On July 6, the Eco Wizard tanker suddenly suffered two explosions 10 minutes apart while anchored at the Russian port of Ust-Luga, on the shore of the Baltic Sea.
The incident prompted experts to immediately link a series of similar explosions that have occurred with at least five other tankers since the beginning of 2025, including many notable coincidences.
Just two weeks before the Eco Wizard explosion, the Vilamoura tanker of a Greek company also exploded while transporting 1 million barrels of crude oil off the coast of Libya.
The Seacharm suffered damage in mid-January while near the Turkish port of Ceyhan. The Grace Ferrum had an incident off the coast of Libya in early February. The Seajewel exploded in the port of Savona, Italy on February 15. Ust-Luga port also recorded the Koala explosion on February 9.
Earlier, in late December 2024, the Ursa Major cargo ship, owned by a company linked to the Russian Defense Ministry, sank in the Mediterranean Sea after a series of explosions.
Although it is not possible to determine an official connection between the incidents, maritime analysts note that the common point is that all the attacked ships have visited Russian ports.
The perpetrators are likely to have targeted ships that have docked in Russian ports, according to a warning bulletin issued by the British maritime security company Ambrey on March 7, 2025, following the first five explosions.
Most of the explosions occurred near the engine room, which was prone to causing serious damage.
The exact cause of the explosions is still unknown, but experts rule out the possibility of technical errors. There is growing evidence that external factors are behind this series of attacks. For example, TMS Tankers, the ship management company Vilamoura, confirmed that explosive device was used in the incident.
Ambrey experts suspect Navy mines were the culprit in the explosions. In its March report, the company said it had not detected any naval mines but there was clear evidence of the presence of the mines.
attention is paid to limpet mines. Dean Mikkelsen, an independent maritime expert, explains that small metal plate-shaped limpet blasts are attached to the boat's body. The mine can be conditioned or detonated remotely. This type of mine often has to be attached manually, below the water level, near the engine room to cause great damage.
Ambrey assessed that it was unlikely that the mines were attached when the ship was docking due to high risks, but the divers may have taken advantage of the opportunity to attach the mines when the ship moved slowly near the port.
"We believe there is more than one group that carries out these cases," Ambrey spokesperson Alexa explained. There may be groups operating in the Mediterranean, Aegean, Black Sea and Baltic Sea. Therefore, there may be differences and diversity in the types of explosives they use. But we believe the threat actor is operating as a unified force in different regions."
Ambrey said it was very likely that a state actor had deliberately targeted oil tankers.
Security company Dryad Global said the attacks demonstrated "military level" capabilities, likely involving a country or a team of proxies amid the complicated Russia-Ukraine conflict.
