UK agencies issue alert on ‘red and blue’ parts of shadow fleet network
British law enforcement and financial regulators have issued a red alert warning financial institutions about a sophisticated Russian oil sanctions evasion network that generated billions of dollars in revenue while circumventing Western restrictions through a dual-sided corporate structure.
The National Crime Agency, Office of Financial Sanctions Implementation, and Foreign Commonwealth & Development Office jointly published the alert detailing how sanctioned Azeri businessmen Etibar Eyyub and Tahir Garayev operated what became Russia’s largest oil trading network in 2024.
‘In 2024, a network of companies run by UK-sanctioned Azeris Etibar Eyyub and Tahir Garayev traded more Russian oil than any other entity. This included the majority of Rosneft’s oil,’ the alert stated, referring to Russia’s largest state-owned oil and gas company. It noted that that the pair ‘have personal relationships with UK-sanctioned Rosneft CEO Igor SECHIN which enables this privileged access to Russia’s largest state-owned oil company.’
The alert revealed that Russian energy exports provided 30 percent of Russia’s federal budget in 2024, with the sanctioned network utilizing over 100 shadow fleet tankers to transport oil while evading detection through deceptive shipping practices.
British authorities described how the network operates through a deliberate ‘blue’ and ‘red’ structure designed to exploit Western financial systems while obscuring Russian origins of petroleum products.
‘The “blue” side works with entities in the Global West, including banks, insurers and trading platforms,’ while ‘the “red” side of the network, with deliberately obscure ownership structures and many front companies designed to be replaced with ease if they are subject to Western sanctions, trades Russian oil directly,’ the alert explained.
The leading companies on the ‘blue’ side were 2Rivers DMCC and 2Rivers PTE, both sanctioned by the UK in December 2024, while the primary ‘red’ side entity was Nord Axis, sanctioned in May 2025.
UK authorities detailed how the network circumvents restrictions through complex oil movements and corporate structures. ‘Finance and oil move between the different sides of the network. Access to Western rates of trade finance, trusted insurers and key commodity exchanges utilised by ‘blue’ companies are combined with the special relationship with Rosneft’s CEO and privileged access to Russian oil of the ‘red’ companies,’ the alert said.
UK authorities emphasized that the evasion scheme likely extends beyond Rosneft to other Russian state entities, warning financial institutions to remain vigilant against ‘persistent attempts employed by the people and companies associated with Eyyub and Garayev.’
The red alert instructs institutions to report suspicious activity through established channels and emphasizes that ‘no single red flag is necessarily indicative of illicit or suspicious activity’ but requires consideration of ‘all the surrounding facts and circumstances.’
