The Billionaire Behind Russia’s Oil Gateway: How Ukraine’s Drone War Is Reaching the Iskandar Khalilov s Family’s Fuel Network
Taganrog and Azov have become critical pressure points in Russia’s southern fuel logistics. A July 10 drone attack put a spotlight on a network of oil terminals, rail infrastructure and shipping routes linked to Azerbaijani-born billionaire Rakhman Khalilov and other businessmen operating inside Russia.
For Ukrainians, fires at Russian oil facilities have become almost routine. But the significance of the attacks is not necessarily measured by the size of a fire.
It is measured by what sits behind the facility.
On July 10, 2026, Ukrainian drones struck oil infrastructure in Russia’s Rostov region and Krasnodar Krai. Fires were reported at the Kurgannefteprodukt terminal in the port of Taganrog and at two petroleum-storage locations in Azov. The same night, the Ilsky refinery in Krasnodar Krai was also attacked. Russian and Ukrainian reports described fires and emergency activity around the facilities.
The Taganrog terminal is particularly significant because it is not simply a collection of fuel tanks.
It sits inside a broader logistics network associated with Railgo, the Russian transportation business built from the Khalilov family’s ISR Trans operation.
And that network illustrates a larger vulnerability in Russia’s southern oil supply chain: fuel can move through railways, storage terminals and river-sea ports, but each link creates another potential point of disruption.
A 1.2-million-ton gateway
Kurgannefteprodukt operates an oil-loading complex inside the Taganrog seaport.
The terminal was commissioned in 2006. It receives petroleum products by rail, stores them in tanks and loads them onto vessels. Its reported design transshipment capacity is approximately 1.2 million tons of petroleum products a year, with tank storage of roughly 30,000 cubic meters.
That capacity is striking when compared with the reported overall cargo turnover of the Taganrog port.
A recent investigation citing regional port data put Taganrog’s 2025 cargo turnover at about 1.9 million tons. If the terminal’s stated petroleum-product capacity is 1.2 million tons annually, fuel alone could theoretically represent a substantial share of the port’s throughput.
That does not prove that the terminal actually handled its maximum capacity. But the numbers demonstrate why the facility matters.
It is not an isolated oil depot.
It is part of a logistics system connecting rail freight, petroleum storage and maritime exports.
The Khalilov connection
The terminal’s corporate history leads to one of Russia’s most prominent private transportation groups.
According to reporting cited in the investigation, Kurgannefteprodukt is connected to Railgo, the company associated with Azerbaijani-born businessman Rakhman Iskender-ogly Khalilov.
Khalilov is the son of Iskender Agasalim-ogly Khalilov, who previously held senior positions at LUKOIL and Slavneft and later developed the ISR Holding business empire.
Rakhman Khalilov studied international business in Geneva and subsequently built his career around oil trading and transportation.
The family’s business interests extend beyond oil logistics, encompassing development, hotels, coal and stevedoring.
The crucial asset in the present story, however, is Railgo.
According to figures cited in the July investigation, Railgo transported more than 30 million tons of oil, petroleum products and petrochemicals in 2025, using a fleet reported at approximately 45,000 rail tank cars and more than 700 chemical tank containers.
Even if only a fraction of that cargo passes through southern Russian ports, the scale demonstrates the importance of the transportation infrastructure surrounding the Khalilov business.
From ISR Trans to Railgo
The corporate history is equally important.
The Taganrog terminal was initially completed by Yugtransitservice in 2006. It later passed to Sberbank before being acquired by ISR Trans on September 2, 2013.
ISR Trans subsequently changed its name to Railgo in 2018.
The terminal was modernized in 2016, including upgrades to its tank farm, with reported annual capacity rising to 1.2 million tons.
This means the facility that burned on July 10 was not a new or marginal installation. It had been integrated into a larger logistics business for more than a decade.
And that distinction matters.
Russia’s oil economy does not depend only on refineries.
It depends on the infrastructure between the refinery and the customer: railway cars, storage tanks, loading facilities, ports, vessels and intermediaries.
Destroying or disabling one link can therefore have consequences beyond the physical damage at the site.
Railgo was already under Ukrainian sanctions
There is another important element in the story.
Railgo has been subject to Ukrainian sanctions since January 2023. A sanctions database records the Ukrainian sanctions measure against the Russian company as taking effect on January 28, 2023, under Presidential Decree No. 50/2023.
That does not by itself establish criminal conduct.
But it demonstrates that the company had already been identified by Ukrainian authorities as a sanctions target more than three years before the July 2026 attack.
