OSINT Investigation Links Russian Shipping Activity to Drone Incidents Near European Military Sites
Source: Digital Digging
Executive Summary
An open source investigation by seven German journalism students, published by Digital Digging, links suspicious movements of three Russian crewed or Russia linked cargo vessels to a pattern of unexplained drone activity over military, critical infrastructure, and transport sites in Germany and the North Sea region. While the investigation does not prove direct operational control, it documents nineteen time and location overlaps between the ships and drone incidents, as well as ties to Russian military connected shipyards and the state nuclear corporation Rosatom, supporting European intelligence assessments that these vessels likely serve Russian state interests.
Analysis
The investigation shows that the coastal freighters HAV Dolphin, HAV Snapper, and the Russian flagged Lauga repeatedly operated in noncommercial patterns near sensitive sites, often coinciding with drone swarms or reconnaissance flights over German military bases, ports, energy facilities, and an airport. AIS tracking data, maintenance records, ownership links, and classified German police and intelligence reporting together suggest these ships may act as offshore platforms or support assets for Russian intelligence operations, possibly using ship launched drones with technical characteristics similar to those advertised by Rosatom. German authorities have acknowledged the broader phenomenon of a Russian “shadow fleet” and say foreign state involvement in some drone incidents is to be presumed, even as public statements remain cautious.
Classified reports from Germany’s federal police (BKA) show one thousand seventy two incidents involving one thousand nine hundred fifty five drones in Germany in 2025 through November, with nearly half at night and most near military facilities, but with pilots identified in only twenty nine of four hundred ninety eight investigated cases and no confirmed state actors.
Drone activity has affected both military and civilian sites, including repeated overflights during the Bundeswehr exercise Gelber Merkur, surveillance of US Air Base Ramstein and other bases, three overflights of the Stade LNG terminal, incidents over Wilhelmshaven Naval Arsenal and a nuclear plant at Biblis, and a two day shutdown of Munich Airport that stranded about ten thousand passengers and caused millions of euros in losses.
AIS data show the HAV Dolphin loitered for about nine to ten days in Kiel Bay in May 2025 with erratic circular tracks, at the same time drones were seen over defense shipyards twenty five kilometers away; the ship had just spent nearly a month at the Pregol shipyard in Kaliningrad, a facility with documented links to the Russian military and Rosatom, and carries an all Russian crew.
The Lauga, escorted by a German federal police vessel in the North Sea on the night of May 16 to 17, was overflown for hours by seven drones that circled both it and the police ship; the vessel previously called at Tartus in Syria, Russia’s naval base, and later docked at a St. Petersburg terminal partly owned by Rosatom through the Delo Group.
The HAV Snapper, owned by the same Norwegian company as the HAV Dolphin, took up station off the Dutch island of Schiermonnikoog two hours before the Lauga drone incident and remained in place for four days, one hundred fifteen kilometers away and within the range of known Rosatom ship launched drones; it also had prior maintenance at the Pregol shipyard.
The students obtained classified BKA text noting a container ship under the flag of Antigua and Barbuda with a recent extended stay in Russia anchoring in Kiel Bay, and other material describing inspections of the HAV Dolphin as superficial, with a suspicious extra watch officer on board and not all containers opened.
European intelligence services reportedly assess with high confidence that the three documented ships operate on behalf of Russian interests, citing their noncommercial movement patterns and links to Russian entities, while Germany’s Interior Ministry publicly acknowledges awareness of the shadow fleet and presumes some foreign state involvement in ongoing drone overflights.
Additional context shows the students used a classic OSINT and ground truth approach: they combined leaked documents, tens of thousands of AIS data points, and a two thousand five hundred kilometer car pursuit across France, the Netherlands, and Belgium to visually confirm the HAV Dolphin, even flying their own drone over the vessel. Their findings align with broader European concerns about low level agents recruited online, sometimes called pocket money agents, who can be tasked with simple sabotage or surveillance activities for modest pay. Although no drones were found on the ships during official searches and causation cannot be proven, the repeated temporal and geographic alignments, the technical feasibility of ship based drones with two hundred kilometer range, and the pattern of Russian linked infrastructure all point to a likely Russian state role in at least some of the unexplained drone activity over European critical sites.
