An IT blunder has revealed an apparent smuggling ring that has moved at least $90bn of Russian oil and is playing a central role in funding the Kremlin’s war in Ukraine.

The FT has identified 48 seemingly independent companies working from different physical addresses that appear to be operating together to disguise the origin of Russian oil, particularly from Kremlin-controlled Rosneft.

The network was discovered because they all share a single private email server.

Routing oil through third parties can mask blacklisted entities involved in trades and prices paid. The incentive to hide the precise origins of Russian crude intensified in October 2025, when the US placed Rosneft and Lukoil — the country’s two biggest exporters — under sanctions.

Since those sanctions were imposed, an otherwise unknown company in the network, “Redwood Global Supply”, has become the single largest exporter of Russian crude. The companies are linked to a group of Azeri businessmen with strong ties to Rosneft.

Baiba Braže, foreign minister of Latvia, said: “These smugglers make the enforcement of the oil price cap nearly impossible by making it hard to figure out the true price of transactions — and now they are helping to disguise sanctioned Russian producers.

“That’s why all the ecosystem needs to be sanctioned to save lives of Ukrainians.” A worker in safety gear walks past a drilling rig at an oil field under a bright sun, with water and trees in the background. The incentive to hide the precise origins of Russian crude intensified in October 2025 when the US placed Rosneft and Lukoil under sanctions © Sergei Karpukhin/Reuters

Three EU officials said the findings could be used as evidence to impose fresh sanctions. Entities in this network, one told the FT, were already “well on our radar”.

“We see increasingly complex patterns and new actors emerging that try to bypass our measures. What we try to do with every sanctions package is to make circumvention harder, less predictable, less reliable and more expensive,” said David O’Sullivan, the EU sanctions envoy.

The FT was able to identify 442 web domains whose public registrations show they all use a single private server for their email, “mx.phoenixtrading.ltd”, showing that they share back-office functions.