Ghost Tankers: How Iran's Oil Fleet Is Going Dark to Dodge US Sanctions

Executive Summary

Nearly six months into a war that has produced a US naval blockade of Iranian shipping, repeated Iranian attacks on commercial vessels, and now a declared "Economic D-Day" campaign of secondary sanctions, Iranian oil continues to reach global buyers through a semi-visible parallel shipping economy that has proven remarkably resistant to disruption. As of late August 2026, United Against Nuclear Iran's tracking consistently shows around fifty tankers from its self-titled Ghost Armada anchored or loitering near Malaysia's East of Pulau Layang-Layang waters with their identification transponders openly broadcasting, alongside a separate population of roughly fifty Iran-flagged cargo vessels operating across the Indo-Pacific, the Red Sea, the Mediterranean, and the Baltic, figures that have held nearly steady week to week despite Washington's intensified pressure. On August 24 alone, Treasury Secretary Scott Bessent announced fresh sanctions on a network of brokers, companies, and tankers, four of five newly designated vessels already sitting on the Ghost Armada list, an enforcement pattern that illustrates both the scale of the tracking effort underway and its limited ability to actually ground the fleet it identifies.

This report assesses that the persistence of Iran's shadow fleet, now estimated by maritime intelligence firm Windward AI at approximately 1,900 vessels globally when combined with sanctioned Russian and other cargo, reflects a structural mismatch between the tools of financial sanctions enforcement and the physical reality of a semi-legal maritime industry that has evolved specific, well-documented countermeasures, transponder manipulation, flag-of-convenience registration, falsified documentation, and mid-ocean ship-to-ship transfers, faster than enforcement agencies have been able to close the gaps. The naval blockade has changed where and how Iranian oil moves, forcing greater reliance on disabled tracking and escorted dark transits even by non-Iranian producers navigating the same contested waters, but it has not stopped the underlying flow, a distinction with direct consequences for how effective Washington's newest sanctions escalation can realistically be expected to become.

Strategic Background

Iran's shadow fleet did not emerge from this year's war; it is the product of a sanctions evasion infrastructure built and refined over years of prior US sanctions regimes, but it has been placed under unprecedented strain and scrutiny since the February 2026 outbreak of the Iran war and the subsequent imposition of a US naval blockade targeting Iranian exports. Maritime intelligence tracking places the broader Iran-linked shadow fleet at over 600 tankers capable of moving roughly 1.5 million barrels of Iranian oil per day even before this year's war, a scale that made Iran's evasion network already one of the most sophisticated sanctions-circumvention systems in the world, developed initially in response to earlier rounds of sanctions dating back to Trump's first-term maximum pressure campaign.

The war has added a second, distinct challenge on top of this pre-existing evasion infrastructure: a formal US naval blockade specifically targeting Iranian oil exports, and simultaneous Iranian retaliatory strikes against commercial shipping transiting the Strait of Hormuz beginning July 7, actions that have collectively depressed open transits through the strait's southern corridor while pushing traffic, dominated increasingly by Iranian and Chinese-linked vessels, toward the northern corridor instead. This has effectively layered a war-driven maritime security crisis directly on top of an already-established sanctions evasion economy, complicating enforcement efforts that must now contend with both financial tracking and active combat zone conditions simultaneously.

Historical Context

The techniques defining today's Iranian shadow fleet, disabling automatic identification system transponders, conducting ship-to-ship transfers in international waters to obscure cargo origin, registering vessels under flags of convenience with minimal enforcement standards such as Palau, Gabon, Cameroon, and Comoros, and insuring vessels through non-Western protection and indemnity clubs including the Russian-linked Ingosstrakh, were substantially developed and refined during the parallel emergence of Russia's own sanctioned oil shadow fleet following the 2022 invasion of Ukraine, creating a shared, mutually reinforcing evasion ecosystem that now moves Iranian, Russian, Venezuelan, and North Korean sanctioned commodities through overlapping vessel pools, ownership structures, and insurance arrangements. The US Treasury's own enforcement pattern, periodic large-tranche designations such as the December 2025 action targeting dozens of tankers and managers tied to ship-to-ship transfer hubs, and the February 2026 listings focused on illicit traders, illustrates a now well-established rhythm of incremental sanctions expansion that has, over multiple rounds, failed to meaningfully shrink the overall size of the fleet in operation.

