Strangers on a Seabed: Sino-Russian Collaboration on Undersea Cable Sabotage Operations

Executive Summary:

• Recent suspicious activities conducted by the merchant vessels Shunxing-39 and Vasili Shukshin in the vicinity of Taiwan in early 2025 suggest possible collaboration between Chinese and Russian merchant ships related to the reconnaissance and sabotage of undersea communications cables that connect Taiwan to the outside world.
• Such activities follow from suspected undersea infrastructure sabotage operations conducted by Chinese merchant vessels in the Baltic Sea in 2023–2024, with strong indications of Russian assistance and coordination.
• Taken as a whole, this string of incidents suggests an increasing willingness by Moscow and Beijing to collaborate on maritime sabotage operations—include on attacks on third-party targets.

On January 3, the Taiwan Coast Guard Administration (CGA) learned that undersea cables north of Yehliu (野柳)—a peninsula near the northern tip of Taiwan, best known for its distinctive hoodoo stone formations—had been damaged. The report was transmitted by Chunghwa Telecom (中華電信), the company that owns the cables, to CGA’s Second Patrol Flotilla in Tamsui (淡水), New Taipei City. A CGA vessel was dispatched to investigate, and suspicion immediately fell upon the Shunxing-39 (顺兴39号), a Hong Kong-registered cargo vessel located later that day approximately 7 nautical miles north of Yehliu (Central News Agency, January 4; CGA, January 6). The CGA was unable to board the vessel due to rough seas, and it departed the area, reportedly for the port of Busan, South Korea. Of note, the vessel employed two separate automatic identification transponders, which it used to switch signals after it was challenged by the CGA. These two transponders were linked to similar but distinct ship names, in an apparent effort to generate confusion over the ship’s identity. [1]

Later in January, another Hong Kong-registered vessel was reported loitering for nearly a month close to the coast of southern Taiwan. The Vasili Shukshin, a Belize-flagged, Russian-operated cargo vessel, spent December 19, 2024 to January 14, 2025 in the general area from Kaohsiung to the Hengchun Peninsula. The vessel did not enter port and maneuvered on a track that made little sense in commercial terms. As one maritime analyst described it, “the vessel was aimlessly criss-crossing the area near Taiwan’s Fangshan undersea cable landing station for 3.5 weeks for no apparent reason.” It eventually exited the area and returned to the Russian Pacific port of Vostochnyy (YouTube/TaiwanPlus News, January 14; vesseltracker.com, January 17).

These incidents were not the first relating to suspected sabotage affecting Taiwan’s undersea telecommunications cables. For example, in February 2023, two of the three undersea cables connecting the main island of Taiwan with the outlying Matsu Islands (馬祖群島) (lying close to the coast of Fujian Province) were severed by Chinese vessels, severely impacting internet connectivity for the islands’ residents. According to Chunghwa Telecom, that incident represented one of 20 times that such cables had been damaged over a five-year period from 2018 to early 2023 (TaiwanPlus, February 17, 2023; China Brief, August 4, 2023).

In the wake of these repeated cable damage incidents, Taiwan’s Ministry of Digital Affairs has announced actions to improve internet and communications connectivity. These include subsidies for Chunghwa Telecom (Taiwan’s largest internet provider) for the construction of additional cables; the expansion of microwave bandwidth for great back-up coverage to the Matsu Islands; and providing satellite resources as an additional back-up to government agencies and essential services in the event of outages (ROC Ministry of Digital Affairs, January 3).

Undersea cables can be subject to accidental damage, for instance by merchant vessels dropping anchor in the wrong place. The waters around Taiwan, especially in the Taiwan Strait, are crowded with fishing and commercial shipping, which increases this possibility. However, both the repetitious nature of these cable damage incidents and the steadily intensifying campaign of “gray zone” operations by the People’s Republic of China (PRC) against Taiwan suggest that these incidents represent something more intentional (GTI, May 2024, p. 11–13). Additionally, although there is no confirmation that such a device has actually been employed for sabotage operations, researchers at multiple PRC research institutions—including military universities, “Sevens Sons of National Defense” universities, and companies that are part of the PRC’s defense industrial base—have filed patents for devices designed to sever cables on the ocean floor (Newsweek, January 10; China Brief Notes, January 16).

