Email Blunder Exposes $90bn Russian Oil Smuggling Ring

An IT email misconfiguration has inadvertently uncovered what appears to be an extensive network of shell companies involved in smuggling tens of billions of dollars’ worth of Russian oil around Western sanctions, Financial Times reporting shows. The revelation sheds light on the sophisticated methods used to disguise the origin of crude exports tied to major Russian producers such as Rosneft after sanctions tightened in late 2025, and underscores the challenges global authorities face in enforcing restrictions on Moscow’s energy revenues.
Mistaken Email Reveals a Web of Firms
Investigative journalists traced a private email server — used by 48 seemingly unrelated companies — which inadvertently revealed that many of those entities were in fact part of a coordinated effort to reroute crude away from sanctioned Russian energy giants. The companies, which share the server “mx.phoenixtrading.ltd,” operated from a patchwork of jurisdictions and used obscure web domains.
By cross‑referencing public domain registrations and customs records from countries including India and Russia, the FT was able to link at least $90 billion in oil exports to this network. While the total value could be higher — due to incomplete filings and conservative counting — the figures already point to a large‑scale circumvention operation that undermines the effectiveness of Western sanctions.
Shell Companies and Sanction Evasion
The apparent smuggling ring used short‑lived companies, often active for only around six months, making them difficult to track or sanction. Many entities had no functional websites or public contact details, and crude cargoes were often declared under generic names such as “export blend” to mask origin points. Some shipments were routed through third countries such as the United Arab Emirates, where firms with UAE‑registered addresses were linked via customs data.
One of the most notable players in the network is Redwood Global Supply, a Ras Al Khaimah‑incorporated firm that has emerged as a major exporter of Russian crude since sanctions on Rosneft and Lukoil took effect. Redwood has been sanctioned by the United Kingdom Sanctions Authority and other Western authorities but continues operations due to the network’s opacity.
Individuals and Alleged Ties
Azerbaijani businessmen Etibar Eyyub and Tahir Garayev have been identified by EU officials as principal figures behind many of the companies sharing the email server. Eyyub, previously linked to Rosneft‑connected firms, is widely believed to be the network’s operational hub, although he has denied involvement in wrongdoing. Garayev, founder of Coral Energy — now inactive — similarly denies participation, despite being linked to multiple domain registrations.
The rapid abandonment of entities once they attract attention is a common characteristic of sanctioned networks. Customs records suggest that many firms lasted an average of about six months before shutting down or morphing into new corporate identities, complicating law‑enforcement measures.
Shadow Fleet and Deceptive Shipping
Experts say the smuggling network’s tactics resemble those used by the so‑called “shadow fleet” of older tankers that carry Russian crude under changing flags and concealed routes to avoid sanctions. Ships associated with these exporters often rely on opaque ownership structures and frequent name changes to avoid detection, with some vessels even listed under unrelated companies’ names.
Maritime analysts note that hiding the true origin of oil cargoes — including through middlemen and misleading paperwork — makes compliance with sanctions like price caps far more difficult. As Baiba Braže of Latvia has warned, such practices can undermine efforts to limit Russia’s oil revenues and reduce funding for Moscow’s war in Ukraine.
Regulatory Response
Several entities in the network — including Redwood and others connected to Coral and Nord Axis — have already been targeted with sanctions by the European Union, the U.K. and the U.S. But officials acknowledge that targeting individual companies is only part of the response; dismantling a sprawling, adaptive network requires coordinated international sanctions, financial regulation and maritime enforcement.
Sanctions envoys argue that the fluid nature of such networks — with hundreds of web domains and frequent changes in corporate identity — means authorities must update legal tools continually to close loopholes and disrupt sanctioned trade flows effectively.
Broader Implications
The exposure of this smuggling network raises fundamental questions about the efficacy of sanctions regimes when confronted with sophisticated evasion strategies. While sanctions have reduced direct exports by major Russian energy companies, these parallel channels — revealed by a simple email configuration error — highlight how commercial actors and intermediaries can adapt quickly.
As Western governments review the findings, lawmakers and sanctions specialists say that closing enforcement gaps will be crucial to maintaining pressure on Russia’s energy sector and cutting off revenue streams that fuel geopolitical conflicts and military operations.