The 2025 European NATO Drone Incursion Wave

Theoretical Alignment

This file substitutes "Man-Made / Hybrid Warfare" for both the Psycho-Social/Mundane and Extraterrestrial categories because no party involved — not NATO, not any national government, not independent investigators — has ever suggested an exotic origin for any object in this wave. The genuine open question is not what kind of phenomenon this is, but which specific incidents within the wave reflect real hostile drone activity versus misidentification, false alarms, or public panic following a confirmed real incursion. This site includes the case because it meets the archive's UAP criteria on its own terms: the individual drones involved in most incidents outside Poland remain formally unidentified as to operator and origin, a defining characteristic of a UAP case even where the broader phenomenon (drones, not exotic craft) is not in question.

Background

The wave began against the backdrop of Russia's ongoing invasion of Ukraine and a documented pattern of "hybrid warfare" activity — sabotage, cyberattacks, and disinformation short of open conflict — that European intelligence services had already attributed to Russia in the years prior. That pattern had a specific, already-institutionalized precedent by the time the drone wave began: a string of undersea telecommunications and power cables in the Baltic Sea had been damaged or severed since Russia's full-scale invasion of Ukraine began in February 2022, incidents Western officials and analysts increasingly linked to Russia's "shadow fleet" of aging, sanctions-evading oil tankers allegedly dragging anchors across cable routes. NATO's Allied Command Operations responded by launching Operation Baltic Sentry on January 14, 2025, combining maritime patrols, aircraft, and naval drones from multiple member states to protect undersea infrastructure; NATO later reported the operation cut its average response time to a suspected sabotage incident from roughly seventeen hours to about one hour between January 2025 and January 2026. The drone wave that began that September, in other words, arrived at a moment when NATO's northern and eastern members already had a live, standing apparatus and a working assumption for interpreting ambiguous incidents near their coastlines and borders as possible Russian hybrid activity — a framework that shaped how quickly officials reached for a hostile explanation once drones began appearing over airports and bases, for better or worse.

The wave also coincided with Russia's large-scale Zapad-2025 joint strategic exercises with Belarus, held in September 2025 near NATO's eastern border, and with a documented pattern of near-continuous Russian missile and drone bombardment of Ukrainian territory. On the night of September 9–10, 2025, Polish officials reported that about 19 to 23 drones entered Polish airspace, many from Belarus, during one such large-scale Russian missile and drone assault on Ukraine. Polish and allied aircraft shot down up to four of them, the first time NATO aircraft had shot down Russian drones over allied territory. Poland invoked NATO's Article 4 consultation mechanism, and Foreign Minister Radosław Sikorski said: "We have never before faced such a massive violation of NATO and EU airspace." NATO Secretary General Mark Rutte launched Operation Eastern Sentry two days later. Denmark, meanwhile, held the rotating presidency of the Council of the European Union for the second half of 2025, meaning the wave's most politically charged incidents — the closures at Copenhagen Airport — came a week before Denmark hosted EU leaders in Copenhagen for an informal European Council summit (October 1–2), and while its national government carried heightened diplomatic visibility across the continent.

