A reported US intelligence warning has raised concerns that Russia could use commercial vessels to launch drones against targets in southern Europe. According to Spanish newspaper El Mundo, authorities in Spain, France and Italy have been alerted to a potential operation involving Russian Gerbera drones concealed inside shipping containers.
By Open Chronicle with agencies
September 24, 2026
United States intelligence agencies have reportedly warned several European governments that Russia may be preparing a drone attack against Spain, France or Italy, potentially using unmanned aircraft launched from commercial vessels operating in European waters.
According to a report published by Spanish newspaper El Mundo on September 23, the alleged operation could involve Russian Gerbera drones concealed inside shipping containers and deployed from vessels approaching European territory.
The newspaper reported that intelligence concerning the potential operation had been shared with authorities in Spain, France, Italy and Lithuania.
The information reportedly originated from US intelligence assessments, although the details of the alleged operation have not been independently confirmed.
No official announcement has established that an attack is imminent or that a specific commercial vessel has been identified as preparing to launch drones against European targets.
Nevertheless, the reported warning comes amid growing European concerns about the vulnerability of critical infrastructure to sabotage, cyberattacks and unmanned aerial systems.
Intelligence warning points to possible drone launches from commercial vessels
According to El Mundo, the alleged Russian operation could involve transporting drones inside ordinary shipping containers before launching them from commercial vessels.
Such a method could complicate efforts to identify potential threats because commercial shipping operates extensively across European maritime routes.
A source close to Lithuania’s Ministry of Defence told the Spanish newspaper that drones could be concealed aboard a ship and launched from the sea.
The source suggested that the operation would not require particularly complex preparations.
The newspaper reported that Lithuanian authorities had received information identifying the Gerbera as the type of unmanned aircraft potentially involved.
Spain, France and Italy were also reportedly informed of the possible threat.
According to the report, a CIA assessment describing the potential operation was circulated among European foreign ministries.
However, the contents of the alleged intelligence document have not been made public, and the information available does not establish whether the reported warning concerns a specific operational plan or a broader assessment of possible Russian capabilities.
What is the Russian Gerbera drone?
The Gerbera is a Russian unmanned aerial vehicle that has been used during the war in Ukraine, including in operations intended to complicate Ukrainian air defence efforts.
The aircraft can serve as a decoy, but certain configurations can also carry explosive payloads.
According to the specifications cited by El Mundo, the Gerbera weighs up to 18 kilograms, can reach speeds of approximately 160 kilometres per hour and has a reported operational range of up to 600 kilometres.
The newspaper reported that the drone can carry a warhead weighing approximately four to five kilograms.
Although such a payload would not ordinarily be sufficient to destroy a large industrial facility, an explosive drone could still cause casualties, start fires or damage vulnerable infrastructure.
An incident involving an airport, port or industrial installation could also lead to temporary closures while authorities assess the threat and conduct security inspections.
The actual consequences would depend on the drone’s configuration, the location of any impact and the protective measures in place.
Lithuania reportedly received intelligence following CIA director’s Moscow visit
The Spanish newspaper reported that Lithuanian authorities received information concerning the potential operation shortly after CIA Director John Ratcliffe visited Moscow on August 25.
According to sources cited by El Mundo, the intelligence was subsequently shared with several European governments.
The report suggests that the information formed part of a wider exchange between American and European security authorities concerning potential Russian operations against NATO countries.
However, the precise origin of the intelligence, the circumstances surrounding its collection and any connection to Ratcliffe’s reported visit to Moscow have not been publicly established.
Neither the alleged operational plan nor the reported intelligence assessment has been independently authenticated.
The available information therefore remains an account of a reported security warning rather than confirmation that Russia has authorised or begun preparations for a specific attack.
France strengthens protection of critical infrastructure
The reported intelligence warning coincides with renewed French government attention to the protection of critical infrastructure against hybrid threats.
According to El Mundo, French President Emmanuel Macron convened the country’s Defence Council on September 16.
Two days later, he invited leaders of France’s political parties to the Élysée Palace for discussions concerning national security.
Following the meeting, Macron announced that France would strengthen measures intended to protect critical infrastructure against cyberattacks and drone threats.
The French government’s concerns extend to facilities whose disruption could affect essential public services, industrial production and national security.
Airports, ports, energy installations and military facilities are among the types of infrastructure that European governments have increasingly sought to protect against unmanned aircraft and other potential threats.
The timing of the French security discussions has been linked in the Spanish newspaper’s reporting to the alleged intelligence warning.
