Back-to-Back Drone Strikes off the Coasts of Romania and Bulgaria Test NATO’s Resolve

Within 24 hours, drones struck commercial ships near two NATO members: a Turkish-owned grain ship near Romania and two vessels in Bulgaria’s exclusive economic zone (EEZ).

Neither Bucharest nor Sofia has attributed the attacks to Russia, but if Moscow were behind them, the incidents would fit a broader pattern of Russian hybrid warfare: covert, deniable, and disruptive tactics meant to test Western resolve while staying below the threshold of conventional conflict. 

Something Not Quite Like War

On October 5, the Royad Mammadov, carrying corn from Ukraine, sank about 30 nautical miles off Romania, inside its EEZ, killing two crew members. Ukrainian President Volodymyr Zelenskyy blamed Russian drones, but Romanian authorities have not confirmed the cause. The next day, Bulgarian Prime Minister Rumen Radev announced that drones had hit two vessels, marking the first attack on shipping in Bulgaria’s EEZ. The Alfa Watan sank with its crew unaccounted for, and the Able caught fire, leaving two sailors seriously injured. Both ships are reportedly Turkish owned.

Russia’s deniable aggression is nothing new. Since its 2022 full-scale invasion of Ukraine, Russian intelligence has brazenly conducted hybrid-war operations against NATO states. Russian sabotage of European critical infrastructure increased 246 percent from 2023 to 2024. In April, NATO’s defense chiefs warned that Russia could disrupt global internet access by sabotaging undersea cables. In 2025, a Russian drone breached Romanian airspace, less than a week after Russian drones were shot down in Polish airspace, which Polish Prime Minister Donald Tusk described as a “large-scale provocation.”

Because an EEZ is not sovereign territory and the ships were commercial, the strikes do not clearly trigger NATO’s collective defense provisions. Drones also make attribution easy to dodge. Both Ukraine and Russia use them over the Black Sea, where wartime spillover is real.

A single incident is easy to dismiss as an accident. Two in 24 hours are harder to ignore, and together they test whether NATO treats each strike as isolated or as part of a campaign. If the Kremlin is behind the attacks, Moscow likely repeated them to see what, if anything, comes back.

Allowing Ambiguity Lowers the Cost of Each Attack

On August 8, a drone exploded near the Trans-Balkan gas pipeline in Bulgaria. The Defense Ministry said it was most likely a Ukrainian-type Maya decoy and that nothing suggested it was intentional. Still, Sofia’s foreign minister was quick to summon Ukraine’s ambassador, and Euroskeptic Prime Minister Radev announced that border police would move anti-drone detection capabilities from the Turkish border to the Romanian border.

After this week’s strikes, Radev called the attack a “crude violation of international law” but said only that the drones were either Russian or Ukrainian. Whether Radev’s ambiguity reflects Moscow-friendly instincts or a politician keeping leverage, it lowers the cost of the next attack.

Not Enough To Trigger Collective Defense, Too Much To Ignore

“NATO is at war with Russia,” Kremlin spokesperson Dmitry Peskov has said. Still, Russia isn’t doing quite enough for Bulgaria or Romania to invoke Article 5 of the NATO treaty, which calls for collective defense. Radev said Sofia would not invoke the NATO charter because the strikes happened in waters that are not territorial, allowing Moscow to benefit from ongoing ambiguity. Washington should work through NATO to agree on a response to attacks that fall in that gap before the next test.

NATO should counter Russian hybrid warfare before the next incident, not after. That means deploying specialized hybrid-response teams and building on its previous efforts in Montenegro and North Macedonia while strengthening allied resilience against cyberattacks, influence operations, and sabotage. It should also declassify intelligence in advance to call out Russian sabotage activities and create a Perception Management Office to counter Russian command and control related to hybrid warfare.

The alliance should make clear that hybrid attacks will not be cost-free. Countering Russia’s hybrid efforts can force Moscow to devote more time, energy, and resources to defending itself and less to testing NATO’s resolve.

Reagan Easter is a senior communications associate at the Foundation for Defense of Democracies (FDD). Ivana Stradner serves as a research fellow with FDD’s Barish Center for Media Integrity. Follow FDD on X @FDD. FDD is a Washington, DC-based, nonpartisan research institute focused on national security and foreign policy.