Is the Chinese Vessel Behind Sabotage on Two Undersea Cables?
An analysis by Maciej Urbanowicz, Product Owner of OrbitSailor

The Russian attack on Ukraine has sparked global tensions, and one of the focal points is the Baltic Sea. With Sweden and Finland joining NATO, the region has effectively become a “NATO lake.” This area is crucial for European infrastructure, hosting numerous undersea cables and pipelines, such as the Nord Stream 2 pipeline, which has been rendered inoperable since its severe damage early in the conflict. Another incident occurred on November 17th, when an undersea cable was cut.

Who might be responsible for this event? Let’s dive into OrbitSailor’s archive for a closer look.

Media reports suggest the Chinese vessel Yi Peng 3 (IMO: 9224984, MMSI: 414270000) was involved. A review of its historical AIS data reveals peculiar patterns. Here’s a summary of its journey:

• October 23, 2024: The vessel was near Tunisia.
• October 24–31, 2024: It roamed waters between Spain and Algeria without docking. This behavior might raise suspicion but could also indicate waiting for cargo or undergoing maintenance.
• October 31, 2024: The vessel passed through the Strait of Gibraltar. Although its AIS system reported Gibraltar as its destination, it never docked there. Instead, its destination field shifted to “For order,” a placeholder that persisted until a new destination, “UST RUS,” was entered.

The “UST RUS” destination raised eyebrows because no Russian port matches this LOCODE. The name aligns with various ports beginning with “Ust” (e.g., Ust-Luga), but these ports aren’t located in the Baltic Sea. Shortly after, the destination was corrected to “RUULU,” the LOCODE for Ust-Luga in the Gulf of Finland.

The vessel reached Ust-Luga on November 10th and departed the next day, engaging in peculiar activities in Koporye Bay before resuming its journey.

By November 16th, the vessel’s AIS transmissions became irregular, reporting its position only every 10–15 minutes. On November 17th at 15:10 UTC, the vessel disappeared from tracking for 7 hours and 31 minutes, a gap during which it traveled approximately 77 km. Normally, the same distance would have been covered in just over three hours.

The location of this gap coincides with the area of the undersea cable incident. After resuming transmissions, the vessel headed toward the North Sea, only to be intercepted by the Danish Navy. Its stated destination—”PSD.EG”—suggested Port Said, Egypt, but the LOCODE was incomplete, raising further questions.

Was Yi Peng 3 involved in the cable sabotage? The AIS transmission gap and its presence in the area are suspicious. The Danish authorities, having intercepted the vessel, likely possess additional evidence.

Incidents like this underscore the vulnerabilities of global infrastructure. Beyond economic and environmental harm, such actions disrupt maritime safety. Analysts describe this as part of a “hybrid war,” where civilian infrastructure becomes a target to destabilize economies. Alleged Russian allies, including China, North Korea, and Iran, are suspected participants in such strategies.

OrbitSailor, as a maritime monitoring platform, plays a crucial role in increasing situational awareness. While AIS data provides essential insights, it is not infallible. Leveraging AI and machine learning, OrbitSailor enhances the ability to respond swiftly to such threats, ensuring better maritime security for all stakeholders.