“Wagner” escort
“Security guards” linked to Prigozhin's PMC and the GRU were found on board a tanker belonging to Russia's “shadow fleet”
Two Russians with experience in the GRU special forces and Wagner group were aboard the tanker Qendil, which was delivering Russian oil to India. In December 2025, Ukraine struck this ship in the Mediterranean Sea. The “security guards” (as they are listed in the crew manifest) may have been engaged in espionage in European waters.
“This will not lead to the expected result, will not disrupt any supplies in the end, but will only create additional threats. Our response will definitely follow,“ Vladimir Putin said during a press conference on December 19, 2025. Shortly before the event, Ukraine attacked a ship of the Russian ”shadow fleet” in neutral waters of the Mediterranean Sea for the first time. Drones struck the tanker Qendil.
Ukraine has been systematically striking Russian facilities involved in energy exports. Until recently, the targets were oil refineries, but at the end of November 2025, explosions occurred on two tankers of the “shadow fleet” in the Black Sea. Since November, tankers in the Black Sea have been repeatedly fired upon. Qendil was the first ship to be hit in the Mediterranean Sea.
The Dossier gained access to the crew lists and discovered that the Qendil’s crew included Russians with a military background. On the penultimate voyage, there were not only crew members from China, the Philippines, Myanmar, Indonesia, and Bangladesh, but also two Russians. They boarded the ship before it left the port of Ust-Luga on September 6. Their names are Alexander Malakhov and Viktor Alexandrov. Opposite their names in the ship’s documents is the note SECURITY.
The ship has repeatedly delivered oil to the Indian port of Sikka. To do this, it must pass through the Suez Canal and the Gulf of Aden, where ships can be threatened by Somali pirates and Yemeni Houthis, so the presence of security on board could be quite logical. However, on previous voyages along the same route, the ship was not accompanied by armed personnel. They were not on board on December 19, when the Qendil was attacked by Ukraine. This may mean that Malakhov and Alexandrov’s mission was not related to protecting the tanker.
Malakhov and Aleksandrov are not sailors. They are the only ones on the crew list who do not have a diploma number or the qualifications required to serve on the ship. However, the documents contain their dates of birth and passport numbers, which allowed the Dossier to reconstruct some details of the men’s biographies using various leaks of personal data.
Malakhov was born in 1975 in the city of Serafimovich in the Volgograd region. He lived in the Rostov region for a long time, where he served in the 22nd Separate Guards Special Purpose Brigade, which is subordinate to the Main Intelligence Directorate of the General Staff (GRU). Since at least 2013, he worked for the company that operates the Rostov-on-Don airport. In 2018, Malakhov was an inspector at the aviation security center. At the end of 2023, he resigned, and in February 2024, according to data on his movements, he flew in from Syria. It is unknown what Malakhov was doing in a country popular with Russian mercenaries. If he had served in the armed forces, the Federal Tax Service databases would have contained relevant records of payments, but no such records were found. One theory is that he served in a private military company.
Another tanker guard, Viktor Aleksandrov, was associated with mercenary structures. He was born in Crimea in 1965 and lived in Yekaterinburg for a long time. In the early 2000s, he was convicted of robbery. He was an active client of microfinance organizations, and in the mid-2010s, he ended up in the bailiffs’ database due to loan debts. He worked as a security guard for a short time and then joined the Wagner Group. He had been in Syria since at least 2017, and according to the state border crossing database, in 2020 he traveled to his place of service on a Ministry of Defense Il-76 transport plane with the registration number RF-76731. Russia uses this aircraft to transport military personnel, equipment, and ammunition.
Documents from the Wagner PMC state that Alexandrov was a member of the sixth assault squad, was a BMP mechanic-driver, and used the call sign “Katso.” In February 2019, he was dismissed: on February 26 and 27, he consumed alcoholic beverages with his colleagues, then left the unit’s location in a service vehicle, drove to Palmyra, and then returned. On the way back, still intoxicated, the Wagnerites disarmed pro-government Syrian soldiers at a checkpoint and demanded that a Syrian general (whose name is not mentioned in the materials) be summoned to them. For this offense, Alexandrov was blacklisted, but apparently did not remain there for long: in 2020, he was again listed as a member of the Wagner Group.
Since 2015, Aleksandrov has been actively traveling to Ukraine. In total, he has crossed the border of this country more than 200 times, including after the start of the war, and, judging by the entry points, visited the occupied territories. Aleksandrov and Malakhov did not respond to questions from Dossier. Professor Kari Aga Myklebost of the Arctic University of Norway said in an interview with NRK that Russia uses a “shadow fleet” for reconnaissance, and that the route passing Yemen and Somalia provides a convenient excuse to deny the fact of espionage.
The special services of Ukraine and Western countries have already reported on mercenaries who were on board the tankers of the “shadow fleet.” CNN, citing sources in intelligence agencies, wrote that the crews of several ships were reinforced with employees of Moran Security, a company linked to the Russian military. The mercenaries may be engaged in espionage in European waters and launching drones over military facilities, as well as monitoring the crews of ships, which mainly consist of non-Russian citizens.
Alleged mercenaries from Moran Security with Russian citizenship (there were no other Russians there) were part of the crew of the tanker Boracay in the summer and fall of 2025, CNN reported. The ship was off the coast of Denmark at the time when drone flights forced authorities to close Copenhagen Airport. The ship was subsequently detained by the French navy, and the captain was charged with refusing to follow instructions. The Dossier obtained the Boracay crew lists and confirmed CNN’s information: there were indeed Russian citizens on board. One of them, Alexander Tishchenko, flew to Syria; another, Stanislav Babichev, served in military unit 71628 (part of the Main Missile and Artillery Directorate of the Ministry of Defense) and then served in the Russian Guard.