Complete Timeline

Date	Event
Sept. 9–10, 2025	About 19–23 Russian drones (at least some of them unarmed Gerbera-type decoys) enter Polish airspace overnight, many from Belarus; Polish F-16s and Dutch F-35s, supported by an Italian early-warning aircraft and a Belgian tanker, shoot down up to four, with German Patriot batteries on alert. Poland invokes NATO Article 4.
Sept. 12, 2025	NATO launches Operation Eastern Sentry, deploying fighter jets, air-defense systems, and naval assets from Denmark, France, Germany, Italy, the UK, Spain, and other member states to reinforce the eastern flank.
Sept. 22, 2025	Copenhagen Airport closes for nearly four hours after two to three large drones are reported in controlled airspace; PM Mette Frederiksen calls it "the most serious attack on Danish critical infrastructure to date." Oslo Gardermoen Airport also briefly closes.
Sept. 24, 2025	Aalborg Airport closes from about 21:44; Billund closes for about an hour early on September 25; further sightings are reported near Sønderborg, Esbjerg, and Skrydstrup air base. Danish police move to a heightened readiness level last used in 2015.
Sept. 25–26, 2025	Drones reported over critical infrastructure sites in Schleswig-Holstein, Germany — including a Thyssenkrupp shipyard facility, a hospital, and a state parliament building — with wingspans reportedly up to eight meters, per Germany's federal interior minister. Karup Air Base, Denmark, also reports a multi-hour sighting.
Sept. 27–28, 2025	Norway's Ørland Main Air Station, a key NATO base, reports drones for roughly two and a half hours; Norwegian police log "five to six possible drones" simultaneously over Brønnøysund Airport.
Oct. 2–3, 2025	Munich Airport suspends operations on two consecutive nights; on October 3, police report "two simultaneous confirmed drone sightings" near the north and south runways, and 46 departures are cancelled or delayed, affecting about 6,500 passengers.
Oct. 16, 2025	The European Commission presents a defense readiness roadmap that includes a proposed European Drone Defence Initiative (the "drone wall"), with initial capability by the end of 2026 and full capability by the end of 2027; EU foreign-policy chief Kaja Kallas presents it.
Oct. 31–Nov. 2, 2025	Berlin Brandenburg Airport closes for roughly two hours; Bremen Airport briefly suspends operations; drones are first reported over Kleine Brogel Air Base, Belgium.
Nov. 1–3, 2025	Drones observed over Kleine Brogel, Leopoldsburg, and Marche-en-Famenne air bases on consecutive nights; Belgian Defense Minister Theo Francken describes a two-phase pattern and calls it a "spy operation."
Nov. 6, 2025	Gothenburg-Landvetter Airport (Sweden) and Brussels Airport briefly close; three drones reportedly overfly the Port of Antwerp.
Nov. 9, 2025	Liège Airport closes for just under an hour; drones are reported over the Doel nuclear power station (three in some reports, five in others). Around this time France, Germany, and the United Kingdom send experts and equipment to Belgium (Reuters, Nov. 10).
Nov. 13, 2025	Francken tells the Belgian parliament that the United States has offered "technical and operational assistance."
Nov. 19, 2025	Germany's cabinet, under Chancellor Friedrich Merz, approves draft amendments to the Air Security Act letting the Bundeswehr help police counter drones, including shooting them down as a last resort.
Nov. 21, 2025	Dutch military personnel fire ground-based weapons at drones over Volkel Air Base, a suspected U.S. nuclear weapons storage site, between about 7 and 9 p.m.; the number of drones is unknown, and none are brought down or recovered.
Nov. 22, 2025	Civil and military flights at Eindhoven, which shares its airfield with an air base, are halted for the evening after drone sightings; the link to Volkel is unclear.
Late Nov. 2025	Dutch newspaper Trouw, with the tracking site Dronewatch, reports that of roughly 60 drone sightings across 11 countries between August and November, only four (Poland, Romania, Moldova) involved confirmed Russian drones, while the origin of about 40 could not be verified at all and at least 14 were ordinary aircraft, helicopters, ships, or stars.
Dec. 1, 2025	During Ukrainian President Volodymyr Zelenskyy's arrival in Dublin, the Irish naval vessel LÉ William Butler Yeats observes several unidentified drones north of Dublin.
Dec. 4, 2025	Five drones are reported over Île Longue, France's ballistic-missile submarine base in Brittany, around 7:30 p.m.; French marines fire a jammer, not firearms, per Rennes prosecutor Frédéric Teillet, who says the inquiry must still confirm whether they were drones and how many. None are downed or recovered.
Feb. 26, 2026	Germany's Bundestag passes the Air Security Act amendments (CDU/CSU, SPD and AfD in favor), allowing the armed forces to support police against drones and, as a last resort, shoot one down to prevent a particularly severe disaster.
June 25, 2026	Copenhagen Police present the outcome of their nine-month investigation into the September 22 incident; Chief Superintendent Søren Thomassen says they "cannot demonstrate that there was drone activity in and around the airport" but cannot rule it out either.
July 2, 2026	A report from the International Institute for Strategic Studies (IISS), plotting 144 suspected drone sightings across central and northwest Europe from 2024 to 2026, concludes it is highly likely that Russia used "shadow fleet" vessels as launch platforms for at least some of them, and calls the campaign a "strategic failure" for Europe's air defenses.

The Confirmed Incident: Poland

The Poland incursion stands apart from every other event in this wave as the wave's one unambiguously confirmed case. Drone wreckage was recovered across Polish territory, examined by prosecutors, and attributed to Russian drones launched amid a broader missile and drone assault on Ukraine. NATO's air response, Poland's Article 4 invocation, and the subsequent launch of Operation Eastern Sentry on September 12 all rest on this single, well-documented event.

The incursion unfolded over roughly seven hours, from around 23:30 CEST on September 9 to 06:45 CEST on September 10. Estimates of the number of drones varied by source: 19 in Poland's report to the UN Security Council, 21 per presidential adviser Marcin Przydacz, and about 23 per Rzeczpospolita; the Polish prosecutor's final findings later put the total at "over 30," falling at 27 locations. Many entered from Belarus during the broader Russian missile-and-drone barrage aimed at Ukraine that night. Debris and drone locations were subsequently documented across a wide swath of Polish territory, from eastern border villages such as Wyryki-Wola, Czosnówka, and Wohyń to sites in south-central Poland (Czyżów, Mniszków, Nowe Miasto nad Pilicą) and as far north as Korsze in Warmia-Masuria; France's representative at the UN said one drone reached the Gdańsk region, which he put at more than 700 kilometers from the Ukrainian border (the straight-line distance is closer to 450 km).

Polish F-16s scrambled alongside Dutch F-35 Lightning IIs, which downed the majority of the intercepted drones; an Italian airborne early-warning aircraft, a Belgian Airbus A330 aerial tanker, and German Patriot air-defense batteries also took part in the alliance-wide response, with German Patriots tracking drone paths at heightened alert. Between three and four drones were confirmed destroyed by the time the incursion ended; by September 12, seventeen individual drones had been identified across the incident sites, with further wreckage — including a Gerbera-type decoy drone built partly from polystyrene rather than plywood — still turning up months later: mushroom foragers found fragments at Wodynie and near Biała Góra, and a Gerbera airframe was found on March 12, 2026, in a lignite mine near Gałczyce, about 170 km west of Warsaw. Investigators, including Lublin's Regional Prosecutor's Office, said the recovered drones were unarmed decoys with no explosive materials (some carried Polish SIM cards for control); that finding did not, in the assessment of NATO and allied governments, make the incursion less deliberate, since decoy drones are typically flown specifically to saturate and probe air defenses. The only reported property damage came not from a drone itself but from a Polish Air Force AIM-120 AMRAAM missile that struck a house in Wyryki-Wola and destroyed its roof without exploding; no one was injured. The government was later accused of initially obscuring that the damage came from a Polish missile.

