in-cyprus 24 October 2025 - by Stelios Marathovouniotis
A Cyprus-based company allegedly supplied Russian military intelligence with around $50 million worth of Western underwater surveillance technology, an investigation by German public broadcasters WDR, NDR and Süddeutsche Zeitung has revealed.
According to the report, Russian businesspeople used the Cyprus firm and other companies to acquire underwater observation equipment from the West for years. Documents show the goods were partly transported via indirect routes to Russia and used to build an Arctic surveillance system codenamed “Harmony”, designed to detect Western submarines and protect Russia’s strategically important nuclear arsenal in the Barents Sea.
The investigation drew on company data from recent years obtained by the International Consortium of Investigative Journalists. Journalists from Le Monde, L’Espresso, ICIJ, Kyodo, NRK, Pointer, SVT, The Times, Washington Post, NDR, WDR and Süddeutsche Zeitung participated.
Russia suspected of using Estonia wreck for NATO espionage
The same Russian underwater espionage unit suspected of using the Cyprus network is now believed to operate in the Baltic Sea, including at the wreck of the MS Estonia ferry. NATO intelligence suggests Russia positioned navigation devices and sensors at the 1994 disaster site to spy on alliance warships and submarines.
The MS Estonia sank during a storm on 28 September 1994 whilst travelling from Tallinn to Stockholm, killing 852 people in Europe’s worst post-war maritime disaster. The wreck lies about 35 kilometres southeast of the Finnish island of Utö at a depth of around 80 metres and is officially designated as a grave site. Sweden, Estonia and Finland signed an agreement in 1995 banning dives around the wreck.
According to the report, several NATO member states possess information indicating that technical devices were positioned at the wreck in recent years, enabling high-precision navigation of underwater drones and robots, according to the investigation. Western security sources told the German media they believe Russian military units have practised operations there.
There is also suspicion that Russia uses the exclusion zone to hide military sensors recording so-called signatures of NATO warships and submarines—their specific propeller sounds and other characteristics.
Multiple military representatives said the wreck’s position between Sweden, Finland and the Baltic states is ideal for covertly collecting such information due to shipping routes. Russia can operate undisturbed because of the official dive ban, whilst equipment mounted on the wreck is less conspicuous than on the sandy Baltic seabed and can be firmly attached.
Estonia and Finland confirm monitoring Russian activities
Estonia’s Foreign Ministry said it closely monitors Baltic Sea developments with allies, noting Russia has become more aggressive since launching its war against Ukraine. Finland’s border guard said it does not publish details of possible surveillance measures for operational reasons.
Finland has comprehensive understanding of Russian intelligence activities on its territory, the agency added. Between 2021 and 2024, special protection for the wreck was suspended to allow investigation of new evidence regarding the Estonia’s sinking.
Secret GUGI unit conducts worldwide operations
Russia’s Main Directorate for Deep Sea Research, known by its Russian acronym GUGI, is responsible for underwater espionage operations. The classified unit has existed since the 1960s and reports directly to Russia’s Defence Ministry rather than the navy.
GUGI’s tasks include underwater espionage and sabotage, such as surveying critical infrastructure like undersea cables and pipelines. The unit operates a fleet of ships officially designated as research vessels, equipped with mini-submarines, diving robots, and powerful sonar and scanners.
The fleet includes the Yantar, which has appeared frequently over underwater infrastructure in the North and Baltic seas in recent years. NATO considers it one of Russia’s most important spy ships.
GUGI records specific sounds from adversary ships, particularly submarines, by covertly deploying sensor systems like hydrophones in regions where vessels are expected. NATO believes Russia uses not only alleged research ships like the Yantar for positioning such espionage technology, but also submarines, civilian vessels like fishing boats or cargo ships, and increasingly unmanned underwater drones.
Western technology builds “Harmony” surveillance system
The Harmony system is an extensively developed underwater warning system in Russian waters. Western security sources told the German media they consider it certain that Russia has installed similar, though less comprehensive, surveillance systems elsewhere in the world’s oceans, possibly including at the Estonia wreck.
