IISS Report Revives 'Russian Shadow Fleet Drone' Theory, But the Evidence Gap Remains Wide

Main Story

A major new report titled Russia's UAV Campaign over Europe, published on 2 July 2026 by the London-based International Institute for Strategic Studies (IISS), has renewed intense debate about the nature and attribution of the wave of 'mystery drone' sightings that swept across Europe from late 2024. The study — led by IISS Senior Fellow for Strategy & National Security Charlie Edwards — catalogues 144 drone-related incidents across 13 European states between August 2024 and February 2026, and concludes it is "highly likely" that the Kremlin conducted a coordinated UAV campaign, and "likely" that Russian-linked vessels from the so-called shadow fleet served as the launch and recovery platforms.

The report attracted immediate, widespread international media coverage, including in The Guardian and The Telegraph, before being scrutinised just as quickly by specialist outlets who questioned the evidentiary basis of its central claims.

What the IISS Found

The IISS dataset shows a campaign that intensified sharply in the second half of 2025: reported incidents jumped from an average of four per month to 22.5 per month between September and December 2025. Germany alone logged 58 sightings. Broken down by site type, roughly 48 percent of incidents occurred over military facilities, 18 percent over civilian airports, and 26 percent over ports and energy infrastructure.

Among the most sensitive targets documented are Kleine-Brogel Air Base in Belgium, Volkel Air Base in the Netherlands, the French ballistic missile submarine base at Île Longue (where five drones were detected on 4 December 2025), and RAF Lakenheath in Suffolk — incursions that forced repeated airport closures and disrupted military operations. The report also documents drone activity near logistics hubs supporting NATO training programmes, suggesting an intent to map alliance supply chains and reinforcement routes.

The IISS concludes that the aggregate pattern of incidents "cannot be adequately explained by misidentification, hobbyist activity or opportunistic harassment alone," and describes the campaign as "a series of tactical successes for the Kremlin and a strategic failure of allied air defence."

To connect vessels to sightings, investigators combined open-source shipping records, drone performance data, and incident timing. One named vessel, the cargo ship Hav Dolphin, was placed by shipping data near Hull while drones appeared over nearby RAF bases in November 2024; German and Dutch authorities subsequently examined the ship in May 2025 after drones were reported over German defence facilities while it was anchored in the Kiel Bight. The report also cites the shadow fleet vessel Arctica, which sailed along Denmark's coast on 3 January 2025 as up to 20 drones flew over the nearby port of Køge before disappearing toward the sea.

The clearest single confirmed incident in the dataset — what analysts have described as the report's strongest evidentiary anchor — occurred on 26 February 2026, when the Swedish military jammed a drone launched from the Russian signals intelligence ship Zhigulevsk toward the French aircraft carrier Charles de Gaulle during a port visit to Malmö.

The Evidentiary Problem

Despite the weight of the pattern analysis, critics have identified a significant and, as yet, unresolved forensic gap. The IISS report does not present physical evidence linking any specific drone to any specific vessel. No launches have been directly observed (beyond the Zhigulevsk incident), no command links intercepted, no wreckage recovered, no credible video footage recorded, and no telemetry or forensic data has been released tying a drone to a Russian ship. In several cases, multiple vessels are listed as possible launch platforms, with some located well over 100 kilometres from the reported sightings.

Dronewatch Europe, which together with Dutch newspaper Trouw conducted its own investigation into 61 reported European drone sightings, found many incidents collapsed on reconstruction: multiple reported 'drones' turned out to be aircraft, helicopters, stars, planets, or other explainable phenomena. The Dronewatch/Trouw investigation also surfaced the case of RAF Lakenheath, where one widely-reported UAV episode ultimately involved a US Air Force F-15 fighter jet mistaken for a drone — a misidentification serious enough to cause a police helicopter to perform evasive manoeuvres.

Further undermining one of the report's key methodological pillars — that shadow fleet vessel proximity is indicative of Russian drone operations — Danish police stated on 19 June 2026 that none of the vessels they investigated, including ships belonging to the Russian shadow fleet, had any connection whatsoever to the reported drone sightings in Denmark.

The IISS pre-empts this line of criticism by arguing that a high non-confirmation rate is itself analytically consistent with a successful Russian deception campaign, noting that European detection capability was "demonstrably insufficient to reliably track low-altitude, non-cooperative UAVs." Critics have noted that this framing risks making the hypothesis effectively unfalsifiable: the absence of evidence becomes, in the report's own logic, evidence of campaign success.

None of the 13 governments whose airspace is implicated have publicly attributed any UAV sighting to Russia, though the IISS says every government consulted indicated it would welcome the report's publication. "Every government we spoke to said they would welcome the report being published," Edwards said. The UK Ministry of Defence declined to comment on intelligence matters; U.S. Air Forces in Europe confirmed drone activity over its UK installations in 2024 but declined to discuss attribution; France said it could not confirm the report's findings.

Report co-author Louis Byrne noted, however, that drone sightings virtually stopped once European countries began inspecting and detaining shadow-fleet vessels — a temporal correlation the IISS regards as analytically significant.