The diplomatic and military response was immediate and multinational. Polish Prime Minister Donald Tusk said the drones "posed a direct threat," and Deputy Prime Minister and Foreign Minister Radosław Sikorski called it an unprecedented attack not only on Polish territory but on NATO and the EU, adding that the drones "did not veer off course, but were deliberately targeted." Ukrainian President Volodymyr Zelenskyy said the incursion "could not be called an accident." German Defense Minister Boris Pistorius said the drones were "quite obviously deliberately directed on this course," while UK Prime Minister Keir Starmer called the incident "deeply concerning" and "an extremely reckless move," and French President Emmanuel Macron termed it "unacceptable." Russia's chargé d'affaires in Warsaw, Andrey Ordash, called the accusations "groundless," and Russia's Defense Ministry said it had "not planned to hit" any targets in Poland. Analysts Justin Bronk (RUSI) and Justin Crump (Sibylline), speaking to BBC Verify, assessed that the sheer scale of the incursion made it "almost certainly a deliberate act on Russia's part" rather than a stray or accidental overflight. Poland closed its border with Belarus from September 12 to 25, spanning Russia and Belarus's Zapad-2025 exercises, and restricted drone and small-aircraft flights near its eastern border until December 9.

The Unproven Flagship: Copenhagen Airport

The incident that gave the broader wave its name and its "hybrid attack" framing, however, could not be substantiated by the investigation. On the night of September 22, 2025, Copenhagen Police described two to three large drones operating inside controlled airspace, forcing a shutdown of nearly four hours; Chief Superintendent Jens Jespersen said the next day that officers had not tried to shoot the drones down because of the risk to a busy airport, that the operation "could very well be something initiated from a ship" many kilometres away, and that "this was what we would call a capable operator" with the capability, will and tools to show itself — language that, alongside PM Frederiksen's "most serious attack" remark, set the tone for how the incident and the wave that followed it were understood for the next nine months.

The investigation did not confirm that understanding. On June 25, 2026, Copenhagen Police Chief Superintendent Søren Thomassen presented the outcome of the nine-month inquiry: "Overall, our conclusion today is that we cannot demonstrate that there was drone activity in and around the airport." Investigators had reviewed witness statements, photographs, video, CCTV footage, radar data, and air- and maritime-traffic records, and could not establish that the observed objects were drones; Thomassen also acknowledged that police had not communicated their uncertainty clearly enough at the time. One radar system had detected an object moving at roughly 100 km/h over the Øresund Strait, but the manufacturer, the Dutch firm Robin Radar, subsequently disclosed that the specific installation at Copenhagen Airport was a bird-detection radar "not designed to detect drones." Thomassen was careful to frame the finding as an absence of proof rather than proof of absence, clarifying that police "cannot rule out that drones were present" — only that nine months of evidence review had failed to substantiate that they were. Earlier in 2026 police had disclosed that the credibility of a key witness statement had come under scrutiny, an internal memo had reported that air traffic controllers saw no drones, and the first completed investigations into other autumn sightings in Denmark found no evidence of hostile or unauthorized drone activity (Dronewatch). This file treats the finding as directly relevant to how the entire wave should be read: the single incident most responsible for the wave's "unprecedented hybrid attack" framing, and the one that did the most to shape the political and military response across a dozen countries in the weeks that followed, rests on evidence its own investigators said they could not substantiate, although they did not rule drones out.

The Broader Danish and Norwegian Pattern

Copenhagen was neither the first nor the last Nordic incident. Two days after the airport closure, on September 24, Aalborg and Billund airports both temporarily closed, and further sightings were reported near Sønderborg, Esbjerg, and Skrydstrup military air base; Danish police moved to a heightened readiness level last used in 2015, and the National Operative Staff was activated. On the evening of September 26, Karup Air Base logged a sighting lasting several hours from about 20:15 local time. Norway experienced a parallel pattern: Oslo's Gardermoen Airport briefly closed the same night as Copenhagen, Ørland Main Air Station — one of Norway's key NATO-integrated bases — reported drone activity for roughly two and a half hours on September 27, and Norwegian police at Brønnøysund Airport filmed "five to six possible drones" at once the following night. Sweden's Gothenburg-Landvetter Airport briefly closed in a related incident in early November. In response, NATO increased its Baltic Sea naval and air presence, and Germany deployed the air-defense frigate FGS Hamburg to waters near Copenhagen; Sweden separately offered Denmark anti-drone equipment. Danish authorities reportedly began quietly mobilizing military reservists around September 29, according to reports that later leaked to the press, and banned civilian drone flights nationwide around the informal European Council summit that Copenhagen hosted on October 1–2 as part of Denmark's rotating EU presidency — meaning the drone scare and the continent's response to it were unfolding in the same city, in the same week, as a gathering of EU heads of government. Danish officials, including PM Frederiksen, publicly described a hybrid attack without formally attributing it to any state, and police said they were pursuing several leads, including a launch from a ship. The 2026 IISS report later noted that shadow-fleet tankers, including the Boracay, were near the Danish coast during the September sightings; French forces boarded the Boracay at the end of the month, and President Macron said he could not rule out its involvement.

