Listen to the article
By Andre Pienaar
Russia has almost certainly run a coordinated drone campaign over Europe since August 2024, using shadow-fleet tankers and other Russian-linked ships as floating launch and recovery platforms, according to a new report from the International Institute for Strategic Studies (IISS).
The study, Russia’s UAV Campaign Over Europe, assesses it as “highly likely” that the Kremlin directed the campaign and “likely” that vessels loitering in the North Sea, Baltic and Atlantic served as its operational base. It compiles 144 incidents in which uninhabited aerial vehicles (UAVs) were flown over a dozen NATO states and Ireland, forcing the closure of airports in Brussels, Copenhagen, Munich, Oslo and Vilnius and penetrating the perimeters of some of the continent’s most sensitive military sites – including bases hosting US B61-12 nuclear bombs and France’s ballistic-missile submarine base at Île Longue.
The authors – Charlie Edwards, IISS Senior Fellow for Strategy and National Security, with data analysts Rex Fox O’Loughlin and Louis Bearn – describe the result as a string of tactical successes for Moscow and “a strategic failure of allied air defence”.
A campaign built on Europe’s blind spots
The report’s core argument is that Europe’s air-defence architecture was designed for a different threat: fast, high-altitude aircraft flying known corridors and broadcasting their identity. Low, slow, non-cooperative drones launched at night from international waters slipped through gaps in both military radar and civil air-traffic systems that regulators have acknowledged for years.
The pattern is stark. Around 48 per cent of the sightings in the IISS dataset occurred over military facilities, 18 per cent over civilian airports and 26 per cent over critical infrastructure such as ports, energy plants and industrial sites. Most took place at night. Germany recorded the most incidents (58), followed by Belgium (25), Denmark (16) and the Netherlands (nine). Between September and December 2025, monthly reported incidents jumped from an average of four to 22.5.
The IISS is careful to bound its claim. It does not argue that every sighting was real or Russian. But the authors note that a high rate of unconfirmed sightings is exactly what one would expect when detection capability is poor, and that psychological warfare is itself a likely objective of the campaign. The incidents that matter, they argue, occurred at night, near nuclear or logistics sites, and involved platforms far larger than hobbyists’ quadcopters.
Four aims
Drawing on Russian doctrine and interviews with European defence and intelligence officials, the report identifies four overlapping objectives.
The first is razvedka boyem – reconnaissance by battle. Every scrambled fighter, activated radar and jammer is itself the intelligence product, revealing frequencies, intercept procedures and rules-of-engagement thresholds. The incursion of up to 24 drones into Polish airspace in September 2025, which triggered Polish F-16s, Dutch F-35s and Italian early-warning aircraft, is cited as a textbook example. The authors compare the approach to Cold War US “ferret” flights along Soviet borders.
The second is mapping critical infrastructure, particularly nuclear-sharing sites and logistics nodes supporting Ukraine. Kleine-Brogel in Belgium, Volkel in the Netherlands and RAF Lakenheath in the UK – all linked in open sources to US nuclear weapons – were repeatedly overflown. So were Køge port in Denmark, NATO’s principal Baltic embarkation point, and German sites where Ukrainians train on Patriot systems and Abrams tanks.
The third is economic attrition and psychological pressure: cheap drones forcing expensive responses, with Copenhagen Airport alone losing four hours and 190 flights on a single night. Russian-aligned disinformation networks then amplified and exploited narratives blaming Ukraine or European incompetence.
The fourth is the slowest and, the report argues, the most dangerous: normalising recurring airspace violations until governments and the public no longer treat them as threat incidents requiring a national security response – potentially paving the way for pre-conflict suppression of allied air defence.
The maritime drone nexus
The report’s most distinctive contribution is its analysis of the sea. Cross-referencing AIS ship-tracking data, satellite imagery, ACLED incident data and media reporting, the authors repeatedly correlate Russian-linked vessels within deployment range of drone incidents.