Current Situation Assessment

Weekly tracking data from United Against Nuclear Iran shows remarkable consistency in shadow fleet activity despite escalating US pressure: forty-six to fifty Ghost Armada-listed tankers were observed anchored or loitering near Malaysia's East of Pulau Layang-Layang waters, broadcasting openly on AIS, across every tracked date from early through late August 2026, a pattern UANI itself has explicitly characterized as demonstrating that these vessels continue to operate with impunity across Southeast Asia's sea lanes. Separately, approximately fifty Iran-flagged cargo vessels have continued operating openly across the Indo-Pacific, Red Sea, Mediterranean, and Baltic regions throughout the same period, including specific vessels tracked loitering near Karachi, drifting in the Gulf of Oman, and anchored near India's Kandla port in the Gulf of Kutch.

The US naval blockade has produced measurable interdiction results without eliminating the trade: as of August 24, US forces had redirected 71 commercial vessels attempting to run the blockade, disabled three that did not comply, and boarded two to enforce compliance, while separately allowing more than forty humanitarian aid vessels to pass, figures that indicate an active, resource-intensive enforcement operation is underway but one still processing a continuous stream of attempted transits rather than having achieved a durable deterrent effect. Compounding the picture, satellite imagery from August 7 documented the tanker Kiku transiting the strait with its transponder disabled before conducting a week-long ship-to-ship transfer with the Nave Electron off the UAE coast, the oil ultimately bound for Ningbo, China, an episode CNN Business reported as illustrative of a broader trend: non-Iranian Gulf oil producers increasingly adopting the same dark-transit tactics pioneered by Iran's own shadow fleet to protect their own exports from the risks of the contested strait, effectively normalizing the evasion playbook across the wider regional oil trade.

Power Center Analysis

The Trump administration's Treasury Department under Secretary Scott Bessent has emerged as the primary institutional actor driving the sanctions enforcement track of this crisis, framing the August 19 "Economic D-Day" announcement and the subsequent August 24 designations targeting specific brokers, companies, and Ghost Armada-listed tankers as a coordinated financial complement to the ongoing naval blockade, with Bessent explicitly stating the combined initiative is designed to collapse the Iranian regime's revenue base. United Against Nuclear Iran, a private advocacy and tracking organization rather than a government body, has positioned itself as the most consistent public source of granular shadow fleet monitoring data, publishing near-daily updates that both inform public understanding of the fleet's continued operation and, implicitly, provide a public benchmark against which the effectiveness of official US enforcement actions can be measured, a dynamic that creates informal accountability pressure on Treasury's designation pace.

China occupies a distinct and largely unaddressed power center in this dynamic, given that Chinese ports and refiners remain the primary destination for the substantial majority of Iranian shadow fleet oil, including cargo transferred through the Kiku-Nave Electron ship-to-ship transfer bound for Ningbo, meaning the fleet's continued commercial viability depends fundamentally on continued Chinese willingness to purchase discounted, sanctions-evading Iranian crude, a demand-side reality that no amount of US vessel-level sanctions designation can address without a corresponding shift in Chinese import policy or enforcement cooperation that has not materialized.

Military and Security Implications

The blending of active war-zone conditions with pre-existing sanctions evasion tactics has produced new and more dangerous ambiguities in the strait, illustrated by the unidentified tanker struck by an unknown projectile while transiting Hormuz on August 25, an incident whose attribution remains unconfirmed precisely because the broader environment of AIS spoofing, disabled transponders, and false ship-to-ship meeting signals, deliberately fabricated GPS and AIS broadcasts designed to make vessels appear in locations other than their true position, has degraded the baseline situational awareness that would normally allow rapid, confident attribution of such attacks. This represents a genuine escalation risk distinct from the underlying sanctions evasion question: a maritime environment this opaque increases the probability of misattributed strikes, accidental escalation, and reduced accountability for attacks on commercial shipping, regardless of which party is ultimately responsible for any individual incident.

Economic and Trade Impact

The continued, largely uninterrupted flow of Iranian oil through shadow fleet channels, even under an active naval blockade and expanding secondary sanctions regime, indicates that Iran's regime retains meaningful oil export revenue despite the war's broader economic pressure, a reality that directly complicates the Trump administration's stated objective of using "Economic D-Day" to collapse Iranian state finances. The broader normalization of dark-transit tactics among non-Iranian Gulf producers, as illustrated by the Kiku-Nave Electron transfer, carries a further economic implication: if legitimate oil-producing states increasingly adopt shadow-fleet-style evasive maneuvers simply to protect cargo from the risks of transiting an active conflict zone, the practical distinction between sanctioned and legitimate maritime oil trade in the Gulf risks becoming further blurred, complicating insurance underwriting, cargo verification, and buyer due diligence across the entire regional oil trade rather than only the specifically sanctioned portion of it.