Germany: Munich, Schleswig-Holstein, and a New Law

Germany experienced some of the wave's most disruptive and most institutionally consequential incidents. On September 25–26, drone formations were reported over multiple critical-infrastructure sites in the northern state of Schleswig-Holstein, including in Kiel, where a Thyssenkrupp Marine Systems shipyard, the university hospital and the state parliament were reported among the sites; federal Interior Minister Alexander Dobrindt spoke of drones with wingspans of up to eight meters, a figure that was not independently verified. Munich Airport, one of Germany's busiest, was forced to suspend operations twice within 24 hours in early October: the first closure, on the evening of October 2, grounded at least 17 flights and affected about 3,000 passengers; the second, from 9:30 p.m. on October 3, followed "two simultaneous confirmed drone sightings by police patrols" near the airport's north and south runways, with 23 inbound flights diverted and 46 departures cancelled or delayed, affecting about 6,500 passengers, before operations resumed from 7 a.m. Berlin Brandenburg Airport suspended flights for almost two hours on October 31, and Bremen Airport briefly halted flights on November 2. German federal authorities were notably tight-lipped about follow-up findings in most of these cases, releasing little information confirming or ruling out drone involvement in individual incidents.

The cumulative effect on German policy was significant. Defense Minister Boris Pistorius stated in early October that Germany intended to legislate a clearer legal basis for shooting down drones over German territory, and on November 19, the cabinet of Chancellor Friedrich Merz approved draft amendments to the Air Security Act letting the Bundeswehr assist police against drones, a significant step given Germany's strict postwar limits on domestic military action. The Bundestag passed the amendments on February 26, 2026, with CDU/CSU, SPD and AfD votes; they allow the armed forces to support the states' police against drones and, as a last resort, to shoot one down if that is the only way to prevent a particularly severe disaster. The Bundesrat approved them in March.

The Middle Ground: Belgium and the Nuclear Bases

Between these two poles sits the Belgian pattern of sightings at Kleine Brogel Air Base, which multiple officials, including Defense Minister Theo Francken, characterized as a coordinated, multi-phase surveillance operation — smaller drones first probing security-service radio frequencies, followed by larger drones. Francken told reporters the pattern "resembles a spy operation — by whom, I don't know. I have a few ideas, but I am going to be careful [about speculation]," and described the first phase as "small drones to test the radio frequencies" of Belgian security agencies, followed by a second phase of "big drones to destabilize the area and people." The sightings, concentrated over the nights of November 1–3, 2025, also extended to Leopoldsburg and Marche-en-Famenne air bases; Kleine Brogel is notable within the wave for hosting Belgium's F-16 fleet, its newly arriving F-35s, and, reportedly, U.S. B61 nuclear bombs (the Center for Arms Control and Non-Proliferation estimates at least 100 such weapons across six bases in five NATO countries; Washington discloses no numbers), making it one of several suspected or confirmed nuclear-weapons storage sites overflown during the wave alongside the Netherlands' Volkel Air Base.

The pattern widened through November. On November 6, Brussels Airport briefly closed and three drones were reported over the Port of Antwerp; on November 9, Liège Airport closed for just under an hour and drones were reported over the Doel nuclear power station. Reuters reported on November 10 that France, Germany, and the United Kingdom had sent experts and equipment to Belgium, and on November 13 Francken told the Belgian parliament that the United States had offered "technical and operational assistance." Belgian officials never named a responsible party. The late-November Trouw/Dronewatch audit found that several Belgian alerts were helicopters or approaching cargo aircraft (a supposed large drone above Brussels Airport was a police helicopter), without resolving whether the specific multi-night Kleine Brogel pattern — with its distinctive, technically specific two-phase signature — was among them. Belgium installed new drone-detection systems in the weeks that followed.

The Netherlands, France, and Ireland: The Wave's Final Months

The wave's last major incidents, in late November and December, again targeted sites associated with nuclear deterrence. On the evening of November 21, guards at Volkel Air Base — one of six European bases believed to store U.S. B61 nuclear bombs — reported drones overhead between about 7 and 9 p.m.; military personnel fired ground-based weapons, but the drones, whose number the Royal Marechaussee said was unknown, left the area and were not found. The next evening, flights at Eindhoven, which shares its airfield with an air base, were halted after further sightings; the link to Volkel is unclear. On December 4, five drones were reported over Île Longue, the Brittany peninsula base that homes all four of France's ballistic-missile submarines (Le Triomphant, Le Téméraire, Le Vigilant, and Le Terrible); French marines responded with a jammer rather than firearms, according to Rennes prosecutor Frédéric Teillet, who said the inquiry still had to confirm whether the objects were drones and how many there were; as with Volkel, nothing was downed or recovered. French authorities said that, at that stage, "no link with foreign interference" had been formally established. On December 1, during Ukrainian President Volodymyr Zelenskyy's arrival in Dublin, the Irish naval vessel LÉ William Butler Yeats observed several unidentified drones north of Dublin; the IISS later reported four large drones flying for two hours above the ship while the shadow-fleet tanker Vezhen circled off the coast — incidents that extended the wave's geographic reach to a nation outside NATO's own membership.

