Shadow Fleet Drones: IISS Report Maps 144 Incursions – What Operators Should Know

A report published on July 2, 2026, by the International Institute for Strategic Studies (IISS) has assembled what it calls the fullest picture yet of drone incursions that have rattled European airbases, airports, and nuclear sites since late 2024. The document, shared first by DroneXL.co, contains a dataset of 144 confirmed incidents and a central claim that is serious: Russian intelligence ran a coordinated surveillance campaign launched from vessels in Moscow’s sanctions-dodging “shadow fleet.” For commercial drone operators, fleet managers, and buyers in the pre-owned market, the report signals a new layer of airspace complexity and security risk that cannot be ignored.

The IISS report distinguishes between real incidents and so-called phantom ones—false alarms, civilian drones, or unrelated sightings that were mistakenly attributed to the same pattern. The difference, the authors argue, is the story. While some sightings raised unnecessary alarm, the 144 verified events paint a deliberate, state-sponsored effort to probe European air defense and gather intelligence. The vessels used are part of a shadow fleet of tankers and cargo ships that Russia has employed to circumvent oil sanctions, now repurposed as launch platforms for drone surveillance.

The IISS Dataset: 144 Verified Incidents and the Phantom Problem

The report’s core dataset spans incidents from September 2024 through June 2026, covering locations across Sweden, Belgium, Norway, Denmark, Germany, the Netherlands, and the United Kingdom. Targets included military airbases, civilian airports, nuclear power stations, and critical infrastructure nodes. The IISS researchers cross-referenced radar data, visual sightings, electronic intercepts, and maritime tracking to link the drones to specific shadow fleet vessels loitering in the North Sea, Baltic Sea, and Norwegian Sea.

One striking finding is the deliberate inclusion of “phantom” incidents—events that appeared to be drone incursions but were later identified as birds, passenger aircraft, or even weather balloons. The report argues that these phantoms matter because they distort threat perception and drain response resources. For a commercial drone operator flying near coastal regions or critical infrastructure, this blurring of real and false alerts creates a more cautious regulatory environment. Authorities may impose no-fly zones or flight restrictions based on a lower threshold of suspicion, directly affecting route planning and operational flexibility.

The shadow fleet vessels themselves are not military ships. They are aging oil tankers and general cargo carriers with opaque ownership, often operating without standard insurance or port state control. The IISS report details how these vessels host commercial off-the-shelf quadcopters and small fixed-wing drones, launched from their decks to fly low-altitude patterns that evade traditional radar. This is not advanced military hardware—it is the same class of drones that an enterprise operator might buy second-hand, repurposed for espionage.

Implications for European Airspace and Drone Operators

For fleet operators conducting survey, inspection, or delivery work in Western Europe, the practical consequence is an increasingly layered airspace security framework. Sweden, Belgium, and Denmark have already tightened remote identification requirements and expanded geofencing near ports and energy sites. The IISS report may accelerate calls for mandatory electronic conspicuity systems on all drones over 250 grams—including pre-owned DJI drones that may lack native Remote ID compliance.

What should a fleet manager do differently? The immediate step is to audit whether every aircraft in the fleet meets the latest EASA or national remote identification mandates. Operators using older, pre-owned DJI drones should verify that firmware updates supporting Direct Remote ID are installed, or consider retrofit modules. At the same time, the report underscores that the threat is not from hobbyist flyers but from state-aligned actors launching from ships. That distinction matters for insurance underwriting and liability—policies that cover “drone incursion” may need to exclude or separately address state-sponsored events.

The IISS dataset also highlights a geographic bias. Incidents cluster around the North Sea coastline and the Baltic straits, meaning operators flying in Norway, Denmark, northern Germany, and the Netherlands face the highest probability of airspace restrictions or heightened surveillance. Flight planning software should now include maritime exclusion zones near known shadow fleet anchorage points, a variable that most current apps do not model.

