Full Report
Between August 2024 and February 2026, Uninhabited Aerial Vehicles (UAVs) were flown in the airspace of a dozen NATO member states and Ireland, forcing repeated closures of major commercial aviation hubs, disrupting military operations and penetrating the perimeters of some of Europe’s most sensitive defence installations – among them nuclear-sharing sites hosting American B61-12 gravity…
Analysis Summary
# Incident Report: Multi-National Russian UAV Campaign
## Executive Summary
Between August 2024 and February 2026, a coordinated campaign of Uninhabited Aerial Vehicles (UAVs) targeted the airspace of 12 NATO member states and Ireland. The operations penetrated high-security perimeters, including nuclear weapons sites and submarine bases, exposing significant gaps in European air-defense architecture. Attributed with high confidence to the Kremlin, the campaign utilized "shadow fleet" vessels as mobile launch platforms to conduct unconventional warfare below the threshold of open conflict.
## Incident Details
- **Discovery Date:** Ongoing detection between Aug 2024 – Feb 2026
- **Incident Date:** August 2024 to February 2026 (Peak activity in late 2025)
- **Affected Organizations:** NATO member air forces, Commercial Aviation Hubs, French Ballistic Missile Submarine Base (Île Longue), and US Nuclear-Sharing sites.
- **Sector:** Defense, Government, and Civil Aviation.
- **Geography:** Northern and Western Europe (12 NATO states and Ireland).
## Timeline of Events
### Initial Access
- **Date/Time:** August 2024.
- **Vector:** Unauthorized entry into restricted sovereign airspace.
- **Details:** Low-cost UAVs were deployed to enter sensitive airspace, bypassing radar systems designed for conventional high-altitude or high-speed threats.
### Lateral Movement
- **Details:** The "movement" in this context refers to the geographic progression across European borders. The campaign moved from sporadic sightings to a coordinated, multi-state effort, specifically targeting critical infrastructure simultaneously across different jurisdictions.
### Data Exfiltration/Impact
- **Details:** Reconnaissance of sensitive military installations (B61-12 gravity bomb storage, submarine bases). Disruption of commercial flights via hub closures. Testing of allied response times and legal thresholds for engagement.
### Detection & Response
- **Detection:** Visual sightings by personnel, civilian reports, and intermittent radar hits.
- **Response:** Closures of airports; military scrambling of assets; UK boarding of a suspected "shadow fleet" vessel in June 2026.
## Attack Methodology
- **Initial Access:** Aerial incursion via low-RCS (Radar Cross Section) UAVs.
- **Persistence:** Utilization of the Russian "shadow fleet" and merchant vessels as nomadic launch/recovery platforms in international waters.
- **Defense Evasion:** Flying at altitudes and speeds that fall below the thresholds of automated air-defense sensors; operating in "deniable" patterns to avoid clear attribution.
- **Discovery:** Physical reconnaissance of military perimeters and aviation flight paths.
- **Impact:** Strategic exhaustion of air defense personnel, disruption of civil commerce, and intelligence gathering on sensitive nuclear sites.
## Impact Assessment
- **Financial:** High costs related to commercial airline delays/cancellations and military fuel/scrambling costs.
- **Data Breach:** Compromise of physical security protocols and visual intelligence of high-security defense sites.
- **Operational:** Extensive disruption to commercial aviation; interruption of military training and readiness exercises.
- **Reputational:** Demonstrated a "strategic failure" of allied air defenses to protect sovereign airspace from low-cost threats.
## Indicators of Compromise
- **Network/Physical:** Unidentified aerial objects in the vicinity of critical infrastructure.
- **Carrier:** Russian-linked "shadow fleet" vessels loitering near coastal defense installations or flight paths.
- **Behavioral:** Coordinated UAV sightings appearing across multiple NATO countries within tight timeframes.
## Response Actions
- **Containment:** Closure of commercial airspace; increased aerial patrols.
- **Eradication:** Interdiction of launch platforms (e.g., UK boarding of suspected vessels).
- **Recovery:** Inter-agency reviews of air defense detection logic and legal authorities to down UAVs in peacetime.
## Lessons Learned
- **Architecture Gap:** Current air-defense systems are optimized for high-end threats (missiles/jets) and struggle with low-slow-small (LSS) UAVs.
- **Siloed Intel:** European governments focused on national responses instead of interconnecting data points to see the continent-wide campaign early on.
- **Legal Thresholds:** Ambiguity in legal authority to engage non-manned systems allowed the adversary to operate with near-impunity.
## Recommendations
- **Modernization:** Update radar and sensor arrays to better detect low-cost, low-altitude UAVs.
- **Unified Policy:** Establish a NATO-wide standard for attributing and responding to non-kinetic airspace violations.
- **Maritime Monitoring:** Increase surveillance on "shadow fleet" merchant vessels in the North Sea, Atlantic, and Mediterranean.