Limpet Mine Attacks in the Mediterranean: A New Era of Hull Sabotage

A weapon most operators had filed under twentieth-century naval history has returned to one of the world's busiest shipping lanes. Across 2025, a run of unexplained explosions tore open the hulls of crude oil tankers in the Mediterranean, and the common thread was not a war zone or a piracy hotspot. It was a port call. Vessel after vessel had recently loaded at, or traded with, Russian terminals before a blast struck below the waterline. The suspected cause is the limpet mine: a magnetically attached, timer-fused charge fixed to a hull by a diver, often while the ship sits at anchor or alongside. For any operator whose trade pattern touches sanctioned energy flows, this is the strategic shift that matters. The threat now follows the cargo, not the coordinates.

What a limpet mine attack actually involves

A limpet mine is a small explosive charge held to a steel hull by magnets and detonated on a timer or remote signal. It is a tool of sabotage, not open warfare. A diver, a swimmer delivery vehicle, or a small craft places the device close to the waterline, frequently over the engine room or a ballast tank, then leaves. Hours or days later the charge fires, opening a breach that floods machinery spaces and can leave a laden tanker without power or steering in a busy seaway.

The reported Mediterranean incidents fit this pattern closely. Damage has clustered around the engine room, hull breaches have run to several feet across, and the explosions have occurred away from any declared conflict. Analysts have pointed to magnetic, timer-activated devices, in some cases resembling Soviet-era designs, which require deliberate planning, diver capability and accurate knowledge of a vessel's schedule. This is not opportunistic violence. It is a targeted campaign executed by an actor with reach, patience and intent.

The pattern: trade with Russia, then a blast

The defining feature of the 2025 wave is selection by association. The targeted tankers were not random. They shared a recent history of calling at Russian export terminals such as Ust-Luga on the Baltic and Novorossiysk on the Black Sea, the loading points that feed sanctioned and grey-market crude into global markets.

A representative sequence runs across the year:

• Late January, near Ceyhan, Turkey. The Marshall Islands-flagged Seacharm suffered a hull breach of roughly three feet.
• Early February, near Tobruk, Libya. The Liberia-flagged Grace Ferrum sustained severe damage.
• 15 February, near Savona-Vado, Italy. The Malta-flagged Seajewel was hit by two explosions, leaving a hull breach around two by four feet, with the devices suspected to be Soviet-pattern mines.
• 29 June, off Benghazi, Libya. The Malta-flagged, Greek-operated crude tanker Vilamoura took a blast that flooded the engine room and left the vessel without control until it was towed clear.

Several of these ships had loaded or traded through Russian ports before the strike. The geographic spread, from the Tyrrhenian Sea to the Gulf of Sirte, shows the campaign is not bound to one chokepoint. It is bound to a commercial profile. That makes a vessel's voyage history a security variable, not a logistics footnote.

Why this marks a new era of maritime risk

The limpet mine campaign sits at the intersection of three trends that, together, change the threat picture for commercial shipping.

• Sabotage has migrated into the commercial fleet. Underwater attacks on merchant tankers in peacetime European waters were, until recently, almost unthinkable. The line between state competition and commercial shipping has thinned, and the so-called shadow fleet moving sanctioned crude is now contested space rather than neutral trade.
• The weapon is cheap, deniable and precise. A limpet mine demands skill but little money, leaves a murky trail of attribution, and can be placed at anchor far from any naval presence. That asymmetry favours the attacker and frustrates conventional deterrence.
• Selection is intelligence-led. Targets are chosen by analysing where ships have been and whom they trade for. The attacker is, in effect, running a screening process on the world fleet. An operator without comparable visibility into its own exposure is at an information disadvantage from the outset.

The result is a low-cost, high-impact threat that defeats the usual mental model of where danger lives. The risk is no longer a region you can route around. It is a relationship embedded in the voyage itself.

What it means for operators, and what to do

Operators whose trade pattern touches Russian-linked energy flows, or who charter, manage or insure vessels that do, should treat hull sabotage as a live planning assumption. The practical response splits into physical measures and the foresight that tells you when to apply them.

• Underwater hull inspection before sailing. Where exposure is plausible, divers or remotely operated vehicles (ROVs) should examine the hull, particularly around the engine room and waterline, before a vessel departs a higher-risk anchorage or port.
• Detection while alongside and at anchor. Acoustic and sonar monitoring, deck watches and controlled access to the waterside reduce the window in which a charge can be placed unobserved.
• Disciplined position and identity management. Considered use of the automatic identification system (AIS), route planning that avoids prolonged exposure at known higher-risk anchorages, and tight control of schedule information all narrow an attacker's planning picture.
• Rehearsed incident response. Crews drilled for flooding, loss of propulsion and coordination with coastguards and salvage stand a far better chance of saving a vessel hit far from help.

The decisive point is that none of these measures can be applied everywhere at once. They are expensive, and they slow operations. The question is therefore not how to defend every voyage, but how to know which voyages warrant the effort. That is a question of intelligence, and it has to be answered before the ship sails, not after a charge detonates.

Where Verihelm helps

The limpet mine threat is selected, not random, so the advantage goes to the operator who can see the same signals the attacker uses: which vessels carry a Russian-linked trade history, which anchorages and ports have seen incidents, and how the campaign is spreading across the Mediterranean rather than staying fixed to one chokepoint. Verihelm is the platform Dryad Global uses to turn that raw maritime picture into analyst-verified intelligence, fusing incident data, threat-actor tracking and voyage-level exposure so operators can judge risk before a vessel sails rather than after a hull is breached. Emerging campaigns like underwater sabotage of the shadow fleet are exactly the kind of shift our analysts surface and contextualise, set against the wider body of regional and threat intelligence that frames where, and against whom, the risk is real. A threat you can anticipate is a threat you can plan around.