Diplomatic Positioning

Washington's diplomatic and enforcement posture combines the blunt instrument of the naval blockade with the more surgical, if slower-moving, tool of individual vessel and entity sanctions designations, a two-track approach that reflects an implicit acknowledgment that neither tool alone has proven sufficient to meaningfully disrupt the shadow fleet's operations. The consistency of UANI's tracked Ghost Armada numbers across nearly the entire month of August, holding in the mid-to-high forties regardless of new designations, suggests that individual vessel sanctions, while providing legal and reputational consequences for specific ships and their operators, have not yet translated into a materially smaller operational fleet, since designated vessels frequently continue operating, are reflagged, or are simply replaced by newly identified vessels entering the same evasion network.

Regional Fallout

India's direct exposure to this dynamic is concrete rather than abstract: UANI's own tracking has specifically documented Iran-linked vessels, including the falsely flagged container ship ZYRA, anchored near India's Kandla port in the Gulf of Kutch, indicating Indian territorial waters and port infrastructure are functioning as active nodes within the broader shadow fleet network, whether or not any Indian buyer is knowingly involved in sanctioned transactions. Malaysia's waters, specifically the area east of Pulau Layang-Layang, have emerged as the single most consistently documented shadow fleet loitering and ship-to-ship transfer zone globally, a concentration that places direct reputational and diplomatic pressure on Kuala Lumpur regarding its capacity or willingness to enforce port state controls against vessels operating openly, with functioning transponders, within its monitored waters. The UAE, meanwhile, finds itself in the more complex position of hosting dark ship-to-ship transfers involving its own coastal waters even as it remains a direct target of Iranian attacks on its ADNOC-linked commercial shipping, illustrating how the same waters now serve simultaneously as combat zone and evasion hub.

Global Strategic Consequences

The Iranian shadow fleet's demonstrated resilience under the combined pressure of active war, naval blockade, and expanding secondary sanctions offers a significant data point for how future sanctions regimes targeting other states, whether North Korea, Venezuela, or any future adversary, are likely to be circumvented: the roughly 1,900-vessel combined shadow fleet identified by Windward AI already moves Iranian, Russian, Venezuelan, and North Korean sanctioned commodities through substantially overlapping infrastructure, ownership networks, and insurance arrangements, meaning the practical template for evading Western maritime sanctions has become a shared, transferable body of tradecraft rather than a bespoke Iran-specific challenge, with direct implications for the long-term efficacy of maritime sanctions as a coercive tool more broadly.

Risk Matrix

The risk that current and forthcoming US sanctions designations meaningfully shrink the operational shadow fleet in the near term is assessed as low, given the consistent, near-stable vessel counts documented through nearly a full month of intensified enforcement activity. The risk of further misattributed or unclaimed attacks on shipping in the strait, compounding the existing environment of degraded situational awareness from AIS spoofing and false ship-to-ship meeting signals, is assessed as medium to high, with direct escalation implications given the already-fragile Iran-US-Gulf state security environment. The risk that continued dark-transit normalization among non-Iranian Gulf producers further blurs insurance and compliance standards across the legitimate regional oil trade is assessed as medium and rising. The risk that Chinese demand for discounted shadow fleet Iranian crude continues unabated regardless of US Treasury designation activity is assessed as high, given the absence of any indication of shifting Chinese import policy.

Scenario Analysis

The following scenarios are forward-looking constructs and are explicitly labeled as scenario analysis rather than confirmed fact.

Base Scenario: The current pattern persists: periodic US Treasury designation tranches targeting specific vessels and networks, continued naval blockade interdiction of a subset of attempted transits, and a broadly stable shadow fleet population continuing to move the substantial majority of Iranian oil exports to Chinese and other buyers largely undisturbed. Neither side achieves a decisive shift in the underlying trajectory over the coming months. Probability: High.

Bull Scenario: A combination of expanded multilateral enforcement cooperation, potentially including Malaysian and other Southeast Asian port state authorities taking more assertive action against openly loitering Ghost Armada vessels, alongside intensified secondary sanctions pressure specifically targeting Chinese importing entities and refiners, produces a meaningful contraction in shadow fleet throughput and a corresponding reduction in Iranian oil export revenue. Probability: Low to Medium.

