Two Russian nationals linked to the Wagner private military company and Russia’s military intelligence agency, the GRU, were found to have been aboard a Russian oil tanker that was later hit by Ukrainian drones in the Mediterranean Sea, according to a joint investigation published on 12 January.

The tanker, Qendil, is part of Russia’s so-called “shadow fleet”, a group of ageing vessels used to bypass Western oil sanctions.

The ship was struck by Ukrainian drones on 19 December 2025 while operating in neutral Mediterranean waters. Ukraine’s Security Service later said the tanker suffered critical damage and would no longer be able to operate for its intended purpose.

Journalists from The Dossier Center and Norwegian broadcaster NRK reported that the two men were listed as “security” personnel in the vessel’s crew records. However, neither individual held any maritime qualifications or seafarer certificates.

The men were identified as Alexander Malakhov and Viktor Alexandrov. Records show they boarded the Qendil in early September 2025 before the vessel left the Russian port of Ust-Luga. Both men left the tanker before it was attacked in December.

Investigators noted that the presence of armed security was unusual, as the Qendil had not hired guards on previous voyages, even when sailing through high-risk areas such as the Gulf of Aden and the Suez Canal.

Malakhov, born in 1975 in Russia’s Volgograd region, previously served in the 22nd Separate Guards Special Purpose Brigade, a unit under the GRU. Public records indicate he later worked in aviation security in Rostov-on-Don but left that role in late 2023.

Journalists reported that he returned to Russia from Syria in early 2024. Syria is widely known as a key base for Russian mercenary operations.

Investigators said his tax records showed no official state salary payments during that period, leading them to believe he may have been linked to private military companies.

Alexandrov, born in 1965 in Crimea, was found to have direct ties to the Wagner Group. Leaked internal documents reviewed by journalists showed that he served in Wagner’s sixth assault detachment in Syria as a BMP infantry fighting vehicle driver under the call sign “Katso”.

Per reports, Alexandrov was dismissed from Wagner in 2019 following an alcohol-related incident in Syria but later returned to the group in 2020. Records also showed that after Russia launched its full-scale invasion of Ukraine, he made repeated visits to occupied Ukrainian territories.

Neither Malakhov nor Alexandrov was listed as holding the professional certificates required for work aboard a ship, unlike other crew members. This, combined with their backgrounds, led analysts to question claims that they were onboard for anti-piracy protection.

Kari Aga Myklebost, a professor at the Arctic University of Norway, told NRK that Russia uses shadow fleet vessels for intelligence activities. He said that routes near Somalia and Yemen provide a convenient explanation for having “security” on board, while allowing Russia to deny espionage.

The attack on the Qendil marked the first time Ukraine targeted a Russian shadow fleet tanker in the Mediterranean, following earlier strikes in the Black Sea. Ukraine has increasingly focused on disrupting Russia’s covert oil exports through vessels operating under opaque ownership.

Russian President Vladimir Putin condemned the attack and warned of “inevitable consequences”, though he also acknowledged that the strike would not seriously affect Russia’s long-term oil exports. Earlier reports had stated that Russia carried out drone attacks near Ukrainian ports, targeting civilian maritime vessels.

References: united24media, english nv