Russia Ups the Ante in the Baltic Sea

In recent months, Russia has adopted a more assertive posture in the Baltic Sea, engaging in a series of provocative actions that appear aimed at raising tensions in the region.

Leaders of the Baltic states have issued warnings about the growing risk of aggression and hybrid threats, not only to their own countries but also to NATO and the broader international community.

Moscow’s increasingly aggressive behavior includes violations of airspace and maritime boundaries, as well as incidents involving the alleged accidental damage of undersea energy and communication cables.

Russia has increasingly turned to hybrid tactics, such as disinformation campaigns and cyberattacks, to destabilize the Baltic states and exert influence over their internal political processes.

Its latest provocations, carried out in May 2025, have been framed by Moscow as efforts to protect its so-called “shadow fleet”—a network of vessels used to transport oil in violation of international sanctions.

Tanker Interception

The most recent escalation in tensions was recorded on April 11, when the Estonian Navy intercepted the oil tanker Kiwala, a vessel linked to Russia’s shadow fleet. The ship was sailing from the Indian port of Sikka to the Russian port of Ust-Luga.

The vessel’s detention was meant to verify its documentation, legal status, and safety, as it is subject to sanctions imposed by the United Kingdom, Canada, and the European Union due to previous illicit activities. The ownership and management of the Kiwala have changed frequently in an apparent attempt to obscure direct ties to Russia and to conceal the true recipients of the oil it was transporting.

Airspace Violations and Interceptions

Meanwhile, Russian military aircraft have continued flying with their transponders switched off and approaching NATO airspace at dangerously close distances.

To identify and escort these aircraft, NATO scrambled fighter jets, most notably British Typhoons deployed as part of the Baltic Air Policing mission. On April 15, they intercepted an Il-20M reconnaissance aircraft, followed shortly afterward by two Su-30 fighter jets. Another interception took place on April 17, involving a second Il-20M.

It is important to note that the absence of a transponder signal prevents civilian air traffic controllers from identifying the aircraft, posing a potential threat to commercial flight routes. These Russian flights are typically aimed at conducting reconnaissance, provoking responses, and projecting military power.

Later, two Swedish JAS 39 Gripen fighter jets deployed in April to patrol NATO airspace from the Malbork Air Base in Poland as part of the Enhanced Air Policing mission were scrambled for the first time to visually identify and escort a Russian Il-20M aircraft.

The identification took place in international airspace over the Baltic Sea, north of the Polish coastline.

The Polish Armed Forces Operational Command reported that on April 25, a Russian helicopter from the Baltic Fleet violated Polish airspace over the territorial waters of the Baltic Sea. As a result, Poland’s air defense forces were placed on full combat alert.

Polish military officials believe these actions may indicate an attempt by Russia to test and conduct reconnaissance on Poland’s air defense systems’ response to potential threats.

Later that evening, on May 13, a Russian Su-35S fighter jet violated Estonian airspace near the Juminda Peninsula, with its transponder switched off.

Portuguese Air Force F-16 fighter jets stationed at the Ämari Air Base, tasked with protecting the airspace of the Baltic states, promptly responded to the incident. This marked the first violation of Estonian airspace by a Russian aircraft in 2025.

Incidents involving the French

It is also worth noting that in March, Russian forces reportedly aimed anti-aircraft weapons, likely from one of their ships, at a French Breguet Br.1150 Atlantic patrol aircraft conducting monitoring of underwater infrastructure in the Baltic Sea.

A similar incident happened earlier and was reported on January 19. At that time, a Russian S-400 air defense system locked its missile guidance radar onto the same type of French aircraft.

Additionally, an attempt was made to jam the aircraft’s systems using electronic warfare measures during its flight.

Resistance to Detention

On May 14, when the Estonian Navy attempted to detain the sanctioned oil tanker Jaguar, part of the so-called “shadow fleet”, which was sailing under the flag of Gabon through international waters of the Gulf of Finland en route to the port of Primorsk, Russia deployed a Su-35S fighter jet to provide cover for the vessel.

A combat aircraft violated Estonian airspace. Portuguese F-16s, tasked with guarding the region’s airspace, responded to the intrusion.

The Estonian authorities demanded that the tanker crew change course. They deployed an AgustaWestland AW139 helicopter, an M28 Skytruck aircraft, and the patrol vessel EML Raju to enforce the detention.

