Recorded Future's Insikt Group exposes how Iranian and Russian shadow fleet operators use cyber-enabled tactics to evade international maritime sanctions. Three clusters of fraudulent online infrastructure were identified, employing typosquatting and impersonation of legitimate maritime administrations (particularly in weak-oversight jurisdictions like Comoros and Benin), automated seafarer certificate forgery with QR codes, fake ship classification society social media accounts, and mutual endorsement loops between fraudulent websites. The report warns that generative AI will likely be adopted to scale document fraud, and recommends targeting underlying corporate entities rather than just taking down websites, as operators can rapidly reconstitute digital infrastructure.
