Hector’s Ships
Traces of an Iranian shipping empire
I woke up last Sunday and wanted to do a few things: get fresh air, wash my clothes, pull up some recent and past ship-tracking work, and start writing this piece.
Hector. This is one of the aliases of Mohammad Hossein Shamkhani. He is the son of Ali Shamkhani, a top political advisor to Iran’s Supreme Leader. He controls a giant shipping network. The U.S. Treasury calls it a “shipping empire” comprised of oil tankers and containerships. A lot can be said about Hector. What made me adamant about keeping my attention on parts of his network is the fact that at least two oil tankers linked to him in 2025 were spotted at Syria’s Baniyas: the first in January 2026, and the second this month.
I wrote about the first tanker, Aether (IMO 9328170), last month, warning in my piece for The Washington Institute that illicit networks like Shamkhani’s have been benefiting from the Russian oil trade in general, and that U.S.-sanctioned tankers have continued to call on Syria since early 2025 carrying Russian oil. This vessel, Aether, arrived at Syria’s Baniyas in early January. TankerTrackers.com brought attention to her on December 29 after it left Russia’s Black Sea terminal of Sheskharis. I noted in my piece that ignoring this trend would only embolden illicit trading networks eyeing Syria, as well as problematic domestic players. Then the second ship was detected.
The Briont ( IMO 9252955 ) was seen at Syria’s Baniyas, based on AIS data. Given the various obfuscation tools sanctioned vessels are resorting to, I made sure to also confirm Briont’s presence at Baniyas with TankerTrackers.com who’ve been closely tracking Syria’s oil imports since the last decade, and they shared with me a satellite image (via Planet) of Briont in Syrian waters based on their independent research (see below).
Both Aether and Briont are falsely flagged vessels. The Aether appears on ship tracking platforms as Guinea-flagged, while the Briont is Madagascar-flagged. But these have already been identified as false ship registries ( as shown below). These fraudulent registries are being used by vessels involved in the trade of sanctioned commodities, and they are part of what is known as the “dark” fleet ( see my colleague and friend Michelle Wiese Bockmann’s work here).
Seeing sanctioned ships transporting Russian crude regularly to Syria since early 2025, now including tankers sanctioned last year due to links to Hector, is alarming and warrants close attention.
Some may argue that the two ships could have been sold to someone else. While it remains unclear if Aether and Briont are still linked to Shamkhani today, vessels affiliated with sanctioned regimes and groups like Hezbollah commonly use front companies to mask their true ownership. Accordingly, the two tankers merit scrutiny to determine if they remain connected to sanctioned Iranian entities, knowing that Hector’s shipping network regularly employs methods to mask its ties with the Shamkhani family.
Syria has become an attraction for U.S.-sanctioned oil tankers moving Russian oil (both crude and oil products). I have been writing about these sanctioned tankers since early last year (see here and here). In my second piece, I warned that Syria’s oil trade should be closely watched, including the identity of any intermediaries brokering oil deals between the government and energy firms. This will help ensure that no illicit networks profit from the country’s current weakness and decades-long corruption, which will likely continue under the new authorities.
And it’s not only Syria that has remained on my radar and which showed me traces of that Iranian shipping empire. Also the Red Sea – a region I’ve been daily monitoring since 2023 amid the Houthi threat ( all my work can be found here).
Passing a Hector Ship without Knowing
I learned more about Hector’s vessels from the U.S. Treasury’s report in summer 2025. A year earlier, I had tracked two containerships in the Red Sea while focusing on the Houthi maritime campaign against commercial shipping. At the time, I had no idea they were linked to him. The Houthis attacked them based on outdated shipping information, and all of this can be tracked in The Washington Institute’s maritime attacks map.
The two containerships, Liberia-flagged at that time, were Pumba (IMO 9302566) and Pinocchio (IMO 9400112). It is easy to say that the Houthis, who are backed by Iran, did not know that they were linked to Hector (Shamkhani), but I will avoid drawing that conclusion for a simple reason: I still do not have all the data I need. When the Houthis attacked them, they did so as if the ships were linked to the United States, Israel, or the United Kingdom ( these were key targets for the Yemeni group). This is based on the information I tracked at that time and the pattern of their attacks against the two ships.
In the case of Pumba, on July 20, 2024, she was attacked twice; first by an UAV (uncrewed aerial vehicle) that exploded in close proximity, causing minor damage, and then by an USV (uncrewed surface vehicle ), which also exploded near the vessel. Pinocchio, in turn, was attacked on March 11, 2024. According to UKMTO, the master reported an explosion near the vessel.
The two ships were chartered by a Singapore-based company called SeaLead. Following the wave of U.S. sanctions in July 2025, SeaLead announced the termination of all charterparties and contracts related to the sanctioned vessels and entities. During the height of the Red Sea crisis, SeaLead was among the companies that continued to charter vessels to trade in the Red Sea despite the attacks on Pumba and Pinocchio ( see my work here citing TradeWinds). Both containerships continued to sail in the Red Sea and were never attacked again by the Houthis.
The more I review the work I did in past years on the Houthi maritime campaign, the more I see answers and trends I was previously unaware of.
Illicit Networks Reconstitute Themselves
Hector’s network, or shipping empire, will not disappear because of sanctions but will instead reincarnate. Based on what I have shared above, what concerns me most is Syria and the sanctioned oil tankers it is attracting. This is a clear signal to illicit networks in the region that Syria represents an opportunity for profit, and I continue to repeat this message.
I was born and raised in Lebanon, a country that has been ruled by highly corrupt governments since the end of the civil war in 1990. These governments have bulldozed the energy sector with poor and destructive policies. I investigated these practices in the past (check my work here) and I will recount a meeting I had in 2018 at the Ministry of Energy and Water in a different post.
In March 2025, I wrote that postwar experiences in Lebanon (after 1990) and Iraq (after 2003) showed that the energy sector is particularly vulnerable to corrupt schemes that paralyze economic development. Syria is absolutely no different. Worrying trends are unfolding there, including the sanctioned and high-risk oil tankers carrying Russian oil to Damascus. The absence of mainstream media coverage does not mean these developments are not occurring.
I will expand some of the issues discussed here in future work, as well as on my social media pages. Follow on X and LinkedIn: @NoamRaydan.
If you’d like to use any parts of my analysis, please cite me: Noam Raydan, author of THE CHOKEPOINT newsletter.
Until the next post, take care of yourself and be kind to those around you.