However, the Jaguar’s crew did not comply with the demands and refused to alter course. Subsequently, the vessel entered Russian waters and anchored near Gogland Island in the Gulf of Finland.

Estonian Prime Minister Kristen Michal later stated in an interview with Reuters that his country will continue inspecting vessels of the “shadow fleet” despite the incident involving the violation of Estonian airspace by a Russian fighter jet.

“I would say that everybody – Estonians, Finns – will be monitoring these kinds of ships, and if there’s something suspicious we will ask about it. Everybody will do that,” Michal said in an interview.

Michal noted that the Estonian Navy had no plans to board the suspect tanker, which then sailed into Russian waters, escorted by the Su-35 and an Estonian patrol boat.

“The question for us – not Estonia, but for Europe and the United States – is how come Russia is waging the war for the fourth year, and is still selling products on the world market?” he said.

According to Estonian estimates, Russia receives an estimated 60% of its oil revenues via shipments by the “shadow fleet” to buyers in countries such as China and India.

The vessels, which frequently have opaque ownership structures and sail without top-tier Western insurance and safety certification, are often loaded in Russian Baltic Sea ports, approached via the waters between Estonia and Finland.

Russia Responds by Detaining a Tanker

On May 18, Russia detained the Greek oil tanker Green Admire, which was navigating from Estonia along an agreed-upon route that partially traverses Russian territorial waters.

According to Estonia’s Department of Transport, the vessel, a Liberian-flagged oil tanker owned by Greek shipping company Aegean Shipping, had departed from the port of Sillamäe and was bound for Rotterdam carrying a cargo of shale oil.

Large vessels departing from Sillamäe typically navigate through Russian territorial waters to avoid the shallow areas of Estonia’s coastline. Estonia, Russia, and Finland had previously coordinated this route. The next day, the Russians released the tanker.

Estonian Foreign Minister Margus Tsahkna stated that Russia’s actions were a response to pressure on its shadow fleet in the Baltic Sea.

NATO Allies’ Response

On May 21, Polish Defense Minister Władysław Kosiniak-Kamysz announced that the Polish Navy had deployed the hydrographic vessel Heweliusz to monitor the activities of Russia’s “shadow fleet.”

This deployment followed reports from Polish authorities of a tanker maneuvering near underwater power cables between Poland and Sweden.

That same evening, a maritime patrol aircraft was dispatched to the area in the Baltic Sea. The crew established radio contact with the tanker and warned that its actions were being monitored. Following this, the vessel left the area and set course for one of the Russian ports.

The Polish hydrographic vessel that arrived on the scene was tasked with inspecting the designated waters for any potential threats to critical maritime infrastructure.

The French Navy also deployed the reconnaissance vessel Dupuy de Lôme to the Baltic Sea to intercept radio signals related to Russian activities.

Additionally, it was reported that the German reconnaissance ship Oker was patrolling the Baltic, operating near Kaliningrad and in the Gulf of Finland for several weeks. This intelligence vessel specializes in intercepting and recording electromagnetic signals.

Provocations Continue

The Polish Defense Minister reported that on May 23, a pair of Polish fighter jets intercepted a Russian Su-24 aircraft conducting “dangerous maneuvers” in international waters of the Baltic Sea.

“Last night, the NATO Joint Forces Command Europe ordered the Polish fighter pair on duty to intercept a Russian Federation Su-24 aircraft,” the Minister stated.

According to him, Russian provocations in the airspace are becoming increasingly frequent. This time, the aircraft performed maneuvers that indicated the pilot’s actions were both dangerous and deliberate.

It is likely that the aircraft involved in the incident was not the bomber version of the Su-24, but rather the Su-24MR frontline reconnaissance variant. These aircraft are primarily designed for electronic reconnaissance and are capable of detecting the locations of active air defense radar systems.

Russian Su-24MRs regularly conduct flights over the Baltic Sea, approaching NATO airspace closely and occasionally violating it.

The Finnish Ministry of Defense also suspects that two Russian aircraft violated Finland’s airspace over the Gulf of Finland on May 23 during the day near the city of Porvoo.

The Ministry of Defense has initiated a formal investigation into the incident.