NATO's Institutional Response: Eastern Sentry and the Cost Problem

Operation Eastern Sentry, launched September 12, 2025, extended a model NATO had already tested in the Baltic: rather than leaving each member state to intercept airspace violations with its own national assets, the alliance established a coordinated, alliance-wide air-defense posture along its entire eastern flank. Rutte framed the escalation bluntly: "Russia's recklessness in the air along our eastern flank is increasing in frequency." The first contributions announced were Danish F-16s and an air-defense frigate, three French Rafales and four German Eurofighters, with the United Kingdom saying it was willing to provide assets; NATO said the mission would integrate air and ground-based defenses and increase information sharing. It carries no announced end date.

The wave also forced a blunter strategic reckoning inside NATO about the economics of countering cheap drones with expensive interceptors. Decoy drones such as the Gerbera are cheap, while the air-to-air missiles fired at them over Poland, such as the AIM-120, cost far more; a single Patriot interceptor costs more than $3 million. In response, NATO members turned to cheaper interceptors. Lithuania bought 48 U.S.-made Merops interceptors, a system costing about $15,000 per shot and credited by the Ukrainian outlet Militarnyi with more than 1,000 Shahed-type intercepts in Ukraine since mid-2024; its defense minister said it could intercept "Shahed, Gerbera, and other similar targets" (Defense News, May 2026). Ukrainian makers argued that even that was too expensive: "When you need to shoot down 60 Shaheds at once, you need $2,000 systems."

The wave also reopened a long-running internal NATO debate about where exactly hybrid activity like drone incursions sits relative to the alliance's collective-defense threshold. Article 4 of the North Atlantic Treaty, which Poland invoked, only obliges member states to consult when one feels its territorial integrity, political independence, or security is threatened; it carries no automatic military response. Article 5, the mutual-defense guarantee, requires a qualifying "armed attack," and NATO has since 2016 left open the possibility that hybrid activity — including cyberattacks, and by extension sabotage or drone incursions — could in principle meet that bar on a case-by-case basis, a position reaffirmed regarding cyber activity at NATO's 2023 Vilnius summit. In practice, every incident in this wave, including the confirmed Poland incursion, was handled through Article 4 consultation and an alliance-level operational response (Eastern Sentry) rather than a formal Article 5 invocation, illustrating how a state can conduct sustained, low-level military probing against NATO territory without triggering the treaty's core collective-defense guarantee — and, critics of NATO's posture argued at the time, without incurring costs remotely proportionate to a member state's own certainty that hostile military drones had crossed its border and been shot down over its own soil.

The EU's Drone Wall Proposal

The wave also produced a parallel, non-NATO institutional response from the European Union. On October 16, 2025, the European Commission presented a defense readiness roadmap, unveiled by EU foreign-policy chief Kaja Kallas among others, proposing a "drone wall," formally the European Drone Defence Initiative (EDDI), intended to give the EU its own layered detection and counter-drone capability along its eastern and northern borders. Kallas emphasized that the initiative was meant to sit alongside, not duplicate, NATO's own efforts: "We are not doubling the work that NATO is doing; actually, we are complementing each other," and separately argued that "drones are already redefining warfare. Having drone defences is no longer optional for anyone." The roadmap targeted an initial operational capacity by the end of 2026 and full operational status by the end of 2027. France, Germany, and the United Kingdom separately sent experts and equipment to Belgium during the November sightings (Reuters, November 10), while the United States offered "technical and operational assistance," according to Francken's November 13 statement to the Belgian parliament.

The Technical and Evidentiary Debate: How Many Drones Were Real?

Perhaps the most consequential open question raised by this case is not whether Russia has waged hybrid warfare against NATO states — the Baltic cable-sabotage pattern and the confirmed Poland incursion both establish that it has — but how many of the dozens of individual "drone" sightings that made up the broader September-to-December wave actually involved real, hostile aircraft. The evidentiary record here is unusually well-documented for a UAP-adjacent case, because two independent outlets conducted systematic after-the-fact tallies rather than relying on impressions built up incident-by-incident in real time.

The Dutch newspaper Trouw's late-November 2025 analysis, carried out with the tracking platform Dronewatch, found that of roughly 60 reported sightings across 11 countries between August and November 2025, only four — all in Poland, Romania, or Moldova, all bordering Ukraine — involved confirmed Russian drones identified through recovered debris or a confirmed shoot-down. Dronewatch's published version (November 29) of the same analysis, covering 61 sightings reported between September 9 and November 27, categorized the outcomes as follows: three cases were confirmed Russian military drones; three more were confirmed hobbyist or tourist drones with no hostile connection; fourteen cases turned out, on investigation, not to involve a drone at all — a police helicopter taken for a large drone above Brussels Airport, other helicopters and approaching cargo aircraft in Belgium, bright stars over Billund and southern Limburg, and an object near a Norwegian oil platform that police said was most likely a nearby ship; and the remaining 41 cases — two out of every three sightings in the tally — yielded no evidence at all of a drone's origin, meaning investigators could neither confirm nor rule out that a real, unidentified drone had been present. In other words, 55 of the 61 incidents analyzed, or roughly 90 percent, produced no confirmation of hostile or illegal drone activity, although official rhetoric during the wave often treated hostile activity as the default assumption. Dronewatch compared the situation to the 2024 New Jersey drone panic in the United States, in which the FBI investigated thousands of reports and found no hostile activity.

