Putin’s unconventional war against Europe

The report by the International Institute for Strategic Studies, "Russia’s UAV Campaign Over Europe", attempts to make sense of one of the most difficult phenomena to interpret in Russia’s hybrid war against Europe: the appearance, between August 2024 and February 2026, of drones over airports, military bases, ports, energy facilities, defence industries and nuclear sites. This starting point is important because it avoids jumping to conclusions. The IISS does not claim that every sighting was the work of Russia, nor that every reported object was actually a drone. It does, however, argue that, taken as a whole, the incidents form a pattern that cannot be explained solely by misidentification, amateur drones or isolated provocations. The database compiled by the institute contains 144 incidents across thirteen European countries. Around 48 per cent involve military installations, 18 per cent civilian airports, and 26 per cent critical infrastructure such as ports, energy facilities and industrial sites. Germany is the country most affected, with 58 incidents recorded, followed by Belgium, Denmark and the Netherlands. The sharp rise occurs between September and December 2025: the average jumps from four incidents per month to 22.5.

The most interesting part of the study, however, concerns how these operations might work. The problem for Moscow is simple: how can it monitor a NATO base, a military port or an airport without launching an aircraft from Russia and without crossing a border in a way that can be detected? The IISS’s answer is the sea. The authors consider it likely that at least some of the drones were launched or recovered by commercial vessels linked to Russia and, above all, by the so-called ‘shadow fleet’: formally civilian oil tankers and cargo ships, often flying flags of convenience and with ownership structures that are difficult to trace, used primarily to circumvent sanctions on Russian oil. The report cites an estimate of around 1,300 oil tankers belonging to the shadow fleet and notes that in February 2026 these vessels were carrying around 70 per cent of Russia’s crude oil exports by sea.

The method is relatively simple. A vessel approaches the coast, remaining in international waters if necessary, switches off its AIS transponder, launches the drone and switches the signal back on once the operation is complete. Alternatively, it continues to transmit but falsifies its coordinates using spoofing techniques. In other cases, it may use the electronic identity of another vessel. The AIS, designed to prevent collisions and identify vessels, thus becomes an easily manipulable tool. This is why investigators must cross-reference it with SAR satellite imagery, which can detect a vessel’s physical presence even at night and beneath cloud cover. In one case analysed in the report, off the coast of Ireland, the satellite shows a vessel that simply does not appear in the AIS data. It is there, but has switched off its signal.

Even launching a drone from a ship does not necessarily require a dramatic conversion of the cargo vessel into an aircraft carrier. A Russian Orlan-10 can have an operational range of around 500 kilometres, remain airborne for up to twelve hours and travel at speeds of between 90 and 130 kilometres per hour. It can be launched from a relatively small space and carry optical and thermal sensors, as well as equipment to jam satellite navigation or monitor communications networks. The Merlin-VR can be launched via a catapult and return using a parachute. Vertical-take-off models require even less space. And to further reduce the likelihood of any Russian involvement being detected, modified commercial drones or homemade aircraft can be used. At the end of the mission, the drone can be recovered with a net, landed or simply abandoned at sea, thereby eliminating any physical evidence.

The Danish case helps to illustrate the system. On 22 September 2025, Copenhagen Airport was closed for around four hours following the sighting of two or three drones. One hundred and ninety flights were affected and thousands of passengers were stranded. In the days immediately following, further drones were reported in Aalborg, Billund, Esbjerg and Sønderborg. But the crucial detail is that these are not just civilian airports. Aalborg is also a Danish Air Force base; Skrydstrup has hosted training for Ukrainian pilots on the F-16; other sightings occur near military installations. The Danish authorities speak of highly capable operators and are publicly considering the possibility that the drones were launched from ships.

Suspicions fell in particular on the Boracay, an oil tanker belonging to the shadow fleet which was sailing in the waters around Denmark at the time. On 28 September, French commandos intercepted and boarded it off the coast of Saint-Nazaire. On board, in addition to the Chinese captain, two Russian nationals were found who were employed by the Moran Security Group, a private military company founded by former FSB officers; one of them is said to have previously worked for Wagner as well. The IISS is careful not to treat this circumstance as proof that the Boracay launched the drones in Copenhagen. But this fact changes the picture: an apparently civilian oil tanker from the shadow fleet was carrying personnel directly linked to the Russian security establishment. For the authors, this is concrete evidence of the possible ‘militarisation’ of these vessels.

An even more striking incident took place on 3 January 2025. Up to twenty large drones were observed flying in formation over the port of Køge, 39 kilometres south-west of Copenhagen. They then accelerated and disappeared towards the bay. Køge was not chosen at random: in 2022, it had been the main embarkation point for Denmark’s largest military deployment in recent decades to NATO’s eastern flank. Monitoring that port means being able to study one of the arteries through which personnel and equipment can be transferred to the Baltic. Here, too, the sea features in the reconstruction: during the same period, a ship from the shadow fleet, the Arctica, is moving around Denmark, whilst the oil tanker Mulan is making unusual zigzag routes between Denmark and Norway, precisely in an area criss-crossed by undersea cables. It is not a ‘smoking gun’, but it is exactly the sort of overlap that the IISS looks for in its database.

