Nearly fifty seemingly separate companies have been involved in coordinating to mask the origin of Russian oil, moving crude worth at least $90 billion, an investigation of the Financial Times has found.
FT uncovered the network due to an IT blunder; the 48 identified entities all share a single private email server.
The oil smuggling network includes firms and persons linked to Russia’s top oil producer, state-controlled Rosneft, and these have been in coordination to mask the origin of Russian crude, especially of Rosneft.
The profits are estimated very conservatively at $90 billion, but are likely much higher, according to FT’s investigation.
Read also: Food security or temporary relief? The battle for Nigeria’s oil-seed future
The network was discovered because they all share a single private email server.
Routing oil through third parties can mask blacklisted entities involved in trades and prices paid. The incentive to hide the precise origins of Russian crude intensified in October 2025, when the US placed Rosneft and Lukoil, the country’s two biggest exporters, under sanctions.
Since those sanctions were imposed, an otherwise unknown company in the network, “Redwood Global Supply”, has become the single largest exporter of Russian crude. The companies are linked to a group of Azeri businessmen with strong ties to Rosneft.
Baiba Braže, foreign minister of Latvia, said: “These smugglers make the enforcement of the oil price cap nearly impossible by making it hard to figure out the true price of transactions — and now they are helping to disguise sanctioned Russian producers.
“That’s why the entire ecosystem needs to be sanctioned to save the lives of Ukrainians.”
Read also: Iran raises fuel prices for heavy users to curb consumption, smuggling:
Three EU officials said the findings could be used as evidence to impose fresh sanctions. Entities in this network, one told the FT, were already “well on our radar”.
“We see increasingly complex patterns and new actors emerging that try to bypass our measures. What we try to do with every sanctions package is to make circumvention harder, less predictable, less reliable and more expensive,” said David O’Sullivan, the EU sanctions envoy.
The FT was able to identify 442 web domains whose public registrations show they all use a single private server for their email, “mx.phoenixtrading.ltd”, showing that they share back-office functions.
The FT was then able to identify companies by comparing the names in the domain to those of entities that appear in Russian and Indian customs records as involved in carrying Russian oil.
For example, Foxton FZCO, a Dubai-based entity listed as the buyer of $5.6bn of oil in Russian export filings, matches “foxton-fzco.com”. Similarly, Advan Alliance, an entity listed in Indian filings as having sold $1.5bn of Russian oil into the country, can be linked to “advanalliance.ltd”.
Filings linked by the FT to the domain list show oil exports from Russia amounting to more than $90bn.
Read also: DHQ intensifies crackdown on oil theft
The total figure moved by these companies is likely to be significantly higher. The customs filings are incomplete, and the FT took a conservative approach both to including potential network members and to avoiding double-counting of shipments.
The large number of entities is a consequence of their short lifespans: customs records suggest they are only active for an average of around six months. That rapid abandonment of each entity complicates the task for sanctions officials. Eight entities in the domain list are already directly subject to sanctions from the EU, US or UK.
The network involves traders linked to Coral Energy, a company founded in 2010 by Azeri businessman Tahir Garayev, who has been sanctions-listed by the UK. One of the domains using the email service is “TahirQarayev.com”, a domain used by Gayarev.
Join BusinessDay whatsapp Channel, to stay up to date
Open In Whatsapp
