A technological oversight has brought to light an ostensible illicit network that has trafficked a minimum of $90 billion worth of Russian petroleum and is proving instrumental in financing the Kremlin’s aggression against Ukraine.
The FT has uncovered forty-eight outwardly distinct entities, operating from varied locations, which seem to collaborate in order to obscure the provenance of Russian petroleum, especially oil emanating from state-owned Rosneft.
This network was uncovered due to their collective utilization of a common confidential email server.
Channeling petroleum via intermediaries may conceal prohibited parties participating in transactions and the corresponding costs. The motivation to obscure the exact source of Russian crude escalated in October 2025, upon the US imposing restrictions on Rosneft and Lukoil – the nation’s two largest petroleum shippers.
Subsequent to the enactment of those sanctions, “Redwood Global Supply”, a previously obscure firm within the network, emerged as the foremost shipper of Russian crude. These entities are connected with a cadre of Azerbaijani entrepreneurs possessing substantial affiliations with Rosneft.
Baiba Braže, Latvia’s Minister of Foreign Affairs, stated: “These illicit traders render the implementation of the petroleum price cap almost impracticable by complicating the ascertainment of actual transaction values — and currently, they are assisting in cloaking sanctioned Russian oil producers.
“For this reason, the entire operational framework must face punitive measures to preserve Ukrainian lives.”
According to three European Union representatives, these discoveries might serve as proof for implementing new punitive measures. Organizations within this web, one informed the FT, had already garnered significant attention from us.
“We observe ever more intricate schemes and novel participants surfacing that endeavor to circumvent our regulations. Our aim with each set of punitive actions is to render evasion more challenging, less foreseeable, less dependable, and costlier,” articulated David O’Sullivan, the European Union’s special envoy for sanctions.
The FT succeeded in pinpointing four hundred forty-two internet domains, which public records indicate utilize a lone confidential server for their electronic mail, “mx.phoenixtrading.ltd”, thereby demonstrating shared administrative operations.
The FT then managed to ascertain firms by cross-referencing the domain names with organizations listed in Russian and Indian trade documentation as participants in the transportation of Russian petroleum.
As an illustration, Foxton FZCO, a firm headquartered in Dubai documented as the purchaser of $5.6 billion worth of petroleum in Russian export declarations, corresponds to “foxton-fzco.com”. Likewise, Advan Alliance, a company cited in Indian documentation for having vended $1.5 billion of Russian petroleum to the nation, is connectable with “advanalliance.ltd”.
Documents associated with the domain roster by the FT indicate petroleum shipments originating from Russia totaling in excess of $90 billion.
The aggregate sum transferred by these firms is probably considerably greater. The trade declarations are partial, and the FT adopted a cautious methodology regarding both the incorporation of prospective network participants and the prevention of duplicate shipment tallies.
The substantial quantity of organizations stems from their brief operational durations: trade documentation indicates they are operational for merely approximately half a year on average. This swift discontinuance of each firm renders the assignment more complex for sanctions enforcement agents. Eight organizations within the domain registry are already under direct punitive measures from the EU, US, or UK.
The consortium comprises merchants associated with Coral Energy, an enterprise established in 2010 by Azerbaijani entrepreneur Tahir Garayev, whom the UK has placed on a sanctions roster. Among the domains employing the email facility is “TahirQarayev.com”, an internet address utilized by Gayarev.
A pair of domains within the collection — “bellatrix-energy.com” and “nord-axis.com” — are linked to two firms, Bellatrix Energy and Nord Axis, which were implicated in EU sanctions declarations as members of an illicit association connected to Coral.
A pivotal individual within this association is Etibar Eyyub, an Azerbaijani entrepreneur considered by EU authorities to be an intimate collaborator of Igor Sechin, Rosneft’s chief executive officer. An additional internet domain transmitting electronic mail to the server is “EEOffice.com”, formerly employed by Eyyub.
Eyyub received a sanctions designation from the UK during the preceding year on grounds of “possessing or overseeing, either directly or indirectly, or serving as a board member” at Coral and Nord Axis. His EU designation implicated him in facilitating “the conveyance and international sale of Russian petroleum, particularly from . . . Rosneft, through the obfuscation of the oil’s genuine source”.
During November 2024, the most recent month with comprehensive Russian data accessible, over eighty percent of Rosneft’s maritime petroleum shipments were conveyed via the ostensible corporate web uncovered by the FT.
Although Garayev established Coral, merchants familiar with both individuals affirmed Eyyub distinctly held authority. “From a commercial standpoint, the true influence consistently resided with Eitbar,” stated one person. He appeared “exceedingly self-satisfied,” the individual added, “consistently ensuring everyone was aware of his private air travel.”
