An investigation by German journalists sheds light on a vast Russian clandestine operation across the bloc, making mockery of European security.

A new investigation by seven German students from the Axel Springer Academy for Journalism and Technology has uncovered strong evidence that Russian intelligence is leveraging seemingly civilian cargo ships as platforms to support drone surveillance of European military and critical infrastructure.

The findings, based on leaked classified documents, ship tracking data and field verification, suggest a systematic pattern of covert reconnaissance linked to vessels with Russian crews and suspicious movement profiles.

More to read:
[video] Defense startup deploys “laser” shield that neutralizes drones in seconds

The project “They Droned Back”, published by DigitalDigging.org, tracked three freighters — the HAV Dolphin, HAV Snapper and the Lauga — operating off the Dutch and German coasts in 2025. These ships were found loitering in atypical patterns near defense shipyards and naval facilities at times when swarms of drones were reported overhead.

Clandestine surveillance

Classified reports obtained from Germany’s Federal Criminal Police Office (BKA) recorded 1,072 drone incidents and 1,955 drones in 2025 alone, with many flights occurring “almost exclusively over or near military installations.” Large airports were among the targets too.

In the vast majority of cases, authorities were unable to identify pilots or drone types, and official assessments noted “complex operations drawing on larger financial and logistical resources,” indicating activity well beyond hobby use.

More to read:
Ukraine integrates AI into drones, paving the way for future warfare

The HAV Dolphin, flagged in Antigua & Barbuda, circled for days in Germany’s Kiel Bay approximately 25 kilometers from defense shipyards where drone swarms were observed. Automatic Identification System shipping data showed erratic patterns inconsistent with commercial transport.

Security sources described inspections of this vessel by German and Dutch authorities as “superficial” and inadequate to detect concealed equipment or activity.

Locations where unidentified drones were spotted in Germany in 2025. 

Another vessel, the Lauga (formerly Ivan Shchepetov), was monitored by German police in the North Sea after drones were seen circling both this Russian-crewed freighter and the escorting police vessel. After a later search by Belgian customs yielded no drones on board, the ship returned to St. Petersburg; ownership records and port calls indicate links to Russia, including a visit to the Russian naval base at Tartus in Syria.

The HAV Snapper was also positioned off the Dutch island of Schiermonnikoog shortly before documented drone flights. Both the Snapper and Dolphin were serviced at a shipyard in Kaliningrad connected to Russian military and state nuclear corporation Rosatom. Publicly available Rosatom materials detail drones capable of long-range operations launched from ships, a capability that covers the distances between these vessels and observed drone activity zones.

No physical evidence

While the investigation could not directly recover drones from the ships themselves, the journalists established 19 temporal and geographic correlations between the vessels’ locations and drone sightings. European intelligence sources told the team the three ships are assessed with “high confidence” as operating on behalf of Russian interests, exhibiting movement profiles that show “little evidence of commercial activity.”

More to read:
NATO considers building a naval drone fleet for protection of undersea infrastructure

Germany’s Federal Office for the Protection of the Constitution characterized Russia’s intelligence use of so-called “low-level agents” — individuals recruited for basic espionage and disruptive tasks — as part of a broader strategy. Official responses from the German Interior Ministry acknowledged awareness of a “shadow fleet” phenomenon and the high frequency of drone overflights, though they stop short of quantifying the extent of foreign state involvement.

The students’ work casts new light on a hybrid threat that blends maritime presence with aerial surveillance, exploiting civilian-flagged ships to mask and facilitate activities that may undermine European security.

While definitive causation remains challenging to prove without direct interception of equipment or personnel, the patterns identified raise urgent questions for E.U. and NATO counter-intelligence and defense authorities.

You may support our small reporting project via BuyMeCoffee. Any amount is welcome.