That skeptical picture was partly revised by later reporting. A report published on July 2, 2026, by the International Institute for Strategic Studies (IISS) plotted 144 suspected drone sightings across central and northwest Europe between 2024 and 2026, a larger and longer-running dataset than the Trouw/Dronewatch tally that excluded NATO's eastern flank. By plotting the movements of Russian "shadow fleet" vessels, the same sanctions-evading tanker fleet linked to Baltic Sea cable damage, it concluded it was highly likely that Russia used them to launch drones, and that Russia likely tried to monitor military sites in the UK, the Netherlands, Belgium, France and Germany and force NATO to reveal radar positions and gaps. It called the campaign a "strategic failure" for Europe. Not everyone agreed on attribution: several senior European officials told the Associated Press that the incursions were hard to attribute to Russia, and a British defense police investigation found no evidence conclusively linking the UK sightings to Russia. Reconciling the two reports is less a matter of one being right and the other wrong than of them measuring different things: the Trouw/Dronewatch analysis is a rigorous case-by-case evidentiary audit that correctly found most individual incidents unproven, while the later IISS assessment is a pattern-level judgment, built on ship movements and the clustering of sightings at military and nuclear-linked sites, that argues real, sustained Russian probing activity was mixed in among the much larger volume of noise, rather than that the entire wave was either wholly genuine or wholly manufactured panic.

A further layer of the technical debate concerns intent even where activity is accepted as real: Polish and Ukrainian officials argued publicly that the Poland incursion was deliberate testing of NATO's defenses rather than incidental spillover from the war. A different explanation is plausible for some other incidents: that a subset of incursions — particularly drones that briefly clipped NATO airspace near the Ukrainian and Belarusian borders during large Russian strikes on Ukraine itself — may reflect navigational error, jamming-induced course deviation, or simple operational spillover from a massive nightly bombardment campaign rather than a deliberately targeted probe of a specific NATO airport or base. Both readings can be true simultaneously for different incidents within the same wave: a border-adjacent, single-drone stray near Poland's frontier during a mass Ukraine strike is a materially different kind of event from five drones flying a deliberate pattern over a French nuclear submarine base roughly 2,000 kilometers from Ukraine's western border, even though both were reported under the same "European drone incursion" umbrella at the time.

Key Figures

The Five Observables Assessment

Applying the Five Observables framework, with the caveat that this case concerns conventional drone technology rather than a claimed anomalous craft:

Assessment: This case scores low on the Five Observables framework by design, since it concerns identifiably conventional drone technology; its inclusion in this archive rests entirely on the unidentified status of the specific operators involved in most incidents outside Poland, not on any anomalous performance characteristics.

Evidence Assessment

Why "Disputed"

This case is rated Disputed because it genuinely contains both a confirmed, high-certainty event and a prominent, later-unproven one within the same continuous wave, and this file declines to average that tension away in either direction. The Poland incursion is not disputed — it is a matter of recovered physical evidence and formal attribution. The Copenhagen incident, by contrast, could not be substantiated by the police investigation tasked with examining it, and in the one systematic audit of the wave, 55 of 61 sightings produced no confirmation of hostile or illegal drone activity.

This file does not rate the case as Debunked because the Poland incursion alone establishes that real, hostile drone activity against NATO airspace did occur during this period, because several other incidents (Kleine Brogel's multi-phase pattern in particular, and the cluster of sightings at nuclear-linked sites more broadly) have not been formally resolved either way, and because the later IISS report linked a number of sightings to shadow-fleet ship movements and judged Russian use of those ships highly likely. It does not rate the case as Credible or Verified because the single incident most responsible for the wave's public alarm and "hybrid attack" characterization could not be substantiated by official investigators, and because the large majority of individually audited sightings across the wave were never substantiated at all. A case combining one confirmed act of war, one unproven flagship incident, and dozens of unresolved reports in between is, by this archive's own standards, close to the textbook definition of Disputed rather than either extreme.

Observer Credibility & Occupational Profile

This case's observers span an unusually wide range of institutional credibility within a single file: on one end, military radar operators and recovered physical evidence in Poland provide genuinely strong, verifiable confirmation; on the other, some airport and public sightings that generated national "hybrid attack" alarm were later found by the responsible police investigation to lack demonstrable supporting evidence. Between those poles sit observers of intermediate reliability — police officers and airport security staff across Germany, Belgium, Norway, and the Netherlands who made good-faith visual identifications under night-time, high-stress conditions, sometimes corroborated by a second independent observer (as at Munich, where two separate police patrols confirmed simultaneous sightings near opposite runways) and sometimes not. This file treats the case as a clear illustration of why institutional source alone (a national government, a police force, a military) does not guarantee a claim's ultimate accuracy — both the initial alarm and the later retraction in the Copenhagen case came from official government sources, and the same pattern (initial confident hostile-activity framing, later walked back or left unresolved) recurred across multiple countries rather than being unique to Denmark.

