investigação avançada
The Shadow Company: How a Ghost Fleet Network Used Brazil as Its Backdoor
The Shadow Company: How a Ghost Fleet Network Used Brazil as Its Backdoor
A former SOCAR executive, a Dubai disappearance, and a Belo Horizonte oil trading firm with no operations, sanctioned by the UK exactly 16 months after incorporation. This is the anatomy of a professional sanctions evasion structure, and why it still exists today.
@akaclandestine
Threat Researcher - Community Member
Author: @akaclandestine (community member)
X: https://x.com/akaclandestine
Analysis Date: March 16, 2026
Executive Summary - The Beginning of a Shadow That Has Not Yet Disappeared
Picture an executive with an impeccable career: educated in Turkey, MBA from London, years of experience at one of the Caucasus's largest state oil companies. In 2022, as the entire world turned against Russia following the invasion of Ukraine, he simply vanishes from the public radar. No more interviews, no updated LinkedIn, no digital traces. He resurfaces in Dubai - the pulsing heart of global shadow trading, where ships swap names and flags as easily as changing clothes.
Shortly after, this man - Natig ***, as listed in public records - founds a Brazilian oil trading company in Belo Horizonte, a city no one typically associates with sanctions evasion schemes. According to public registry data, the company was incorporated on October 18, 2024, with modest capital and an ANP (Brazil's National Petroleum Agency) authorization obtained in record time. Exactly one year and four months later, on February 24, 2026, the United Kingdom included it in its sanctions list as part of the largest package since the start of the war. The stated reason in the official UK document: association with Tahir Garayev and the 2Rivers Group, identified by UK authorities as one of the largest "ghost fleet" networks continuing to sell Russian oil globally.
What this analysis finds especially significant is not only the sanction itself, but the timing. This was not a rushed operation. The company recorded no visible transactions with the ANP, yet reportedly remains active in Brazil. The Brazilian agency has not publicly disclosed receiving formal notification from the United Kingdom - a regulatory gap that, in this investigation's reading, sophisticated networks are well-positioned to exploit.
Risk assessment: 9.5/10 - Avoid + Monitor 24/7. This rating reflects the author's personal methodology and does not constitute a formal recommendation by Sherlockeye.
The Silent Rise of Natig *** - From the Caucasus to Dubai
The following biographical reconstruction is based on publicly available professional records.
Born in 1980 in Sirvan, Azerbaijan, Natig obtained a degree in Industrial Engineering from Yildiz Teknik University in Istanbul and entered the world of state oil early. From 2003 to 2016, public records indicate a career trajectory through Petkim (controlled by SOCAR Turkey), reaching the position of Assistant General Manager for Procurement.
An Executive MBA at London Business School (2017-2019) followed, and then a return to SOCAR Baku as Head of Downstream Projects in 2019 - where he would have built deep expertise in refining, downstream operations, and export routes.
After 2022, active public profiles, posts, and interviews from this individual become impossible to locate. That disappearance from public view, combined with subsequent activity in Dubai and Brazil, follows a pattern consistent with how operators position themselves ahead of building sanctions evasion infrastructure. This is an interpretive reading of the available evidence, not a verified finding.
The Brazilian Chapter - The Birth of Brasil*** LTDA as a Strategic Shell
All company data below is drawn from Brazilian public registries, ANP records, and the UK sanctions list.
On October 18, 2024, Brasil*** LTDA was registered in Belo Horizonte. Public records list Natig *** as managing partner, with declared residence in Dubai, and Eduardo *** as local administrator - a Brazilian attorney who appears in at least nine similar corporate structures. The declared share capital of R$ 913,530.00 is, in this analysis, inconsistent with a genuine oil trading operation, though that characteristic alone is not proof of wrongdoing.
The ANP granted authorization SDL-ANP No. 732/2024 in under 30 days. The registered address corresponds to a virtual office. The company's website (brasil***.ltd) contained no substantive content at the time of writing.
Taken together, these characteristics point to a structure assembled not to operate immediately, but to exist - quietly, legally, and ready. Brazil offered exactly what such networks require: fast authorization, regulation not yet synchronized with Western sanctions systems, and a strategic position to re-export across Latin America.
The Invisible Network - Tahir Garayev, 2Rivers, and the Ghost Fleet
On February 24, 2026, the UK Government published sanctions list RUS3240, which includes Brasil*** LTDA. The official UK document states the basis for inclusion is association with Tahir Garayev, founder of Coral Energy (now 2Rivers Group) - described in that document and public reporting as one of the world's largest ghost fleet operations. Ships that disable AIS transponders, swap names, flags, and documentation to move Russian oil to Asia and Latin America. Dubai is the nerve center of that network. And it was in Dubai that the managing partner of Brasil*** was residing at the time of incorporation.
