BREAKINGChina-linked hackers step up attacks on European shipping
← Eagle Intelligence News
War RiskHIGH ALERT

Zombie Tankers & Dark Logistics: How AIS Spoofing Is Becoming a Legitimate Escape Route Through Hormuz

Eagle Intelligence AI·Eagle Intelligence·March 23, 2026 · 22:03 UTC·2 min read
Why This Matters

At least two 'zombie tankers' using scrapped vessel identities have transited Hormuz in days. The pattern signals a new dark logistics playbook: AIS spoofing + identity fraud = tactical evasion.

Zombie Tankers & Dark Logistics: How AIS Spoofing Is Becoming a Legitimate Escape Route Through Hormuz

Advertisement

The Strait of Hormuz is becoming a playground for maritime identity fraud. Two oil tankers—the Nabiin and the Jamal—have successfully transited the chokepoint in recent days despite being officially scrapped for demolition years ago. These are 'zombie tankers,' vessels sailing under the identities of ships already sent to shipbreaking yards, a tactic that fundamentally changes how operators are moving cargo through the war-hit waterway.

The Nabiin, an Aframax tanker built in 2002, was officially sent to a Bangladesh shipbreaking yard five years ago according to Lloyd's Register records. Yet on Sunday, March 23, ship-tracking systems detected a vessel broadcasting the Nabiin identity transiting the Strait from the Persian Gulf into the Gulf of Oman, suggesting a successful passage through Iran's blockade. Three days earlier, another 'zombie'—the Jamal, a liquefied natural gas carrier officially demolished last year—executed an identical maneuver.

What makes this significant is not the fraud itself, but the operational mechanics behind it. In a traditional sanctions-evasion scenario, a dark fleet operator would flag-hop: reregister under a complicit jurisdiction (Curacao, Liberia, Comoros) every few months. AIS spoofing is faster. By broadcasting the signal of a 'dead' vessel that carries zero compliance liability, operators sidestep the entire insurance-flag-state nexus. Port State Control cannot detain a ship that doesn't technically exist. P&I clubs cannot withdraw coverage from a vessel already written off. The intelligence apparatus that tracks maritime sanctions evasion is built to detect flag changes and ownership shifts. It is not optimized for identity fraud of this scale.

IRGC Navy personnel conducting inspections via the Larak Island toll corridor have already approved at least nine vessels for safe passage. How many of those vessels were broadcasting genuine identities? The window for a zombie tanker to transit, collect cargo, and disappear is narrow—days, not weeks. But that window has already proven wide enough. Each successful transit of a ghost vessel validates the playbook for the next operator.

The broader implication: if zombie tankers become a repeatable tactic, the entire architecture of maritime sanctions enforcement collapses at the point where vessel identity is verified. Lloyd's List updates, flag state records, P&I club registries—all of these assume that the ship broadcasting on AIS is actually the ship. In a war economy, that assumption is no longer safe.

Operators with legitimate vessels parked in the Gulf and stranded crews now face an operational choice: sit idle for months (or years) waiting for a ceasefire, or assume a dead identity for 48-72 hours and transit. For crew safety and capital recovery, the calculus has shifted. The zombie tanker is not just a sanctions evasion tool—it is now a legitimate survival tactic in an abnormal market.

Advertisement

Related Eagle hubs

⚠️ Intelligence Disclaimer: This analysis is produced by Eagle Intelligence's AI-assisted automated analysis system and is provided for informational purposes only. See our editorial standards. It is not a substitute for official maritime safety advisories from UKMTO, MSCHOA, IMO, or flag state authorities. Operational decisions should always be based on official guidance and professional judgment. Eagle Intelligence accepts no liability for any loss arising from reliance on this content.

Get Eagle maritime risk alerts by email

Live chokepoint status, war-risk shifts, and the daily maritime wire, straight to your inbox. Free.

📰 Related Analysis

War Risk

Week in One Page: Hormuz Attacks Disrupt Oil Flows While US Claims Record Volumes

Strait of Hormuz attacks and Iranian assertions of control dominated the week, raising direct risks to tanker routing and crew safety even as CENTCOM reported six-month-high oil shipments. The central question is whether sustained traffic volumes can continue under repeated strikes and cyber incidents without forcing wider rerouting or higher war-risk premiums.

Sep 20, 2026
War Risk

Hormuz Tanker Attacks Intensify Oil Shortage Signals as Diesel Hits Records

Mounting strikes on commercial tankers in the Strait of Hormuz, set against wars cutting exports from Russia, Saudi Arabia and the UAE, are driving tanker rates higher and diesel to record levels, raising immediate questions over energy-flow reliability and crew exposure.

Sep 22, 2026
War Risk

Iranian Pressure Forces Hormuz Traffic Into Tehran Corridor, Raising Insurance and Routing Stakes

Attacks on tankers are driving vessels toward the northern, Tehran-controlled route through the Strait of Hormuz; the shift carries immediate implications for war-risk premiums, sanctions compliance and long-term charter rates already up 40 percent on key trades.

Aug 15, 2026
War Risk

Hormuz Traffic Splits as Ceasefire Collapses — 11 July 2026

Renewed US-Iran clashes and fresh attacks on shipping have reopened war-risk pricing in the Strait of Hormuz, with tanker owners routing south while non-Iranian tonnage still accounts for 70 percent of June transits.

Jul 11, 2026

Comments & Corrections

0Spot an error? Flag it below ↓

Leave a comment

All comments moderated for quality

Be the first to comment on this story
Corrections policy: Flag inaccuracies using the ⚠️ Correction type. Eagle Intelligence will review flagged corrections. Verified corrections result in an article update with a notice appended. Comments are stored locally in your browser and are not shared with other readers.