Russian operatives with backgrounds in GRU special forces and the Wagner Group had previously been on board the tanker Qendil (IMO: 9310525), which came under attack by Ukrainian drones in the Mediterranean in December 2025. That’s according to an investigation by the Dossier Center and Norwegian broadcaster NRK, which obtained access to the ship’s documents. Two Russians were listed on the crew as security guards, though experts link their presence to possible reconnaissance activity. One of them, 49-year-old Alexander Malakhov from Russia’s Volgograd region, served in the GRU’s 22nd Separate Guards Special-Purpose Brigade. He returned from Syria—a common destination for Russian mercenaries—in February 2024. No government payments appear in his tax records, indicating possible ties to private military companies. The second “guard,” 59-year-old Viktor Alexandrov from Crimea, is directly linked to the Wagner Group. Since 2017 he had been in Syria as a BMP driver in Wagner’s 6th assault detachment with the call sign “Katso.” He was dismissed in 2019 for drunkenness and going AWOL, but returned to Wagner in 2020. After the full-scale invasion began, Alexandrov repeatedly visited Russian-occupied areas of Ukraine. Malakhov and Alexandrov boarded the tanker in September 2025 before it departed Ust-Luga but left the vessel before the December attack. Unlike other crew members, ship documents listed no maritime diplomas or qualifications for them. On previous voyages along the same route via the Suez Canal and the Gulf of Aden, armed guards had not been required—casting doubt on the notion that they were aboard to protect the ship from pirates. Kari Aga-Miklebost, a professor at UiT The Arctic University of Norway, told NRK that Moscow uses “shadow fleet” vessels for intelligence-gathering, and that transits through dangerous waters provide convenient cover to deny espionage. Western and Ukrainian intelligence services have previously documented Russian mercenaries aboard other tankers; among other tasks, they may monitor international military sites and launch drones. On December 19, 2025, it emerged that Ukraine’s Security Service (SBU) had, for the first time, struck a tanker belonging to Russia’s “shadow fleet” in international waters of the Mediterranean. The special operation, conducted more than 2,000 kilometers from Ukrainian territory, was described as unprecedented in scale.