Figure 1: Undersea Communications Cable Network Connecting Taiwan With the World

(Source: Telegeography, undated)

Most concerning of all, there are growing indications, both from the suspicious activities of the Vasili Shukshin and from apparent sabotage activities involving PRC-affiliated merchant vessels in the Baltic region, that the PRC and Russian governments are collaborating on undersea infrastructure sabotage operations, employing merchant vessels as potentially expendable weapons.

Sabotage Activities in the Baltic Sea—and Indications of Possible Sino-Russian Collaboration

In the classic Alfred Hitchcock thriller Strangers on a Train, a man undergoing a difficult divorce from his duplicitous wife encounters another man in the course of a train journey—with the latter man revealing that he wishes his father dead, and proposing that the two of them swap murders in order to frustrate the inevitable police investigations. Unlike in the Hitchcock film—where the first man tries to avoid this criminal conspiracy—the increasing convergence of Sino-Russian activities in the Baltic and around Taiwan suggests that Beijing and Moscow may have hit upon a similar formula relating to undersea infrastructure sabotage.

The February incidents around Taiwan bear some similarities to a string of recent incidents in the Baltic Sea, in which merchant ships—often suspected of being part of Russia’s sanctions-evading “shadow fleet” of tankers and cargo vessels—have severed or damaged undersea infrastructure under circumstances anomalous with routine merchant navigation. In such incidents, the identified cause is usually that of an anchor snagging the affected cables—and with the suspect ships often determined to have conducted a “dragging track” over the areas of the affected cables, with the anchor deployed and the ship transiting at an unusually slow speed. [3] In at least two major incidents over the past two years, Chinese merchant vessels were involved in suspected sabotage activities in the Baltic—with additional indications of likely coordination with Russian maritime assets.

The October 2023 Balticconnector Incident

On October 7–8, 2023, there was reported damage to at least three items of major undersea infrastructure in the Baltic Sea. The most prominent of these was the Balticconnector Pipeline, a 77-kilometer–long undersea pipeline in the Gulf of Finland, connecting Finland and Estonia—one which had initially transported primarily Russian-origin natural gas, but which had shifted primarily to Norwegian and U.S.-produced gas in the wake of sanctions levied against Russia for the invasion of Ukraine. The pipeline’s operators detected a sudden drop in pressure in the early morning hours of October 8, causing the pipeline to be shut down. The same day, two undersea telecommunications cables in the area—one connecting Estonia and Finland, and one connecting Estonia and Sweden—were also damaged (European Commission, accessed February 14; Reuters, October 19). [4] Speaking on the pipeline damage and cable cuttings, Timo Kilpeläinen, deputy director of the Finnish National Bureau of Investigation, stated that, “A sabotage of this caliber requires a certain amount of know-how and special equipment. It’s probably not ordinary people who were behind this” (Maritime Executive, October 17, 2023).

Figure 2: Balticconnector Pipeline Following Damage from Chinese Merchant Vessel, October 7, 2023

(Source: Finnish Border Guard / Wikimedia Commons, October 2023)

In the wake of the incident, Finnish authorities directed suspicion at two vessels: the Russian nuclear-powered cargo ship Sevmorput, which has traditionally operated moving cargoes to Russian military facilities in the Arctic; and the Hong Kong-flagged Newnew Polar Bear (formerly the Baltic Fumar). Both ships were underway near the locations of the damaged pipeline and cable segments. The vessels then departed the area together, on a course toward first Kaliningrad and then the Barents Sea (Finnish National Bureau of Investigation, October 17, 2023; Barents Observer, October 18, 2023). Finnish authorities found an anchor in the seabed close to the damaged pipeline segment. The Newnew Polar Bear was photographed entering port in Arkhangelsk on October 21, apparently missing its port side anchor (Yle (Finland), October 24, 2023; Barents Observer, October 26, 2023).

