Four years ago, when the Russians launched their failed ‘special military operation’, drone warfare was a secondary element, a complement to conventional warfare involving tanks, aircraft and artillery. Now, however, drones have become the primary weapon on the battlefield. Their use is increasingly widespread and encompasses every type of operation; this is a fact that Ukraine knows all too well, but one that Russia is also well aware of. IKAR (the Russian Institute for Conflict Studies and Analysis) has published a report on Russian drone incursions into NATO and European Union airspace from 2022 to the present day, demonstrating that these represent an integrated, state-directed military intelligence doctrine; these are not errors or malfunctions, as the Kremlin claims every time a drone violates the airspace of a NATO country, but rather a sustained operation of hybrid warfare that ‘has evolved into direct industrial and logistical sabotage, under the deliberate cover of ambiguity regarding the attribution of responsibility’.
With the start of the invasion in February 2022, the report emphasises, over 400 Russian intelligence agents, operating under diplomatic cover, were expelled from the EU, creating an operational intelligence shortfall for Russia. The response to this shortfall was the creation of an unmanned aerial systems (UAS) architecture, designed to operate continuously in the grey zone. To this end, the Russian intelligence services have integrated commercial maritime and land-based logistics into a complex operational framework for reconnaissance and sabotage. In this way, ‘oil tankers, bulk carriers and auxiliary survey vessels have become mobile, autonomous forward launch platforms for medium- and long-range drones intended for the covert gathering of intelligence’. An operational profile that: ‘ensures prolonged maritime autonomy and the ability to deny involvement, whilst eliminating exit signals detected by land-based radars, thereby enabling the platforms to approach the perimeters of coastal radars at low altitude before land-based sensors detect them’.
On the ground, a shortage of intelligence officers has led the GRU, Russia’s military intelligence service, to rely on recruited, disposable intermediaries (‘disposable intermediaries’), which also enables Moscow to disguise these operations as industrial espionage. The report cites as an example the events of November 2024, involving reconnaissance flights over US Air Force installations in East Anglia: ‘agents carried out tactical drops from farmland whilst posing as seasonal workers, which effectively prevented the rapid attribution of responsibility and the identification of the operatives’. The sabotage operation at Leipzig/Halle Airport in August 2026 is cited as the technical pinnacle of this type of operation. ‘An FPV attack drone was launched from the abandoned village of Kursdorf/Kabelsketal, using a network of high-performance industrial 5G routers and radio frequency repeaters. This topology allows tactical flight operations to be conducted remotely from third countries or directly from Russian territory, which creates complete ambiguity regarding the attribution of responsibility and disconnects the flight operator from the physical point of departure’. Finally, the researchers identified a Russian and a Belarusian national as responsible for an operation in which ‘disposable intermediaries’ are also said to have participated.
The evolution of Russian strategy
The report distinguishes four distinct operational phases in Russian unmanned aerial operations against the West between 2022 and 2026. The first phase, in 2022–2023, aimed to ‘exploit the fault lines between national command centres and NATO’s integrated structures’, initially in Europe and, from late 2023, on both sides of the Atlantic, by carrying out reconnaissance sorties. From 2024 to mid-2025, the Russian intelligence services began ‘systematically mapping, from offshore, strategic logistical and energy resources’. Constant surveillance of the ChemCoast industrial complex, the LNG terminals and the decommissioned Brunsbüttel nuclear power station in August 2024 highlighted an operational approach focused on critical civilian energy hubs. In November 2024, operations were carried out at the RAF bases at Lakenheath, Mildenhall and Feltwell, due to ongoing infrastructure upgrade works at these bases to accommodate the modernised B61-12 thermonuclear munitions.
By the end of 2025, we had moved into a third phase, shifting from reconnaissance raids to causing severe economic and civil disruption. In September, ‘the coordinated deployment of formations of heavy UAS with strobe lights activated over the airports of Copenhagen, Aalborg and Billund completely paralysed civil aviation across Denmark for four hours, grounding 190 flights, whilst Skrydstrup Air Base – which housed Ukrainian personnel trained on F-16s – was under surveillance’. Surveillance flights were also reported over Volkel Air Base in the Netherlands, over the French Strategic Oceanic Force’s (FOST) ballistic missile submarine base at Île Longue, and even near the French aircraft carrier ‘Charles de Gaulle’, off the coast of Malmö, until they were neutralised by a Swedish electronic attack.
And so we come to the current phase, which began this spring and has crossed the strategic threshold, in which Moscow has decided to carry out destructive kinetic operations. On 29 May 2026, a Geran-2 crashed into a residential complex in Galați, Romania, causing fires and injuring two civilians: the first direct civilian casualties suffered by a NATO member state as a result of a Russian drone attack. In August, in the aforementioned incident at Leipzig/Halle Airport, an FPV carrying high-powered Semtex attempted to destroy an Antonov Airlines An-124-100 strategic transport aircraft. On 9 September, a massive incursion of 21 drones into Polish airspace forced the closure of the main air traffic control centres and prompted the Polish government to formally initiate consultations under Article 4 of the Washington Treaty.
This escalation in Russian drone operations in the West points to ongoing logistical sabotage on an industrial scale: ‘These operations are designed to inflict deliberate collateral damage on the civilian population or critical infrastructure within NATO states, with the specific aim of creating political rifts within the Western alliance and undermining public support for defence aid to Ukraine,’ the report emphasises.
How can the Russian threat be countered?
In addition to strengthening defence systems, a number of measures are proposed that Western countries can implement to effectively counter this Russian threat. These begin with a review of peacetime rules of engagement, which limit the capacity to respond to the presence of unmanned systems at critical facilities. ‘A commander must have clear legal authority to immediately employ kinetic and directed-energy fire against any unauthorised unmanned system that penetrates the base’s restricted airspace.’
Another key point is the Russian ‘ghost fleet’; the report recommends the creation of an operational force in the Baltic Sea and the North Sea, with the aim of conducting ‘board, search and seizure operations against sanctioned “shadow fleet” vessels that tamper with their AIS transponders, display fraudulent flag documentation or carry undeclared tactical unmanned systems and technical personnel’.
Western countries have the necessary means to confront Russia. The problem lies not in a lack of resources, but in a lack of political will to deploy them. So far, this lack of political will – this ‘fear of escalation’ – has only led Putin, who understands only force, to keep raising the stakes. Perhaps the time has come to change strategy.
You can read the full report here.
