• Russia conducted a drone campaign over a dozen NATO states for 18 months, launching unmanned aircraft from tankers, cargo ships, and smaller vessels, largely without interference.
• The International Institute for Strategic Studies in London examined 144 incidents in 13 countries between August 2024 and February 2026, with experts noting a clear pattern of drone activity originating from Russia.
• Germany was the most affected country with 58 incidents, followed by Belgium with 25 incidents, with nearly half occurring at military facilities and 25% involving critical infrastructure like ports and energy facilities.

Russia subjected a dozen NATO states to a drone campaign over a period of 18 months, largely without interference, by launching the unmanned aircraft from tankers belonging to Russia's shadow fleet, cargo ships close to the coast and smaller vessels, an analysis published on Thursday showed.

The International Institute for Strategic Studies (IISS) in London examined 144 incidents in 13 countries between August 2024 and February 2026, it said.

Although not every single incident is likely to have originated from Moscow, experts see a clear pattern, a statement on the analysis said. Western governments have not yet publicly confirmed the findings.

The report said Russia has increasingly relied on drones for intelligence gathering since its full-scale invasion of Ukraine more than four years ago, after the expulsion of large numbers of Russian diplomats across Europe curtailed traditional espionage networks.

It argued that the activity also served to test NATO members' readiness and response capabilities, exposing vulnerabilities in European air defences that remain largely geared towards conventional threats.

Germany was hit hardest with 58 incidents, including six over the US Air Force base in Ramstein and at the German Armed Forces sites in Manching and Neuburg an der Donau, the analysis showed.

Belgium ranked second with 25 incidents, including activity near Kleine Brogel Air Base, where US nuclear weapons are believed to be stored.

Just under half of the incidents occurred at military facilities and just under 20% at civilian airports, many of which had to suspend operations temporarily, it showed. A good 25% involved critical infrastructure such as ports, energy facilities and industrial sites.