Irina Borogan’s November 2025 investigation in Foreign Affairs, “Moscow’s Offshore Menace,” which documents how Russia’s sanctioned fleet has evolved from a financial evasion mechanism into an active platform for hybrid warfare. When OFAC published today’s action, all three of the newly delisted ships were already live in my system, flagged with active anomalies.
What the data shows about these vessels does not square with a routine administrative cleanup.
“Ordinary Course of Business”
Asked about the deletions, a U.S. Treasury spokesperson told the Kyiv Independent that the actions are “not indicative of a broader shift in the U.S. Russia policy,” adding that “the removals implemented today were done in the ordinary course of business as part of OFAC’s investigations and based on a thorough review.” The spokesperson noted that such reviews may be triggered by requests from sanctioned individuals, internal OFAC considerations, or “in response to other national security and foreign policy priorities consistent with the law.”
“The ultimate goal of sanctions is not to punish but to change behavior and to promote accountability,” the spokesperson said.
That explanation deserves to be tested against the full record of what Treasury has been doing in relation to Russian sanctions for the past 33 days because today’s vessel delistings did not arrive in a vacuum. A review of OFAC’s own published actions since late February reveals a systematic, rolling dismantlement of Russia-related sanctions pressure across multiple sectors simultaneously:
February 27: Three PMC Wagner Group-linked individuals removed from the SDN list under Russia-EO14024
March 5: General License 133 issued, authorizing Russian oil deliveries specifically to India. This oil license was issued within days of the Hormuz closure beginning around February 28
March 12: General License 134 issued, authorizing Russian oil sales globally, citing market disruption from the closure of the Strait of Hormuz
March 18: Evgeniya Tyurikova, a senior Sberbank executive sanctioned for her role in Russia’s financial system was quietly removed from the SDN list, along with a Turkish sanctions evasion network and a UAE-based entity
March 19: GL-134 amended and extended as GL-134A
March 20: A UAE freight company and several individuals sanctioned for Russian sanctions evasion removed from the SDN list
March 27: Vladimir Dmitriev, former head of Vnesheconombank (VEB) — Russia’s state development bank was removed under Russia-EO14024; Andriy Portnov, a Yanukovych-era Ukrainian official with longstanding Russian political ties, removed under Global Magnitsky along with his charitable foundation, ANDRIY PORTNOV FUND
March 30: General License 131D amended to facilitate the negotiated sale of Lukoil International GmbH — the day before today’s vessel delistings
March 31: FESCO Moneron, FESCO Magadan, and SV Nikolay removed from the SDN list
Treasury’s “ordinary course of business” explanation might have held for each action read in isolation. Against the full 33-day sequence — PMC Wagner personnel, a Sberbank executive, VEB’s former head, a Yanukovych political ally, oil license upon oil license, a Lukoil transaction pathway cleared, and now defense-bank vessels — it becomes considerably harder to sustain.
Russia’s Informal Military Flotilla
To understand why these three vessels matter specifically, you have to understand who owns them.
FESCO Moneron and FESCO Magadan are currently owned and operated by Investconsulting LLC, a Russian company whose corporate lineage runs directly through the FESCO Group. Transgarant LLC, which founded Investconsulting, is 91.2% owned by PJSC DSMP, the FESCO Group’s parent company. But their previous owner tells the more significant story: both vessels were held by PSB Leasing LLC, a subsidiary of Promsvyazbank (known in Russia by its initials PSB), before being transferred into the FESCO corporate structure after sanctions were imposed, a transfer that is itself a textbook sanctions evasion technique.
The U.S. sanctioned both vessels in February 2022 as part of a package targeting five PSB Leasing-owned ships. Today’s action removes two of the five. The three that remain on the SDN list are Baltic Leader, Linda (now Inda), and Pegas (now Gallileo). Notably, both Linda and Pegas have already been renamed using similar identity-cycling behavior flagged in FESCO Magadan — and Linda has also cycled through multiple flags including Liberia, Netherlands, and Russia.
PSB is not a typical commercial bank. PSB itself was seized from its founders, brothers Dmitry and Alexei Ananyev, by Russia’s Central Bank in late 2017 — and then repurposed by the Kremlin as its defense-sector bank. The Ananyevs fled Russia, and the vessel assets remained. Since 2018, PSB has operated as Russia’s designated defense-industry financial institution, processing state defense contracts for the Ministry of Defense, providing mortgage and banking services exclusively for military personnel, and extending its operations into Russian-occupied territories of Ukraine. Sanctioning these vessels was, in effect, sanctioning assets of Russia’s military bank.
