Gulf of Aden: pirates took a sanctioned tanker running dark
Six armed men boarded the product tanker Sibu 1 in the Gulf of Aden and turned her toward the Somali coast. Regional maritime authorities assess them as Somali pirates and the motive as ransom.
She is under United States sanctions, designated in December 2025 as part of the shadow fleet moving Iranian petroleum. She was the thirteenth vessel attacked off Somalia or in the Gulf of Aden this year, against five in all of 2025, and the sixth hijacked since April.
↓ Download one-page brief (PDF)15 to 19 August - into the high risk area
Tracking data shows the tanker changing her declared destination to Port Sudan on 15 August and entering the Somalia high risk area at 17:18 UTC on 19 August, making west-south-west at about nine knots.
20 August - the boarding
Six armed individuals board the tanker about 136 nautical miles east of al-Mukalla, Yemen, and take control.
A distress message on the ship's own transponder
Her automatic identification system broadcasts a message stating that a pirate is on board and requesting help, before the vessel alters course. The alarm came from the ship's own reporting equipment, which is worth noting given that vessels in the sanctioned trade often run silent.
Diverted toward Puntland
The tanker is turned toward Somalia's Puntland coast, which is the pattern of a ransom hijacking rather than a theft of cargo.
The sixth since April
She is the sixth commercial vessel hijacked by Somali pirates since 21 April, three days after eight armed men seized the Lutuf near Mareeyo, and at least the thirteenth vessel attacked in the region this year against five in all of 2025.
The last time
Somali piracy produced more than a thousand attacks and roughly four hundred million dollars in ransoms before international naval patrols, armed guards and industry practice suppressed it to near zero by 2013.
Naval attention elsewhere
Warships that once patrolled this corridor have been drawn to the Red Sea and to the approaches to Hormuz. Piracy has resurged markedly since around April 2026.
Ships that do not want to be seen
Tankers moving sanctioned petroleum commonly disable transponders, falsify positions and avoid reporting schemes. That makes them harder for enforcement to track and equally harder for a navy to protect or even to know is there.
The other threat in the same water
The Tihamah was struck by missiles at the Bab el-Mandeb and the rescue was attacked, with six killed. Two entirely different threats, one corridor, within nine days.
A seafarer transiting this water now faces a state-aligned missile campaign, a resurgent criminal hijacking economy, and an employer who may have chosen to travel dark. None of those three risks is within the crew's control and the third one actively removes the protections against the other two.
The sanctioned trade puts a vessel outside the arrangements that protect shipping
This tanker was broadcasting and sent a distress message, so she was not silent at the moment of attack. The wider point stands nonetheless: vessels in the sanctioned petroleum trade avoid naval reporting schemes, change declared destinations and keep away from official contact, because the same authorities who would protect them are the ones enforcing the sanctions against them. An owner who has organised a ship to be difficult for governments to track has also made it difficult for a warship to find in a hurry.
The resurgence is enabled by where the warships went
Piracy in this corridor was suppressed by sustained naval presence, and that presence has been drawn to the Red Sea and the approaches to Hormuz by a different threat. The capability to suppress piracy did not disappear; it was reallocated, and the criminal economy has responded to the gap within months.
Two unrelated threats now share one corridor, which compounds rather than adds
Missile attacks on shipping and armed hijacking for ransom have different actors, motives and countermeasures. Armed guards deter boarders and do nothing against an anti-ship missile; rerouting away from one may run into the other. An operator cannot mitigate both with a single decision, and the crews absorb the residual.
A sanctioned Iranian-linked cargo in pirate hands is an untested situation
The vessel and its cargo sit inside a sanctions regime, which complicates who may lawfully pay a ransom, negotiate, or recover the ship. It is a realistic possibility that this produces a slower resolution than a conventional hijacking, and the crew bear that delay.
Further hijackings are highly likely
The method is proven, the enablers are in place, five vessels are reportedly already held and the naval imbalance shows no sign of correcting. It is highly likely that further hijackings occur in the Gulf of Aden and off Somalia, and likely that poorly reported and unescorted vessels remain the preferred targets.
Set this beside the Tihamah nine days earlier and a few hundred miles west, where a small cargo ship was hit by ballistic missiles and the rescue was then attacked. One corridor, two campaigns, and in both cases the people paying are third-country crews on vessels whose ownership and trade they had no part in choosing.
- Understand what your reporting posture costs you. A vessel that avoids reporting schemes to stay unobserved is also unobserved by the people who would come to help. That trade is a commercial decision with a crew-safety consequence.
- Reinstate hardening measures that lapsed. Citadels, razor wire, freeboard measures and watchkeeping practice were developed for exactly this threat and were quietly relaxed after 2013. They work, and they are cheap relative to a hijacking.
- Plan for a hijacking as a long event. Ransom cases run for months. Owners need crisis management, family liaison and legal advice arranged in advance, particularly where sanctions complicate payment.
- Do not treat rerouting as mitigation without checking what you are routing into. The Gulf of Aden now carries piracy and missile attack simultaneously, with different geography and different countermeasures.
- Know the nationality mix of your crews and the consular consequences. Reporting indicates 22 Indian nationals among those taken in the current spate. Crew nationality determines which governments become involved and how quickly.
- Watch naval disposition as a leading indicator. Piracy returned to this corridor as warships left it. Where escorts and patrols concentrate is a usable predictor of where criminal maritime activity will grow next.
- https://gcaptain.com/sanctioned-shadow-fleet-tanker-hijacked-in-gulf-of-aden-and-diverted-toward-somalia/
- https://abcnews.com/International/wireStory/somali-pirates-hijack-oil-tanker-off-yemen-latest-135860915
- https://www.hiiraan.com/security4/2026/Aug/206052/iranlinked_oil_tanker_falls_victim_to_somali_piracy_surge_.aspx
- https://www.jpost.com/international/article-906216
Compiled from open-source reporting for professional security discussion. The identification of the attackers as Somali pirates is an assessment by regional maritime authorities and no group has been named. Sources differ on the exact date of the hijacking. The number of vessels currently held and the nationalities of the crews taken are as reported and have not been independently confirmed. The vessel's sanctions designation and its identification as part of Iran's shadow fleet derive from the United States Treasury listing of December 2025 as reported. Details may be revised. This is a protective-security lessons-learned assessment, not an operational account.