Bear Scenario: The blending of active war conditions with sanctions evasion tactics produces a serious escalatory incident, a misattributed attack on a dark-transiting vessel triggering a disproportionate military response, or a major environmental disaster from an aging, poorly maintained shadow fleet tanker involved in an unsafe ship-to-ship transfer, compounding the existing Hormuz crisis with an additional acute security or environmental emergency that further destabilizes an already fragile regional security environment. Probability: Low, but a genuine and rising tail risk given current operating conditions.

Intelligence Forecast (6-24 Months)

Over the next six months, expect continued periodic US Treasury OFAC designation tranches targeting shadow fleet vessels, brokers, and facilitating companies, following the established pattern of incremental rather than comprehensive enforcement, alongside continued near-daily monitoring and public reporting from organizations including United Against Nuclear Iran and Windward AI that will likely continue to document persistent, largely undiminished shadow fleet activity despite these measures. Expect continued normalization of dark-transit tactics among non-Iranian Gulf producers navigating the contested strait, a trend likely to continue regardless of the underlying Iran sanctions question given its origin in genuine war-zone risk mitigation rather than sanctions evasion specifically.

Over twelve to twenty-four months, watch for whether any of the flag-of-convenience registries most heavily used by the shadow fleet, including Palau, Gabon, Cameroon, and Comoros, face meaningful international pressure or capacity constraints that could disrupt the reflagging pipeline these vessels depend on, since registry-level intervention represents one of the few enforcement levers not yet fully tested at scale. Watch also for any shift in Chinese import policy or enforcement posture toward Iranian shadow fleet crude, given that sustained Chinese demand remains the single most important variable determining the fleet's continued commercial viability regardless of Western enforcement intensity.

Final Strategic Takeaway

Iran's ghost tanker fleet illustrates a structural truth about modern maritime sanctions enforcement: a determined, well-resourced evasion network, built on flag-of-convenience registration, transponder manipulation, and a demand-side buyer willing to absorb discounted sanctioned crude, can sustain substantial operational continuity even against the combined pressure of an active naval blockade and an intensifying, high-profile sanctions campaign. The consistency of United Against Nuclear Iran's tracked vessel counts through a month of escalating US enforcement action is the clearest available evidence that "Economic D-Day," whatever its political framing, has not yet achieved a structural break in Iran's capacity to move oil to market. Policymakers and market analysts assessing the campaign's prospects should weight this demonstrated resilience heavily against the more optimistic assumptions embedded in the administration's own public statements.

Global Chanakya Assessment

The dominant framing of this story treats the shadow fleet as an Iran-specific evasion problem to be solved through sufficiently aggressive sanctions designation. The more accurate strategic reading recognizes the shadow fleet as a mature, transferable maritime industry, now moving Iranian, Russian, Venezuelan, and North Korean cargo through substantially shared infrastructure, that has evolved specifically because it serves the interests of sanctioned exporters and unsanctioned buyers simultaneously, with China's sustained demand functioning as the actual load-bearing element of the entire system. Western sanctions policy continues to focus overwhelmingly on the supply side, designating vessels, brokers, and Iranian entities, while the demand side, the refineries and buyers actually purchasing this crude, remains comparatively under-addressed, a structural imbalance that helps explain why vessel counts have proven so resistant to enforcement pressure.

A contrarian judgment worth stating directly: the fact that Ghost Armada tankers continue broadcasting openly on AIS while loitering in Malaysian waters, rather than going fully dark, should be read as a signal of operator confidence rather than carelessness. Vessels that believe they face a meaningful risk of interdiction or enforcement action have every incentive to disable tracking entirely; the willingness of dozens of sanctioned tankers to broadcast their positions openly, week after week, in the same waters, suggests operators have made a calculated assessment that Malaysian port state enforcement risk is low enough to make continued AIS operation, useful for coordination and commercial purposes, worth the transparency cost, a telling indicator of where the actual enforcement gaps lie.

An underreported risk deserving closer attention is the normalization dynamic documented in the Kiku-Nave Electron transfer, non-Iranian Gulf oil producers adopting dark-transit tactics to protect legitimate cargo from war-zone risk. This is a distinct and arguably more consequential trend than the Iran-specific shadow fleet story, because it indicates that the tools and tactics of sanctions evasion are becoming standard operating procedure for the broader regional oil trade regardless of sanctions status, a development that will make it progressively harder for compliance officers, insurers, and enforcement agencies to distinguish sanctioned Iranian evasion from legitimate risk mitigation by producers with no sanctions exposure at all.