The SV Nikolay carries a different ownership chain but a grimmer operational history. Sanctioned in connection with Russia’s Alfa-Bank, the financial empire co-built by Mikhail Fridman and Peter Aven, both of whom were sanctioned by the EU and UK — and both of whom successfully challenged their EU designations in court in 2024, with an Advocate General opinion suggesting a further appeals ruling may go their way. According to Ukrainian authorities, the vessel has been involved in transporting stolen grain from Russian-occupied Ukrainian territories to Turkey.
Reuters used satellite imagery and ship-tracking data to reconstruct a June 2022 voyage in which SV Nikolay appeared at Crimea’s main grain terminal before docking in Izmir, Turkey — while its own documents claimed the cargo had been loaded at a Russian port 160 miles away. The 10,000-metric-ton corn shipment was purchased by Turkish food company Yayla Agro, which said it had been given falsified documents. Ukrainian military intelligence lists the vessel as actively involved in stolen grain transport to Turkey to this day.
This is not a ship that was swept up in broad financial measures and later found to be commercially innocent. SV Nikolay has had a documented role in the physical looting of Ukrainian agricultural output.
The Trump administration’s official framing for its Russia sanctions relief program has centered on energy markets: U.S.-Iran tensions sent oil prices surging, the Strait of Hormuz effectively closed, and on March 12 Treasury issued a general license permitting the purchase of certain sanctioned Russian oil at sea. The March 5 India-specific oil license suggests that framing was already in motion before the Hormuz closure, complicating the implied causation.
And regardless, FESCO Moneron, FESCO Magadan, and SV Nikolay are container ships and a general cargo vessel. They do not carry oil. The energy market rationale does not apply here.
What “Going Dark” Means
Every large commercial vessel is required by international law to operate an Automatic Identification System (AIS) transponder which broadcasts the ship’s identity, position, speed, heading, and declared destination. Port authorities, coast guards, insurers, and compliance teams all rely on this data. “Going dark” means switching the transponder off, or transmitting false data. When a vessel disappears from AIS tracking, it may be in a geographic dead zone beyond terrestrial receiver range, experiencing equipment failure, or deliberately suppressing its signal to conceal where it is and what it is doing.
In the context of Russia’s shadow fleet, deliberate darkness is the rule, not the exception. Extended AIS gaps correlate reliably with ship-to-ship oil transfers at sea, undeclared Russian port calls, and, according to Soldatov and Borogan’s reporting, potentially the positioning of personnel and equipment for hybrid warfare operations.
The tanker Boracay, previously sanctioned by the UK and EU, was tracked near the Danish coast during drone incursions that forced the closure of Copenhagen Airport in September 2025 — one of three shadow fleet vessels Danish authorities placed under investigation as a possible drone launch point. French commandos boarded the ship in international waters off Ushant Island on September 27, finding approximately $100 million in Russian oil bound for India, two Russian private security agents who, according to French investigators, were controlling the crew and “representing Russian interests and gathering intelligence”, and a false flag of Benin flying where a proper registration should have been. French President Emmanuel Macron said the vessel was suspected of “serious offences” but declined to address the drone speculation directly.
Putin called the French boarding “piracy.”
Just yesterday, the day before OFAC quietly removed these three Russian vessels in question from the SDN list, a criminal court in Brest, France sentenced the Boracay's captain, Chinese national Chen Zhangjie, to one year in prison and a €150,000 fine — in absentia, because he was already back at sea.
The ship itself has since been renamed Feniks (“The Phoenix”) and was last reported flying the Russian flag in the Strait of Malacca. Its ultimate beneficial owner has not been publicly identified.
The shadow fleet’s dual life as economic instrument and military-intelligence platform reflects a Soviet-era operational playbook Russia has maintained for nearly a century.
What I Found Using PHANTOM WAKE
PHANTOM WAKE maintains a watchlist of 2,000+ vessels drawn from OpenSanctions, which aggregates designations from OFAC, the EU, UK, Australia, Canada, and Ukraine, and from GUR Ukraine’s independently compiled shadow fleet database. Every vessel with a known position is scored continuously against a multi-tier risk formula: static identity factors including flag state, ownership opacity, and the history of name changes; behavioral signals derived from AIS data; infrastructure proximity checks against more than 700 submarine cable routes; and fleet-clustering detection that flags when multiple tracked vessels converge in the same area.