Both individuals have departed from Coral, presently identified as 2Rivers, which operates under novel proprietorship. The present proprietors of 2Rivers declared the firm is dormant, possesses no present affiliation with Eyyub and Garayev, and maintains no present participation in or awareness of any such associations.
Sergey Vakulenko, a research associate at the Carnegie Russia and Eurasia Centre and previously the head of strategy for state-controlled petroleum giant Gazprom Neft, commented: “Employing a labyrinth of fifty corporations represents an archaic stratagem from the nineteen-nineties. This was the method by which wealth was amassed and fiscal obligations evaded by prospective oligarchs.
“However, it is a significant astonishment that a singular network has grown so expansive and vital to Rosneft. I would have anticipated a greater number of shell entities.”
The exact lawful connection among the network’s constituents remains ambiguous. Nevertheless, the firms appear to fulfill separate functions. The network employs one group of corporations to acquire consignments and a separate group to vend them into markets like India and China. Merely two of these corporations have surfaced in documentation from both India and Russia.
On occasion, consignments are directed through an intermediary site, for instance, the United Arab Emirates. Most
Most of the unprocessed oil was identified by general designations like “export blend,” instead of a definite classification that would facilitate tracking deliveries to their origin.
These businesses are similarly challenging to locate: the majority lack any websites or contact information linked to their internet domains.
A few of these organizations — predominantly situated in the UAE — bear names that partially coincide with unrelated businesses globally. Nevertheless, the entities mentioned in this chart restrict their activities exclusively to petroleum commerce.
Nonetheless, a particular firm within this network has drawn notable scrutiny. Kpler, a prominent data and analysis platform, has reported a significant decrease in shipments from Lukoil and Rosneft following their sanctioning in October — with an unlisted entity stepping in to fill their void.
Redwood Global Supply currently stands as the primary exporter of Russian crude oil. This organization, established in Ras Al Khaimah in the UAE, faced sanctions from the UK in December.
The FT has connected this enterprise to the web address “redwoodgroup.ltd” — a distinct domain utilizing an identical email server. The firm’s registration date corresponds with that of the internet domain, and it shares a phone contact with another organization within the collective.
According to two dealers knowledgeable about the Russian petroleum market, Redwood is thought to function as an Eyyub trading conduit.
Both present and past Russian energy officials informed the FT that penalized oil suppliers had rerouted their provisions via unsanctioned enterprises and little-known intermediaries.
“This generates additional expenses and difficulties. However, ultimately, operations must continue,” remarked a high-ranking Russian energy executive.
“Rosneft is shipping out less petroleum and distributing more within the national market. [Unsanctioned firms] are abruptly increasing their oil exports. You can draw your own conclusions.”
The actual size and extent of this web remain uncertain. Various other enterprises engage with the network in manners implying their involvement, whereas the almost 400 domains on the registry not associated with oil consignments suggest the network’s activities might extend beyond mere oil commerce.
Among the 448 domains pinpointed by the FT, 19 are connected to Russian ventures, encompassing energy and property firms, with several managed by Azeri citizens.
Within the EU’s sanctions documentation for Coral, the firm was alleged to oversee “a substantial segment of the ships comprising Russia’s purported ‘shadow fleet’.”
Examination of maritime movement trends indicates that enterprises on the domain registry often utilize vessels linked to Rosneft, including those previously managed by Gatik Ship Management, an Indian-registered company that momentarily appeared in 2023 as the proprietor of 58 covert fleet tankers.
Michelle Wiese Bockmann, a nautical specialist at Windward, a marine intelligence corporation, stated: “It is evidently clear that Rosneft and Lukoil are employing identical petroleum distribution channels and tankers to bypass restrictions and ensure the continued flow of oil.
“The constant alterations in vessel names, managers, and oil marketing firms . . . represent enduring misleading maritime methods crafted to obscure the ultimate destination, source, and proprietorship of shipments and their associated transportation.”
Vakulenko from the Carnegie Centre commented: “Every party involved in this commerce undoubtedly comprehends its nature. They receive generous compensation for it, and documentation provides sufficient cover for them to claim they are operating in earnest.”
The FT requested statements from every company within the network through electronic mail.
Garayev informed the FT: “I unequivocally refute being, or ever having been, a ‘central figure’ in any collective associated with the transport, exchange, or foreign sale of Russian petroleum.”
In response to an electronic message directed to a domain on the network’s roster, he further disclaimed “any part, whether direct or indirect, in the entities mentioned in your communication . . . I have never engaged in or aided any operation designed to violate relevant sanctions rules or price limit structures.”
Eyyub was unavailable for a statement. Upon his sanctioning by the EU in December, Eyyub characterized the measure as “unfounded,” telling the FT: “I have never committed any illegal or improper act.” His electronic message originated from an address found on the domain registry.
Rosneft has been contacted for its response.
Mapping by Steven Bernard