In 1996, boxer Mike Tyson left a phrase for history: "Everyone has a plan until they get punched in the mouth." If what the latest reports from the CIA suggest about Russian activities is true (and several European intelligence services such as the French, German, and Polish assess them in that direction), Spain could receive this first blow this fall. The bad news is that it would catch us off guard and unprepared.
Denmark, Poland, and the Baltic countries have already experienced this harsh reality and are rapidly preparing to resist and even combat the hybrid escalation of the Putin regime. While the geographical distance may suggest that Spain is too far from Russia to worry, this thought is very inaccurate. For the internal Russian narrative, repeatedly echoed in their propaganda outlets, all EU and NATO countries are considered enemies for supporting Ukraine. Spain is no exception, and Moscow does have platforms to destabilize Southern Europe.
The Kremlin not only controls vast areas in the Sahel through allied dictatorships like Niger, Mali, or Burkina Faso but can also project its actions from the coasts of Algeria or Libya, where it enjoys the favor of governments and warlords like the Libyan Khalifa Haftar. In May 2025, the British Ministry of Defense reported that the well-known Russian general Sergei Surovikin, who led the invasion of Ukraine in 2023, had been assigned to the Russian embassy in Algeria as "head of a group of Russian military specialists."
But the greatest danger comes from the ships of the so-called ghost fleet, their network of shadow tankers to evade international sanctions and use them as drone launch platforms.
Have they already used these types of vessels, some flying flags of convenience with transponders turned off, in hybrid attacks? Governments like France, Denmark, or Germany suspect so. The most documented case is that of the Arctica, a ship from the ghost fleet that on January 3, 2025, sailed along the Danish coast while up to 20 drones flew over the port of Køge before disappearing out to sea. Months later, on September 22, drone sightings over Copenhagen that forced the airport to close coincided again with the presence of the Arctica and the Boracay in the area, the latter later boarded by French naval forces: President Macron stated that he could not rule out their involvement in the flights.
In Germany, the Scanlark was directly seized after accusations of launching a reconnaissance drone over a Navy frigate at the naval base in Kiel. The most politically disturbing case was that of the Vezhen, which on December 2, 2025, was circling off the Irish coast exactly when Zelenski arrived for his first official visit to the country: at that same moment, four large military drones flew over an Irish Navy ship off Dublin for two hours.
The IISS (International Institute for Strategic Studies) has documented 144 suspicious drone sightings over 12 NATO countries between 2024 and 2026, concluding that it is likely that "the ghost fleet has been used as a launch platform, with a clear strategic objective: monitoring sensitive military installations (including bases storing B61 nuclear bombs in the Netherlands and Belgium), testing allied air defense response times, and creating anxiety in civilian populations to pressure governments to cut their support to Ukraine." Within these ships, according to outlets like the Financial Times, former Wagner mercenaries, the company of the late Yevgeny Prigozhin who died in 2023 after his notorious mutiny, have found accommodation.
Facing these attacks, it is striking that Spain has not taken any measures (as France is already doing to defend its critical infrastructures) or has not yet foreseen civil defense protocols equivalent to those activated by Poland or the Baltic countries on their borders. Even neutral Switzerland has recently incorporated these threats into its new 2026 Security Strategy.
Spain has not launched any specific domestic preparedness campaign against a potential Russian hybrid attack, lacks updated evacuation plans for this type of threat (from schools to refineries), and still does not have a drone interceptor system worthy of the name.
The ghost fleet is already sailing in Spanish waters, unloading sanctioned oil in our ports. Our airports have already been flown over by unidentified drones, and our more than 30 submarine cables (ensuring the country's connectivity with the rest of the world) are precisely the type of infrastructure that the Russian ghost fleet has targeted in the Baltic.
The Spanish paradox goes further: according to an investigation by The Conversation, among the 20 EU ports with the most dockings of sanctioned ships are Ceuta at 11th place, Huelva at 17th, and Cartagena at 20th, making Spain not only a country incapable of stopping the ghost fleet but also one of its main ports of call or discharge. A ship with a Cameroonian flag, sanctioned by the EU, unloaded nearly 900,000 barrels of Russian crude oil from the Russian port of Murmansk in Ceuta on September 12, 2025, without any issues. In contrast to this behavior, both the US and France, as well as the UK, have inspected and even confiscated some of these fortune tankers.
On the CESEDEN (Higher Center for National Defense Studies) website, we can read: "The ghost fleet is not just a mechanism to evade sanctions, but another instrument of the Russian hybrid strategy."
Spain does have some capabilities on par with our European partners: in the industrial and development field, Indra provides electronic inhibition systems deployed in various military installations. The Spanish company Armmo Defense Technologies has validated its anti-drone capabilities in NATO exercises in 2026 and specializes in autonomous systems, electronic warfare, and detection and interception solutions.
But there are also four deficits: Spain still does not arm its Reaper attack drones, making them only reconnaissance platforms without offensive capabilities to shoot down other drones. This is a political decision, not a technical one.
The second is territorial coverage: existing anti-drone systems protect specific military installations but there is no integrated national coverage network comparable to what Poland or the Baltic countries are deploying along their borders. The third is the legal framework: shooting down a suspicious civilian drone over Spanish territory involves an authorization chain that in practice can take longer than the drone's flight itself. There is no rapid response protocol equivalent to what Denmark activated when it had sightings over its military bases.
The fourth is the lack of civil-military integration: Spanish civilian airports do not have anti-drone systems integrated with the Spanish Armed Forces. When a suspicious drone appears over a civilian airport, the current protocol is to close the airspace, not shoot down the drone, a practice that is beginning to change in Europe.
Retired Admiral Juan Rodríguez Garat assures this newspaper that "using drones from the sea to interfere with major airports is relatively simple, but Spain is not the most likely target. It does not stand out as much as others in supporting Ukraine, and its most important airports are not near major maritime routes. If, nevertheless, it happens, it is a type of action where the aggressor has all the advantage. The most they can lose is a drone. The response to these hybrid attacks - the same goes for the assault on Ceuta - must be asymmetrical. Not to confront the arrow, but the archer. You do this, I do the opposite of what you want: I intensify support for Ukraine."