The platform draws entirely on publicly available data sources. Every feed it taps are accessible to anyone. What the scoring engine does is fuse those signals into a continuous, ranked assessment of which vessels warrant added attention, and why. Beyond sanctions evasion, PHANTOM WAKE monitors a second threat class that has received far less public attention: shadow fleet vessels being used to destroy the undersea cables and power lines that keep Europe’s lights on and internet running.
The incidents are no longer hypothetical.
In November 2024, a Chinese-flagged bulk carrier called the Yi Peng 3 crossed the Baltic Sea and left two severed cables in its wake. One of them, the C-Lion1, was the only direct telecommunications cable connecting Finland to Central Europe — 144 terabits per second of internet traffic, gone. The other, the BCS East-West link, carries a significant share of Lithuania’s internet capacity. Both were cut within hours of each other. On Christmas morning 2024, the Eagle S dragged its anchor across the Estlink-2 cable on the floor of the Gulf of Finland. Estlink-2 is not a data cable — it is the power line that carries electricity from Finland into Estonia. Cross-border power transmission dropped by two-thirds, from 1,016 megawatts to 358. Estonia’s government convened an emergency session. Repairs were expected to take up to seven months. Finland seized the Eagle S at sea.
Estonia’s Prime Minister said publicly that shadow tankers “assist Russia in generating revenue that supports its hybrid attacks.” In January 2025, the MV Arne was caught dragging its anchor through 90 meters of water — nearly three times the depth at which commercial vessels normally anchor — directly over the AEC-1 cable off Ireland’s County Mayo coast. German police who boarded the vessel later found it was missing its anchor entirely.
The AEC-1 is Ireland’s only dedicated transatlantic cable, carrying internet and cloud traffic between New York and Europe, including a dedicated connection used by the U.S. Department of Energy to move scientific data between American national laboratories and CERN’s particle accelerator in Switzerland. If the cable had been cut, there is no backup route. Ireland has no redundant transatlantic cable. None of these three incidents was detected before the damage occurred. Each required a patrol aircraft or seized vessel to piece together what had happened after the fact.
The method is almost always the same: anchor drag. A ship drops or drags its anchor across a cable route, the anchor snaps fibers or power lines that have lain undisturbed on the ocean floor for decades, and the vessel sails away. It looks like an accident. It usually isn’t. PHANTOM WAKE checks every vessel’s position against 708 submarine cable routes in real time, flagging ships that anchor in suspiciously deep water, loiter over cable corridors at near-zero speed, or go dark in an area where their projected path crosses critical infrastructure. The three vessels delisted today did not trigger cable proximity alerts during the monitoring window. But the behavior that makes a vessel dangerous to cables, such as extended radio silence, deep-water loitering, and/or weeks of static position data, is exactly the behavior all three have displayed. The tool was built to find vessels like these before the next cable goes dark, not after.
Here is what the system was showing for the three vessels as of this afternoon.
SV Nikolay carries the highest risk score of the three: 52 out of 100, in the HIGH tier. Its AIS transponder has been effectively silent for 197 days. The last confirmed transmission was September 15, 2025. Its last reported position places it near 41.3 degrees north, 29.5 degrees east — the northern Bosphorus approaches, one of the most strategically significant chokepoints in the world for Russian commercial and naval traffic, and a well-documented hub for ship-to-ship grain and oil transfers. PHANTOM WAKE flagged it with the STS_ZONE_DARK signal: the vessel went dark while inside a known ship-to-ship transfer zone.
Something else stood out when I reviewed the PHANTOM WAKE data for all three vessels. Their draught readings (the measure of how deep a hull sits in the water, a direct proxy for cargo and fuel load) were completely static across 18 consecutive daily readings spanning nearly three weeks.
In commercial shipping, draught varies constantly. Fuel burns, ballast is adjusted, cargo is loaded and offloaded. A flat line across days or weeks suggests one of several possibilities: the vessel is moored and not operating commercially; the position data being broadcast is replayed or fabricated; or the vessel is being held in a deliberate staging posture. Any of these would be consistent with the broader evasion pattern these ships have displayed.