Germany is the main testing ground. According to documents from the Bundeskriminalamt cited in the report, in 2025 alone the country recorded 1,072 incidents involving 1,955 drones; the IISS has selected 58 of these for its more limited database. The targets are telling: military bases, industrial sites, ports and airports. Between November 2024 and March 2025, six incidents involving possible ‘spy drones’ were reported over Ramstein, which is home to both the headquarters of the US Air Force in Europe and NATO’s Allied Air Command. Other overflights affected Bundeswehr installations, the BASF chemical complex in Ludwigshafen and Rheinmetall, which is involved in the production of munitions and military equipment and in providing support to Ukraine. In Brunsbüttel, in the north of the country, drones arrive from the sea and fly over an industrial area that includes liquefied natural gas infrastructure built specifically to reduce energy dependence on Russia. German prosecutors have gone so far as to suggest “espionage activities aimed at sabotage”.

Even more significant is the story of certain ships. The cargo ship Scanlark, with a predominantly Russian crew, was boarded by German special forces following suspicions that a drone had been launched from its deck on 26 August 2025 to photograph a German military vessel. An investigation based on federal police documents subsequently linked the unusual movements of the Hav Dolphin, Hav Snapper and Lauga to nineteen overflights. The Hav Dolphin remained off the coast of Kiel for eight days whilst drones were sighted over the submarine base at Eckernförde. The Lauga is linked to an incident in which seven drones flew over the German patrol vessel BP 81 Potsdam. The authors even hypothesise a multi-vessel system: one vessel could launch and recover the drones, whilst another could act as a relay or gather electronic intelligence, providing the drone and its operator with the necessary data.

A similar situation is unfolding in the United Kingdom. Between 20 and 26 November 2024, sophisticated drones were observed near the US bases at RAF Fairford, Feltwell, Lakenheath and Mildenhall. Lakenheath is particularly sensitive because open-source information indicates preparations for the possible return of US nuclear weapons. Following an appeal to the public, around 170 reports were received, and roughly half were deemed credible as they were supported by multiple witnesses or by images that could not be explained by known air traffic. The objects appear to be of different types: some are multirotors, others fixed-wing; some witnesses even report a noise more akin to a petrol engine than to the electric motors of common commercial drones. During those days, the Hav Dolphin, which had already come under scrutiny in Germany, was docked in the UK.

The case of Belgium, on the other hand, shows how a flyover can serve not only to photograph a target but also to study its defences. In early November 2025, drones entered the airspace of the Kleine-Brogel base – where American nuclear weapons are stored – for three consecutive nights. Defence Minister Theo Francken described the operation as akin to espionage. According to the reconstruction cited by the IISS, in an initial phase, small drones enabled operators to identify the radio frequencies used by the Belgian security systems. When larger drones subsequently arrived, the jammers were unable to neutralise them because the operators had adjusted the frequencies. “An amateur wouldn’t know how to do that,” the minister observed.

Here we can clearly see the logic that runs through the entire report. A drone does not necessarily have to steal documents, take extraordinary photographs or destroy anything. It may be enough simply to force the enemy to react. If the base activates a radar, Moscow discovers its frequencies and coverage. If a fighter jet takes off, it reveals the timing and procedures for interception. If a jammer is activated, it studies how it works. If the government decides not to fire, it discovers where the political threshold for the use of force lies. This is what the IISS links to the Russian tradition of ‘razvedka boyem’, reconnaissance through combat: provoking a response to obtain information that passive surveillance would not provide.

The Netherlands perhaps provides the most comprehensive example. The Volkel base, which is also linked to NATO’s nuclear deterrent, was repeatedly flown over in November and December 2025. On 21 November, up to ten drones operated directly above the base between 7 pm and 9 pm. Security personnel fired from the ground, but the drones evaded the shots and no wreckage was recovered. At the same time, other drones appear over Eindhoven, forcing a temporary suspension of civil air traffic. On 7 December, another drone is pursued by two F-35s until it exits Dutch airspace. The value of the operation is clear: within a few hours, the responses of the base’s security, the fighter jets and civil aviation can all be observed. During those time periods, several vessels deemed suspicious were also identified off the Dutch and French coasts, including the Arctica, the Cgas Leopard and the Tranquil Sea.

Then there is Ireland. On 1 December 2025, Volodymyr Zelenskyy arrives in Dublin for his first official visit to the country. At around 10.30 pm, four drones described as large, expensive and of military specification are spotted offshore and remain for almost two hours above the Irish Navy vessel LÉ William Butler Yeats. When the crew spots them, they are heading towards the coast. Firing would mean directing the ship’s weapons towards Irish territory, so the decision is made not to do so. Some sixty kilometres away is the Vezhen, a vessel that had already been seized months earlier by Sweden during an investigation into damage to an undersea cable, which was later deemed to have been accidental. But, more importantly, satellite images show another vessel less than forty kilometres from the scene of the incident: it appears on the SAR radar but not on the AIS. It is physically present with its transponder switched off.

