An IT blunder has revealed an apparent smuggling ring that has moved at least $90bn of Russian oil and is playing a central role in funding the Kremlin’s war in Ukraine.
The FT has identified 48 seemingly independent companies working from different physical addresses that appear to be operating together to disguise the origin of Russian oil, particularly from Kremlin-controlled Rosneft.
The network was discovered because they all share a single private email server.
Routing oil through third parties can mask blacklisted entities involved in trades and prices paid. The incentive to hide the precise origins of Russian crude intensified in October 2025, when the US placed Rosneft and Lukoil — the country’s two biggest exporters — under sanctions.
Since those sanctions were imposed, an otherwise unknown company in the network, “Redwood Global Supply”, has become the single largest exporter of Russian crude. The companies are linked to a group of Azeri businessmen with strong ties to Rosneft.
Baiba Braže, foreign minister of Latvia, said: “These smugglers make the enforcement of the oil price cap nearly impossible by making it hard to figure out the true price of transactions — and now they are helping to disguise sanctioned Russian producers.
“That’s why all the ecosystem needs to be sanctioned to save lives of Ukrainians.”
Three EU officials said the findings could be used as evidence to impose fresh sanctions. Entities in this network, one told the FT, were already “well on our radar”.
“We see increasingly complex patterns and new actors emerging that try to bypass our measures. What we try to do with every sanctions package is to make circumvention harder, less predictable, less reliable and more expensive,” said David O’Sullivan, the EU sanctions envoy.
The FT was able to identify 442 web domains whose public registrations show they all use a single private server for their email, “mx.phoenixtrading.ltd”, showing that they share back-office functions.
The FT was then able to identify companies by comparing the names in the domain to those of entities that appear in Russian and Indian customs records as involved in carrying Russian oil.
For example, Foxton FZCO, a Dubai-based entity listed as the buyer of $5.6bn of oil in Russian export filings, matches “foxton-fzco.com”. Similarly, Advan Alliance, an entity listed in Indian filings as having sold $1.5bn of Russian oil into the country, can be linked to “advanalliance.ltd”.
Filings linked by the FT to the domain list show oil exports from Russia amounting to more than $90bn.
The total figure moved by these companies is likely to be significantly higher. The customs filings are incomplete and the FT took a conservative approach both to including potential network members and to avoiding double counting of shipments.
The large number of entities is a consequence of their short lifespans: customs records suggest they are only active for an average of around six months. That rapid abandonment of each entity complicates the task for sanctions officials. Eight entities in the domain list are already directly subject to sanctions from the EU, US or UK.
The network involves traders linked to Coral Energy, a company founded in 2010 by Azeri businessman Tahir Garayev, who has been sanctions-listed by the UK. One of the domains using the email service is “TahirQarayev.com”, a domain used by Gayarev.
Two domains in the set — “bellatrix-energy.com” and “nord-axis.com” — correspond to two companies, Bellatrix Energy and Nord Axis, that were accused in EU sanctions listings of being part of a network around Coral.
A key figure in this network is Etibar Eyyub, an Azeri businessman believed by EU officials to be a close associate of Igor Sechin, chief executive of Rosneft. Another web domain sending email to the server is “EEOffice.com”, which has previously been used by Eyyub.
Eyyub was sanctions-listed by the UK last year for “owning or controlling directly or indirectly or working as a director” at Coral and Nord Axis. His EU listing accused him of enabling “shipments and exports of Russian oil, notably from . . . Rosneft, by concealing the actual origin of the oil”.
In November 2024, the last month for which full Russian data is available, more than 80 per cent of Rosneft’s ship-borne oil exports were moved through the apparent network of companies identified by the FT.
While Garayev was the founder of Coral, traders who have dealt with the two men said Eyyub was clearly in charge. “From a trading perspective, the real power was always in Eitbar’s hands,” said one person. He seemed “very proud of himself” the person added, “always making sure everybody knows he’s flying private”.
The two men have left Coral, now known as 2Rivers, which is under new ownership. 2Rivers’ current owners said the company is inactive, has no current connection with Eyyub and Garayev, and has no current involvement in or knowledge of any networks.