The SV Nikolay’s draught reading has not moved by so much as a tenth of a meter across 18 consecutive daily readings spanning March 14 through March 31. It has no declared destination. This is the same vessel used to move stolen Ukrainian grain to Turkey — more on that below.
FESCO Moneron (Cyrillic: ФЕСКО МОНЕРОН) last transmitted a confirmed AIS signal on December 21, 2025 — ninety-nine days ago. Its reported position puts it in the Sea of Okhotsk, off Russia’s Pacific coast, moving at 13.1 knots. Global Fishing Watch recorded four loitering events for this vessel in the past twelve months: three consecutive days in late February 2026 near 50.9 degrees north, 150.5 degrees east, roughly 88 kilometers offshore and well clear of any declared port, drifting at between 0.34 and 1.13 knots. Its draught, 6.2 meters, has not changed across 18 consecutive readings since March 14.
These signals appear abnormal in every way.
FESCO Magadan (Cyrillic: ФЕСКО МАГАДАН) presents the most analytically complex picture. Its behavioral score at the time of capture is low. On the surface, it looks relatively clean. It is not.
The Ship That Called Itself a French Carrier
FESCO Magadan has cycled through five flag states (Germany, the UK, Malta, Portugal, and Russia) and carries four known aliases: CMA CGM Tatiana, India, Velazquez, and its Cyrillic name variant, Феско Магадан.
PHANTOM WAKE gives it an Identity Cycling score of 80 out of 100, the highest of the three vessels.
The alias “CMA CGM Tatiana” is worth sitting with. CMA CGM is one of the world’s largest and most recognized container shipping companies, a French firm whose vessels move through virtually every major port on earth. Using that name looks nothing like coincidence or administrative carelessness. It is a deliberate technique to create name confusion with a legitimate, widely recognized Western carrier with the intention of reducing scrutiny at port, in insurance documentation, and in compliance database queries.
PHANTOM WAKE now specifically scores for this class of behavior, flagging vessels whose aliases match major Western carriers including CMA CGM, Maersk, MSC, and Hapag-Lloyd.
FESCO Magadan’s low behavioral score reflects only what the system could observe during a narrow capture window, not what Global Fishing Watch’s historical archive shows. On February 18, 2026, the vessel had a three-day, eight-hour AIS gap in the Sea of Okhotsk, at approximately 52 degrees north, 158.7 degrees east. On the same day, in the same general zone, FESCO Moneron was in the middle of its own three-day loitering cluster.
These ships are both listed at exactly 7,519 gross registered tonnage or GRT, indicating they are sister ships built to the same specification.
Two vessels built together, sharing ownership connections to Russia’s sanctioned defense bank, co-sanctioned and now co-delisted together, operated in dark posture in the same remote Pacific waters on the same dates. The behavioral signature is consistent with a coordinated ship-to-ship transfer operation, but it is not definitive confirmation. That would require cross-referencing with closed satellite imagery sources, which my system cannot provide at present.
But this does not seem like a coincidence.
Speaking of Coincidences
It is worth noting that the FESCO Moneron carries one additional entry in its public sanctions record that the ownership chain alone does not capture.
Back then, it was named Francop — the vessel at the center of the Francop Affair, in which Israeli Navy commandos from Shayetet 13 boarded the ship in the eastern Mediterranean on November 4, 2009 during Operation Four Species and seized, according to CNN, 40 containers of missiles, rockets, lights arms and mortars. We’re talking 320 tons of weapons, including 9,000 mortar shells, Katyusha rockets, hand grenades, and over half a million rounds of ammunition in what Israel described as the largest arms seizure in its history.
The Katyusha rockets stand out. According to a September 2023 analysis by The Economist, these particular rockets have a relatively recent history of North Korean arms sales to Russia:
“North Korea has been delivering 152mm shells and Katyusha-type rockets to Russia for the best part of a year. Russia is shopping in Pyongyang and Tehran because both regimes are already so heavily targeted by international sanctions that they have nothing to lose and much to gain by doing business with Mr. Putin’s government.”
The cargo was Iranian-origin, bound for Hezbollah via Syria.
Israeli President Shimon Peres issued a strong condemnation following the seizure, asserting that the operation exposed the “large gap between Syria and Iran's statements and their actual activities.” Israeli PM Netanyahu said,
“This is a war crime. This is a war crime that the UN General Assembly, which is meeting today, should investigate, discuss and condemn. This is a war crime that should prompt the UN Security Council to convene in special session, especially since it was in gross violation of UN Security Council resolutions.