The navigational history of the Newnew Polar Bear, both immediately prior to and immediately after the October 7–8 incident, was composed exclusively of Russian ports. The vessel made a port call in Kalinigrad on October 3, and then the adjoining Russian Navy base of Baltiysk on October 6. Immediately after the incident, it transited to St. Petersburg on October 8; then to Kaliningrad again on October 13; and then made its transit through the Barents to Arkhangelsk, accompanied by Sevmorput (Barents Observer, October 26, 2023).

The Newnew Polar Bear also undertook a suspicious change of operator registration immediately following the incident: shifting from the Chinese company Hainan Xin Xin Yang Shipping to the Russian-Chinese company Torgmoll, before departing the region through the Northern Sea Route (Radio Free Asia, November 11, 2023).

The November 2024 Cutting of Baltic Communications Cables

On November 17–18, 2024, two Baltic undersea communications cables were cut, once again in suspicious circumstances that suggest Chinese-Russian collusion. The first cable damaged was the BCS East-West Interlink cable, which connects Lithuania to the Swedish island of Gotland. On November 17, Lithuanian telecom provider Telia Lietuva reported that its connection to Gotland had been lost, affecting internet service in much of Lithuania. Later, in the early morning hours of November 18, the Finnish telecom company Cinia reported a loss of connectivity on the C-Lion 1 cable, a 1,173-kilometer–long undersea communications cable that connects Finland to Germany.

Addressing the damage to C-Lion 1, the Finnish and German foreign ministers released a joint statement later that day that stated:

We are deeply concerned about the severed undersea cable connecting Finland and Germany in the Baltic Sea. The fact that such an incident immediately raises suspicions of intentional damage speaks volumes about the volatility of our times. A thorough investigation is underway. Our European security is not only under threat from Russia‘s war of aggression against Ukraine, but also from hybrid warfare by malicious actors. Safeguarding our shared critical infrastructure is vital to our security and the resilience of our societies. (German Federal Foreign Office, November 18, 2024)

Figure 3: Map of C-Lion 1 Undersea Cable Likely cut by a Chinese Merchant Vessel in November 2024

(Source: Wikimedia Commons, undated)

As with the previous year’s Balticconnector incident, suspicion soon fell on a Chinese merchant vessel with an immediately preceding port call in Russia. This vessel was the Yipeng-3 (伊鹏-3), a bulk cargo carrier transiting from the Russian port of Ust Luga (Leningrad oblast). Per an investigation conducted by Swedish authorities, the vessel allegedly dropped its anchor on the evening of November 17 and dragged it across the sea floor off the coast of Gotland, first severing the BCS East-West Interlink cable (Lithuania-Sweden). It then dragged the anchor and chain an additional 178 kilometers along the ocean floor, also severing the C-Lion 1 cable (Germany-Finland) (Marine Traffic, November 29, 2024). The idea of a merchant vessel accidentally dragging its anchor for this distance, absent multiple severe material casualties, strains credulity. Press reporting, citing unnamed European officials, has indicated that the vessel’s captain was acting under the instructions of an unidentified figure in Russian intelligence (Wall Street Journal, December 15, 2024).

Following the incident, the Yipeng-3 was subsequently escorted by Danish Navy ships to an anchorage in the Kattegat Strait, a waterway between the Swedish mainland and Denmark’s Jutland peninsula. The vessel remained there for a month, amid diplomatic wrangling over European requests to search the vessel. After a limited search and questioning of the crew on December 19, the vessel proceeded on its way.

Strangers on a Seabed: Shared PRC and Russian State Motivations for Undersea Sabotage

The incidents discussed above—at least in terms of information disclosed to the public—do not provide conclusive proof of Sino-Russian state collusion in acts of undersea cable sabotage in the Baltic and around Taiwan. However, the available evidence is strongly suggestive that just such a cooperative campaign of industrial sabotage is underway—and may indeed be picking up in tempo.

