What did the ships near the Gulf's internet cables do?
Four vessels linked to Iran took unusual routes over undersea internet cables in the Gulf of Oman last month. The Financial Times reported the pattern on Friday, November 6, 2026. The report drew on tracking data from Windward, a maritime analytics company.
Windward's analysis covered October 5 to October 28. It found three US-sanctioned tankers and one Iranian fishing-support vessel near cable corridors off Oman and Iran. The vessels slowed, looped, turned back or switched off their tracking signals.
All four switched off their tracking systems at some point during the month, according to the FT. Ships broadcast Automatic Identification System data so ports and other vessels can see them. A gap in that signal does not by itself prove wrongdoing. It does make a vessel harder to follow.
Windward compared the tracks with normal traffic in the area. It said the movements differed from those of other ships using the same water.
No cable was cut. No damage has been reported by operators, governments or cable owners. The finding is a pattern of behaviour, not proof of an attack.
The most striking case was Celestial Sea, an Iran-flagged products tanker. On October 14 it drifted in a loop for 4.3 hours about 0.65 nautical miles from the 2Africa cable. The next day it went dark inside the 2Africa and Bay of Bengal Gateway corridors off Sohar.
It stayed dark for 86 hours. It reappeared on October 19 about nine nautical miles away. The tanker then made a U-turn over the Bay of Bengal Gateway and anchored off Shinas. It was in ballast, or empty, throughout.
Which vessels were involved?
Windward published detailed tracks for Celestial Sea and withheld the names of two other tankers. It described each vessel's cargo and ownership ties.
Celestial Sea has a long sanctions history. The US Treasury designated it in April 2025 under its former name, Harmony. Windward says the vessel used an Iranian call sign and an Iranian MMSI, and swapped identities with another tanker in August 2025.
Two other tankers had spent long periods dark before October. Windward says the gas carrier was dark for 877 hours in August and September, and changed its MMSI and call sign in May and June. The crude carrier is operated by the National Iranian Tanker Company, which the Treasury sanctioned in 2020 over funding for the IRGC Quds Force.
The gas carrier turned around ten hours after leaving port. It slowed below three knots for 42 minutes inside the 2Africa corridor. It then turned 180 degrees back toward Oman and went dark about two nautical miles from the AAE-1 cable.
Five days later it had not reappeared. Windward noted that a loaded ship with a buyer waiting has no cargo reason to do that.
The crude carrier stayed under one knot for about ten days. It sat within three nautical miles of four cable routes. It went dark repeatedly, including for 33 hours from October 17, and met another Iran-flagged vessel with no IMO number.
The fishing-support vessel was the odd one. It drifted at 0.1 to 0.5 knots along the Europe India Gateway and Transworld routes between October 21 and 24. It then crossed two more cables and sailed into Iranian waters. It has been dark since October 26.
- •Celestial Sea: Iran-flagged products tanker, sanctioned by the US Treasury in April 2025 under the name Harmony. US Marines boarded it in the Gulf of Oman in May.
- •Very large gas carrier: US-sanctioned, with a Panama-based owner, loaded with about 494,500 barrels of LPG. It left Shinas for Pasir Gudang in Malaysia on October 23.
- •Very large crude carrier: Iran-flagged and operated by the National Iranian Tanker Company. It loitered for about ten days between Jask and Chabahar.
- •Fishing-support vessel: 34 metres long, Iran-flagged, with a beneficial owner unknown since August 2025. It had not entered the area in two years of tracking.
How strong is the evidence that this was sabotage preparation?
Windward's conclusion is careful but pointed. The behaviour, it said, “fits the profile of mapping the cable routes, or of placing charges or mines on them while dark.”
The company based that view on timing, route geometry and cargo status. The moves began in the same weeks as a run of Iranian threats against Gulf cables and data centres.
Cargo logic does not explain the tracks. Two tankers were empty, so their time over the cables was not floating storage. The gas carrier had a cargo and a destination, yet it reversed course after slowing over 2Africa.
Other analysts are more cautious. Sidharth Kaushal, a naval warfare specialist at the Royal United Services Institute, told the Financial Times the movements could be coincidental. He added that Iran may be trying to show it can damage undersea infrastructure in a war.
Windward's own wording is conditional. It says the tracks fit a profile. It does not say a device was placed. That distinction matters because tracking data shows where a ship went, not what it did underwater.
The vessels were tracked using a mix of maritime positioning data and satellite imagery, according to Ynetnews. Even with both, the picture stops at the surface.
John Pentreath, a retired British rear admiral, said even ordinary commercial vessels could lay mines. “Pretty much any vessel can launch mines,” he told the FT. He added that such operations usually need rails or other modifications.
The public record still has gaps. The FT said Glory International FZ, which owns Celestial Sea, did not respond to a request for comment. Neither the FT report nor Windward's analysis includes an on-record government finding that the ships were preparing an attack.
What has Iran actually threatened?
Iranian officials have spent a month warning that digital infrastructure would be a target. On October 12, Mohsen Rezaei, secretary of the Supreme National Security Council, said: “Data centers and artificial intelligence facilities will be destroyed.”