This is a war crime which we know the Iranian regime intends to repeat, further arming Hizbullah, which has already fired thousands of missiles at our communities.”
Hezbollah denied any connection to the weapons and, as with Putin in the case of the Boracay, condemned the maritime interception as an act of piracy. The ship was released. It was renamed. It became FESCO Moneron.
And today, the United States removed it from the sanctions list.
The U.S. government manages the sanctions list. The review that produced yesterday’s delisting was, in Treasury’s own words, “thorough.” The Francop Affair was not a footnote buried in a classified annex. This was a public diplomatic incident involving ambassadors from 44 countries, an IDF press conference, and a statement from Israel’s Prime Minister.
Netanyahu was that Prime Minister. He is back in office.
Given the multifaceted, high-level intelligence sharing and security coordination that characterizes the U.S.–Israel alliance, especially during the current conflict, it is highly improbable that an action involving vessels tied to a major Israeli security incident would occur without some level of bilateral coordination.
The conclusion is not comfortable, but it is the only one the record supports: whoever approved this delisting knew exactly what the Francop was. They removed it anyway. The question is not at all whether that decision was informed. The questions are: what was it made in exchange for, what does it suggest about the future of this war, and what are its implications for the American people?
Ukraine Is Watching
These delistings do not only register in Washington. While the Trump administration was quietly removing three Russian vessels from the SDN list, the rest of the Western alliance was moving in the opposite direction.
On March 25, Prime Minister Keir Starmer authorized British military and law enforcement to board, interdict, and detain sanctioned shadow fleet vessels transiting UK waters. The announcement was made at the Joint Expeditionary Force Summit in Helsinki, where allied nations agreed to coordinate shadow fleet interdiction across European and Mediterranean waters.
“Putin is delighted with the conflict in the Middle East,” Starmer said, “as he believes rising oil prices will enrich him. That’s why we are intensifying our efforts against his shadow fleet.”
The day after that authorization, a Cameroon-flagged tanker named VAYU 1 — sanctioned by the UK in May 2025 for transporting Russian oil, having departed Murmansk on March 10 — sailed to within six nautical miles of Dover, close to the narrowest part of the English Channel, and passed through undetained. BBC Verify tracked it spending at least five and a half hours inside UK territorial waters and twenty-nine hours in the UK’s Exclusive Economic Zone. The Ministry of Defence told the BBC that “any action is on a case-by-case basis.”
By today, at least 25 sanctioned Russian vessels have transited UK waters since the boarding authorization was announced (out of a total of 544 vessels Britain has sanctioned as shadow fleet participants) with no reported detentions, according to ship tracking data analyzed by Reuters. Pole Star Global counted 301 Russian shadow fleet vessel events in UK waters in the first three months of 2026 alone: 95 in January, 100 in February, 106 in March — increasing each month, with incidents recorded not just in the Channel but inside UK internal waters and at ports including Belfast, Immingham, and Grangemouth.
Yesterday, France sentenced a shadow fleet captain to prison. The UK authorized boarding last week and has not yet used it. The EU’s 20th sanctions package remains blocked by Hungary and Slovakia. On the same day OFAC freed three Russian vessels, the Russian oil tanker Anatoly Kolodkin docked in Cuba with Washington’s blessing. Ukraine is urging allies to tighten the noose while the United States actively loosens it.
In a joint statement with Senators Warren and Schumer on March 13, Senator Jeanne Shaheen (D-NH) said the administration had helped “facilitate a windfall of $150 million each day for [Russia’s] war machine,” and raised the possibility that Treasury was “flouting” the congressional notification requirements of the Countering America’s Adversaries Through Sanctions Act. Thirteen days later, Shaheen and Republican Senator Thom Tillis co-introduced the BLOCK PUTIN Act — legislation explicitly designed to prevent the kind of sanctions rollback now unfolding.
Treasury’s assurance that today’s actions are “not indicative of a broader shift” is difficult to square with a calendar that speaks for itself.
What PHANTOM WAKE Does and Does Not Do
The platform works entirely on publicly available data sources. It cannot access classified intelligence. It uses reported AIS positions at face value, which introduces a meaningful limitation: AIS is trivially spoofable, and Russia’s shadow fleet operators know it. Vessels can broadcast false coordinates while operating elsewhere entirely. Pole Star Global calls this “long-term anchor spoofing,” a state in which a ship appears stationary or on a plausible route while physically conducting illicit operations somewhere else.
