Information began to leak out in the early days of the conflict in Ukraine revealing that a shadowy company named Nord Axis had grown into a major player in the international trading of Russian oil.

It looked like the business had materialized out of thin air. Nine days prior to Russia’s invasion, it had been incorporated in Hong Kong. A Belizean candidate director later that year admitted ignorance about the origins and ownership of Nord Axis.

Nord Axis and a number of other unknown companies were salvaging Russia’s most vital business as Western consumers of oil withdrew, finding new markets for the commodity and funneling billions of euros into President Vladimir Putin’s war effort.

The West, led by the United States, sought to cut off Russia’s oil revenue. However, who was orchestrating the deals?

According to those who have dealt with or worked with Etibar Eyyub, a relatively unknown Azerbaijani merchant, the solution is a covert shipping and trading enterprise that today transports huge amounts of oil to customers in China, India, and other emerging countries. Those in the know say that he repurposed a number of old tankers and used a web of offshore entities based in Hong Kong and Dubai to conceal his trade activities.

According to trade data from the Kyiv School of Economics, at least $33 billion worth of Russian crude and petroleum was exported by Nord Axis and four other firms that those individuals claim are operated by Eyyub in 2023. This accounted for one-fifth of Russia’s total exports. According to those sources, Eyyub was also the boss of other companies active in the Russian market.

Following the invasion, Russia’s massive state oil producer Rosneft Oil began to rely on shipping and trade companies whose ownership and management were shrouded in mystery in order to get its crude oil to markets.

Senior Justice Department officials warned that regimes frequently use shell firms and obscure management structures to evade U.S. sanctions. Because of these methods, it is nearly impossible to determine who is coordinating oil shipments from sanctioned nations like Russia.

Interviews with current and former coworkers, energy and shipping executives who have dealt with or competed with Eyyub, and employees of the companies he allegedly runs provide the basis for this account of how the clandestine trading operation helped Russia evade Western attempts to drain its oil revenues. Additionally, the Wall Street Journal examined Russian export statistics, shipping data, and corporate and legal records in twelve nations. These firms were alleged to be part of the trade network, and the documentation describing their transactions and shipments were scrutinized.

The operation seems to revolve around subterfuge. Traders based out of Moscow and Dubai redirected funds via Nord Axis and the other entities, making it hard to pin down exactly who benefited. Based on information from senior oil executives in the Middle East, Eyyub flies privately to and from Moscow.

Eyyub once worked for Coral Energy, a commodities dealer based in the UAE. U.S. officials are following the trade and have asked whether any of its workers are involved. Even while many Western corporations have vowed not to purchase or finance Russian oil, Coral is still doing business in these regions.

Coral ceased all business relations with Eyyub in early 2022 upon its decision to withdraw from the Russian market, according to a Coral spokeswoman. The company also denied any affiliation with Nord Axis and other companies linked to Eyyub.

However, as a result of the fact that certain individuals worked for both Coral and the trading of Russian oil, current and former employees of Coral referred to both companies as “satellites” of Coral in interviews. Coral is a shorthand for Eyyub’s network of enterprises, according to Rosneft officials.

Those in the know have indicated that Eyyub, Coral, and Tahir Garayev, the creator of Coral, are the targets of a wide-ranging inquiry by the Justice Department investigating possible breaches of sanctions on Russian oil.

Also hailing from Azerbaijan, Garayev established Coral Energy in Singapore in 2010. A current official at Coral said that the Azerbaijani national oil firm was seeking merchants to locate consumers for its oil on a worldwide scale during that period.

Eyyub was employed by Garayev in 2014. The oil market was foreign to Eyyub, but he quickly became knowledgeable. Eyyub, who was second-in-command under Garayev and was characterized by former colleagues as a hard-charging dealmaker, set up Coral’s operations in Russia.

Eyyub is shown wearing a black turtleneck and rimless spectacles in a Facebook snapshot. Someone who has done business with him indicated that he informed associates that he wanted to be on Forbes’ list of billionaires.