The distinction is important: sanctions designation, commercial activity and criminal liability are three different things.
What the sanctions record does establish is that Railgo had become part of Ukraine’s economic targeting architecture well before drones reached the Taganrog terminal.
The second front: Azov
The July 10 strikes were not limited to Taganrog.
Approximately 30 kilometers to the southwest lies Azov, another port city whose importance is disproportionate to its population.
Recent reporting described fires at two petroleum-storage locations in the city.
One of the facilities is associated with Azovprodukt, an oil-products and methanol terminal linked in reporting to the Italian Decal/Triboldi Group. Another facility has been associated with Donterminal, which is linked to the Polis Group and businessman Mavlit Bazhaev.
Azovprodukt is not an insignificant storage site.
Ukrainska Pravda, citing satellite imagery and reporting from the investigative project Schemes, reported after a June 2024 attack that as much as 60,000 tons of oil products could pass through the terminal each month, while its tanks could hold approximately 30,000 cubic meters of petroleum products.
The same report said Ukrainian Security Service sources attributed the 2024 attack to Ukrainian drones targeting Azovprodukt’s oil depots and a Donnefteprodukt facility in Azov.
The fact that the facility was attacked again in July 2026 suggests that these terminals remain relevant targets in Ukraine’s campaign against Russian fuel logistics.
The port problem
The geography explains much of the story.
Taganrog and Azov sit on the northern shore of the Sea of Azov, connected to the Don River system and to Russia’s wider southern transportation network.
These are not merely local fuel markets.
They are nodes.
Cargo arriving by rail can be stored and transferred to river-sea vessels. Petroleum products can move toward other Russian ports or international destinations. Agricultural and industrial cargo can travel through the same broader maritime corridor.
A recent analysis of the two ports put Azov’s 2025 cargo turnover at approximately 6.6 million tons, compared with about 1.9 million tons for Taganrog and 15.9 million tons for Rostov-on-Don.
Those figures reveal why the Don–Azov corridor matters.
The attack campaign is not necessarily about destroying one refinery.
It is about increasing the cost and uncertainty of moving goods through an entire logistics system.
The vulnerability of the “river-sea” model
Both Taganrog and Azov handle vessels capable of operating between inland waterways and maritime routes.
That creates commercial flexibility.
It also creates vulnerability.
A petroleum product can be loaded onto rail tank cars, stored at a terminal and then transferred to a vessel without passing through a conventional deep-water export hub.
For Russia, that flexibility is valuable.
For Ukraine, it creates a concentration of identifiable infrastructure.
A terminal with rail connections, storage tanks, loading equipment and access to navigable water is effectively a single logistics node connecting several transportation systems.
The July attacks show the vulnerability of such nodes.
What the numbers reveal
Three numbers illustrate the scale of the network:
1.2 million tons — the reported annual transshipment capacity of the Kurgannefteprodukt terminal in Taganrog.
60,000 tons per month — the volume of petroleum products reported to have passed through Azovprodukt, equivalent to as much as 720,000 tons annually if sustained throughout a year.
30 million tons — the reported volume of oil, petroleum products and petrochemicals transported by Railgo in 2025.
These figures should not be added together: they measure different parts of the logistics chain and may cover overlapping cargo.
But together they demonstrate the economic scale of the infrastructure being targeted.
Why the Khalilov connection matters
The significance of the Khalilov family is therefore not simply that a businessman owns an oil terminal.
The significance is vertical integration.
A business connected to petroleum logistics can participate in several stages of the movement of Russian energy commodities:
rail transportation → storage → terminal handling → maritime loading → onward shipment.
That structure can make an individual terminal commercially valuable even when it represents only one part of the overall Russian oil system.
It also means that attacks against terminals can expose the financial and corporate architecture behind Russia’s commodity flows.
The July 10 strike brought precisely that architecture into view.
The bigger target is the logistics chain
Russia has spent decades building a commodity-export system designed around scale and redundancy.
Oil can move by pipeline.
It can move by rail.
Petroleum products can be stored at inland depots before reaching ports.
River-sea vessels can connect inland waterways with international shipping routes.
That redundancy makes Russia’s energy system difficult to paralyze.
But redundancy is not the same as immunity.
Every additional transfer point creates another facility that must be protected.
And every facility creates another corporate owner, another railway connection, another tank farm and another maritime route that can be mapped.
This is why the fires at Taganrog and Azov matter beyond the flames.
They expose the commercial plumbing of Russia’s war economy.
