In late November 2024, a surge of activity unfolded over strategic US and UK airbases in East Anglia—RAF Lakenheath and RAF Fairford—where the US had resumed stationing its tactical nuclear weapons in the summer of 2025. Over the course of a week, groups of unidentified, low-flying unmanned aerial vehicles (UAVs) were detected within the restricted airspace of these facilities. A few months later, in September 2025, similar incidents completely paralyzed Copenhagen International Airport, prompting Danish security services to declare the highest alert level. In December of the same year, five large drones breached the ultra-secret perimeter of the Île Longue French nuclear submarine base in Brittany.
Western intelligence agencies spent a long time struggling to pinpoint the launch sites of these assets, as radar failed to track them crossing any European land borders. The answer lay at sea. As demonstrated by a massive joint investigation by the International Institute for Strategic Studies (IISS) and leading European defense agencies published in July 2026, these incidents are directly linked to the operations of Russia’s so-called “shadow fleet.” Hundreds of aging commercial tankers roaming European waters have outgrown their original function of bypassing economic sanctions. Today, they serve as mobile, legally protected floating platforms under international law for the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU), deployed for hybrid warfare, electronic warfare, and large-scale espionage right off the coasts of NATO countries.
Understanding how civilian vessels transformed into instruments of military expansion requires looking back at the economic realities of 2022. Following Russia’s full-scale invasion of Ukraine, Western nations imposed an embargo and a strict price cap on Russian crude oil. In response, Moscow allocated billions of dollars to build a massive maritime shipping architecture operating entirely outside Western financial and insurance jurisdictions. By 2026, this “shadow fleet” had swelled to colossal proportions, numbering over a thousand tankers and handling roughly 60% of all seaborne Russian crude oil exports. Economically, this scheme generates billions of dollars monthly, funneled directly into financing military operations. These vessels utilize “flags of convenience,” registering in states like Gabon, Panama, or Malta, which legally shields them from direct oversight by European regulators. Sailing through the Baltic, North, Mediterranean seas, or the English Channel, the captains of these tankers systematically employ “Dark Sailing” tactics—completely disabling their Automatic Identification System (AIS) transponders, making them invisible to standard civilian monitoring. In international waters, they conduct dangerous ship-to-ship (STS) oil transfers to mask the origin of their cargo.
Until recently, European analysts assessed the risks of the shadow fleet primarily through an environmental and maritime safety lens, given that the lack of high-quality international insurance threatens catastrophic oil spills off the Scandinavian or Baltic coasts. However, as the events of the past two years have shown, the Kremlin found an entirely different application for this fleet, turning commercial vessels into the perfect cover for sabotaging subsea internet cables, jamming GPS signals (GPS djamming), and conducting aerial reconnaissance.
The key document unmasking these maritime operations was the July 2026 IISS report. Institute experts presented the results of a meticulous cross-analysis of satellite imagery, vessel tracking data, physical radio intercepts, and national police reports. The findings were staggering, revealing a clear spatial-temporal correlation between August 2024 and February 2026 linking the presence of specific Russian tankers in European waters to 144 unauthorized UAV incursions into the airspace of 12 NATO countries and Ireland.
Data analysis exposed the distinct operational patterns of Russian intelligence services. Crucially, drone launches are executed directly from the decks of commercial ships situated in international waters or at anchorages close to the European coastline. The primary intelligence tool is the Orlan-10 UAV and its variants, disguised as civilian drones. With an operational range of up to 300 miles (approximately 480 kilometers) and an endurance of up to 12 hours, these drones allow operators to control them without leaving the vessel, remaining in the relative legal safety of international waters.
A CNN investigation published in December 2025 shed light on the internal mechanics of these operations. According to confidential European intelligence data, trained personnel from Russian private military companies are embedded aboard shadow fleet vessels disguised as “technical specialists,” “marine engineers,” or “safety inspectors.” Among them, mercenaries from the Moran Security Group and former Wagner PMC operatives have been identified, their actions coordinated directly by GRU handlers. They bring containers holding reconnaissance gear, UAV launchers, and electronic warfare stations onto the ships.
The IISS report names specific vessels and incidents highlighting the geographic reach of the Russian campaign.
In November 2024, the cargo ship HAV Dolphin, flying the flag of Antigua and Barbuda with an all-Russian crew, anchored in the British port of Hull. During those exact days, surveillance drones filled the skies over nuclear storage facilities in Suffolk and nearby US bases. In May 2025, German security forces spotted the same vessel in the North Sea while drones were spying on Bundeswehr exercises in northwestern Germany. Finally, in December 2025, the HAV Dolphin was located off the Isle of Wight in southern England during the precise hours when five drones swarmed the Île Longue French strategic submarine base.
In November 2024, the tanker Seasons 1 maneuvered in the North Sea close to the Essex coast, coordinating reconnaissance flights over RAF bases.
In the autumn of 2025, the tankers Arctica and Boracay operated in Danish territorial waters. Their presence coincided with the September paralysis of Copenhagen Airport and a January 2025 incident where up to 20 unidentified UAVs circled the Port of Køge simultaneously. The tanker Boracay was subsequently subjected to an unprecedented boarding and search by French naval special forces, who discovered remnants of dismantled launching equipment.