After leaving Coral in 2018 to pursue a career as a trading consultant, he kept working with them on a commission basis. A representative from Coral stated that the firm “engaged him on specific projects” following Eyyub’s departure till the beginning of 2022.

According to export data, the executive, and U.K. court records, Coral was trading petroleum from Rosneft and smaller private enterprises by the time Russia invaded Ukraine in February 2022.

When compared to the Western traders who controlled the Russian market, Coral was a minor player. Rosneft relied on those dealers to source customers, secure financing, and coordinate shipments. Its most important outlet to the world was Switzerland’s Trafigura Group.

The West imposed a deluge of sanctions on Russia after its invasion of Ukraine. In March 2022, the U.S. banned imports of Russian oil and the European Union took steps to restrict dealings with Rosneft.

Suddenly, Western banks were afraid to touch anything Russian, and many oil middlemen abandoned Russia. Trafigura wound down its relationship with Rosneft. Continuing to do business with Russia’s state producer would have endangered its business with many other nations and its relationships with Western banks.

Russia’s oil and fuel exports—which accounted for almost one-tenth of the world’s petroleum—started to seize up. Without the middlemen and fearful of sanctions, refiners would buy Russian oil only at big discounts, threatening Moscow’s budget.

Rosneft asked Coral to take Trafigura’s place, people familiar with the request said. Trafigura had dealt with Coral before and Eyyub understood the Russian supply system, according to people familiar with those trading relationships.

“We consider it inappropriate and moreover useless to comment on the variety of rumors and speculations presented by you,” a Rosneft spokesperson said in response to questions from the Journal.

The Coral spokeswoman said the company, “from the very first day of the war,” clearly expressed its intention to withdraw from the Russian market.

Coral didn’t want to imperil its ability to borrow from Western banks. So, like its bigger rivals, it said it would stop trading with Rosneft, in May, and would wind down its entire Russian oil business. Regulatory and logistical uncertainties also played a part in the decision, the Coral spokesperson said.

In July 2022, Trafigura announced that Nord Axis had purchased its 10% stake in Russia’s flagship oil-exploration project in the Arctic, called Vostok Oil. Eyyub and Garayev put together the purchase with Igor Sechin, a Putin confidante who leads Rosneft, said people familiar with the arrangement. Shipping and export data show Nord Axis began exporting large amounts of Rosneft’s petroleum.

A Trafigura spokeswoman said Nord Axis was an independent company. She said Trafigura’s due diligence determined that neither Nord Axis nor its beneficial owners were the target of any sanctions restrictions in effect at the time of the purchase.

Nord Axis’s public filings in Hong Kong, where it is registered, don’t mention Eyyub or Garayev. They show the firm was owned by a holding company in the U.A.E. with unnamed shareholders. The filings indicate those shareholders had bought Nord Axis from another Azeri trader, a month before Nord Axis purchased the Vostok shares. At the time, that trader also served as a Coral representative in Turkey, according to messages, meeting minutes and internal company documents reviewed by the Journal. Coral said the trader had acted as the company’s agent on “a few transactions,” but that he wasn’t an employee.

A Nord Axis spokesperson said the company worked directly with Trafigura on the Vostok purchase, and that Nord Axis isn’t related to either Eyyub or Garayev.

The Journal attempted for more than two weeks to send Garayev questions via Coral’s spokeswoman and a cellphone number confirmed by a Coral executive. Both Coral and the executive said they had informed Garayev that the Journal wished to contact him. Later, a person who purported to represent Garayev but didn’t provide a name or phone number emailed the Journal inviting questions. That person didn’t respond to the questions or a subsequent email.

The Coral spokesperson said Garayev had no involvement, direct or indirect, with the transaction, and that he has no relation to Nord Axis or any of the other entities trading Russian oil. Eyyub is no longer involved in Coral’s business, she said, so the company couldn’t comment on his activities.

She said Garayev hasn’t been involved in Coral management for more than a year. “Any efforts to directly or indirectly try to tie Mr. Garayev to Coral Energy is not reflective of the facts,” said the spokeswoman, who described Garayev as a “passive minority investor.”