Security sources told NDR, WDR and SZ that underwater sensors were discovered in the Baltic Sea years ago. There are indications that not only individual devices but entire systems with sensors and control points have been installed in the Baltic as well as the Barents Sea.
Sensors discovered across multiple countries
Lithuania officially reported in early 2024 finding a Russian-type hydroacoustic sonar in the Curonian Spit and published a photograph of the apparently non-functional device. Lithuanian reports stated similar discoveries occurred in Lithuania, Britain and Ireland in previous years. The investigation found Latvia also made such a discovery.
Only Ireland’s military responded to enquiries, stating it does not comment on current maritime operations for operational reasons. Britain’s Sunday Times reported months ago on allegedly Russian spy sensors discovered off British coasts, citing security sources.
Experts told the German media they believe such sensors are installed in German waters and may have already been found. A German Defence Ministry spokesman said only generally that Germany monitors underwater activities “potentially directed against maritime critical infrastructure or serving espionage purposes”. Detailed responses were declined as they would “allow conclusions about our capabilities in underwater reconnaissance, location and detection”, the spokesman said.
Cyprus as a ‘surveillance technology hub’
The latest revelations add to evidence of Cyprus’s role as a European hub for the global surveillance technology industry.
The European Parliament’s PEGA committee accused Cyprus in 2022 of being “an important European export hub for the surveillance industry,” with MEP Sophie in ‘t Veld stating that “on paper there is a strong legal framework regulating the matter, which includes EU rules, but in practice Cyprus is an attractive place for companies selling surveillance technologies.”
The PEGA committee concluded that “in practice it would seem that rules are easy to circumvent and there are close ties between politics, the security agencies and the surveillance industry. It seems to be the lax application of the rules that makes Cyprus such an attractive place for the trade in spyware.”
In May 2023, the European Parliament called on Cyprus to “thoroughly assess all export licences issued for spyware and repeal them where appropriate” after PEGA’s investigation found “contraventions and maladministration in the implementation of Union law are likely to have taken place in Cyprus.”
NSO Group and Pegasus spyware
Israeli spyware firm NSO Group, maker of the Pegasus surveillance software, said in a June 2021 report that its products were “closely regulated by export control authorities in the countries from which we export our products: Israel, Bulgaria and Cyprus”.
NSO Group “acquired its exporting licences from Cyprus and Bulgaria, and had set up subsidiaries in the two EU countries to sell its products.” The NSO group’s Pegasus spyware “had been implicated in the targeting and killing of Saudi Arabian journalist Jamal Khashoggi in 2018.”
However, the Cypriot government told the PEGA committee that “NSO Group does not appear to be a registered legal entity in Cyprus or to hold shares in any legal entity registered in Cyprus,” though it acknowledged identifying six Cyprus companies established or bought by NSO board members.
The WiSpear “spy van” scandal
Cyprus faced international scrutiny in 2019 when police seized a $9 million “spy van” owned by WiSpear, a Cyprus-registered company run by former Israeli intelligence officer Tal Dilian. The van was equipped with technology that could monitor electronic devices within a 500-metre radius, hack any phone and listen in on conversations regardless of encryption.
In November 2021, Cyprus’s personal data commissioner fined WiSpear €925,000 for violations after determining the company’s activities “resulted in the collection of Mac Address and IMSI data from various handsets as part of tests and presentations it had been carrying out without the users knowing.”
The PEGA committee noted “a possible link between the ‘spy van’ affair and Greece,” as the company which created surveillance software used in Greece “was established by the former Israeli spy Tal Dilian, the main suspect in the Cyprus ‘black van’ case.”
The PEGA report added that “Cyprus is also of considerable strategic interest to Russia, Turkey and the US. Furthermore, close relations with Israel seem to be of particular mutual benefit with regard to the trade in spyware. Export licences for spyware have become a currency in diplomatic relations.”
