Russia's Shadow Fleet May Be Running a Drone Harassment Campaign Across NATO Europe
A new report from the International Institute for Strategic Studies makes a compelling case that Russia has been using commercial ships, including vessels from the infamous shadow fleet that moves sanctioned Russian oil, to launch drones over European military bases, airports, and critical infrastructure.
The IISS cross-referenced AIS maritime tracking data with publicly documented drone incidents across Europe between August 2024 and February 2026. The pattern they found is awkward to dismiss. Russian-linked vessels were repeatedly sitting nearby when unexplained drones appeared over sensitive NATO sites.
Out of 144 drone sightings the IISS identified as unlikely to be hobbyists or Ukraine war spillover, nearly half occurred over military installations. A quarter targeted critical infrastructure. Around 18 percent disrupted civilian airports. Most happened at night, and witnesses consistently described the drones as professional or military-grade rather than the kind of thing you'd buy from a hobby shop.
The think tank stops short of attributing every incident to Moscow, but describes the overall pattern as consistent with the Kremlin probing allied defences, stress-testing civilian and military response procedures, and gradually normalising low-level airspace violations without quite crossing into anything that triggers a formal military response. Subtle, deniable, and deeply annoying. Classic.
The one incident with a confirmed Russian fingerprint came in February 2026, when Swedish forces spotted a drone lifting off from the Russian signals intelligence ship Zhigulevsk while it sat in Swedish territorial waters. Inconveniently for Moscow, the French carrier Charles de Gaulle happened to be visiting at the time. The Swedes jammed the drone. The Russians said nothing, as is tradition.
What hardware might be involved
The IISS fingered a few plausible candidates for the drones themselves. The Orlan-10 keeps coming up. It's a fixed-wing Russian military drone with a 500km operational range, up to 12 hours of endurance, and the ability to carry GPS spoofing modules, communications intercept payloads, and optical or thermal sensors. Critically, it fits on the deck of a mid-sized commercial vessel. Its combustion engine produces a distinctive sound that matches witness accounts from drone incursions near RAF Lakenheath in November 2024.
The Merlin-VR is another candidate, a ship-launchable fixed-wing drone that uses a catapult for takeoff and a parachute for recovery. Russia has also developed VTOL drones like the Legioner E29 that need minimal deck space. The report also raises the possibility that modified commercial drones were used precisely because they're harder to attribute.
The incidents themselves
RAF Lakenheath, the largest US military base in the UK and the site of a planned $1.6 billion upgrade that includes nuclear weapons storage facilities, saw repeated drone incursions between November 20 and 26, 2024. So did RAF Fairford, RAF Feltwell, and RAF Mildenhall. During that same window, the cargo ship Hav Dolphin, flagged in Antigua and Barbuda but crewed by Russians, was docked in the UK.
The same Hav Dolphin later turned up anchored off Kiel in Germany in May 2025, just as drones appeared over a submarine base at Eckernförde nearby. German authorities took notice.
Also in November 2024, drones entered the airspace over Kleine-Brogel Air Base in Belgium on three consecutive nights. That base stores US nuclear weapons under NATO's nuclear-sharing arrangement. Ramstein Air Base in Germany, headquarters for both NATO Allied Air Command and US Air Forces in Europe, saw drone overflights on November 26 and intermittently into early 2025.
In the Netherlands, Volkel Air Base, another nuclear-sharing site, was targeted on multiple occasions in late 2025. The most significant incident, on November 21, 2025, involved up to ten drones in what the IISS calls a highly coordinated flight. Base security tried and failed to bring them down. Simultaneously, drones over Eindhoven Airport forced a brief shutdown of civil air traffic across southern Netherlands. Several shadow fleet ships, including the Arctica, Cgas Leopard, Tranquil Sea, and the Eagle S tanker (previously investigated for cutting Baltic Sea cables on Christmas Day 2024), were loitering in nearby waters at the time.
In December 2025, five drones appeared over Île Longue in Brittany, the home of France's nuclear ballistic missile submarine fleet and its associated warhead stockpile. The Hav Dolphin and Arctica were both within 370km of the base when it happened.
The Boracay case
The most revealing episode involves an oil tanker called the Boracay. In September 2025, drone swarms disrupted airports across Denmark and briefly shut Copenhagen Airport and the Aalborg air force base. Danish investigators focused their attention on the Boracay, which was offshore when it happened.
On September 28, 2025, French naval commandos boarded the vessel off the French coast. What they found was not your standard merchant crew. The ship had a Chinese captain, but two of its personnel were Russians employed by Moran Security Group, a private military company founded by former FSB officers. One of them had also previously worked for Wagner.
Interviews with the crew revealed the Russians were there to gather intelligence, protect the vessel, and make sure the captain followed Russian instructions. The IISS describes this as direct evidence of a shadow fleet ship linked to Russian intelligence structures. A French court subsequently convicted the Chinese captain in absentia, sentencing him to a year in prison, issuing an arrest warrant, and handing him a fine of roughly $172,000.
Europe's response has been patchy
The EU is developing something called the European Drone Defence Initiative, which aims to give member states interoperable counter-drone capabilities. It won't be ready until the end of 2027. In the meantime, the responses to individual incidents have been uncoordinated, legally murky, and frequently ineffective.
The IISS is blunt about this: no amount of hardware solves the problem if governments haven't sorted out the legal authority to actually use it. Rules of engagement for drone incursions remain unclear across much of Europe.
The hardest piece, the report argues, is maritime accountability. Shadow fleet vessels have been loitering off European coasts and, if this assessment is correct, launching drones with near-total impunity. Until European governments are willing to board, detain, and genuinely investigate these ships, that's unlikely to change.