Russia likely ran an 18-month drone campaign across Europe from shadow ships, report says

An analysis by the International Institute for Strategic Studies says Russia likely ran an 18-month drone campaign across Europe, with 144 suspected sightings mapped across more than a dozen countries and some launches linked to shadow-fleet vessels.

Published on July 2, the report says the incidents were not isolated. Instead, it describes a pattern that stretched from late 2024 into 2026 and appears to have targeted airports, military bases, defense-industry sites and nuclear-linked infrastructure while staying below the threshold for a direct NATO response.

The findings have not been independently verified in full, and attribution remains indirect in many of the cases. Even so, the report argues that the scale, geography and timing of the incidents point to a coordinated cross-border campaign rather than a series of separate drone events.

What the report found

The IISS analysis plotted suspected drone sightings across NATO countries including Germany, France, Belgium, the Netherlands, the U.K. and Denmark, as well as Ireland. It says the pattern peaked in late 2025, when the disruptions included temporary airport closures in Denmark.

Among the incidents highlighted in the reporting were drone activity near RAF Lakenheath and RAF Fairford in the U.K. and near France’s Île Longue submarine base. The report also says some incidents may have involved the HAV Dolphin near Hull and the Seasons 1 tanker near Essex.

The analysis says the drones were used in ways that mapped NATO air-defense gaps and took advantage of weaknesses in surveillance, rules of engagement and maritime enforcement. That matters because the campaign appears to have been designed to probe defenses without triggering a collective military response.

Why shadow ships matter

A central finding in the report is that Russia likely used shadow-fleet or other covert vessels as launch, recovery or relay platforms in some cases. Shadow-fleet vessels are typically unmarked or covertly operated ships used to evade sanctions.

If that assessment is correct, it would widen the security challenge for European states. The threat would not be limited to monitoring airspace near the intended target. It would also require tracking suspicious vessels moving through busy shipping lanes, ports and territorial waters.

The report frames that maritime angle as part of a broader hybrid pressure campaign against Europe. The implication is that commercial shipping routes may have been used to create concealment, mobility and deniability for drone operations.

Chronology of the campaign

The report says the earliest incidents date to November 2024, when drone activity was reported over U.K. bases including RAF Lakenheath and RAF Fairford. Those episodes are presented as the beginning of the campaign.

The pattern then expanded over the following months and years, with the incident map spanning multiple countries and sensitive sites. According to the report, the activity reached its peak in September 2025, when drone disruptions included airport closures in Denmark.

By July 2, 2026, the IISS analysis had been published publicly and the reporting on it had spread across major outlets. The timing is important: this is not an older incident being reinterpreted, but a newly published assessment of a continuing security problem.

Stakes for Europe and NATO

The most immediate stakes are aviation safety and critical infrastructure protection. Repeated drone sightings near airports create disruption risks even when the aircraft do not cause physical damage.

The broader concern is military and strategic infrastructure. Sites linked to air bases, submarines and defense operations are harder to protect if drones can arrive from unexpected vectors or be launched from vessels outside the normal perimeter of land-based surveillance.

The report also raises questions about NATO readiness. If the incidents were intended to remain below the collective-response threshold, then the campaign may have exploited a gray zone in which states are forced to respond individually even when the pattern is transnational.

Government reaction and attribution

The AP report on the IISS findings says Danish Prime Minister Mette Frederiksen described the Danish incidents as the most serious attack on Danish critical infrastructure to date. That framing reflects how seriously Denmark has treated the drone disruptions.

The reporting also says Sweden has officially blamed Moscow, while most other governments have been reluctant to make direct attributions. That caution is consistent with the report’s own language, which says many of the incidents are linked to Russia only through indirect evidence and pattern analysis.

The result is a familiar dilemma for European governments: the security threat looks coordinated, but the evidentiary threshold for public attribution is often higher than the threshold for concern.

What comes next

The next question is whether the full IISS report, or additional government disclosures, identifies more of the 144 incidents with direct evidence. A fuller incident list could clarify which cases are strongly attributed and which remain circumstantial.

It will also be important to see whether NATO or individual governments move from general concern to specific counter-drone and maritime enforcement measures. The reporting suggests existing air-defense systems are not enough if the launch platform can be hidden at sea.

For now, the report’s central claim is that a scattered series of drone incidents across Europe may have been part of a much larger Russian campaign, one that combined aviation disruption, covert maritime support and systematic testing of European defenses.