A think tank assessment names two shadow-fleet vessels as likely launch platforms for an 18-month reconnaissance campaign against NATO nuclear and military sites, though physical evidence directly linking any drone to any ship remains absent.
Intelligence Lead
The International Institute for Strategic Studies has assessed it "highly likely" that the Kremlin ran a coordinated uncrewed aerial vehicle campaign over Europe between August 2024 and February 2026, using vessels linked to Russia's shadow fleet as launch and recovery platforms from international waters. The study catalogues 144 incidents across thirteen countries, concentrated over NATO nuclear-deterrence sites, military installations, and the logistics infrastructure supporting Ukraine, and finds a pattern that "cannot be adequately explained by misidentification, hobbyist activity or opportunistic harassment alone."
Situation Report
IISS researchers combined ACLED conflict-tracking data with media reporting to build a database of 144 confirmed drone sightings spanning twelve NATO members and Ireland, filtering out incidents attributable to hobbyist activity or the war in Ukraine itself. Roughly 48 percent of incidents occurred over military facilities, 18 percent over civilian airports, and 26 percent over critical infrastructure including ports and energy installations. The report names two shadow-fleet vessels of particular interest: the cargo ship Hav Dolphin, investigated by German and Dutch authorities after drone incursions in spring 2025, and the tanker Seasons I, which transited the Straits of Dover on a course paralleling the East Anglian coastline near RAF Lakenheath and RAF Mildenhall during the November 2024 incursions over those bases.
Among the sites documented are installations storing US B61-12 nuclear gravity bombs under NATO's nuclear-sharing arrangement and the French ballistic-missile submarine base at Île Longue. Sweden's military remains the only government to have directly attributed a drone launch to Russia, having jammed a UAV it traced to the Russian signals-intelligence vessel Zhigulevsk as it approached the French carrier Charles de Gaulle during a port call in Malmö. No other NATO member has issued a comparable public attribution, though IISS Senior Fellow Charlie Edwards said every government the institute consulted welcomed the report's publication, an indication of tacit endorsement even absent public confirmation.
The findings arrive in the same week Austria expelled three Russian Embassy staff over an antenna array on Vienna diplomatic property used, Austrian authorities suspect, to intercept satellite data from UN agencies and other international organizations, and days after Polish intelligence warned of possible Russian "little green men" provocations in the Baltic states. Taken together, the reporting describes a summer of simultaneous, mutually reinforcing pressure on European detection, counterintelligence, and information infrastructure.
Background & Context
The shadow fleet, originally assembled to move sanctioned Russian oil outside Western-insured shipping channels, has increasingly been assessed by European intelligence services as a dual-use asset capable of surveillance, cable interference, and now, per this report, aerial reconnaissance. Operating from international waters lets these vessels conduct activity without technically violating a state's territorial airspace at the point of launch, which is precisely the ambiguity that has stalled formal attribution across a dozen separate national investigations.
The incursions over RAF Lakenheath and RAF Mildenhall in November 2024, which The Aviationist covered in depth at the time, came within days of the Biden administration's decision to permit Ukraine to strike targets deep inside Russian territory with long-range missiles, a timing correlation the IISS report treats as circumstantial but notable. Dronewatch Europe, an independent monitoring project, has pushed back on the study's conclusions, noting that no launch has been observed, no command link intercepted, no wreckage recovered, and no telemetry released connecting any drone to any vessel.
Analysis & Assessment
The evidentiary gap is the central tension in this assessment, and it is likely intentional on Moscow's part if the IISS reading is correct. The report itself argues that a high rate of unconfirmed sightings is "analytically consistent with Russian operational design," since an environment of manufactured ambiguity is more useful to a reconnaissance campaign than a confirmable one: it collects data on NATO's radar coverage, response timelines, and command authorities without ever crossing a threshold that would force an Article 4 or Article 5 conversation.
Attribution restraint by the affected governments most plausibly reflects a calculation that going public with a definitive case would expose the SIGINT, radar, or human sources used to build it, not that the case does not exist. If that reading holds, expect continued official ambiguity even as private intelligence-sharing among NATO members hardens, and expect the campaign's stated objectives, mapping detection gaps and normalizing low-level airspace violations, to remain the working assumption inside allied planning cells regardless of what is said publicly.
The unresolved variable is Europe's material response. IISS explicitly rates continental counter-UAS capability as inadequate: detection is uneven, legal authorities are fragmented across jurisdictions, and attribution moves too slowly to support deterrence. The UK's deployment of its ORCUS counter-drone system to Denmark and Belgium suggests the beginning of a coordinated fix, but a single system rotating between two countries does not yet constitute continental coverage against a campaign documented across thirteen.