“We regard the suspected breach of our territory with utmost seriousness and are committed to a comprehensive inquiry,” Antti Häkkänen, Finland’s Minister of Defense, stated.

Threats Perceived by Baltic Region Countries

Russia’s aggressive behavior in the Baltic Sea is causing growing concern among the Baltic states.

Polish Prime Minister Donald Tusk believes that the Baltic Sea, much like Poland’s eastern border, could become a permanent zone of hybrid confrontation.

“Let us not deceive ourselves: the Baltic Sea could become, just as Poland’s eastern border is today, a place of ongoing hybrid conflict,” the Polish prime minister emphasized.

Meanwhile, he suggested that incidents involving Russian saboteurs may become increasingly frequent in the future.

He acknowledged that the term “hybrid” may be inappropriate when someone simply “sends units to destroy infrastructure.”

“This is pure aggression aimed at our security, not only energy security,” Tusk stated.

Lithuanian President Gitanas Nausėda, following incidents involving the “shadow fleet,” stated that Russia is escalating tensions in the Baltic Sea and seeking revenge against Estonia.

“Russia is deliberately escalating the situation and retaliating against Estonia for its previous actions. There are certain ways to protect against similar incidents in the future, and our Estonian colleagues are currently considering how to reroute these vessel paths to avoid Russian territorial waters so that such incidents are reduced. This is a shared problem,” Nausėda noted.

He added that Lithuania has applied to extend NATO’s Baltic Sentry observer mission. However, Gitanas Nausėda stressed that additional measures are necessary to ensure maritime security.

Furthermore, ten European countries have agreed to strengthen the protection of critical underwater infrastructure in the Baltic Sea amid concerns that Russia is using “shadow fleet” vessels as a weapon against EU and NATO countries.

The foreign ministers of Lithuania, Denmark, Estonia, Finland, Iceland, Latvia, Poland, Norway, Sweden, and Germany signed a corresponding memorandum in Tallinn.

The agreement assumes enhanced cooperation to increase the resilience of seabed cables and pipelines, ensure supply chain security, conduct underwater monitoring, and expand rapid repair capabilities. The document also includes provisions on information protection, potential joint funding sources, and coordinated actions.

On May 24, Finnish Defense Minister Antti Häkkänen stated that Russian armed forces have begun escorting “shadow fleet” tankers passing through the Gulf of Finland.

The Shadow Fleet

The so-called “shadow fleet” refers to a group of various vessels, mostly oil tankers, used to trade Russian oil despite the restrictions and sanctions imposed by Western countries.

Many of these ships are old, have opaque ownership structures, are poorly maintained, and are insured by companies outside Western jurisdictions, which complicates their tracking, identification, and regulation.

Using the “shadow fleet” poses not only security risks but also environmental hazards, including accidents, oil spills, and other ecological incidents due to poor technical conditions. Additionally, the lack of transparency regarding ownership and operations complicates holding them accountable for any violations.

Overall, the Russian “shadow fleet” in the Baltic Sea represents a complex challenge encompassing economic, environmental, and regulatory dimensions.

Operation Baltic Sentry

Following a series of damages to underwater energy and communication cables in the Baltic Sea, NATO announced the launch of a new operation, Baltic Sentry, aimed at protecting the region’s maritime infrastructure.

The announcement was made during the Baltic NATO countries summit that NATO Secretary-General Mark Rutte, Finnish President Alexander Stubb, and Estonian Prime Minister Kristen Michal attended.

During the summit, regional leaders discussed the growing threat to critical underwater infrastructure.

As part of Operation Baltic Sentry, protection is provided by naval vessels and aviation, including large unmanned aerial vehicles. The NATO Secretary-General also announced the deployment of a fleet of maritime drones.

Situation

On May 26, it was reported that Russian naval personnel had seized a measurement buoy belonging to the Estonian Marine Systems Institute, which was located within Estonia’s exclusive economic zone in the Baltic Sea.

Estonian researchers traced the buoy’s trajectory and confirmed that it is now located in Kaliningrad. The buoy is specifically designed to monitor wave conditions in the water.

The situation in the Baltic Sea remains fluid, with all parties acting according to their interests: regional countries are focused on safeguarding their security, while Russia continues to exploit the “shadow fleet” to finance its war against Ukraine and to conduct acts of sabotage and terrorism in other nations, including across Europe.