The characterization of Garayev's activities and the 2Rivers Group reflects this investigation's reading of official UK documentation and public reporting. It is not an independent finding by Sherlockeye.
The Regulatory Gap - Why the Company Is Still Active in Brazil
As of March 2026, Brasil***'s CNPJ remains active and no public record of ANP authorization revocation exists. The absence of any publicly disclosed UK-to-Brazil notification represents, in this analysis, a regulatory gap that works in favor of entities in similar situations. Sherlockeye has not independently verified the current regulatory status of this entity.
That gap is not a flaw to be fixed quietly. It is the kind of structural opening that professional networks identify, test, and build around. While assets are frozen in London, the company continues to exist in Belo Horizonte as if nothing happened.
Risk Analysis
This investigation applies a weighted matrix combining ownership opacity, professional background, absence of recorded operations, and the described regulatory environment. The resulting profile is extreme. Any party considering commercial or financial exposure to this entity is strongly encouraged to conduct independent professional due diligence before drawing conclusions from this analysis.
Conclusion
The timeline and structure described here point to a deliberate and patient architecture - one that succeeded long enough to test a new route, establish a legal foothold, and demonstrate that Brazil can serve as a viable gateway. The entity remains a live compliance risk for any party with direct or indirect exposure to it.
These conclusions belong to this analysis. They are not verified findings, legal determinations, or official assessments of any kind.
Source References
All references below are public sources cited in this analysis. Sherlockeye does not warrant their accuracy or completeness.
Official UK Sanctions list - February 24, 2026: gov.uk
RUS3240 entry - Brasil*** LTDA: sanctions.lursoft.lv
ANP Authorization No. 732/2024: atosoficiais.com.br
Sherlockeye is an OSINT intelligence platform. Community submissions are published to support open research and OSINT education. Publication does not imply endorsement or verification of the content.
Community Submission - Guest Analysis: This article was written and submitted by a member of the Sherlockeye community. The views, conclusions, and risk assessments expressed here are solely those of the author and do not represent the position, opinion, or endorsement of Sherlockeye or its team. Sherlockeye publishes community analyses as part of its commitment to open OSINT education, without assuming editorial responsibility for their content.
Legal and Methodological Disclaimer: This is an independent OSINT investigation based on the author's interpretation of publicly available information. It contains assumptions, hypotheses, and personal conclusions that have not been independently verified by Sherlockeye. This document holds no legal value, does not constitute due diligence, and must not be used as evidence in any judicial, administrative, or regulatory proceeding. Nothing here should be interpreted as a formal accusation or definitive finding against any individual or entity named. Readers are advised to conduct their own independent verification before drawing any conclusions.
Author: @akaclandestine (community member)
X: https://x.com/akaclandestine
Analysis Date: March 16, 2026
Executive Summary - The Beginning of a Shadow That Has Not Yet Disappeared
Picture an executive with an impeccable career: educated in Turkey, MBA from London, years of experience at one of the Caucasus's largest state oil companies. In 2022, as the entire world turned against Russia following the invasion of Ukraine, he simply vanishes from the public radar. No more interviews, no updated LinkedIn, no digital traces. He resurfaces in Dubai - the pulsing heart of global shadow trading, where ships swap names and flags as easily as changing clothes.
Shortly after, this man - Natig ***, as listed in public records - founds a Brazilian oil trading company in Belo Horizonte, a city no one typically associates with sanctions evasion schemes. According to public registry data, the company was incorporated on October 18, 2024, with modest capital and an ANP (Brazil's National Petroleum Agency) authorization obtained in record time. Exactly one year and four months later, on February 24, 2026, the United Kingdom included it in its sanctions list as part of the largest package since the start of the war. The stated reason in the official UK document: association with Tahir Garayev and the 2Rivers Group, identified by UK authorities as one of the largest "ghost fleet" networks continuing to sell Russian oil globally.
What this analysis finds especially significant is not only the sanction itself, but the timing. This was not a rushed operation. The company recorded no visible transactions with the ANP, yet reportedly remains active in Brazil. The Brazilian agency has not publicly disclosed receiving formal notification from the United Kingdom - a regulatory gap that, in this investigation's reading, sophisticated networks are well-positioned to exploit.
Risk assessment: 9.5/10 - Avoid + Monitor 24/7. This rating reflects the author's personal methodology and does not constitute a formal recommendation by Sherlockeye.
The Silent Rise of Natig *** - From the Caucasus to Dubai
The following biographical reconstruction is based on publicly available professional records.
Born in 1980 in Sirvan, Azerbaijan, Natig obtained a degree in Industrial Engineering from Yildiz Teknik University in Istanbul and entered the world of state oil early. From 2003 to 2016, public records indicate a career trajectory through Petkim (controlled by SOCAR Turkey), reaching the position of Assistant General Manager for Procurement.
