Military personnel with experience in the special forces of Russia’s military intelligence agency (GRU) and the Wagner private military company (PMC) previously served aboard the tanker Qendil (IMO: 9310525), which was attacked by Ukrainian drones in the Mediterranean Sea last December, the independent investigative outlet Dossier Center and Norway’s public broadcaster NRK report. The publications said they obtained access to ship documents, which revealed that two Russian nationals were listed as security guards in the crew.
One of them, 49-year-old Alexander Malakhov from Russia’s Volgograd Region, previously served in the GRU’s 22nd Separate Guards Special Purpose Brigade. In February 2024, he returned from Syria, a popular destination for Russian mercenaries. No records of budget-funded payments were found in his tax data, suggesting possible ties to private military companies.
The second “guard,” 59-year-old Viktor Alexandrov, a native of Crimea, has direct links to the Wagner Group. In 2017 he was stationed in Syria, where he served with the PMC’s 6th Assault Detachment as a BMP infantry fighting vehicle driver under the call sign “Katso.” However, in 2019 Alexandrov was dismissed for drunkenness and unauthorized absence but rejoined Wagner in 2020. After the start of Russia’s full-scale invasion of Ukraine in 2022, Alexandrov repeatedly visited the occupied territories there.
Malakhov and Alexandrov boarded the tanker in September 2025 before it departed the port of Ust-Luga, but they left the vessel ahead of the December attack. Ship records show, unlike the rest of the crew, neither “guard” held maritime diplomas or seafaring qualifications. On earlier voyages along the same route through the Suez Canal and the Gulf of Aden, the tanker did not carry armed guards, raising questions about claims that they were aboard to protect the ship from piracy.
Kari Aga Myklebost, a professor at the Arctic University of Norway, told NRK that Moscow uses ships from its so-called “shadow fleet” for intelligence purposes, and that routes through dangerous waters provide convenient cover for carrying out espionage. Western and Ukrainian intelligence agencies have previously reported the presence of Russian mercenaries aboard other tankers, noting they could monitor international military facilities and launch drones.
On Dec. 19, 2025, reports emerged that Ukraine’s Security Service had for the first time attacked a tanker linked to Russia’s “shadow fleet” in the neutral waters of the Mediterranean Sea. The operation was carried out more than 2,000 kilometers (1,240 miles) from Ukrainian territory and was described as unprecedented in scale.