Historical Precedents & Archive Matches

This case is comparable to other drone-swarm incidents in this archive involving military and critical infrastructure sites, including the New Jersey/Northeast Drone Wave and the 2019 Navy Destroyer Drone Swarm, both of which similarly combined genuine unresolved sightings with significant public speculation exceeding the confirmed evidentiary record. Dronewatch's own analysts drew an explicit comparison between this wave and the New Jersey/Northeast case in particular, noting that both episodes saw a large volume of individual reports investigated by a capable institution (the FBI in the American case, national police forces in the European one) that ultimately could confirm hostile or unlawful activity in only a small fraction of incidents, while public and political alarm during the event itself ran well ahead of the confirmed evidentiary record in both cases. The parallel is not exact — this wave contains one incident (Poland) with a confirmed hostile state actor and recovered military hardware, which the New Jersey wave never did — but the underlying dynamic, in which a single credible early incident lowers the public and institutional threshold for interpreting subsequent ambiguous sightings as hostile, recurs across both files.

Material Analysis

The case's physical evidence is sharply divided by location: confirmed drone wreckage was recovered and formally examined in Poland, while no physical material has been recovered from any other national incident within the wave, including the high-profile Kleine Brogel, Copenhagen, Volkel, and Île Longue incidents. The Polish wreckage record is itself unusually rich for this archive: seventeen individual drones had been identified by September 12, 2025, additional fragments continued to surface through debris searches in Wodynie and Biała Góra, and a further Gerbera-type airframe was recovered as late as March 12, 2026, in a lignite mine roughly 170 kilometers west of Warsaw — a recovery timeline stretching across six months that underscores how physically extensive the incursion actually was on the ground, independent of any single contested sighting. By contrast, every other national military response documented in this wave — Dutch ground fire at Volkel, French jamming at Île Longue, repeated Belgian and German patrol confirmations — failed to bring down or physically recover a single drone, leaving those incidents to rest entirely on visual, radar, or electronic-detection evidence rather than hardware.

The Conventional Explanation Candidate: A Mix of Genuine Russian Hybrid Activity and Public Panic/Misidentification

The leading, and this file's assessed, explanation is not a single unified theory but a layered one: a confirmed, deliberate Russian drone incursion into Poland created a genuine security shock that plausibly motivated additional real Russian probing activity at other NATO sites (particularly the multi-phase Kleine Brogel pattern and the cluster of sightings at nuclear-linked bases), while simultaneously lowering the public and institutional threshold for reporting ordinary aircraft, birds, satellites, and other conventional objects as hostile drones across the wider region. This layered reading is not merely this file's editorial compromise; it is closest to where the two major independent evidentiary reviews — Trouw/Dronewatch's skeptical, case-by-case audit and the IISS's later pattern-level shadow-fleet assessment — actually converge, once their different methodologies and scopes are accounted for.

The Copenhagen Radar Problem

The disclosure that Copenhagen's key radar contact came from a system designed to detect birds, not drones, is a concrete, specific mechanism by which a real security scare can generate false institutional confirmation without any actual drone being present. It also illustrates a broader technical weakness that ran through much of the wave: most airports and even many military installations across the affected countries lacked purpose-built, drone-specific detection radar in September 2025, meaning the vast majority of sightings depended on unaided visual observation at night, a notoriously unreliable basis for confidently distinguishing a small unmanned aircraft from a bird, a star, a distant airliner, or a helicopter. Trouw linked the false alarms to exactly this: the difficulty of detecting drones, reliance on human observation, and heightened public and media sensitivity.

Genuine Probing Activity Elsewhere

This file does not extend the Copenhagen finding to the entire wave: the Kleine Brogel pattern's described two-phase structure (frequency-probing followed by larger aircraft) is a specific technical signature that fits deliberate reconnaissance more than misidentification, and remains formally unresolved rather than debunked. The IISS's July 2026 finding that shadow-fleet ships were nearby during several clusters of sightings, including in Denmark in September and off Dublin in December, points the same direction: a genuine, if numerically small, core of deliberate Russian activity sitting inside a much larger volume of false alarms and misidentification generated by the atmosphere that core activity created.

A Mix of Genuine Russian Hybrid Activity and Public Panic/Misidentification — Plausibility Rating: PLAUSIBLE, PARTIALLY CONFIRMED

Related Cases

Further Reading — Recommended Literature

DISCLOSURE: Some links above are affiliate links. If you purchase through them, OverClassified receives a small commission at no additional cost to you. This helps support independent research.

