Russian Shadow Fleet Ships Linked to Drone Incursions Over Europe

A new report from the International Institute for Strategic Studies (IISS) provides evidence that Russian-linked commercial ships, part of a "shadow fleet" transporting sanctioned oil, have been launching drones over European military bases, airports, and critical infrastructure. The report covers 144 drone sightings across 12 NATO countries and Ireland between August 2024 and February 2026, with 48% over military bases, 26% over critical infrastructure, and 18% over civilian airports.

Specific Incidents and Ships

The most compelling case: the oil tanker Boracay, a shadow fleet vessel, was investigated by Danish authorities after drone sightings disrupted air traffic across Denmark in September 2025, forcing the temporary closure of Copenhagen Airport and Aalborg Royal Danish Air Force base. French naval commandos boarded the Boracay off the French coast on September 28, 2025, and found two Russians employed by the Moran Security Group, a private military company founded by former FSB officers. One had previously worked for the Wagner Group. The Russians were tasked with "gathering intelligence, protecting the vessel and ensuring the captain strictly adhered to Russian interests." The Chinese captain was convicted in absentia by a French court on March 30, 2026, sentenced to one year in prison and fined $172,000.

Another vessel, the cargo ship Hav Dolphin (flagged in Antigua and Barbuda, Russian crew), was docked in the UK during drone incursions at RAF Lakenheath, RAF Fairford, RAF Feltwell, and RAF Mildenhall between November 20-26, 2024. These bases host US Air Force personnel and aircraft, with RAF Lakenheath slated for $1.6 billion in upgrades including facilities for housing a nuclear arsenal. The Hav Dolphin later anchored near Kiel, Germany in May 2025, coinciding with drone sightings at the German submarine base at Eckernförde.

On November 21, 2025, up to 10 drones conducted a "highly coordinated flight" over Volkel Air Base in the Netherlands, evading capture despite security attempts to shoot them down. This coincided with drone sightings over Eindhoven Airport, shutting down civil air traffic across the southern Netherlands. Multiple shadow fleet ships—Arctica, Cgas Leopard, Tranquil Sea, and Eagle S—were loitering in international waters or anchorages near Dutch and French coasts. The Eagle S had previously been investigated for severing undersea cables in the Baltic Sea on Christmas Day 2024 (a Finnish court later dismissed the case for lack of jurisdiction).

In early December 2025, five drones were detected over the Île Longue base in Brittany, France, which houses French nuclear ballistic missile submarines. The suspect ships Hav Dolphin and Arctica were within 350–370 km of the base, while three other shadow fleet ships were even closer.

Drone Models and Capabilities

The IISS report identifies several drone models consistent with ship-launched operations:

  • Orlan-10: A fixed-wing drone with a 500 km operational range, up to 12 hours endurance, and speeds of 90–130 km/h. Its combustion engine noise matches witness accounts from RAF Lakenheath incidents. It can carry payloads for GPS spoofing, communications network monitoring, and optical/thermal sensors. Its range and payload are "consistent with maritime launch from a vessel operating well beyond visual detection range of European coastlines."
  • Merlin-VR: A fixed-wing drone launched by a shipboard catapult and recovered by parachute. It has the flight range and loiter capability for many incursions.
  • Legioner E29: A VTOL electric drone requiring minimal deck space.

The report notes that homemade or commercial drones could also be modified to prevent easy attribution.

European Response and Gaps

The European Union is developing the European Drone Defence Initiative (EDDI) to deploy interoperable counter-drone technologies, but it won't be fully operational until end of 2027. The IISS warns that "no amount of hardware will compensate for the absence of political authority to use it," and calls for coordinated rules of engagement. The "hardest" problem is maritime accountability: European governments must be willing to investigate and stop shadow fleet vessels loitering near coasts.

Technical Takeaways for Developers

  • AIS data analysis can be used to correlate vessel positions with drone sightings. Developers can build tools to cross-reference maritime tracking data with airspace incident reports.
  • Drone detection systems need to handle low-cost, small drones that evade traditional radar. Counter-drone technologies like RF jamming, GPS spoofing detection, and acoustic sensors are relevant.
  • Maritime surveillance APIs (e.g., from MarineTraffic or exactEarth) can be integrated into security dashboards to monitor suspicious vessel movements.

Conclusion

Europe's air defense is vulnerable to cheap drones launched from commercial ships. The IISS report provides a data-driven framework for understanding the threat. Developers in defense, security, or data analysis should explore AIS data integration and drone detection algorithms. The next step is for governments to act on the report's findings and accelerate counter-drone initiatives.