However, the French government’s publicly reported security measures do not, by themselves, confirm the existence of a specific Russian attack plan.
Pro-Russian Telegram channel publishes map of potential targets in southern France
On September 19, the pro-Russian Telegram channel Rybar published a map identifying potential targets in southern France that it suggested could be within range of Russian drones launched from North Africa.
According to El Mundo, the map included aircraft manufacturing facilities, military bases, nuclear power stations and petrochemical complexes.
The channel reportedly referred to Geran-5 drones potentially launched from the northern coast of Algeria.
The Geran-5 and Gerbera are different unmanned aircraft, and the publication of a map concerning one system does not establish that it forms part of the alleged operation involving the other.
The Telegram publication also does not constitute evidence that Russian authorities have selected the facilities as operational targets.
Nevertheless, the report illustrates how the potential use of drones launched from maritime locations has entered public discussion concerning European infrastructure security.
The geographical proximity of southern European countries to Mediterranean shipping routes has made maritime security an important consideration for national defence authorities.
German authorities investigate separate suspected drone incidents
The reported warning comes amid investigations into separate drone-related incidents in Germany.
According to reporting cited in the information provided, debris from an unmanned aircraft and a substance believed by investigators to be explosive material were discovered in Lower Saxony near the German military’s Wunstorf Air Base.
German federal prosecutors are reportedly examining whether the discovery could be connected to an earlier suspected sabotage incident at Leipzig/Halle Airport in August.
In that incident, a drone equipped with a detonator was reportedly discovered near a Ukrainian transport aircraft.
German authorities have attributed the suspected operation to Russia, according to the reporting.
However, the connection between the two German incidents remains under investigation.
There is also no publicly established evidence linking either incident to the alleged maritime drone operation described by El Mundo.
The cases nevertheless demonstrate the range of security concerns associated with unmanned aircraft operating near military and civilian infrastructure.
European security concerns extend beyond conventional military threats
The reported intelligence warning comes as European governments devote increasing attention to activities commonly described as hybrid threats.
These can include cyberattacks, sabotage, disinformation campaigns and covert operations that may be conducted without a formal declaration of war.
Russia has faced accusations from European governments concerning suspected sabotage and other hostile activities across the continent.
Moscow has rejected numerous Western allegations concerning its involvement in such operations.
The possible use of commercial vessels as platforms for launching drones would present a particular security challenge because civilian maritime traffic is extensive and essential to international trade.
European ports and shipping routes handle large volumes of cargo, while coastal regions contain important industrial, energy and transport infrastructure.
Security authorities must therefore balance the protection of critical facilities with the continued operation of commercial maritime activity.
The reported scenario also highlights the importance of intelligence sharing between NATO members and European security agencies.
Information concerning potential threats can help governments assess vulnerabilities and coordinate protective measures, even when the underlying intelligence remains classified.
Political implications ahead of European elections
El Mundo also noted that Spain, France and Italy are scheduled to hold elections in 2027, raising questions about the potential political consequences of a major security incident.
The newspaper suggested that public concern over Russian attacks and fatigue surrounding the war in Ukraine could influence domestic political debate.
However, the possibility of political consequences does not establish that the alleged operation is intended to influence elections.
No publicly available evidence cited in the report demonstrates that Russia has selected the three countries because of their electoral calendars.
The political implications of any future security incident would depend on its circumstances, the response of national authorities and the information available to the public.
No confirmed attack, but reported warning highlights infrastructure vulnerabilities
The intelligence warning described by El Mundo has not been accompanied by public confirmation of an imminent attack against Spain, France or Italy.
The available reporting does not identify a specific vessel, operational timetable or confirmed target associated with the alleged plan.
It also remains unclear whether the intelligence concerns preparations for an actual operation or an assessment of a possible method of attack.
Nevertheless, the reported warning has drawn attention to the potential security implications of unmanned aircraft operating from maritime platforms.
For European governments, the protection of ports, airports, military installations and energy infrastructure remains an important component of national security planning.
The alleged threat also underscores the role of intelligence cooperation in identifying and assessing potential hostile activities before they result in physical damage.
As European authorities continue to examine the risks associated with drones and suspected sabotage operations, further official information will be necessary to establish the credibility, scope and operational status of the alleged Russian plan.
Editorial note: This article is based on the September 23 report by El Mundo and the additional reporting supplied. The alleged intelligence warning and proposed maritime attack have not been independently verified. References to possible targets, operational methods and Russian involvement are attributed to the relevant reports and sources.