Both Coral Energy and Garayev, she said, “unequivocally condemn the invasion of Ukraine and fully support and adhere to all applicable sanctions.”

By the summer of 2022, new oil revenue was pouring into Russia from Asian buyers who hadn’t taken sides in the war. Chinese, Indian and Turkish refineries bought most of the barrels.

But a new danger loomed: The U.S., in concert with the rest of the G-7 nations, was preparing sanctions that would attempt to cap the price of Russian oil. The idea was to keep Russian oil flowing to world markets to keep energy prices low, while crimping how much Moscow could earn.

The planned sanctions would allow Russia to continue using Western oil tankers and insurance companies, but only if it sold oil at or below $60 a barrel, substantially below benchmark prices. To sell crude at prices above $60 a barrel, Russia would need to build its own fleet.

Companies operated by Eyyub snapped up tankers, said people familiar with the activities of those firms and executives who sold the boats. European and Asian shipowners said those companies offered them generous prices for 25-year-old tankers destined for scrap.

Using both purchases and charters, firms run by Eyyub assembled more than 80 ships, one of the world’s largest fleets, said some of the people familiar with the deals. Brokers said more than $1 billion was spent to put it together.

The vessels joined what the industry calls the shadow fleet—hundreds of tankers with unclear ownership that move petroleum from sanctioned producers, often traveling without tracking transponders.

The Western imposed price cap on Russian crude took effect on Dec. 5, 2022.

Companies said to be operated by Eyyub were busy trying to sidestep the measure. In late 2022, people executing trades for those firms in Moscow discussed ways to hide sales of oil above the cap, said someone who worked for Coral at the time and another person familiar with the matter. They worked from an office that was registered to a company whose director was a senior Coral executive at the time, corporate records show.

Managers told people working in that office to remove mention of Coral from LinkedIn, those people said. When people in the office used their Coral email accounts, they were not supposed to mention Rosneft. The Nord Axis and Bellatrix Energy email addresses they used to communicate with Rosneft didn’t include their full names, the person who worked for Coral said.

The Coral spokeswoman said it was “baseless and untrue” to say that anyone working for Coral had discussed ways to skirt sanctions. “Coral Energy was no longer engaged in trading Russian oil after the price cap was implemented,” she said.

She said the company registered at the Moscow office had provided services to Coral. Coral wound that firm down when it left Russia, she said, and Moscow-based Coral employees were told to update their social-media profiles to reflect that withdrawal.

Garayev sold 60% of the Coral shares that he owned to company managers at the start of 2023 and hasn’t played any part in running the company since then, the spokeswoman said.

In a sign that the makeshift trading network was working, Russian petroleum sales exceeded $180 billion last year, according to the International Energy Agency. That was down from more than $230 billion in 2022, when the invasion led to high oil prices, but only $5 billion below revenues from 2021, before the war. Russian oil prices have risen relative to the global benchmark for crude.

Nord Axis’s contracts in Russia ended last July, said Murat Sayin, a lawyer in Turkey who was the director of Nord Axis at the time. But the oil kept flowing through different companies. Eyyub, through Voliton, Guron Trading, Pontus Trading and other vehicles, emerged as Rosneft’s premier middleman, said people familiar with the Russian company’s exports. A Pontus spokesperson said the firm had no affiliation to Eyyub.

One sign of Eyyub’s deepening relationship with Moscow: He has accompanied Sechin to meetings with foreign counterparts in Qatar, and the two men spent time together at a hunting lodge in Tula, south of the Russian capital, said people familiar with the men’s activities.

Garayev held meetings with Rosneft officials in Moscow in late 2023, said people familiar with the matter. The Coral spokeswoman said the company no longer had any knowledge of Garayev’s activities.

U.S. authorities investigating the trading network believe it is connected to Coral, said people familiar with the matter. Neither Eyyub nor Garayev has been sanctioned by the U.S. Coral’s spokeswoman said the company hasn’t received any queries from U.S. officials.

In December, the Treasury Department sanctioned Bellatrix and Voliton, two of the firms. Activity immediately began to shift to different firms that Eyyub operates, some of the people familiar with their activities said.