A few days later, in France, five drones were detected flying over Île Longue, the Breton base for French nuclear submarines. It is one of Europe’s most sensitive targets, as those submarines carry the majority of France’s nuclear warheads deployed on ballistic missiles. The overflight took place a few weeks after the M51.3 missile entered service and during a supermoon, meaning visibility was particularly good. Several vessels that the IISS considers worthy of attention were located a few hundred kilometres away; the nearest was just over a hundred. France launched an investigation but did not attribute the incident to Moscow. This, too, is key to understanding the report: correlation and plausibility are not presented as definitive proof.

The strongest evidence of the ability to launch drones from a Russian vessel emerged on 26 February 2026, whilst the French aircraft carrier Charles de Gaulle was in Malmö. According to the report, an unauthorised drone was launched from the Zhigulevsk, a Russian vessel specialising in signals intelligence. The vessel entered Swedish territorial waters and the drone was neutralised approximately twelve kilometres from the aircraft carrier’s anchorage. This incident is crucial because it transforms what, until then, could have been regarded primarily as an investigative hypothesis into a proven capability: a Russian ship can indeed approach a European target and launch a reconnaissance drone. It does not prove that all other missions were organised in the same way, but it makes the maritime hypothesis far less theoretical.

Added to all this is NATO’s eastern flank, where the line between war against Ukraine and provocation against the Alliance is even more tenuous. On the night of 9–10 September 2025, up to 24 Russian drones entered Polish airspace. The response involved Polish F-16s, Dutch F-35s and Italian early-warning aircraft. Some Gerbera drones were directed towards the area around Rzeszów-Jasionka Airport, the major logistics hub through which a significant proportion of Western military aid to Ukraine passes. Here too, the outcome is not measured solely in terms of damage: the incursion provided an opportunity to observe who took off, how quickly, using which procedures, through which corridors and with which systems.

Then there is the economic cost. A relatively inexpensive drone can force the closure of an airport handling hundreds of flights, or trigger the scramble of a fighter jet and the activation of far more expensive anti-aircraft systems. Copenhagen remains closed for four hours; Eindhoven has to suspend air traffic; in Denmark, several airports are affected within the space of a few days. And on top of this first level comes a second, informational one. The IISS notes that pro-Russian networks, including those linked to Operation Doppelganger, immediately amplify alternative narratives: the drones are not Russian; it is Ukraine that is orchestrating provocations; or it is European governments that are artificially manufacturing a crisis. First, uncertainty is created, and then the impossibility of attributing the attack with certainty is exploited politically.

It is this ambiguity that poses a challenge for Europe. Western air defences were designed primarily to detect conventional aircraft: fast, relatively large, flying at high altitude and normally identifiable. A small drone flying low at night, which does not transmit its position and may have taken off from the sea, slips through the system’s defences. Furthermore, it is not always clear who has the right to shoot it down. The police, civil aviation authorities and the military have different powers. In Germany, for example, the Bundeswehr was previously authorised to intervene directly, particularly over military installations; incidents have prompted the government to amend the rules and establish a joint anti-drone defence structure. In other cases, there is a prevailing fear that shooting down a UAV over a populated area could result in casualties from the wreckage.

The problem remains even if Europe manages to build a far more effective anti-drone network. The European Drone Defence Initiative aims to link up radar, acoustic and radio sensors, jammers and interceptors. But the IISS identifies a conceptual flaw: such a system focuses on the drone only once it has already entered European airspace. It does not necessarily solve the problem of the vessel that launched it. As long as an oil tanker from the shadow fleet can remain in international waters or within an exclusive economic zone, fly a flag of convenience, switch off its AIS and launch a drone, the platform enabling the operation remains essentially intact.

And this is where the study’s perhaps most important conclusion comes in. The IISS does not claim to have proven that all 144 incidents are Russian in origin. Indeed, it explicitly points out that some sightings may be false positives, misidentifications or harmless activities; furthermore, no reconstruction based on open-source information allows us to establish with certainty whether there is a single command centre in the Kremlin or whether some operations are conducted independently by the FSB, GRU, SVR or their intermediaries. Yet the overall picture remains striking: drones operating mainly at night, nuclear bases, ports, infrastructure used for Ukraine and major airports; Russian or Russia-linked vessels in the affected areas; anomalies in tracking systems; and Western assets forced to activate radars, jammers and defences, thereby revealing how they react. For the IISS, it is this combination of factors that is difficult to explain as mere coincidence.

Essentially, the mechanism described in the report is very simple. A vessel that appears to be civilian approaches. The transponder is switched off or tampered with. A relatively inexpensive drone is launched. The drone enters an area it should not enter. Europe must decide whether it is actually a drone, who sent it, who is authorised to stop it and how much risk can be taken to shoot it down. Meanwhile, radar systems, fighter jets, jammers, the police and airports react. And that reaction generates information. Even when the drone is detected, pursued or neutralised, therefore, the mission may already have achieved part of its objective. This is the crux of the report: not so much a new Russian weapon, but a relatively inexpensive, ambiguous and repeatable way of exploiting Europe’s grey areas against Europe itself.