Russia's shadow fleet has served as the launch infrastructure for a sustained drone campaign targeting NATO nuclear sites, military bases, and critical infrastructure across thirteen European states — a capability that existing counter-drone architecture is structurally incapable of addressing.

Intelligence Lead

The International Institute for Strategic Studies has assessed with high confidence that Russia conducted a systematic UAV campaign over European NATO territory between August 2024 and February 2026, using shadow fleet tankers and intelligence vessels as seaborne launch platforms. The campaign — 144 documented incidents across 13 states — was designed to probe Western air defences, surveil nuclear deterrence infrastructure, and impose recurring disruption costs while remaining below the threshold of collective NATO response. Europe's counter-drone architecture, as currently configured, has no mandate over the maritime domain from which the threat originates.

Situation Report

The IISS report, authored by senior fellow Charlie Edwards and published today, compiles a dataset of 144 drone sightings across 13 European states spanning August 2024 to February 2026. Incidents concentrated heavily around military facilities (48%), civilian airports (18%), and critical infrastructure including ports and energy sites (26%). Reported sightings surged from an average of four per month to 22.5 per month between September and December 2025, with Germany alone recording 58 incidents.

The targeting pattern is assessed as deliberate. Nuclear deterrence infrastructure featured prominently: Kleine-Brogel Air Base in Belgium and Volkel Air Base in the Netherlands — both confirmed hosts of US B61-12 nuclear gravity bombs under NATO sharing arrangements — recorded multiple overflights. The French ballistic missile submarine base at Île Longue was penetrated on 4 December 2025, with five drones detected over the facility. Copenhagen, Brussels, Munich, Oslo, and Vilnius airports were each temporarily closed in response to separate incidents.

Shadow fleet vessels — operating at times with AIS transponders disabled — are assessed as the primary launch platform for a subset of incidents. The strongest confirmed case: on 26 February 2026, Swedish military forces jammed a drone launched from the Russian signals intelligence ship Zhigulevsk toward the French aircraft carrier Charles de Gaulle during a port visit to Malmö. It remains the only incident publicly attributed to a specific Russian platform. A broader indicator emerged on 28 September 2025, when French naval commandos boarded the tanker Boracay and found two employees of a Russian private military company aboard.

Background & Context

Russia's shadow fleet — a network of ageing tankers and freighters used to circumvent energy sanctions — has increasingly been repurposed as a dual-use covert operations infrastructure. Operating in international waters, often with falsified registrations and disabled tracking transponders, these vessels afford Russia a degree of maritime deniability unavailable to conventional naval assets. The fleet's expansion since 2022 has been extensively documented; its conversion into an ISR and drone operations platform represents a significant capability evolution that Western intelligence services have been slow to characterise publicly.

Europe's counter-drone response has accelerated since 2025. NATO's Operation Eastern Sentry, combined with new shootdown authorisations in Germany, Lithuania, and Romania, has increased detection capacity. The European Drone Defence Initiative — the so-called "Drone Wall" — is targeting initial operational capability by end of 2026. However, the architecture is oriented toward aerial interception after border crossing. No mandate exists to interdict the maritime vessels deploying platforms before they enter the threat envelope.

Analysis & Assessment

The IISS assessment establishes that Russia's drone activity over Europe was not a series of isolated incidents but a coordinated intelligence and harassment operation calibrated to avoid triggering a collective NATO response under Article 5. The deliberate targeting of nuclear storage and SSBN facilities indicates the campaign's primary intelligence objective extended beyond disruption to persistent surveillance of NATO's nuclear posture — specifically, the location, readiness cycle, and physical security of second-strike assets. That assessment carries significant strategic weight.

The maritime launch mechanism is the critical finding. As long as shadow fleet vessels can loiter in international waters, operate with disabled AIS, and deploy UAVs with effective impunity, the campaign's fundamental enabling infrastructure remains intact. The Drone Wall addresses only the distal end of the kill chain. Europe has invested in the shield while the sword — mobile maritime launch platforms — continues to operate freely. A policy framework covering maritime interdiction of suspected drone launch vessels has not yet emerged in NATO planning doctrine. The confirmation that Russian PMC personnel were aboard at least one shadow fleet vessel raises a further possibility: that Russia is partially outsourcing drone operations to deniable contractor networks, creating additional attribution complexity and insulating the Kremlin from direct accountability for individual incidents.