For India, the implications are direct rather than incidental. First, the documented presence of Iran-linked vessels, including falsely flagged ships, anchored near Indian ports including Kandla, means Indian port authorities and customs enforcement face genuine, ongoing exposure to shadow fleet activity within domestic territorial waters, warranting closer coordination between Indian maritime authorities and international tracking organizations to ensure Indian ports are not inadvertently facilitating transactions that could expose Indian entities to secondary sanctions risk under the expanding Economic D-Day framework. Second, Indian oil refiners and shipping companies operating in or near the Strait of Hormuz should treat the degraded situational awareness environment, AIS spoofing, false ship-to-ship meeting signals, and unattributed attacks, as an elevated and specific operational risk factor distinct from the broader war risk already being priced into Gulf shipping insurance, given the genuine difficulty of distinguishing legitimate from illegitimate traffic in current conditions. Third, India's own crude sourcing diversification strategy, already underway in response to the broader Hormuz disruption discussed in prior Global Chanakya reporting, gains additional urgency from this analysis, since continued reliance on any Gulf-transiting crude, whether nominally sanctioned or not, now carries a shared exposure to the opacity and risk that Iran's shadow fleet has helped normalize across the wider regional trade.

Key intelligence indicators to monitor include weekly UANI Ghost Armada vessel counts and locations, further US Treasury OFAC designation tranches targeting shadow fleet vessels and facilitating networks, Chinese import data for Iranian-origin or ambiguously-sourced crude, Malaysian and other Southeast Asian port state enforcement actions or policy statements, further unattributed attacks or incidents involving vessels with disabled tracking in the Strait of Hormuz, and any shift in flag-of-convenience registry enforcement affecting Palau, Gabon, Cameroon, or Comoros-flagged vessels.

Indicators to Monitor

Weekly United Against Nuclear Iran Ghost Armada tracked vessel counts and geographic distribution
Further US Treasury OFAC sanctions designation tranches targeting shadow fleet vessels, brokers, and networks
Chinese crude import data and any policy shifts affecting Iranian-origin or ambiguously sourced oil
Malaysian and Southeast Asian port state enforcement actions or statements regarding loitering sanctioned vessels
Further unattributed attacks or incidents involving tracking-disabled vessels in the Strait of Hormuz
Enforcement or policy actions affecting flag-of-convenience registries including Palau, Gabon, Cameroon, and Comoros
US naval blockade interdiction statistics, including redirected, disabled, and boarded vessel counts
Documented shadow fleet or falsely flagged vessel activity in or near Indian ports and territorial waters
Normalization trends in dark-transit tactics among non-Iranian Gulf oil producers
Non-Western protection and indemnity club insurance activity, particularly involving Ingosstrakh and similar entities

FAQ

How large is Iran's shadow fleet? Maritime intelligence tracking places Iran's dedicated shadow fleet at over 600 tankers capable of moving roughly 1.5 million barrels of oil per day, while the broader combined shadow fleet moving Iranian, Russian, Venezuelan, and North Korean sanctioned commodities is estimated by Windward AI at approximately 1,900 vessels.

What tactics do ghost tankers use to evade sanctions? Common tactics include disabling automatic identification system transponders, conducting ship-to-ship cargo transfers in international waters to obscure origin, registering under flags of convenience with minimal enforcement, falsifying documentation and cargo assays, and broadcasting fake GPS and AIS signals to simulate false ship-to-ship meetings.

Is the US naval blockade stopping Iranian oil exports? The blockade has produced measurable interdiction activity, including 71 vessels redirected and several disabled or boarded as of late August 2026, but tracking data shows a broadly stable population of shadow fleet vessels continuing to operate largely undisturbed, indicating the blockade has not eliminated the underlying trade.

Why do some ghost tankers broadcast their location openly instead of going dark? Analysts note that vessels operating in regions with limited port state enforcement, such as the waters near Malaysia's East of Pulau Layang-Layang, appear to calculate that the operational benefits of maintaining AIS broadcasts, including commercial coordination, outweigh the low practical risk of enforcement action in that specific location.

Who buys the oil from Iran's shadow fleet? China remains the primary destination for the substantial majority of shadow fleet-transported Iranian oil, a demand-side reality that sustains the fleet's commercial viability regardless of the pace or scale of US vessel-level sanctions designations.

Iran Oil Sanctions

Intelligence Reports & Briefings

Ghost Tankers: How Iran's Oil Fleet Is Going Dark to Dodge US Sanctions