For 18 months, a shadowy armada of Russian‑linked vessels is alleged to have operated just beyond Europe’s horizons, launching small drones that slipped over airbases, ports, and nuclear installations with alarming regularity. The International Institute for Strategic Studies (IISS) says it is
“highly likely that the Kremlin conducted a coordinated UAV [unmanned aerial vehicle] campaign over Europe”
between August 2024 and February 2026, logging 144 separate incidents across more than a dozen countries and exposing what researchers call
“a strategic failure of allied air defence.”
The campaign’s most sensitive targets were nuclear deterrence infrastructure: sites in the UK, France, Belgium and the Netherlands where US and European nuclear weapons are stored or where ballistic missile submarines are based.
How the operation reportedly worked
As per the IISS analysis, the maritime-centric approach entails the use of the so-called shadow fleet, which includes tankers and cargo ships that do not have transponders turned on and/or obscure ownerships. Scholars believe that the drones could be launched and recovered from ships at sea, including relay vessels, in a manner that has been perfected through the war in Ukraine. This process was not random. Sightings peaked in late 2025; specifically, there was a sharp increase in sightings from an average of four incidents per month to 22.5 per month from September to December 2025. In this period, Germany reported 58 sightings. Approximately 48% of the sightings were made above military installations, while 18% and 26% were made above civilian airports and critical infrastructures like ports and energy facilities.
The nuclear targets: why they matter
It is the nuclear dimension of the campaign that has elicited the most intense interest. In the UK, there have been sightings of drones over RAF Lakenheath and RAF Fairford and other US Air Force bases in November 2024 when Lakenheath was preparing to take in US nuclear weapons; US nuclear weapons were eventually deployed there in July 2025, per the timeline of events in the report. In France, there have been sightings of five drones over Île Longue in Brittany on December 4, 2025, where the submarine-based nuclear weapons of the French Navy are based. In Belgium and the Netherlands, incursions have been reported over Kleine-Brogel and Volkel air bases, where US B61-12 gravity bombs, under NATO’s nuclear sharing program, are stored.
Shadow fleet vessels and the maritime link
The marine aspect forms an essential part of the IISS storyline. There is evidence showing how drone incidents are linked to Russian vessels in the North Sea and the surrounding waters through correlation studies. According to the research findings, there is evidence showing how vessels like the Seasons 1 oil tanker and the HAV Dolphin cargo vessel were involved in these incidents. An example of this is seen where French commandos took control of the shadow fleet tanker Boracay in September 2025 off the coast of Denmark because of drone sightings that forced the closing of Copenhagen Airport for some hours. The raid showed a Chinese skipper and two Russian nationals employed by the Russian private military organization, Moran Security Group. Although there is no direct information of the discovery of any particular drone associated with the vessel, there is an emphasis on the consistencies of vessel movements and “dark sailing.”
The gaps in Europe’s air defenses
Another common aspect in the IISS analysis is the fact that the air defenses of NATO and Europe were geared towards dealing with conventional flights and attacks coming from high altitudes rather than the drones being used against them in the Baltic Sea. According to Charlie Edwards, a IISS fellow quoted by reporters covering the story, the European governments were reticent about accusing the Russian government of the attacks, yet they appreciated the publication of the report as it might lead to changing the policies. According to Lord Ricketts, former national security advisor in the UK, who responded to the report through media interviews, the findings were a “wake-call” concerning the problem and urged giving priority funding to the technology for fighting drones. The IISS described the Russian operation as “a series of tactical successes for the Kremlin” and “strategic failure of allied air defense.”
Objectives: reconnaissance, pressure, and signaling
The IISS identifies multiple motives rather than singling out any particular one. Firstly, these drones most probably conducted surveillance on nuclear deterrent infrastructure, logistics, and supply lines in order to understand how Europe’s deterrent network is defended and maintained. Secondly, the repeated violations were used for the purpose of putting additional psychological pressure on civil and military authorities since airports had to close their operations due to the attacks. Thirdly, the whole campaign could be seen as an attempt to send a message in the context of Russia’s “unconventional war” against Europe. It shows the reach and persistence of Russian operations without crossing the line which would force NATO to conduct retaliatory actions.
The incidents that defined the campaign
Outside of the nuclear facilities, however, the most disruptive actions took place at large civilian airports and military installations. In Denmark, for example, the sighting of drones in September 2025 led to the closure of Copenhagen Airport, where four shadow fleet tankers had been sighted in the vicinity. In Ireland, four drones were spotted heading towards the Irish naval ship after the visit by President Zelensky in December 2025; at that point, a Maltese-flagged ship named Vezhen was present in the area. In Germany, it is clear from the sheer number of sightings (58 in total) that mapping was taking place across military and dual-use infrastructures. According to the IISS, the most obvious pattern in the mapping was associated with nuclear deterrence infrastructure, with Kleine-Brogel and Volkel being targets along with Île Longue, where a five-drone attack took place on December 4, 2025.
Attribution, evidence, and the limits of what is known
The IISS stops short of claiming definitive proof that the Kremlin ordered each flight, instead using the language of assessed likelihood: “highly likely” that the Kremlin conducted a coordinated campaign. The report leans on correlation of vessel movements, incident clustering, and the operational feasibility of maritime launch and recovery, rather than on recovered hardware publicly tied to a specific ship. This cautious framing reflects both the nature of open‑source intelligence and the diplomatic sensitivities involved; European leaders have generally avoided explicit formal accusations in many cases, even as they acknowledge the threat. Media coverage has noted that while the pattern is striking, the absence of public, physical proof of launch from a specific vessel means that hard evidence directly proving Kremlin orders remains limited in the open domain.
Policy implications and the road ahead
There are obvious policy implications from the IISS conclusions. First, it emphasizes the requirement to develop layered solutions for countering UAS with an emphasis on detecting and neutralizing LLLS drones. Second, there is the question of maritime domain awareness, specifically related to the detection and identification of shadow fleets which may operate without much transparency. Third, it implies that NATO and European countries should reevaluate their air defense strategy and approach towards small drones as a strategic threat rather than a nuisance. Indeed, the British government reaction to the results mentioned above is evident from the increased funding for anti-drone measures, laws against sabotage, and threats of serious consequences in case of any attempts at interference.
What the campaign reveals about modern hybrid warfare
The Russia drone surveillance of European nuclear sites episode illustrates how hybrid warfare can be waged below the threshold of war while still achieving strategic effects. By using shadow‑fleet vessels and small drones, the alleged campaign combined deniability, persistence, and precision, probing Europe’s defenses without triggering a collective military response. The IISS assessment that this was
“a series of tactical successes for the Kremlin”
and
“a strategic failure of allied air defence”
captures the core lesson: that adversaries can exploit technological and doctrinal gaps to conduct sustained intelligence operations against the most sensitive sites. For European capitals, the challenge now is to translate that lesson into capability, doctrine, and deterrence before the next 18‑month campaign begins.