What this means for drone buyers

For the commercial drone buyer—whether acquiring new enterprise units or pre-owned DJI drones—the IISS report shifts the risk calculation in two ways. First, the value of a drone with verifiable firmware provenance increases. Used aircraft that cannot be updated to the latest security patches or Remote ID standards may lose utility in European airspace, depressing resale prices. Second, the report creates a secondary demand for drones that can be legally exported or re-exported to countries with less restrictive drone legislation, as some operators may relocate fleets to avoid entangled airspace.

Drone buyers should also consider the implications of electronic warfare countermeasures that European nations are deploying. The report mentions that several European airbases now employ portable GPS spoofing and RF jamming systems to disrupt suspected surveillance drones. Pilots of consumer drones near these sites risk loss of control or flyaway events. Buying a drone with robust failsafe logic, such as return-to-home on signal loss, becomes a safety and financial priority. The pre-owned DJI marketplace already reflects this: units with known GPS lock reliability and redundant sensors command a premium.

Additionally, the report may influence insurance premiums for commercial fleets. Underwriters are reviewing exclusions for “war risks” and “state-backed cyber or physical interference.” A buyer looking to finance a new fleet should expect more detailed questionnaire about flight geography, anti-jamming hardware, and compliance with military avoidance protocols. The prudence of investing in professional DJI repair services to keep older aircraft airworthy and compliant becomes clearer when replacement units could be subject to sudden import restrictions or price spikes due to defense-related demand.

Fleet Planning and Repair Implications in a Heightened Security Environment

For repair workshops and fleet maintenance operations, the IISS report signals a shift toward longer supply lead times for certain OEM parts. The shadow fleet phenomenon is a maritime logistics story as much as a drone story. The same vessels used for drone launches are also involved in transporting electronic components and dual-use goods. Sanctions enforcement is tightening, and customs inspections on drone parts arriving at European ports are increasing. Workshops that rely on just-in-time inventory of genuine OEM spare parts may face delays, especially for motors, flight controllers, and transmission modules that could be repurposed for military surveillance.

Fleet operators should consider building a buffer stock of high-turnover components such as propellers, batteries, and gimbal ribbons. For the pre-owned market, the availability of drones with clean traceability—units that were originally sold to commercial operators in Europe and never exported to sanctioned jurisdictions—will become a selling point. A drone trade-in guide can help operators evaluate which of their current aircraft hold value in a market where compliance and provenance matter.

The IISS report also notes that the shadow fleet drones are predominantly commercial models, including some that appear to be older DJI Phantom and Mavic platforms. That observation is relevant for repair businesses: the parts needed to keep these older generations flying are still available, but demand from both legitimate commercial users and, hypothetically, state actors could drive price increases. Repair shops that service vintage quadcopters may see margin opportunities, but should screen customers to avoid inadvertently supporting unauthorized or sanctioned activity.

Should commercial drone operators worry about flying near coastal areas now?

Yes, but not panic. The report shows that the threat is concentrated near known shadow fleet anchorage zones and around specific high-value targets. Operators near North Sea and Baltic coasts should check NOTAMs for temporary flight restrictions linked to naval security, and consider using flight planning software that incorporates maritime exclusion boundaries. No blanket ban exists, but situational awareness is more important than ever.

How does the IISS report affect the value of pre-owned DJI drones?

The report strengthens the value of drones with full firmware update history and Remote ID compliance. Units that cannot be upgraded or that lack robust GPS fail-safes may depreciate faster, especially in European markets where airspace rules are tightening. Buyers should always request a firmware version log before completing any pre-owned purchase.

What steps should a fleet operator take immediately after reading this report?

Audit every drone in your fleet for Remote ID compatibility and GPS anti-jamming features. Update firmware to the latest official release. Review your insurance policy for war-risk exclusions. Consider building a small inventory of genuine OEM spare parts for high-use components to buffer against potential supply disruptions from tightened sanctions enforcement on maritime shipping.