In December of the same year, four large military drones were launched from the Maltese-flagged vessel Vezhen 30 miles off the Dublin coast. The drones ostentatiously circled an Irish Naval Service warship immediately following an official visit to the country by Ukrainian President Volodymyr Zelenskyy.
The objectives of these flights go far beyond basic aerial photography. Russian military planners are solving a complex puzzle: they are mapping critical infrastructure, tracking troop movements, intercepting internal communication channels, and, most importantly, testing response times and operational protocols of European air defense and electronic warfare systems by deliberately baiting them into activating their radars. Why did NATO’s advanced military machine and European security architectures prove so vulnerable to this threat? The answer lies in a profound socio-political and legal crisis that the Kremlin masterfully exploits within its hybrid warfare doctrine.
The first European vulnerability lies in the provisions of international maritime law. The UN Convention on the Law of the Sea (UNCLOS) guarantees commercial vessels of all nations the right of “innocent passage” through territorial seas and freedom of navigation in international waters. To stop, search, or detain a tanker flying the flag of a country like Gabon in international waters, European states require ironclad legal proof of a crime committed on board. However, when transponders are turned off and a drone is launched at night, proving a direct link between a specific vessel and a UAV launch point beyond visual line of sight is exceptionally difficult in a court of law. This creates an attribution crisis: European governments know who is behind the attacks but find their hands tied by their own legal frameworks.
The second issue is technical. Existing national air defense systems in European countries were historically designed to detect and destroy large, high-speed military targets, such as fighter jets, cruise missiles, and ballistic missiles. Small, low-flying commercial and reconnaissance UAVs moving at low speeds are often misidentified by radar as “birds” or “clutter.” Furthermore, out of the 144 incidents documented by the IISS, not a single drone was shot down by European militaries. This was due to strict internal guidelines prohibiting engagement over densely populated areas or civilian infrastructure due to the risk of falling debris and the absence of a formal state of war. This paralysis within defense systems has drawn sharp criticism from military departments in Sweden, Finland, and the Baltic states, all demanding an immediate overhaul of the rules of engagement.
For ordinary citizens of the European Union, the activities of the “GRU shadow fleet” have ceased to be a distant geopolitical abstraction, morphing into tangible risks to their daily lives. The surge in Russian hybrid activity at sea strikes at highly sensitive sectors. Specifically, commercial aviation passengers face scheduling disruptions and emergency airspace closures over major transport hubs, as seen in Copenhagen due to the risk of mid-air collisions with reconnaissance UAVs. European energy security is also under a permanent microscope, as the presence of suspicious Russian tankers along shipping lanes is now viewed as a direct sabotage threat to offshore wind farms, critical gas pipelines, and LNG terminals. Exacerbating the situation is an impending regional environmental catastrophe, since Russia’s use of poorly maintained, uninspected vessels without reliable international insurance exponentially raises the risk of massive oil spills in the Baltic and North seas. Ultimately, this shadow war inflicts a heavy financial toll on ordinary people; European governments are forced into emergency budget reallocations to abruptly increase defense spending on Counter-UAS (C-UAS) systems, a burden that inevitably shifts onto taxpayers.
Europe’s political landscape is also transforming. A rift is widening between nations demanding radical action (the Baltics, Scandinavia, and the UK) and Southern European states whose ports and companies still profit, directly or indirectly, from servicing maritime trade, even if it belongs to the “shadow” market.
The expert community and NATO military leadership agree that targeted sanctions against specific individuals or individual vessels are no longer effective. A systemic, aggressive counter-strategy is required, demanding political will and legislative reform from Europe. IISS analysts and specialized maritime agencies recommend addressing three core issues.
The first is tightening transit regulations through critical straits. EU states controlling key maritime arteries—most notably Denmark through its straits—must introduce a mandatory ban on the passage of vessels lacking transparent beneficial ownership structures and verifiable, Western-approved environmental insurance. Any vessel operating with an inactive transponder (AIS) must be immediately detained by the coast guard for inspection.
At the EU-wide level, there must be a legislative overhaul regarding the use of force against UAVs (C-UAS). Legal norms must be adopted to authorize and compel military structures to instantly destroy or electronically suppress any unidentified drones breaching the security perimeter of critical, military, or civilian installations. The concept of the “gray zone” must be dismantled, and launching a drone from a civilian vessel must be legally equated to an armed attack, bearing all corresponding consequences for the shipowner.
Expanding the practice of maritime interdictions by joint NATO fleets and coalitions of willing nations would also prove effective. The French special forces’ interception of the tanker Boracay should become a standard practice for vessels suspected of espionage rather than an anomaly.
The Kremlin’s “shadow fleet” has vividly demonstrated that modern hybrid warfare respects neither borders nor civilian statuses. By weaponizing the humanitarian foundations of international law and capitalizing on the structural inertia of European bureaucracy, Russia has converted commercial shipping into an instrument of military coercion. Whether Europe can secure its borders and its skies depends entirely on the willingness of European leaders to act collectively, decisively, and proactively. The era of compromise and turning a blind eye has definitively drawn to a close.