Washington has warned three southern European governments that Moscow may be preparing a new hybrid operation aimed at disrupting ports, airports and critical infrastructure from the Mediterranean.
Russia may be planning to launch attack and reconnaissance drones from civilian vessels in the Mediterranean, according to reports published on 24 September 2026. US intelligence has passed warnings to the governments of Spain, France and Italy about a possible operation in which drones would be concealed in containers aboard commercial ships before being launched at sea. The report was first published by El Mundo and subsequently reported by Apostrophe.
The intelligence warning describes a potential attempt to cause selective disruption rather than widespread physical destruction. The targets under consideration include transport hubs, ports, airports and energy infrastructure in southern Europe. By using civilian shipping as a launch platform, the Kremlin would be able to conceal its direct involvement and make it harder for Nato and European governments to establish the legal status of any incident.
A new use for Russia’s shadow fleet
According to the information reported, the drones could be carried covertly in containers on civilian ships linked to Russia’s so-called shadow fleet. Intelligence assessments cited in the material indicate that Moscow is considering launching both strike and reconnaissance drones from vessels operating in the Mediterranean.
The possible use of Gerbera-type drones would mark a significant expansion of Russia’s hybrid methods against Europe. Rather than concentrating on the destruction of a small number of selected sites, the proposed tactic would seek to interrupt logistics, create delays and generate a sustained public and political response at comparatively low cost.
The shadow fleet was initially assembled by Russia to help circumvent oil sanctions. Its possible use in an attack role would blur the distinction between commercial and military shipping, creating a new challenge for international maritime security. A suspicious merchant vessel in international waters could no longer be viewed only as a commercial concern: it could also be treated as a potential floating launch site.
Testing the southern flank
France, Spain and Italy are identified as the countries that received the US warning. The choice of southern European targets is assessed as an attempt to test areas of the continent’s air-defence system that are considered less prepared for this type of threat than Nato’s eastern flank.
The objective would not necessarily be to destroy major facilities. Disrupting the operation of a port or airport, even temporarily, could affect deliveries, passenger movements and wider confidence in the security of critical infrastructure. The prospect of attacks launched from commercial vessels would also force authorities to monitor maritime traffic more closely, increasing pressure on already limited security and defence resources.
Experts cited in the material view the potential launches as part of a broader effort by the Kremlin to test the readiness of Nato’s southern members. Moscow would be seeking to expose weaknesses, sow doubts among European leaders and make it harder for the alliance to form a rapid and united position on collective security.
Pressure before Europe’s 2027 elections
The operation is also linked to Europe’s political calendar. The material says Moscow may seek to exploit attacks or credible threats of attacks before important elections in 2027, using panic and disruption to highlight the vulnerability of European security systems.
That strategy would be designed to deepen social tension and strengthen ultra-right and populist forces arguing that European countries should avoid involvement in external conflicts and reduce their participation in Nato. The intended political effect would be less about a single incident than about repeated doubts over whether governments can protect transport and energy infrastructure without imposing wider restrictions on daily life.
Russia’s broader calculation, according to the assessment, is that European governments would have to divert defence budgets and military resources towards domestic security. The pressure could then slow or reduce the transfer of military assistance to Ukraine, while encouraging divisions over the scale and cost of Europe’s support.
The warnings do not establish that an attack has taken place, but they point to a method that would exploit the openness of civilian maritime trade. The unresolved question is how European governments can protect ports and other infrastructure without allowing the threat of covert launches to disrupt legitimate commercial shipping across the Mediterranean.
How should Spain, France and Italy balance tighter maritime security with the need to keep civilian trade moving?