Sergey Vakulenko, a fellow at the Carnegie Russia and Eurasia Centre and former head of strategy at state-owned oil major Gazprom Neft, said: “Using a maze of 50 companies is an old trick from the nineties. That’s how fortunes were made and taxes dodged by soon to become oligarchs.
“But it’s a big surprise that one network has become so big and important to Rosneft. I’d have expected more sock puppets.”
The precise legal relationship between entities in the network is unclear. But the companies seem to play distinct roles. The network uses one set of companies to buy cargoes and another set to sell them into markets such as India and China. Only two of the companies have appeared in paperwork from both India and Russia.
In some cases, shipments are routed via a third location, such as the UAE. Most of the crude was listed under generic names such as “export blend” rather than with a precise grade which would help trace shipments to their source.
The companies are also hard to trace: most have no websites or contact details on their web domains.
Some of the entities — most of which are based in the UAE — have names shared, at least in part, with unrelated companies based around the world. The entities referred to in this table, however, confine themselves solely to the oil trade.
One of the network companies has attracted some attention, however. Kpler, the data and analytics platform, has listed a marked decline in exports by Lukoil and Rosneft since their sanctions-listing in October — with a previously unknown company taking their place.
The single largest exporter of Russian crude is now Redwood Global Supply. This entity, incorporated in Ras Al Khaimah in the UAE, was sanctioned by the UK in December.
The FT has linked the company to the domain name “redwoodgroup.ltd” — another domain that shares the same email server. The timing of the company’s registration aligns with that of the web domain, and it shares a telephone number with another entity within the network.
Two traders familiar with the Russian oil market told the FT that Redwood was believed to be an Eyyub trading vehicle.
Current and former Russian energy executives told the FT that sanctioned oil exporters had redirected supply through non-sanctioned companies and obscure middlemen.
“It creates extra costs and inconveniences. But at the end of the day, the show must go on,” said a senior Russian energy executive.
“Rosneft is exporting less oil and selling more on the domestic market. [Non-sanctioned companies] are exporting more oil all of a sudden. You do the math.”
The true scale and reach of the network is unclear. Several other companies interact with the network in ways that suggest they are part of it, while the nearly 400 domains on the list that have not been linked to oil cargoes hint that the network may be doing more than just trading oil.
Of 448 domains identified by the FT, 19 are linked to Russian businesses, including energy and real estate enterprises, several run by Azeri nationals.
In the EU sanctions listing for Coral, the company was accused of controlling “a large proportion of the vessels in Russia’s so-called ‘shadow fleet’”.
Analysis of shipping patterns shows that companies on the domain list frequently rely on Rosneft-connected ships, such as those formerly run by Gatik Ship Management, an Indian-registered company that briefly emerged in 2023 as the owner of 58 ghost fleet tankers.
Michelle Wiese Bockmann, a maritime expert at Windward, a marine intelligence company, said: “It’s quite obvious that Rosneft and Lukoil are using the same oil marketing networks and tankers to circumvent sanctions and keep oil flowing.
“The frequent changes of names of ships, managers and oil marketing companies . . . are long-standing deceptive shipping practices designed to obfuscate the destination, origin and ownership of cargoes and their logistics.”
The Carnegie Centre’s Vakulenko said: “All the participants in this trade must know what it is about. They are paid well for it and paperwork covers them to the extent that they can pretend they are acting in good faith.”
The FT sought comment from all the companies in the network via email.
Garayev told the FT: “I categorically deny that I am, or have been, a ‘key player’ in any network connected to the shipping, trading, or export of Russian oil.”
Replying to an email sent to a domain in the network list, he also denied “any role direct or indirect in the companies referenced in your correspondence . . . I have never participated in or facilitated any activity intended to breach applicable sanctions regimes or price cap frameworks.”
Eyyub could not be reached for comment. When he was sanctioned by the EU in December, Eyyub described the action as “baseless”, telling the FT: “I have never done anything unlawful or wrongful.” His email was sent from an address on the domain list.
Rosneft has been approached for comment.
Cartography by Steven Bernard