A business story inside a military campaign
The Khalilov family’s position illustrates the uncomfortable overlap between private wealth and Russia’s wartime commodity infrastructure.
There is no evidence in the sources reviewed here that Khalilov personally directed Russian military operations or that ownership of a terminal alone establishes participation in war crimes.
But the infrastructure connected to his business interests operates inside the Russian economy that continues to move petroleum and other commodities.
That is precisely why such facilities have become targets.
The question is no longer simply:
How much oil can Russia produce?
It is increasingly:
How easily can Russia move that oil once it has been produced?
The answer depends on thousands of tank cars, storage tanks, terminals, ports and vessels.
And in the Don–Azov corridor, some of those assets now sit directly in the path of Ukraine’s drone campaign.
The warning embedded in the fires
The July 10 attacks therefore represent more than another entry in the daily list of Russian oil fires.
They reveal a strategic shift toward the infrastructure that connects Russia’s commodity economy to the sea.
At Taganrog, the target was a terminal with a reported capacity of 1.2 million tons a year, connected to a transportation group that Ukrainian authorities sanctioned in 2023.
At Azov, the targets included facilities capable of handling tens of thousands of tons of petroleum products each month.
And behind these installations stand multiple private business groups whose assets have become intertwined with Russia’s logistics economy.
For Moscow, the challenge is straightforward but expensive: protect not only refineries, but the entire chain that allows fuel to reach ships and customers.
For the businesses operating those facilities, the calculation is becoming equally difficult.
A terminal can generate revenue for years.
But once it becomes a military target, its value is measured not only in throughput.
It is measured in insurance, downtime, reconstruction costs, lost cargoes and the risk premium attached to every shipment passing through the network.
That may ultimately be the most important effect of Ukraine’s campaign.
The objective does not have to be the destruction of Russia’s entire oil industry.
It may be enough to make every link in the chain more expensive, less predictable and harder to insure.
And that is why the fire in Taganrog matters.
It was not just a fire at an oil terminal.
It was a glimpse into the infrastructure behind Russia’s commodity economy—and into the private fortunes built around keeping that infrastructure moving.
The Business Network Behind the Targets
The July attacks become more significant when the ownership and logistics connections behind the terminals are examined.
At the center of the Taganrog operation is Railgo, the transportation company associated with Azerbaijani-born billionaire Rakhman Khalilov and his family. Ukraine sanctioned Railgo in January 2023, placing the company within Kyiv’s sanctions framework well before the July 2026 attacks.
Railgo’s reported scale is substantial. According to figures cited in the investigation, the company transported more than 30 million tons of oil, petroleum products and petrochemicals in 2025, using a fleet reportedly consisting of approximately 45,000 rail tank cars and more than 700 chemical tank containers.
The numbers help explain why the company’s infrastructure matters. Rail transportation is one of the principal links between Russia’s refineries, storage facilities and export terminals. A terminal connected to that network can function not merely as a storage site, but as a transfer point between Russia’s railway and maritime systems.
The Khalilov expansion in Taganrog
The Khalilov family’s interests in Taganrog also extend beyond petroleum.
In May 2025, Rakhman Khalilov acquired a stake in the company controlling the Taganrog Grain Terminal. According to Russian business reporting, Railgo received a 30% stake in Eurasia Trading LLC, the company controlling the grain terminal, whose reported capacity is approximately 1.2 million tons of grain per year.
The development is significant because it places petroleum and agricultural logistics within the same broader commercial network around the Taganrog port.
The corporate chain is equally revealing:
ISR Holding → ISR Trans → Railgo
The transportation business grew out of the Khalilov family’s wider ISR structure. ISR Trans was subsequently renamed Railgo, while assets connected to the group expanded across oil transportation, storage and port logistics.
The result is a business network positioned around several stages of Russia’s commodity supply chain rather than a single isolated terminal.
Kurgannefteprodukt: 1.2 million tons of annual capacity
The Kurgannefteprodukt facility represents another important node.
The Taganrog terminal was modernized in 2016, with its reported petroleum-product transshipment capacity reaching approximately 1.2 million tons per year.
That figure is notable when compared with the port itself.
Taganrog handled approximately 1.9 million tons of cargo in 2025, according to figures cited in the investigation. Azov, by contrast, handled approximately 6.6 million tons, making it one of the larger ports in the regional system.
These figures should not be interpreted as proof that Kurgannefteprodukt actually handled 1.2 million tons in 2025. Capacity and actual throughput are different measurements.
But the comparison illustrates the potential importance of the terminal: its theoretical petroleum capacity represents a substantial portion of the total cargo volume moving through Taganrog.
