SCORPIUSSecurity & Intelligence Solutions Incident Reports
← All Incident Reports
Incident report · Armed Conflict
Shaping activity - Phase Zero · Probing · Testing Response

The Black Sea flank: three drones in three days

Romania shot down a drone over the Black Sea, the third in three days to violate its airspace, and summoned Russia's ambassador. After years of absorbing incursions without firing, a NATO member on the Danube changed its posture. The lesson is the shift from tolerating gray-zone probing to answering it - and the escalation that choice invites.

Scorpius Security & Intelligence Solutions · July 2026

↓  Download one-page brief (PDF)
Who
Actor: Russia. Romania attributed the incursions to Russia and summoned its ambassador; the drone downed on 24 July was identified by prosecutors as a Shahed-type used by Russian forces, with the others under investigation. Casualties: none.
What
A Romanian F-16 shot down a drone that had violated Romanian - and therefore NATO - airspace: the third such shoot-down in three days.
Where
Over the Black Sea, in Romanian territorial waters roughly 12 km north-east of Sulina, at the mouth of the Danube.
When
Sunday 26 July 2026; the drone entered Romanian airspace at about 10:08 and was neutralised at 10:13.
Why
The repeated incursions are likely a deliberate test of NATO and European Union air defences and reaction, set against Russia intensifying strikes on Ukrainian Danube and Black Sea ports near Romania's border.
How
Radar detected the drone outside Romanian airspace; an F-16, scrambled under NATO command, shot it down over territorial waters five minutes after it crossed.
What happened
1

A 650 km border

Romania shares a 650 km border with Ukraine and has recorded dozens of drone incursions since 2022, but had shot none down - as Russia stepped up strikes on Danube and Black Sea ports.

2

24 Jul - the first shoot-down

A Romanian pilot brings a drone down safely in an uninhabited area - the first time Romania has destroyed one. Prosecutors later identify it as a Shahed-type used by Russia.

3

25 Jul - the second

A second drone violating Romanian airspace is shot down the following day.

4

26 Jul - the third

An F-16 detects a drone crossing into Romanian territorial waters at 10:08 and neutralises it over the Black Sea at 10:13, about 12 km north-east of Sulina.

5

A diplomatic answer

Romania summons Russia's ambassador over the “repeated violations,” shows him fragments of a downed drone, and expels an embassy staffer; President Nicușor Dan calls the breaches “inadmissible and intolerable.”

Impact
Human & physical
No casualties; drones brought down over uninhabited ground and territorial waters. The risk of debris over populated areas remains a live constraint on any shoot-down.
Operational
A demonstrated shift to active interception on NATO's south-eastern flank - and the acquisition of ground-based interceptors by Romania and allies to sustain it.
Reputational & political
An exploitable test of NATO cohesion and thresholds: each incursion forces a choice between absorbing a violation and an escalatory response over one's own territory.
Adversary gain
For Russia, deniable, low-cost pressure that maps a NATO member's detection and reaction, ties down air-policing assets, and probes the political appetite to respond.
A pattern on the Danube
2022-25

Repeated incursions

Dozens of drone incursions into Romanian airspace during the war, absorbed without interception.

2025

A law to respond

Romania's parliament adopts a law allowing drones that breach its airspace to be shot down.

May 2026

Galați

A Russian drone strikes an apartment block in Galați, on the border with Ukraine, causing a fire and injuring two people.

This is the same probing seen over Poland and the Baltic, applied to the Black Sea flank. The change is Romania's: from years of tolerating incursions to answering them - a shift that raises both deterrence and the risk of escalation.

Assessment
1

Probing meets a new posture

The incursions are likely a deliberate probe; the news is Romania's decision to fire after years of restraint. That resets the exchange, and the adversary now learns from the response as much as the incursion.

2

The debris problem constrains the answer

Shooting down cheap drones over one's own territory risks debris on the ground. That is why the intercepts here were over uninhabited ground and the sea - and why layered, discriminating defences matter more than a blanket shoot-down policy.

3

Attribution is uneven; the pattern is not

One drone is confirmed Shahed; others are under investigation. The individual attribution will lag, but the pattern of Russian-origin incursions on the flank is well established and should drive posture now.

The comparison worth making

Poland faced the swarm; Romania faces the trickle - but the calculus is the same. Each cheap, deniable incursion forces an expensive, escalatory choice. The sustainable answer is not heroics but layered detection, discriminating interceptors, and a rehearsed political threshold - so the response is deliberate, not reflexive.

What should carry
  • Match the threat's economics - pair fast air-policing with cheaper ground-based counter-uncrewed-aerial-system (C-UAS) interceptors, so cheap drones do not draw only expensive responses.
  • Design for debris - discriminating, low-collateral effectors and firing geometry that keeps intercepts clear of populated ground.
  • Pre-agree the threshold - a clear, rehearsed political and military decision on when to fire over national territory, set before the incursion.
  • Read the flank as one campaign - treat Black Sea, Baltic and Polish incursions as a single probing effort and share detection and lessons across allies.
  • Sustain the diplomatic track - summonses, expulsions and attribution impose cost and shape the record, alongside the military response.
Sources

Compiled from open-source reporting for professional security discussion. Figures and attributions may be revised as investigations and court proceedings continue. This is a protective-security lessons-learned assessment, not an operational account.