CIA Warns Spain, France, and Italy of Possible Russian Drone Attacks
The CIA has warned Spain, France, and Italy that Russia may be preparing drone attacks against these three countries. Relevant intelligence has been shared with multiple European governments following CIA Director John Ratcliffe's secret visit to Moscow in August.
The drones involved are Russian-made Gerbera suicide drones, with a range of about 600 kilometers and capable of carrying 4 to 5 kilograms of explosives. The attacks would be launched secretly from commercial vessels in international waters, turning civilian ships into mobile launch platforms. By using flag-of-convenience vessels and stealth navigation, Russia can maintain plausible deniability. Lithuania is reportedly aware of the specific model of the drones involved.
The intelligence lists potential targets concentrated along the coast: ports, energy facilities, and coastal communication nodes. Spain, France, and Italy control Mediterranean shipping routes and are core nodes for European energy imports and maritime transport. After receiving the warning, the relevant countries have strengthened maritime surveillance in the Mediterranean and Atlantic regions.
Ratcliffe's trip to Moscow was his first publicly known visit to Russia since becoming CIA Director. An American military aircraft was spotted at Moscow airport, and Ukraine was informed in advance and asked to pause attacks during the visit. Ratcliffe met with Russian intelligence officials, not Putin. He conveyed two messages to the Russian side: no attacks on NATO member states; and if the Strait of Hormuz does not reopen to navigation, Russia will face more sanctions. Kremlin spokesman Peskov called the reports unrelated to reality "scare stories."
At the same time, intelligence chiefs from multiple European countries have issued collective warnings. Czech Security Information Service Director Koudelka stated that Russia's escalation against NATO could occur "in months rather than years," taking forms such as limited invasions, false flag provocations, and large-scale information warfare. NATO's internal planning is assessing the possibility of limited Russian actions against member states by early 2027 to test the credibility of Article 5 collective defense. The head of Latvia's State Security Service indicated that there are currently no signs of imminent attacks, but Russia is preparing for "more decisive" actions.
In market mechanisms, this is a re-evaluation of security premiums driven by events. Buyers are the defense ministries and procurement agencies of European countries, with demand focused on anti-drone systems, coastal radar, and maritime patrol capabilities; sellers include European defense contractors such as Rheinmetall, Leonardo, Thales, Indra, and anti-drone startups. Funding is flowing from budget allocations and EU defense loans to the defense industry. Mediterranean shipping and port operators face higher insurance and security costs, with Spain, which has low defense spending and previously did not meet NATO's 5% spending target, being directly named and facing increased pressure to boost spending.
Supplementary data: The number of drone incursions in Romania in 2026 is three times that of 2025. Recently, an Italian fighter jet shot down a drone entering from Belarus over Lithuania. In August, a drone carrying explosives was discovered at Leipzig/Halle Airport in Germany. Dutch railway operators reported about 30 instances of suspected track damage. In late September, Ukraine launched about 1,600 drones into Russian territory over a weekend.
Source: Public information
ABAB AI Insight
Russia has a clear path for hybrid warfare in Europe. In 2024, DHL logistics centers in Leipzig, Germany, and Birmingham, UK, experienced package fires, with investigations pointing to tests of incendiary devices planned by the Russian military intelligence. In December 2024, the oil tanker Eagle S, flying the Cook Islands flag, anchored and severed the Estlink 2 undersea cable between Finland and Estonia, leading to its detention by Finland. In September 2025, about 19 Russian drones entered Poland, with NATO aircraft firing for the first time to intercept, many of which were Gerbera decoy drones. In the same month, Copenhagen and Oslo airports were closed due to drone sightings; subsequently, the French Navy boarded the shadow fleet tanker Boracay off the coast of Saint-Nazaire, suspecting its connection to the Danish drone incident. The "commercial ship launching drones" tactic had been previously checked on board.
In terms of resource allocation, Russia is taking a low-cost asymmetric approach. A factory in Tatarstan is ramping up production of Geran (the domestic version of Iran's Shahed) to thousands of units per month, while Gerbera drones are made from foam and plywood, costing far less than Western air defense missiles. The shadow fleet generates income by evading oil price caps while also serving as an intelligence and delivery platform. On the European side, the approach is "defending against cheap with expensive": the EU has launched an €800 billion ReArm Europe plan and a €150 billion SAFE defense loan, while NATO's Hague summit set a target for defense spending to reach 5% of GDP by 2035. Intercepting a cheap drone often costs hundreds of thousands to millions of dollars in missiles.
There are two similar cases. The first is the Houthis: starting in November 2023, they used cheap drones and missiles to attack merchant ships in the Red Sea, forcing many shipping companies to reroute around the Cape of Good Hope, drastically altering the pricing structure of the Suez route at a very low cost. The second is Ukraine: in June 2025, the "Web Operation" smuggled drones into the Russian hinterland using truck containers, striking multiple strategic bombers in one go. The "civilian vehicles + drones" model has been validated by both sides and is now being reversed at sea, targeting southern European ports. Hybrid warfare is expanding from the gray zones of Northern and Eastern Europe into the Mediterranean, moving from the "harassment" phase to the "capable of lethal deterrence" phase.
The essence is technological substitution. Cheap drones are replacing missiles and air power as the main means of long-range strikes for three reasons. First, cost asymmetry: the attacker spends thousands to tens of thousands of dollars, while the defender spends hundreds of thousands to intercept, making attrition warfare unsustainable. Second, platform civilianization: merchant ships, trucks, and containers can all serve as launch platforms, while traditional border air defense networks cannot cover tens of thousands of civilian vessels. Third, attribution failure: NATO's deterrence relies on "being able to confirm who fired," but flag-of-convenience vessels and denial strategies specifically undermine this premise. Article 5 collective defense thus faces a gap in "below-threshold attacks."
ABAB News · Cognitive Laws
- The cheapest weapons force the most expensive defenses.
- Indistinguishable merchant ships are more dangerous than warships.
- Deterrence relies on attribution, and gray zones specifically eliminate attribution.