The Central Intelligence Agency (CIA) has warned several European governments of a Russian plan to launch armed drones from merchant vessels in the Mediterranean Sea against targets in Spain, France or Italy. The report, attributed by El Mundo journalist Xavier Colás to an anonymous source close to Lithuania's Defense Ministry and a diplomatic source in an unnamed Baltic country, describes a CIA intelligence assessment that has circulated among European foreign ministries since mid-September.
The alleged method centers on the Gerbera, a Russian-made jet-powered drone roughly two meters long with a 2.5-meter wingspan, weighing 18 kilograms, carrying 4 to 5 kilograms of explosives and capable of covering approximately 600 kilometers at 160 kilometers per hour. According to the report, the drones would be concealed inside shipping containers aboard commercial or so-called shadow-fleet vessels and catapult-launched from international waters, striking coastal ports, airports or tourist infrastructure. No government named in the report, the CIA, the White House or the Kremlin has publicly confirmed it.
What the intelligence describes, and what it doesn't
The reported payload matters as much as the range. Four to five kilograms of explosive is enough to start a fire or force a temporary shutdown, not to inflict mass casualties. El Mundo's source drew a comparison to Ukraine's Operation Spiderweb, in which drones smuggled inside Russia struck military airfields, a comparison that speaks to method rather than to demonstrated capability. Nothing in the report indicates Russia has already built or tested this specific maritime-launch configuration against a European target.
The precedent Elena's beat has already documented cuts the other way, toward capability that is real but calibrated to stay under a threshold rather than to devastate. In February, a Swedish naval unit detected a drone taking off from a Russian intelligence vessel in the Öresund Strait. In August, an explosives-laden drone was found on the tarmac at Leipzig/Halle airport beside a Ukrainian Antonov An-124 cargo jet; its detonator failed. Germany's Interior and Foreign Ministries subsequently attributed that attack to Russia's GRU military intelligence agency, Berlin's first direct public accusation of Russian sabotage on its own territory. Both incidents involved drones that malfunctioned before causing damage, a pattern that suggests operational testing more than perfected capability.
Observers are reading: what the CIA director's unannounced Moscow visit in August reveals about the origin of this warning.
Become an Observer — it's free. Get full access to all Crisis.Zone analysis, briefings and breaking coverage.
What the answer to the question actually is
Taken together, the reporting answers the narrow question only partially. There is no confirmation from any named government, the CIA, or the Kremlin, which has not commented. Italy's public denial is unresolved. What the El Mundo report establishes, on the sourcing available, is that some European foreign ministries have been shown an assessment describing a plan, not an attack. Denmark's intelligence service said separately on September 24 that Russia is expected to escalate hybrid activity against NATO allies in coming months, with a "small but increasing" risk of limited military action, while Estonian Foreign Minister Margus Tsahkna pushed back against alarmism, arguing Russia lacks the capability for active aggression against NATO while its forces remain committed in Ukraine. Both views can be accurate at once: a state can be probing for vulnerabilities in the Mediterranean without possessing, in September 2026, a demonstrated capability to execute the specific attack described. Whether southern European governments treat this warning as the moment to close that gap, or as one more hybrid-warfare bulletin to file away, is a political decision that has not yet been made.
Become an Observer — it's free — to unlock direct links to all sources used in this article.
We believe you deserve to verify everything we write. That's why we meticulously document every source.
