Zombie Ships: How Sanctioned Vessels Assume Fake Identities to Transit Hormuz

Zombie Ship: Why One Mystery Vessel Now Matters to Sanctions Enforcement

A vessel exited the Strait of Hormuz on March 21 claiming to be the Jamal, a liquefied natural gas carrier. The problem: Jamal was beached at an Indian demolition yard and being scrapped as of October 2025. The ship that left Hormuz was neither the Jamal nor an LNG carrier, but a perfect example of how dark fleet operators are evolving tactics in real time to evade both military interdiction and sanctions regimes.

This is the first documented use of identity-swap tactics in the 2026 Strait of Hormuz crisis, signaling a dangerous escalation in compliance evasion complexity.

The Mechanics of the Zombie Tactic

The mystery Jamal doppelganger first broadcast its fraudulent identity on March 13, claiming the Omani port of Sohar as destination. It then went dark, switching off its Automatic Identification System (AIS). It reappeared on March 20 near Sharjah in the UAE. Within hours, it had transited the strait and was broadcasting from Iranian waters.

By assuming the identity of a scrapped ship, the operator achieved three goals simultaneously: obscured vessel type (real identity unknown), created cover under a legitimate shipping database record, and provided plausible deniability if intercepted (the real Jamal is known to be scrapped, muddying ownership chains).

What makes this different from typical dark fleet operations: LNG carriers are specialized, tightly regulated assets. There are fewer than 500 in global service. Port terminals track them meticulously. Using one's identity as a cover vessel is unprecedented because the specialized nature makes detection more likely.

Yet it worked.

Implications for Sanctions Architecture

The Jamal incident exposes a structural gap in maritime sanctions enforcement. Current regimes operate on three pillars: vessel identity (flag, registration), beneficial ownership (corporate records), and AIS tracking. The zombie ship approach bypasses the first and third simultaneously while exploiting the international database lag between demolition yards and official delisting.

OFAC and EU maritime sanctions programs compile Denied Parties Lists (DPL) and blocked vessel registries. But these are updated on multi-week cycles. The zombie ship operated in the gap: it selected a real vessel name with a legitimate trail (Jamal was real, was registered, has port records) but whose current status was not yet propagated across every sanctions database.

Windward AI and TankerTrackers have already flagged ~285 tankers broadcasting false or fraudulent flags as of late 2025. But identity-swapping adds a new layer: not just flag fraud, but complete corporate identity spoofing tied to legitimate scrapped assets.

For banks and insurers checking beneficial owner compliance: a zombie ship using a scrapped vessel's identity would pass initial database checks because the vessel name exists in Equasis and other shipping registers. The fraudulent captain has time before red flags surface.

Why This Matters Beyond Hormuz

The zombie ship technique is now in the dark fleet playbook. Operators will replicate it against other sanctions regimes: Russian oil to China, Iranian crude to India, North Korean goods via transshipment. Any maritime sanctions architecture dependent on vessel identity and AIS will see this tactic spread.

Insurance underwriters flagging vessels based on name alone may inadvertently write policies for sanctioned cargo under fraudulent vessel identities. P&I clubs will face claims (actual damage) vs. coverage refusals (sanctions violation) if zombie ships suffer incidents in insured territory.

The first countermeasure is real-time vessel authentication tied to physical characteristics (satellite imagery, hull shape analysis, transponder signal patterns). But commercial operators lack access to these tools. The enforcement gap widens.

The second implication: crew. Zombie ships require complicit crews willing to navigate contested waters under false flags. Labor recruitment networks become critical links in the sanctions evasion chain. Crew sourcing from Southeast Asia and Eastern Europe accelerates because local mariners face lower legal exposure than Western nationals.

The Broader Signal

The fact that a zombie ship transited Hormuz successfully, and that it was first detected only after the fact via post-hoc analysis of vessel databases, signals that the Strait is no longer a choke point for cargo control. Iran's selective blockade (allowing some traffic through) has created space for sophisticated evasion.

Three weeks into the Strait closure, operators are innovating faster than regulators can respond. The industry baseline has shifted from ""hide in plain sight via dark transits"" to ""assume a completely false identity via database manipulation."" This is not a marginal tactic—it is becoming standard practice for any high-value, high-risk cargo.

Sanctioning regimes will adapt. Expect imminent OFAC guidance on identity verification protocols, likely including biometric crew manifests and real-time satellite tracking mandates for high-risk routes. But the cat-and-mouse cycle has reset. Every new enforcement layer will spawn three new evasion tactics.