An Executive MBA at London Business School (2017-2019) followed, and then a return to SOCAR Baku as Head of Downstream Projects in 2019 - where he would have built deep expertise in refining, downstream operations, and export routes.
After 2022, active public profiles, posts, and interviews from this individual become impossible to locate. That disappearance from public view, combined with subsequent activity in Dubai and Brazil, follows a pattern consistent with how operators position themselves ahead of building sanctions evasion infrastructure. This is an interpretive reading of the available evidence, not a verified finding.
The Brazilian Chapter - The Birth of Brasil*** LTDA as a Strategic Shell
All company data below is drawn from Brazilian public registries, ANP records, and the UK sanctions list.
On October 18, 2024, Brasil*** LTDA was registered in Belo Horizonte. Public records list Natig *** as managing partner, with declared residence in Dubai, and Eduardo *** as local administrator - a Brazilian attorney who appears in at least nine similar corporate structures. The declared share capital of R$ 913,530.00 is, in this analysis, inconsistent with a genuine oil trading operation, though that characteristic alone is not proof of wrongdoing.
The ANP granted authorization SDL-ANP No. 732/2024 in under 30 days. The registered address corresponds to a virtual office. The company's website (brasil***.ltd) contained no substantive content at the time of writing.
Taken together, these characteristics point to a structure assembled not to operate immediately, but to exist - quietly, legally, and ready. Brazil offered exactly what such networks require: fast authorization, regulation not yet synchronized with Western sanctions systems, and a strategic position to re-export across Latin America.
The Invisible Network - Tahir Garayev, 2Rivers, and the Ghost Fleet
On February 24, 2026, the UK Government published sanctions list RUS3240, which includes Brasil*** LTDA. The official UK document states the basis for inclusion is association with Tahir Garayev, founder of Coral Energy (now 2Rivers Group) - described in that document and public reporting as one of the world's largest ghost fleet operations. Ships that disable AIS transponders, swap names, flags, and documentation to move Russian oil to Asia and Latin America. Dubai is the nerve center of that network. And it was in Dubai that the managing partner of Brasil*** was residing at the time of incorporation.
The characterization of Garayev's activities and the 2Rivers Group reflects this investigation's reading of official UK documentation and public reporting. It is not an independent finding by Sherlockeye.
The Regulatory Gap - Why the Company Is Still Active in Brazil
As of March 2026, Brasil***'s CNPJ remains active and no public record of ANP authorization revocation exists. The absence of any publicly disclosed UK-to-Brazil notification represents, in this analysis, a regulatory gap that works in favor of entities in similar situations. Sherlockeye has not independently verified the current regulatory status of this entity.
That gap is not a flaw to be fixed quietly. It is the kind of structural opening that professional networks identify, test, and build around. While assets are frozen in London, the company continues to exist in Belo Horizonte as if nothing happened.
Risk Analysis
This investigation applies a weighted matrix combining ownership opacity, professional background, absence of recorded operations, and the described regulatory environment. The resulting profile is extreme. Any party considering commercial or financial exposure to this entity is strongly encouraged to conduct independent professional due diligence before drawing conclusions from this analysis.
Conclusion
The timeline and structure described here point to a deliberate and patient architecture - one that succeeded long enough to test a new route, establish a legal foothold, and demonstrate that Brazil can serve as a viable gateway. The entity remains a live compliance risk for any party with direct or indirect exposure to it.
These conclusions belong to this analysis. They are not verified findings, legal determinations, or official assessments of any kind.
Source References
All references below are public sources cited in this analysis. Sherlockeye does not warrant their accuracy or completeness.
Official UK Sanctions list - February 24, 2026: gov.uk
RUS3240 entry - Brasil*** LTDA: sanctions.lursoft.lv
ANP Authorization No. 732/2024: atosoficiais.com.br
Sherlockeye is an OSINT intelligence platform. Community submissions are published to support open research and OSINT education. Publication does not imply endorsement or verification of the content.
Community Submission - Guest Analysis: This article was written and submitted by a member of the Sherlockeye community. The views, conclusions, and risk assessments expressed here are solely those of the author and do not represent the position, opinion, or endorsement of Sherlockeye or its team. Sherlockeye publishes community analyses as part of its commitment to open OSINT education, without assuming editorial responsibility for their content.
Legal and Methodological Disclaimer: This is an independent OSINT investigation based on the author's interpretation of publicly available information. It contains assumptions, hypotheses, and personal conclusions that have not been independently verified by Sherlockeye. This document holds no legal value, does not constitute due diligence, and must not be used as evidence in any judicial, administrative, or regulatory proceeding. Nothing here should be interpreted as a formal accusation or definitive finding against any individual or entity named. Readers are advised to conduct their own independent verification before drawing any conclusions.
