[View original](https://www.ft.com/content/4310f010-2b3c-493e-ba0a-26dc6d156b2e)

An IT blunder has revealed an apparent smuggling ring that has moved at least $90bn of Russian oil and is playing a central role in funding the Kremlin’s war in Ukraine.

The FT has identified 48 seemingly independent companies working from different physical addresses that appear to be operating together to disguise the origin of Russian oil, particularly from Kremlin-controlled Rosneft.

The network was discovered because they all share a single private email server.

Routing oil through third parties can mask blacklisted entities involved in trades and prices paid. The incentive to hide the precise origins of Russian crude intensified in October 2025, when the US placed Rosneft and Lukoil — the country’s two biggest exporters — under sanctions.

Since those sanctions were imposed, an otherwise unknown company in the network, “Redwood Global Supply”, has become the single largest exporter of Russian crude. The companies are linked to a group of Azeri businessmen with strong ties to Rosneft.

Baiba Braže, foreign minister of Latvia, said: “These smugglers make the enforcement of the oil price cap nearly impossible by making it hard to figure out the true price of transactions — and now they are helping to disguise sanctioned Russian producers.

“That’s why all the ecosystem needs to be sanctioned to save lives of Ukrainians.”

![A worker in safety gear walks past a drilling rig at an oil field under a bright sun, with water and trees in the background.](https://archive.is/WaPkL/5c6f67841ca197f9ee0228c7a47c8568441df092.avif)

The incentive to hide the precise origins of Russian crude intensified in October 2025 when the US placed Rosneft and Lukoil under sanctions © Sergei Karpukhin/Reuters

Three EU officials said the findings could be used as evidence to impose fresh sanctions. Entities in this network, one told the FT, were already “well on our radar”.

“We see increasingly complex patterns and new actors emerging that try to bypass our measures. What we try to do with every sanctions package is to make circumvention harder, less predictable, less reliable and more expensive,” said David O’Sullivan, the EU sanctions envoy.

The FT was able to identify 442 web domains whose public registrations show they all use a single private server for their email, “mx.phoenixtrading.ltd”, showing that they share back-office functions.

The FT was then able to identify companies by comparing the names in the domain to those of entities that appear in Russian and Indian customs records as involved in carrying Russian oil.

For example, Foxton FZCO, a Dubai-based entity listed as the buyer of $5.6bn of oil in Russian export filings, matches “[foxton-fzco.com](https://archive.is/o/WaPkL/foxton-fzco.com/)”. Similarly, Advan Alliance, an entity listed in Indian filings as having sold $1.5bn of Russian oil into the country, can be linked to “advanalliance.ltd”. 

Filings linked by the FT to the domain list show oil exports from Russia amounting to more than $90bn.

The total figure moved by these companies is likely to be significantly higher. The customs filings are incomplete and the FT took a conservative approach both to including potential network members and to avoiding double counting of shipments.

The large number of entities is a consequence of their short lifespans: customs records suggest they are only active for an average of around six months. That rapid abandonment of each entity complicates the task for sanctions officials. Eight entities in the domain list are already directly subject to sanctions from the EU, US or UK.

The network involves traders linked to Coral Energy, a company founded in 2010 by Azeri businessman Tahir Garayev, who has been sanctions-listed by the UK. One of the domains using the email service is “TahirQarayev.com”, a domain used by Garayev.

Two domains in the set — “bellatrix-energy.com” and “nord-axis.com” — correspond to two companies, Bellatrix Energy and Nord Axis, that were accused in EU sanctions listings of being part of a network around Coral.

A key figure in this network is Etibar Eyyub, an Azeri businessman believed by EU officials to be a close associate of Igor Sechin, chief executive of Rosneft. Another web domain sending email to the server is “EEOffice.com”, which has previously been used by Eyyub.

Eyyub was sanctions-listed by the UK last year for “owning or controlling directly or indirectly or working as a director” at Coral and Nord Axis. His EU listing accused him of enabling “shipments and exports of Russian oil, notably from . . . Rosneft, by concealing the actual origin of the oil”.

In November 2024, the last month for which full Russian data is available, more than 80 per cent of Rosneft’s ship-borne oil exports were moved through the apparent network of companies identified by the FT.