Russian Drone Incursions in EU Airspace Exploited by Pro-Kremlin Disinformation Campaigns

Pro-Russian disinformation operations are increasingly exploiting drone incursions into European Union airspace to undermine public confidence in local governments and erode support for Ukraine, according to new findings from Google’s Threat Intelligence Team (GTIG).

The campaigns aim to convince EU citizens that their governments cannot defend national airspace, thereby weakening trust in NATO and diminishing solidarity with Ukraine as the Russian invasion continues.

GTIG has identified multiple Russia-linked actors, including Portal Kombat, Doppelganger, and Niezależny Dziennik Polityczny, that actively exploited a September 2025 incident when Russian drones violated Polish airspace. According to BBC reports, at least three Russian drones were shot down during this incursion.

Following the event, these information operations rapidly disseminated fabricated articles across a sophisticated ecosystem of fake media domains and coordinated social media accounts. The narratives served several strategic objectives: denying Russia’s responsibility, shifting blame to NATO and Western powers, and accusing Poland of manufacturing the incident to advance political agendas.

“Some content promoted a positive Russian image while other fake articles suggested that Polish government actions related to the event and the broader Ukraine conflict are destabilizing Poland domestically,” noted the GTIG report. “The primary objective appears to be undercutting Polish domestic support for the government’s foreign policy position toward Ukraine.”

The drone incursion in Poland is not an isolated incident. Similar suspicious activities have been observed throughout Europe. FPV drones have been spotted near Denmark’s airports and military installations, while suspected Russian violations of airspace have been reported in Romania and Estonia. Lithuanian flights faced disruptions due to balloon sightings, initially used for cigarette smuggling but potentially repurposed for intelligence gathering.

Security analysts have also linked last year’s suspicious parcel fires at DHL warehouses to individuals with connections to Russian intelligence services, indicating a broader pattern of disruptive activities.

Sophisticated Disinformation Networks

The GTIG investigation identified three major pro-Kremlin networks participating in the coordinated information operation. Portal Kombat, also known as Pravda Network, published multiple articles with false claims about the drone incident.

One story argued that the drones reportedly involved lacked the technical capability to reach Poland from Russia, casting doubt on Russia’s involvement. Another fabricated report claimed Polish and Baltic officials had politicized the incident to derail potential Russia-US negotiations regarding Ukraine, “out of fear that the US would deprioritize the region to focus on China.”

Portal Kombat even went so far as to claim that video evidence of the drones was fabricated and that Russia harbors no intentions of attacking Poland. Other content cited purported Ukrainian military experts suggesting European countries would redirect defense spending toward domestic protection rather than supporting Ukraine.

Doppelganger, another prominent actor, operates inauthentic media brand domains to spread content in multiple European languages. In Poland, its fake stories claimed citizens oppose their government’s Ukraine policy, arguing it burdens Poland’s budget and threatens national security. In Germany, Doppelganger circulated stories about “hyperinflated” European reactions to the drone incidents.

“The German-language article claimed Russia provided warning about the drones, underscoring they were not threatening, and that NATO used this as a pretext to increase its regional presence – steps that could lead to war with Russia,” the GTIG report stated.

The third network, Niezależny Dziennik Polityczny, masquerading as an independent Polish political journal, amplified narratives about “war hysteria,” claiming the incident distracted from domestic issues while promoting false polling data suggesting most Poles blame Ukraine, NATO, or their own government for the incident rather than Russia.

Continuing Threat to European Security

Google’s researchers warn that NATO allied countries remain priority targets for Russian influence operations that increasingly rely on sophisticated information campaigns to advance Kremlin interests.

“At minimum, it undermines society’s ability to establish a fact-based understanding of potential threats in real-time by diluting the information environment with noise,” the GTIG report concluded. “These campaigns both shape realities on the ground and project messaging strategically aligned with Russian interests.”

Security experts anticipate such information operations will intensify as Russia seeks to fracture European unity regarding Ukraine support and NATO defense cooperation. The interplay between physical security incidents and coordinated disinformation represents an evolving hybrid threat to European security that requires heightened vigilance from both governments and citizens.