Platform Hypotheses

On the drone types potentially involved, the IISS report identifies the Russian-built Orlan-10 as one plausible platform, alongside modified commercial drones or custom-built long-range fixed-wing aircraft using cellular communication systems to complicate attribution. The Kalashnikov Legioner E29 is also cited as a candidate type. Using commercially-derived or custom-built platforms would make forensic attribution significantly more difficult than deploying a recognisable military system.

The Zhigulevsk incident is the only case where a specific Russian platform was publicly confirmed. The drone involved was subsequently assessed to be most probably an Orlan-10.

Technical Breakdown

Platform class (primary candidate): Orlan-10 (ISR/EW fixed-wing UAV)

• Developer: Special Technology Center (STC), Saint Petersburg
• Maximum take-off weight: 16.5 kg
• Payload capacity: 6 kg (modular; optical/thermal imaging, SIGINT, ELINT, EW jamming payloads)
• Propulsion: Internal combustion engine (gasoline-fuelled piston, rear-mounted two-blade propeller)
• Maximum speed: ~150 km/h; cruise speed ~110–115 km/h
• Endurance: Up to 16–18 hours
• Operational range: ~110–120 km; telemetry/data-link range quoted as 120–600 km depending on source and relay configuration
• Service ceiling: 5,000 m
• Launch/recovery: Collapsible catapult launch; parachute recovery — both compatible with deck operations aboard a sufficiently large vessel
• Navigation: GLONASS primary; receivers also capable of integrating Galileo and BeiDou signals
• Autonomy: Autonomous waypoint-following with in-flight path modification by operator; ground control station capable of managing up to four vehicles simultaneously
• Radar signature: Reduced by composite fuselage construction
• Communications: Three-link radio architecture (control, telemetry, imagery); can also use 3G/4G cellular networks for imagery relay
• Typical deployment: Groups of two or three — one reconnaissance vehicle, one electronic warfare, one data relay

Alternative/Modified Commercial Platforms (IISS secondary hypothesis)

• Custom-built long-range fixed-wing aircraft using cellular communication links instead of conventional radio control — a configuration that would substantially complicate RF-based attribution and defeat conventional SIGINT triangulation methods.

The Orlan-10's catapult-launch, parachute-recovery profile, extended endurance, and use of cellular data links make it — in principle — adaptable to maritime operations from a suitable vessel deck. The IISS argues that in an environment of deficient European low-altitude radar coverage, a non-confirmatory detection record is the expected operational outcome rather than proof of absence.

Industry Impact

For C-UAS Manufacturers and Integrators

The IISS report crystallises what European C-UAS vendors have been arguing for over a year: that existing air defence architecture was designed for high-altitude, high-speed conventional threats, not for low-cost, low-altitude, non-cooperative UAVs operating below the threshold of collective response. The report explicitly states that European C-UAS posture suffers from uneven detection, fragmented legal authorities, disproportionate response options (expensive interceptors against cheap drones), and attribution too slow to support timely deterrence. This translates into a structural market gap for multi-sensor fusion platforms, RF-cyber defeat layers, AI-assisted detection software, and low-cost interceptor systems — exactly the product categories receiving the heaviest venture capital inflow in Europe right now.

The maritime launch dimension specifically adds a requirement that is absent from most current C-UAS procurement frameworks: detecting and neutralising drones over coastal waters before they enter national airspace, rather than only after. This is a technically and legally distinct problem from land-based C-UAS, requiring integration of maritime radar, vessel AIS monitoring, and coastal surveillance networks.

For the European Drone Defence Initiative (EDDI)

The IISS report lands as the European Drone Defence Initiative — the EU's 'Drone Wall' — works toward an initial operational capability targeted for end of 2026, with full functionality by end of 2027. However, the IISS and independent analysts have highlighted a critical architectural gap: the EDDI is designed to intercept drones once they enter European airspace, but currently provides no mandate to act against vessels launching them from international waters or European EEZs. Closing this gap would require a level of maritime-domain integration — linking European navies, coast guards, intelligence agencies, and air defence networks — that is not currently provided for in EDDI's framework. The EU's February 2026 Action Plan on Drone and Counter-Drone Security addresses detection, preparedness, and industrial coordination, but stops short of providing cross-border legal authority over suspect vessels.

For Operators and Militaries

The report's implicit finding — that a state actor can conduct sustained, multi-country ISR operations against some of the most heavily protected military and nuclear infrastructure in the world using low-cost, commercially adjacent UAVs, and achieve 'substantial impunity' for approximately 18 months — represents a significant benchmark recalibration for base security planners across NATO. The fact that none of the 144 documented incidents resulted in an interception or drone recovery dramatically underscores the detection gap. Militaries will likely accelerate investment in persistent low-altitude radar coverage, EO/IR-based detection (which captures motor and battery heat signatures regardless of RF behaviour), and formal protocols for connecting nationally-siloed incident data into alliance-level pattern analysis.

For Investors

The report provides further narrative backing for the already-robust European C-UAS investment cycle. Maritime C-UAS — coastal monitoring, vessel-behaviour analytics, shipboard launch detection — is an underserved sub-segment likely to attract dedicated procurement attention if the IISS framing gains official traction. The unresolved attribution problem also highlights commercial opportunity in forensic-grade drone identification: technologies capable of recovering telemetry, RF signatures, or physical evidence from downed or recovered platforms, rather than relying on proximity-based pattern inference.