Essential Viewing

Sources

• "2025 European drone sightings," Wikipedia. Read online →
• "2025 Russian drone incursion into Poland," Wikipedia. Read online →
• "Operation Eastern Sentry," Wikipedia. Read online →
• "After Months of Investigation: No Evidence of Drones Over Copenhagen Airport," Dronewatch Europe. Read online →
• "NATO Shoots Down Russian Drones Over Poland," CNN. Read online →
• "Surge of Mystery Drone Incursions Targets Europe's Military Nerve Centers," The Washington Times. Read online →
• "Belgium Suspects 'Spy Operation' in Drone Flight Near Nuclear Air Base," Defense News. Read online →
• "Drone Incursions in Belgium Spark Probes, NATO-EU Response," Arms Control Association. Read online →
• "Denmark Reports 'Hybrid Attack' as Drones Shutter Major Airport," Al Jazeera. Read online →
• "Eastern Flank Watch and European Drone Wall," European Parliament Think Tank. Read online →
• "EU Discusses 'Drone Wall' to Protect Airspace From Russian Violations," Al Jazeera. Read online →
• "Drones Seen Over Belgian Military Base for Third Night, Minister Says," BBC News. Read online →
• "Police Unable to Prove Drones Over Airport," The Copenhagen Post. Read online →
• "61 European Drone Sightings Analysed: Here's What We Know," Dronewatch Europe. Read online →
• "Majority of Reported Drone Incidents in Europe Not Linked to Russia — Trouw," The Moscow Times. Read online →
• "Russia Waged a Drone Campaign in Europe and Likely Launched Drones From Shadow Ships, Report Says," ABC News. Read online →
• "Munich Airport Resumes Operations After More Drone Sightings Halted Flights," Al Jazeera. Read online →
• "Dutch Military Opens Fire on Unidentified Drones Over Volkel Air Base," NL Times. Read online →
• "France Probes Mystery Drone Flight Over Nuclear Sub Base," France 24. Read online →
• "Germany Empowers Military to Shoot Down Drones in Emergencies," Bloomberg. Read online →
• "NATO Says Baltic Sentry Helped Slash Russian Undersea Infrastructure Sabotage, Cut Response Time to One Hour," United24 Media. Read online →
• "NATO Nations Size Up an Interceptor-Drone Bazaar Where Low Price Is Everything," Defense News. Read online →
• Graff, Garrett M. UFO: The Inside Story of the US Government's Search for Alien Life Here—and Out There. Avid Reader Press, 2023.
• Kean, Leslie. UFOs: Generals, Pilots, and Government Officials Go on the Record. Harmony Books, 2010.
• Greenewald, John, Jr. Inside The Black Vault: The Government's UFO Secrets Revealed. Rowman & Littlefield, 2019.
• Hynek, J. Allen. The UFO Experience: A Scientific Inquiry. Da Capo Press, 1998 (orig. 1972).
• Peebles, Curtis. Watch the Skies! A Chronicle of the Flying Saucer Myth. Smithsonian Institution Press, 1994.
• "File: F-16 AF Belgium Sanicole 2007 flying P1020648 (50852999882).jpg," Jim van de Burgt, CC0/public domain. View file →
• "Plenum beschließt Änderung des Luftsicherheitsgesetzes" (vote of February 26, 2026), Deutscher Bundestag. Read online →
• "France probes mystery drone flight over nuclear sub base," AFP via GPS Daily, December 5, 2025 (prosecutor Frédéric Teillet). Read online →
• "EU says drone defences not optional in push to face Russia," AFP via SpaceWar, October 16, 2025. Read online →
• "Russia deliberately targeted Poland's airspace, Sikorski says," Kyiv Independent, September 10, 2025. Read online →

Corrections (October 2026)

This page was rechecked against its cited reporting in October 2026. The earlier version called the Copenhagen Airport incident "debunked" and "formally retracted" and said the case was closed without charges; Copenhagen Police said they could neither demonstrate nor rule out drone activity, and the page now says so. It gave figures from the July 2026 IISS report (48% military, 18% airports, 26% infrastructure) that do not appear in the Associated Press account of the report and could not be traced; they were removed, and the report's actual conclusions (shadow-fleet launches "highly likely," a "strategic failure" for European air defense) are now given. It stated that Belgium's new detection systems produced a sharp drop in sightings; no source for that was found, and it was removed. It said Kleine Brogel stores "roughly 100" B61 bombs; the estimate of at least 100 covers six bases in five countries. It said up to ten drones were fired on at Volkel; the Marechaussee said the number was unknown.

Other corrections: the Poland drones fell only in Poland, not Romania. The "largest concentration of violations" remark was attributed to Rutte; the comparable quote is Sikorski's. The Gdańsk "700 km" figure is the French UN representative's; the straight-line distance is about 450 km. The Bundestag vote was on February 26, 2026, not February 27, and the law allows shooting down drones only as a last resort. The "oil platform mistaken for a vessel" example was reversed: police said an object near a platform was most likely a ship. Merops cost-ratio figures ($15 million against $200 million), a €85,000 sortie cost, a "few thousand dollars" Gerbera price and an unnamed NATO commander's remark were not in the cited source and were removed. The Eastern Sentry contribution list was cut to the first announced offers. The EU roadmap was presented by the Commission, with Kallas; a von der Leyen presentation to Parliament was not confirmed. Eindhoven's closure was on November 22, not November 27, and an F-35 interception date of December 7 was not confirmed. The Île Longue prosecutor is the Rennes military prosecutor, who said the number and type of drones were still to be confirmed. Computed Moon and weather values for a single map point were removed.