The Guardian reported that Rezaei threatened oil facilities, undersea cables, data centres and AI sites across as many as seven Gulf countries. An adviser to Mohammad Ghalibaf, the hardliner who led Iran's negotiations with the US, described a strategy of “zero red lines.”
On October 19, IRGC spokesman Hossein Mohebbi addressed the cables directly. “Seven major undersea internet cables run through the Strait of Hormuz,” he said. He promised new targets and new weapons.
Two days later, IRGC political deputy Yadollah Javani said the cables would be hit in retaliation for attacks on Iranian infrastructure, according to Tasnim. On October 23, two senior Iranian security officials told Iran International that Tehran had detailed plans to target the cables and to hinder repairs. Reuters reported the same plan.
That last detail matters. A cut cable can be repaired. A cut cable that cannot be repaired stays down for much longer.
Iran has used civilian hulls for intelligence before. Windward notes that the IRISL cargo ships Saviz and Behshad served as IRGC platforms off Yemen, passing targeting data to the Houthis. On October 6, US forces destroyed an Iranian-linked dhow in the Gulf of Oman that CENTCOM said was watching American warships.
Those precedents do not prove the October movements were hostile. They do explain why unexplained loitering by Iranian-linked ships draws attention rather than a shrug.
The wider war is the backdrop. Iran has blocked the Strait of Hormuz since late February, according to Data Center Dynamics. Brent crude traded at $113.4 a barrel on October 22, a recent high, as the Guardian reported.
Which countries and companies depend on these cables?
The numbers depend on how you draw the map. TeleGeography counts six active cables under the Strait of Hormuz, according to Ynetnews. Three more are under construction: Fibre in Gulf, Sea-Me-We 6 and 2Africa.
The IRGC says seven. Windward counts seven systems in the Omani corridors where the tankers operated. Those systems are 2Africa, the Bay of Bengal Gateway, AAE-1, the Oman Australia Cable, the Europe India Gateway, Transworld and SeaMeWe-4.
The Batinah coast carries one of the densest concentrations of undersea cables in the region, according to Windward. That density is efficient in normal times. It also means one disruption can affect several routes at once.
Iraq, Kuwait, Bahrain and Qatar depend entirely on cables under the strait for international connectivity, according to TeleGeography data cited by the FT. Windward says the same corridor links Oman, the UAE, Saudi Arabia and Pakistan with India, Sri Lanka, Egypt and Europe.
Ownership is concentrated among telecom and technology firms. Windward lists Meta, Vodafone, Orange, AT&T, Verizon, BT, China Mobile, China Telecom, Reliance Jio, Omantel and e& among the cable owners.
The stakes are global, not only regional. The International Telecommunication Union says submarine cables carry about 99% of the world's internet traffic. It counted more than 500 active and planned systems in 2024 and about 200,000 km of new cable installed that year.
Cables also fail without sabotage. The ITU reports more than 170 cable repairs worldwide in 2025, almost four a week. Fishing and anchoring are the main causes, followed by earthquakes and underwater landslides.
Building a replacement is slow. The ITU says a system can take more than two years to go from design to operation.
Why does this matter for the Gulf's AI and data-centre plans?
Gulf governments are spending heavily on AI, cloud computing and data centres. Those projects assume reliable links to Europe, Asia and the United States.
Iran has already targeted digital infrastructure in the region. Data Center Dynamics reports that Iran has targeted Oracle and Amazon Web Services infrastructure. In April, the IRGC named 18 US technology companies in the Middle East as legitimate targets.
Cable work has already been disrupted. Meta paused work on a section of its 45,000 km 2Africa cable in March because of the war. Three planned Hormuz cables have been delayed.
Masha Kotkin, a fellow at the Center for Strategic and International Studies, told the FT that damage would slow financial transactions and disrupt cloud computing. She said Gulf states betting on digital business would feel it.
Ynet reported her warning that security threats have already suspended construction work on several cable projects. That turns a security problem into an investment problem.
Cloud and AI services are sensitive to latency as well as bandwidth. A break can force traffic onto longer routes, adding delay and cost. For an operator selling real-time services, that is a commercial problem, not just an outage.
For the companies that own the cables, the exposure is direct. They carry the traffic and fund repairs. Meta, for one, is both a cable owner and a large AI investor.
The region has some redundancy because several cables share the same seabed. That helps with a single break. It helps less if several breaks happen at once, or if repair ships cannot reach them.
What should we watch next?
Three of the four vessels were still dark when Windward published its report on October 29. Where and when they reappear will show whether the cable corridors were a destination or a stop on a longer voyage.
More loitering over the Batinah corridors, especially after new IRGC statements, would strengthen the pattern. A return to normal shipping would weaken it.
Official responses matter. So far, the public case rests on commercial tracking data and press reporting, not on a government attribution.
AIS data is also incomplete. Transponders can fail, be disabled or be spoofed. Windward's case is strongest where several indicators line up: the route, the timing, the cargo and the threats.
Cable owners also face a practical problem. Repairs require ships, permits and calm water. Iran's reported plan to hinder repairs turns a technical job into a strategic one.
The story is a reminder of how much of the internet sits on the seabed in a narrow, contested stretch of water. It is also a reminder that intention is hard to read from a track.
For now, the cables are working. The question is whether the ships were mapping them, threatening them, or whether the movements have an ordinary explanation.