Russian Shadow Ships May Have Launched Drones Over European Infrastructure

An IISS investigation links 144 suspicious drone incidents to Russian shadow-fleet activity, suggesting vessels built to evade oil sanctions may also serve as platforms for reconnaissance and hybrid operations against NATO countries.

Russia likely used vessels associated with its shadow fleet to launch, recover or support drones operating near European airports, military installations and critical infrastructure, according to a new investigation by the International Institute for Strategic Studies.

The report shared with the Associated Press mapped 144 suspicious drone sightings across 13 NATO states and Ireland between August 2024 and February 2026. It compared the timing and location of those incidents with movements by vessels whose ownership, flagging or trading patterns link them to Russia’s sanctions-evasion network.

The assessment is probabilistic rather than a public presentation of forensic proof for every incident. European governments have generally avoided formal attribution. Even so, the pattern shifts the shadow-fleet debate beyond oil revenue, insurance and environmental risk. Commercial-looking ships may also provide mobile, deniable platforms for intelligence collection and testing European air defences.

From sanctions evasion to operational access

The shadow fleet grew as Russia sought to keep oil moving despite Western restrictions. Its vessels often use opaque ownership, frequent flag changes, weak insurance and inconsistent tracking practices.

Those characteristics also create operational advantages. A tanker or cargo vessel can move through busy European waters without the political visibility of a Russian naval ship. It can remain offshore near airports, naval bases, submarine facilities or energy infrastructure while blending into civilian traffic.

The IISS assessment says some ships may have launched drones with their tracking transponders switched off, while other vessels with visible identities could have supported recovery or communications. The use of several vessels would complicate attribution and allow an operator to separate launch, control and retrieval functions.

Defence Matters has previously examined how Russia’s shadow fleet is increasingly protected and integrated into maritime security activity. The new report suggests the network may itself be used for active hybrid operations.

What the drones may have been doing

The recorded sightings included activity near civilian airports, military sites, nuclear-related facilities and critical infrastructure. Potential purposes include surveillance, mapping response times, collecting electronic signatures and creating disruption without crossing the threshold of an armed attack.

Airport closures impose economic costs and public anxiety even when a drone carries no weapon. Flights are diverted, security teams mobilise and authorities face pressure to act without knowing who controls the aircraft.

Military overflights can be more valuable. Repeated observation may reveal radar coverage, patrol routines, construction, aircraft movements or how quickly counter-drone units deploy. A hostile service can learn from the response even if the drone is lost.

Defence Matters warned after earlier incidents that Europe lacked consistent authority and equipment to stop rogue drones. A mobile maritime launch system makes that problem harder because the operator may remain outside territorial waters.

The attribution problem

Correlation between a ship’s position and a drone sighting is not by itself proof of launch. Investigators need radar tracks, radio-frequency data, imagery, recovered components and intelligence on crews and ownership.

European authorities have been reluctant to disclose such information, partly to protect sources and methods. The resulting silence creates a policy gap: governments may privately assess Russian responsibility while publicly treating each incident as unexplained.

That ambiguity benefits Moscow. It allows disruption without a clearly attributable act that would trigger a unified response. Russia denies conducting sabotage operations in Europe.

The answer is not careless public accusation. It is a shared evidentiary framework among NATO members, maritime agencies and civilian aviation authorities. Suspicious ship movements, drone data and electronic intelligence must be analysed together rather than held in national silos.

Europe needs a maritime counter-drone policy

The IISS findings strengthen the case for closer monitoring of shadow vessels, especially those loitering near sensitive coasts or operating with disabled transponders. Inspection powers, port restrictions and sanctions can raise the cost of using commercial shipping for covert activity.

Navies and coastguards also need systems capable of detecting small drones from sea, tracing control links and preserving evidence. Civil authorities require clear rules on when police or military units may jam or destroy an aircraft.

The shadow fleet has always been more than a collection of tankers. It is an infrastructure of ambiguity. If the IISS assessment is correct, Russia has extended that infrastructure from sanctions evasion into reconnaissance and coercion.

Europe’s response must therefore connect maritime enforcement, counter-intelligence and air defence. Treating each suspicious drone as an isolated nuisance leaves the network’s principal advantage intact.