More sophisticated variants involve dual transmitters broadcasting different IMO identification numbers simultaneously, pre-programmed routes that mimic legitimate voyages, and other forms of Vessel Identity Laundering or Identity Theft. For example, a high-risk ship in proximity of a clean vessel will briefly assume its identity, conduct its transfer, and swap back to avoid detection. The static draught and speed readings I flagged for all three delisted vessels are themselves consistent with long-term anchor spoofing.
This is the operational baseline for this class of vessel. Confirming or ruling out spoofing as well as other anomalies I described would require cross-referencing against Synthetic Aperture Radar satellite imagery cross-referenced against the AIS record (the standard methodology used by commercial maritime intelligence platforms), RF signal geolocation, and in some cases human intelligence, none of which PHANTOM WAKE can provide from public sources alone.
What the system can do is identify the behavioral footprint that spoofing reliably leaves behind: impossible speed transitions, coordinate jumps, repeated positional values across weeks of readings, and AIS gaps timed to known transfer zones. The anomalies flagged here are real. Where exactly these ships are right now is a question that requires satellite data to answer.
PHANTOM WAKE continues to track all three vessels under a DELISTED category. Removal from the OFAC SDN list does not remove a vessel from Ukrainian military intelligence’s shadow fleet database, from the EU’s watchlist, or from other lists — and it raises an immediate question about what else on the watchlist may be OFAC’s next target.
Another One To Watch
There is a fourth vessel worth watching: FESCO Sofia, a container ship bearing the FESCO name but operated by Steam Line Middle East Shipping L.L.C., a UAE-based company — and currently not designated by any Western sanctions authority.
It appears in OpenSanctions not as a sanctioned vessel but as an “entity of interest,” flagged through the Tokyo Memorandum of Understanding’s port state control detention database. It has been detained by Asian port authorities five times in fourteen months — February, July, August, September 2024, and April 2025 — with each detention indicating serious safety or compliance deficiencies. It is classified by the Russian Maritime Register of Shipping, itself a sanctioned entity.
FESCO Sofia’s AIS transponder has been dark for 193 days. Global Fishing Watch recorded 14 loitering events in the past year, nearly all at the same cluster of coordinates in the East China Sea, 40 kilometers offshore, drifting at fractions of a knot. Its draught has not moved by a single millimeter across 18 consecutive daily readings. Both FESCO vessels delisted today share every one of those behavioral signatures — and SV Nikolay’s 197-day AIS silence makes the parallel hard to ignore, regardless of ownership chain.
Whether FESCO Sofia is a vessel the West should be watching more closely, or simply one that hasn’t attracted sufficient attention yet, is a question PHANTOM WAKE will keep asking.
The Cuffs Are Off
As of this morning, the vessels are no longer sanctioned by the U.S. They can enjoy calling at Western ports and will avoid triggering secondary sanctions risk. Their insurers can cover them through markets that previously dropped them. The practical effects of today’s decision are immediate.
More significantly, all three previously carried a secondary sanctions designation under Section 11 of Executive Order 14024, meaning foreign companies worldwide, not just American ones, faced potential U.S. designation for conducting significant transactions with them. That extraterritorial deterrent is now gone.
“Ordinary course of business” is one explanation — one which the data strongly suggests shouldn’t be the only one considered. The sanctions regime is only as credible as the decisions made in its name. When a vessel with this history is removed without explanation and without scrutiny, the question is no longer whether the list reflects U.S. national security interests.
The question is whose interests it reflects instead.
Jackie Singh is an information security professional and investigative journalist.
PHANTOM WAKE is accessible at phantom-wake.com. Data sources include OpenSanctions, GUR Ukraine, Global Fishing Watch, and TeleGeography.
Follow @hackingbutlegal on X.
Just curious, are you a machine or just superhuman lol?
Reading and then fully digesting and comprehending everything in this article alone was challenging for me. You just blasted it out as your second article in one day! Then, you go on to describe the insane tool that you built as casually and humbly as I would announce that I managed to take the dog for his walk and made myself lunch!
Holy shit, you go girl! No wonder this administration is terrified of females having equal rights and opportunities...