The motives for such a campaign of gray zone sabotage are not entirely clear, and do not fit within the Western paradigm of statecraft. However, a number of potential motives stand out. The Russian government has for years engaged in a “hybrid warfare” campaign of sabotage, assassination, and disinformation targeted against its neighbors and NATO states. These efforts escalated dramatically in the wake of Russia’s 2022 invasion of Ukraine, and the subsequent international sanctions levied against Russia (NATO Review, April 26, 2024). In the conception of Putin’s regime, a campaign of undersea infrastructure sabotage is simply another front for measures to destabilize European states, and to punish them for their support to Ukraine (Ukrainska Pravda, February 4). The employment of civilian merchants in these operations is both lower-cost and lower-risk than using naval units, and allows the aggressor state to maintain a thin veneer of semi-plausible deniability for what is tantamount to state-sponsored terrorism.

It is in this latter sense that Moscow’s motives find a parallel to the motivations of Beijing’s ruling Chinese Communist Party (CCP). The CCP employs both overt coercive military activities, and thinly disguised sabotage activities, as part of its broader package of political warfare intended to erode Taiwan’s sovereignty and pave the way for eventual annexation. The early January cable sabotage operations of the Shunxing-39 north of Taiwan, and the suspicious transit of the Vasili Shukshin south of Taiwan (possibly surveying cables for future sabotage or intelligence exploitation), suggest that the two regimes are entering 2025 with an emboldened willingness to begin using tactics deployed in the Baltic region to the waters closer to Taiwan.

Notes

[1] The vessel in question appears to operate under at least two, and possibly three, identities—likely employed in an effort to generate confusion. The vessel suspected in the January 3 incident used Automated Identification System (AIS) transponder signals linked to two vessel names: first, as Shunxing-39; and then as Xing Shun 39, reportedly switching signals at the time the vessel was approached and challenged by the Taiwan Coast Guard. To compound the confusion, the latter name is employed by two vessels in maritime databases, one flagged in Tanzania and one flagged in Cameroon. See: “Foreign Freighter Being Investigated for Suspected Damaging of Undersea Cable,” Central News Agency (Taiwan), January 4, 2025, https://focustaiwan.tw/society/202501040011; and Bridget Diakun and Joshua Minchin, “Taiwan Is Hunting One Cable Cutting Vessel Disguised with Three Separate Digital Identities,” Lloyd’s List, January 8, 2025, https://www.lloydslist.com/LL1152160/Taiwan-is-hunting-one-cable-cutting-vessel-disguised-with-three-separate-digital-identities.

[2] To cite but one such example, the Cook Islands-flagged tanker Eagle-S is the prime suspect in the December 25, 2024 incident in which the Estlink-2 undersea electrical power cable, connecting Finland and Estonia, was heavily damaged. Additionally, at least two telecommunications cables operated by the Finnish company Elisa were severed, and two more damaged, on the same day. Finnish and Swedish authorities identified the Eagle-S as the main suspect due to its “dragging track” for roughly 50 miles over the area, and its missing anchor—which was later recovered on the seabed near the Porkkala Peninsula in the Gulf of Finland. See: “Suspected Sabotage Ship’s Anchor Shows Signs of Extreme Damage,” Maritime Executive (Jan. 7, 2025), https://maritime-executive.com/article/suspected-sabotage-ship-s-anchor-shows-signs-of-extreme-damage; and Alex Stuart-Grumbar, “Eagle S Commercial Vessel Held by Finland, Suspected of Sabotaging the Estlink 2 Power Cable and Baltic Sea Communication Cables,” Marine Traffic (Jan. 20, 2025), https://www.marinetraffic.com/en/maritime-news/16/general/2025/11749/eagle-s-commercial-vessel-held-by-finland-suspected-of-sabot.

[3] In November 2023, the Russian telecom company Rostelecom indicated that one of its cables in the Baltic had been cut, and implied that it was connected to the other cable cuttings the previous month (Reuters, November 7, 2023).