European officials and experts warn that Russian fishing companies are being used for espionage and sabotage of critical underwater infrastructure, including cables that carry 95% of internet traffic.
In May 2025, Brussels blacklisted two Russian fishing companies, Norebo JSC and Murman Sea Food, but not for their fishing activities. According to Euronews, the companies are part of a Russian state surveillance campaign involving espionage missions and sabotage of critical infrastructure, including underwater cables.
Norway followed Brussels' lead a few months later, sanctioning the same companies. Norwegian Foreign Minister Espen Barth Eide stated that their operations could facilitate future sabotage incidents. Norebo JSC has denied both accusations.
A year later, European Commissioner for Fisheries and Oceans Costas Kadis admitted that the Kremlin uses trawlers to gather intelligence.
"We are aware that Russia is involved in illegal, unreported, and unregulated fishing activities, as well as espionage, mapping of critical infrastructure, and sabotage. This raises security concerns," Kadis told the Financial Times in May 2025.
Experts say that many Kremlin-linked vessels pretend to fish for cod or crabs and sail close to European shores, while actually collecting intelligence and damaging key underwater infrastructure.
Erlend Heier, an expert on hybrid warfare at the Fridtjof Nansen Institute, pointed out that almost all major powers, from Moscow to Washington to Beijing, have used spies disguised as fishermen for decades.
"In 1940, German soldiers disguised as civilians on fishing boats entered Oslo a day before the full attack. Norway has done it, the United States has done it, the United Kingdom has done it. Most states with a maritime area have done something similar," Heier said.
What is new, according to Heier, is that Russian intelligence activities on fishing vessels have sharply increased since the start of the full-scale invasion of Ukraine in 2022 and have become more insidious. Activities have gradually shifted from underwater mapping to allegedly damaging important maritime infrastructure in the North and Baltic Seas, such as cutting cables.
"It's all part of broader hybrid campaigns in the gray zone that are essentially aimed at destabilizing Norway and European societies. The targets are now civilian critical underwater infrastructure instead of solely surveillance of military exercises and ports," Heier added.
James Appathurai, NATO's senior expert on cyber and hybrid threats, described these hybrid activities as the "most active threat" to Western infrastructure.
"The Russians are running a program they've had for decades. It's called the Russian Underwater Research Program, which is a euphemism for a paramilitary structure, very well funded, that maps all our cables and energy pipelines," Appathurai told Euronews in 2024.
After a major cable-cutting incident in late 2025, NATO Secretary-General Mark Rutte acknowledged a "concerted campaign" of hybrid warfare in the Baltic Sea and promised greater support.
"Protecting infrastructure is of utmost importance," Rutte said, noting that 95% of internet traffic passes through underwater cables.
Mariia Vladymyrova, an academic from Copenhagen specializing in Russian maritime activities and foreign policy, told Euronews that it is difficult to give a "credible number" of Russian fishing vessels involved in espionage in European waters, but she believes their presence is on the rise.
News organizations like Follow The Money have published detailed investigations tracking patterns of "circling" and "loitering" of vessels, showing that fishing boats in European waters most often circled in place, drifted aimlessly, or deviated from usual routes.
"A Belgian officer once told me about a Chinese vessel: 'No fish. We know that 100%. No one fishes in this water, but this vessel has been sitting for two weeks,'" Vladymyrova recounted.
When the Belgian officer contacted the sailors via radio, one of them replied that they were repairing nets, "which is also not an activity you do on the open sea," Vladymyrova added.
The bigger issue is how to deal with these suspicious operations at the EU and national levels. As hybrid warfare expert Julian Pawlak points out in a paper published by the German Institute for International and Security Affairs, many "gray fleet" vessels operate with forged or concealed ownership structures and insurance, or are reflagged.
This makes it difficult to track and identify vessels suspected of intelligence activities.
"These companies change names and change their legal identity day by day... but they are not on the sanctions list. Closing all these gaps, I think, is an important task for the EU," Vladymyrova said.
A European Commission official said that any vessel attempting to "compromise critical infrastructure" or "engage in hostile activity" is taken seriously, and that individual incidents should be reported to national authorities.
Six weeks after Russia began its full-scale invasion of Ukraine in 2022, the EU adopted its fifth package of sanctions against the Kremlin, including a ban on port access for Russian vessels, with certain exceptions.
"What the EU would welcome is to continue on this path (of sanctioning fishing vessels) and update the list," Vladymyrova said.
However, she noted that national governments, including those overseeing port authorities and domestic legislation, can be equally effective.
"More significant interventions can be taken at the national level because it's usually a matter for the coast guard or police, depending on national laws," Vladymyrova concluded.
