The Kaliningrad Spoofer goes to Sea

Between June 13th and 15th, 2025, the intensity of GNSS spoofing in the Baltic — and, as we’ll see, the Kattegat — surged dramatically. This uptick didn’t go unnoticed: authorities issued alerts and advisories to mariners across the region.

The disruption is visible on monitoring platforms like gpsjam.org, though that site is increasingly saturated. Its detection is based on ADS-B reports from aircraft experiencing degraded navigational accuracy — a method that, while useful, has limitations.

Detecting Spoofing at Sea Level

Aircraft are especially sensitive to GNSS anomalies — but spoofing impacts more than just airspace. At ground and sea level, spoofed signals are physically constrained by the Earth’s curvature. Because GNSS (e.g., GPS L1 band at 1575.42 MHz) relies on line-of-sight transmission, the theoretical maximum range for spoofing is comparable to VHF radio — around 20–30 nautical miles. Practical range depends on transmit power, antenna height, and environmental conditions.

Because both ships and aircraft broadcast position data via AIS and ADS-B respectively, we can use AIS telemetry to triangulate spoofing events occurring at sea level.

While examining spoofing signatures, I noticed erratic, jagged AIS trails from vessels caught in spoofed zones — a hallmark described in community analyses. These strange tracks, often observed in Russia and near the Ukrainian front, are collectively referred to as ‘TOREC’ patterns by GNSS spoofing connoisseurs.

One of the most common spoofing footprints — the TOREC triangle — can be broken down further:

Spoofed locations hop between red and gray nodes, typically centered on the red point, but rotated randomly. Each node contains a distinct microstructure — sub-patterns such as loops or figure-eights.

These sub-patterns are likely scripted. Notably, the red node features a circular swoop, ending in a south-north line, while the gray nodes share a similar internal motion, but ending in a east-west line. Although AIS data doesn’t provide altitude, it’s plausible that spoofers simulate an elevation ramp (designed to force drones to land).

Some of these characteristics are present in many commercial off-the-shelf GNSS spoofing systems, such as the Crown JS1-7. These systems support external power amplification and can be fitted with directional antennas, extending their operational range considerably.

Most COTS GNSS spoofers can also be coupled with drone detectors, such that the navigation interference is limited during a drone incursion event.

Spoofing Reaches the Kattegat

Using AIS heatmaps from Kaliningrad, I defined geofences around all identifiable TOREC nodes. I then queried platforms like web.ais.dk, aprs.fi, aisstream.io, and marinetraffic.com for vessels passing through these zones.

This technique reliably flagged ships affected by spoofing and revealed a concerning trend: GNSS spoofing is now extending beyond the Baltic, into the Kattegat.

The following figures show examples from June 14th, between 20:00 and midnight UTC:

Identifying Distinct Spoofing Systems

Given the repeated use of near-identical, but spatially shifted spoofing patterns, I propose that these are distinct systems — possibly different units of the same spoofing hardware, configured with slight variations. Treating each unique pattern as a system allows us to visualize them using color-coded IDs.

These system IDs were manually derived using the geofencing method mentioned earlier coupled with node transition probabilities. Here’s what that looks like in practice:

Identifying Distinct Spoofing Systems

Assuming each system operates within a spoofing zone limited by line-of-sight, we can detect when a ship enters or exits that zone—revealed by jumps between spoofed and actual AIS positions.

This method distinguishes at least two primary systems (yellow/green vs. blue/red). Spoofing noise around Kaliningrad should mostly be ignored due to data ambiguity beyond the geofence.

As validation, the full-day spoofing map on June 14th matches large-scale disruptions seen on gpsjam.org — but with added system-level resolution.

Zooming into one-hour time slots reveals that spoofing zones are not continuous — they move. My annotations (shown as large colored circles) are approximate, but each likely encloses a Russian naval vessel broadcasting the spoofed signals.