When Copenhagen Airport closed on 22 September 2025, the shadow-fleet tanker Boracay was tracked off the Danish coast. Six days later, French naval commandos boarded the vessel off Saint-Nazaire and found, alongside its Chinese captain, two Russian nationals from the Moran Security Group, a private military company focused on maritime operations founded by former FSB officers. Vyacheslav Kalashnikov is a former FSB colonel. Moran recruits actively from GRU, airborne and naval commando units. The US Treasury sanctioned Moran in 2024 for providing “armed security services” to Russian state-owned enterprises. The IISS describes this as confirmation that the militarisation of shadow-fleet tankers is operational practice rather than hypothesis.
During the November 2025 incursions over Volkel and Eindhoven, several suspect vessels – including the Arctica, the Cgas Leopard and the Tranquil Sea, formerly the Eagle S, which was implicated in Baltic cable damage – were loitering off the Dutch and French coasts. The Hav Dolphin, a cargo ship investigated by Germany and the Netherlands after drone flights near the Eckernförde submarine base, was docked in Britain during the Lakenheath sightings of November 2024 and was 350 km from Île Longue when five drones overflew France’s nuclear-submarine base on 4 December 2025.
When four “military specification” drones shadowed an Irish Navy ship off Dublin during President Zelenskyy’s visit on 1 December 2025, satellite radar detected an unidentified vessel less than 40 km away that was broadcasting no AIS signal at all.
The clearest proof came in February 2026, when Sweden publicly attributed a drone jammed near the French carrier Charles de Gaulle in Malmö to the Russian intelligence ship Zhigulevsk. That incident, the authors write, validates the broader vulnerability: maritime drone launch is technically feasible and has now happened.
The report also highlights a German investigation, based on a leaked federal police assessment of 1,072 drone incidents in 2025, which correlated 19 overflights with the loitering movements of three ships, including the Russian-flagged Lauga, previously used for military cargo runs to Syria.
Shadow-fleet vessels solve a problem for Moscow, the IISS argues. Arson and simple sabotage can be outsourced to untrained proxies recruited on Telegram; flying military-grade drones cannot. Ships provide cover, mobility and a ready-made layer of deniability – AIS spoofing, flags of convenience and opaque ownership – that slows attribution and, with it, political response.
A divided Europe
The report is unsparing about the response. Danish Defence Minister Troels Lund Poulsen said the September incidents pointed to “a professional actor”, and Belgian Defence Minister Theo Francken observed of the operators who adapted to Kleine-Brogel’s jammers that “an amateur doesn’t know how to do that”. Yet no European government has publicly attributed a single drone sighting to Russia or described a coordinated campaign, in part because each capital focused on its own national response rather than the pattern across the continent.
NATO’s posture compounded the incoherence. When NATO Military Committee Chair Admiral Giuseppe Cavo Dragone floated pre-emptive action against Russian “hybrid infrastructure”, Italy publicly distanced itself. The threshold for collective punishment, the authors conclude, has proved higher than European deterrence postures assumed.
The European Drone Defence Initiative (EDDI), the rebranded “drone wall”, aims for initial operating capability by the end of 2026, but the European Parliament has already warned that interception costs are unsustainable and that procurement timelines risk fielding obsolete kit. More fundamentally, the IISS notes, the EDDI remains focused on the eastern flank and can only engage a drone once it is over Europe. It has no mandate over the Russian shadow-fleet vessels that launched it.
The unanswered question
The authors set out three requirements for a credible response: legal clarity on rules of engagement across civil, police and military jurisdictions; an inversion of the cost-exchange ratio so that cheap drones no longer drain finite interceptor stocks; and – the hardest – maritime accountability. As long as Russian-linked ships can loiter in international waters and EEZs and launch drones with impunity, they write, the campaign’s primary enabling mechanism remains intact.
The Zhigulevsk incident showed that attribution is possible. Whether European governments are prepared to act on it is, in the report’s closing words, the question that remains.
The full report, “Russia’s UAV Campaign Over Europe” by Charlie Edwards, Rex Fox O’Loughlin and Louis Bearn (IISS, July 2026), is available at iiss.org.
Andre Pienaar is the founder of C5 Capital, a specialist investment firm focused on energy security. He is the Executive Chairman of Collective Defence, a Luxembourg-headquartered cybersecurity and counter-drone company.