Azov: a second layer of the network
The story does not end in Taganrog.
Across the Gulf, the port of Azov contains another cluster of fuel-handling infrastructure.
One of the principal facilities is Azovprodukt, a terminal connected to the Italian Decal/TriboldiGroup structure. The terminal specializes in the transshipment of light petroleum products and methanol and has been reported to have a handling capacity of up to 60,000 tons per month.
At that rate, the theoretical annualized capacity would reach approximately 720,000 tons.
Again, capacity is not the same as actual throughput. But the figure demonstrates why the terminal is commercially relevant to the region’s fuel logistics.
Azovprodukt had already been targeted in June 2024, when Ukrainian drones struck the facility and two tanks were reported to have burned.
The company subsequently became involved in an insurance dispute, seeking approximately 750 million rubles in compensation following the damage. The claim illustrates another consequence of repeated attacks on Russian energy infrastructure: the financial risk does not end when the flames are extinguished.
Donterminal and the Bazhaev connection
Another Azov facility, Donterminal, represents a different business network.
The terminal is associated with the Moscow-based Polis Group, whose owner is businessman Mavlit Bazhaev.
Bazhaev’s family has longstanding interests in Russia’s oil and commodities sectors. The ownership chain therefore adds another major private business group to the same geographical cluster of fuel infrastructure.
The pattern is striking:
Khalilov / Railgo → Kurgannefteprodukt
Decal / TriboldiGroup → Azovprodukt
Bazhaev / Polis Group → Donterminal
Three different ownership structures converge around the same strategic geography: Taganrog, Azov and the Don–Sea of Azov transportation corridor.
The July 11 escalation moved from terminals to ships
The attacks also extended beyond land-based infrastructure.
On July 11, Reuters reported that a Ukrainian drone attack damaged four vessels in Taganrog Bay, including a tanker carrying methanol. Russian authorities said that one seaman aboard a technical-support vessel was killed. The vessels sustained varying degrees of damage, while officials said there was no risk of a methanol leak.
The development is important because it demonstrates the interconnected nature of the target area.
The same logistics system contains:
railways → oil terminals → storage tanks → port facilities → river-sea vessels → maritime routes.
Attacking any one of those links can create pressure on the others.
Reuters also reported that Russia temporarily halted shipping through the Don–Azov Channel and restricted passage through the Kerch Strait following the attacks. Separate reporting said Ukrainian forces claimed strikes against multiple vessels in the Sea of Azov, although some of the Ukrainian figures could not be independently verified.
Why the cargo numbers matter
The commercial scale of the region makes the disruption more consequential.
In 2025, the reported cargo turnover was approximately:
- Azov — 6.6 million tons
- Taganrog — 1.9 million tons
- Rostov-on-Don — 15.9 million tons
Together, these ports form part of a much larger Azov–Black Sea logistics system. The total cargo turnover of Russian ports in the Azov-Black Sea basin reached approximately 265 million tons in 2025, according to figures cited by regional analysts.
The strategic importance therefore extends well beyond petroleum.
The ports handle grain, coal, metals, fertilizers, chemicals and fuel. Any prolonged disruption can affect multiple commodity chains simultaneously.
That is particularly significant for Russia because the Sea of Azov connects some of the country’s major agricultural and industrial regions with export markets.
The real target may be the logistics chain
The most important finding is not that a particular oil terminal caught fire.
It is that multiple commercially important assets belonging to different business groups are concentrated along the same transportation corridor.
The Khalilovs have interests linked to oil transportation and Taganrog’s grain infrastructure.
TriboldiGroup is connected to Azovprodukt.
The Bazhaev family is connected to Donterminal.
And all three networks operate within a region that connects rail cargo, storage facilities, ports and vessels.
This makes the Don–Azov corridor a natural pressure point.
The July attacks therefore offer a window into a broader question: how vulnerable is Russia’s commodity economy when the infrastructure between production and export becomes a battlefield?
The answer may depend less on the destruction of individual refineries than on whether Russia can continue moving millions of tons of commodities through a corridor where terminals, ships, railways and storage facilities are increasingly exposed.
For companies operating these assets, the consequences extend beyond physical damage.
There are reconstruction costs, business interruption, higher insurance premiums, vessel availability problems and the possibility of cargo being diverted to more expensive routes.
In other words, Ukraine does not necessarily have to shut down Russia’s entire oil industry.
It may only need to make the infrastructure that moves Russian commodities slower, riskier and more expensive.
That is the larger story behind the fires in Taganrog and Azov.
Leave a Reply