Enemy in the Crates: The Risks of Pre-deployed Covert Payloads for European Defence

CSDS POLICY BRIEF • 18/2025

By Daniel Fiott

16.6.2025

Key issues

• The wars between Russia and Ukraine and Iran and Israel reveal an interesting trend in warfare today involving pre-deployed weapons systems behind enemy lines.
• European allies need to consider that adversaries and rivals may have already pre-deployed drones or missiles on EU/NATO territory.
• Although European states have considerably improved their resilience, they have seemingly turned a blind eye to the threat of “Pre-deployed Covert Payloads”.

Introduction

Two wars, one interesting trend. In early June 2025, Ukraine struck deep into Russian territory to damage 41 of Russia’s strategic bombers. “Operation Spider’s Web”, as Ukraine’s audacious attack was called, reportedly damaged eight Tu-95s and four Tu-22s bombers beyond repair. Spectacularly, Ukraine managed to hit deep inside Russia at its Olenya, Ivanovo, Dyagilevo and Belaya airbases with Belaya airbase being close to 5,000kms away from Ukraine. Fast forward to mid-June 2025, and we observe Israel hitting military targets deep inside Iran. Israeli strikes hit Iran’s nuclear refinement and technology sites at Fordo, Natanz and Isfahan. Israel also successfully hit military targets in Tehran, Boroujerd and Shiraz and Israel managed to decapitate Iran’s military leadership – including prominent members of the Iran Revolutionary Guard Corps (IRGC).

While the strategic theatres in Russia and Iran are different, each attack shared one key characteristic: the attacks were enabled by having in place pre-positioned military assets close to military bases and strategic locations. The Kremlin and Tehran were struck with a high degree of surprise. In the case of Ukraine’s attack, Kyiv reportedly embedded approximately 117 drones inside Russia. They were apparently concealed under specialised retractable wooden roofs and hidden in trucks. The Ukrainian drones were remotely activated from Ukraine near strategic sites in Russia, including by using Artificial Intelligence (AI)-enabled systems to conduct precision strikes on Russian assets in electronic warfare denied zones. For its attack, Israel used a tried-and-tested method of espionage where Mossad operatives pre-positioned missiles and drones close to Iranian military sites. Each operation took months of covert action to prepare.

Seizing the element of surprise, both Ukraine and Israel managed to use pre-positioned military assets for strategic effect. Not only do the attacks demonstrate the technological capacities of Ukraine and Israel, but also a high degree of strategic patience. To pull off their respective attacks, each party spent considerable time and energy building up an intelligence picture and covertly smuggling in missiles and drones. Without intelligence operatives on the ground in Iran and Russia, these attacks would not have been possible. The strikes would have made Sun Tsu and Clausewitz proud; not only were the surprise attacks audacious but they have demonstrably affected the morale of Russia and Iran.

All of this begs the question: what if European Union (EU) and NATO countries are also home to such “Pre-deployed Covert Payloads”. If missiles and drones have already been smuggled in to Europe, thereby fashioning adversaries with pre-positioned assets, the EU and NATO should combat such a vulnerability. While this seems like the stuff of sci-fi movies, a cautionary word against hubris and complacency is required. Keep in mind that Europe has already been the location of sabotage efforts including to undersea cables or shopping malls, to name but a few incidents. Accordingly, this CSDS Policy Brief considers the risks from embedded strategic nodes and it looks at possible policy responses.

The threat from within? 

The threat from having Pre-deployed Covert Payloads on one’s territory should need no real elaboration. In times of war, having missile and drone batteries close to critical military and civilian locations would be a significant vulnerability. Covert drone fleets and missiles could be activated near military infrastructure (e.g. airfields or air defence systems) and could be used to attack or disable command and control (C2) facilities before war has been begun. They could even be used to attack civilian infrastructure such as ports or energy installations. In short, should adversaries and rivals be able to covertly smuggle missiles and drones into EU/NATO territory and place them in tactically salient areas, they could have devastating effects for European defence and deterrence.

Not only could these Pre-deployed Covert Payloads be used to subvert Anti-Access, Area-Denial (A2/AD) “bubbles”, but they can help change deterrence calculations. If adversaries can covertly strike key air and missile defence capabilities across NATO and the EU, this may encourage further military strikes and action. And here we are not speaking of “Trojan horses”: European allies will not be wilfully accepting Pre-deployed Covert Payloads on their territory. Instead, such covert methods to pre-position military technologies such as drones and missiles fall within the “grey zone” or hybrid level of strategic engagement by adversaries.

The military technologies we are considering here are truly remarkable. In the case of Ukraine’s strikes on Russia, the Security Service of Ukraine (SBU) spent 18 months procuring specially developed wooden containers that were attached to trucks. These trucks were driven by operatives within Russian territory, close to their intended targets, but the drones were remotely piloted from Ukraine, where they were released from the truck roof and their explosive munitions dropped on Russian targets. In the case of Israel, the intelligence picture is not as clear but there are reports that Mossad operativeshad pre-positioned drones and missiles in Iran to eventually use as part of “Operation Rising Lion”. What we do know at this stage is that such Pre-deployed Covert Payloads were used to disable Iran’s air defence systems, which allowed Israeli jets to penetrate Iranian airspace and conduct precision strikes on radars, C2 assets and Iran’s military hierarchy.

The use of covert, pre-positioned, weapons is not a new phenomenon in military history. During the Vietnam War, North Vietnam supported the Viet Cong insurgency in South Vietnam through the supply of weapons, transported covertly via jungle trails and tunnels and stored in camouflaged bunkers and depots. The United States (US) also covertly supplied the Mujahideen in Afghanistan with weapons such as Stinger missiles, transporting the weapons through mountainous terrain while hidden in humanitarian aid shipments. Of course, British and the American special operations branches dropped weapons by parachute into France, Poland and other occupied countries during World War II. What sets the examples of Ukraine and Israel aside, however, is the sophistication of the weapons systems, especially armed drones.

The way in which Ukraine and Israel have instrumentalised Pre-deployed Covert Payloads has also seemingly vindicated academic analysis that argues that drones are vulnerable to air defence systems and electronic warfare technologies. Such analysis is premised on the idea that drones have to fly through enemy airspace, thereby giving rise to detection and defensive strikes. It is because of this major vulnerability, that the analysis has shifted to drone swarms that can overwhelm air defences and electronic warfare capabilities. What Pre-deployed Covert Payloads do, however, is side-step enemy air defences by being covertly transported behind enemy lines and extremely close to military targets. In fact, even the US military has been experimenting with undersea drone swarms that are either housed on submarines or in self-contained capsules anchored to the seabed (e.g. Hydra project). Here, the idea is that enemy air defences can be by-passed by having in place covert stocks of drones and missiles.

See no evil, speak no evil? 

A challenge in detecting and responding to Pre-deployed Covert Payloads is that they can be camouflaged in benign locations such as shipping containers, trucks or buildings. Again, smuggling in such devices is nothing new but the risk that such locations can be hidden from authorities and surveillance is particularly risky. In particular, national authorities should consider how critical infrastructure, owned by non-EU or non-NATO states, could be instrumentalised for Pre-deployed Covert Payloads. We already know that there are fears that Chinese-owned ports could be used for nefarious military purposes. Ships containing missiles, drones and other weapons systems and military technologies could more easily pass through surveillance procedures in circumstances where ports are owned by non-EU or non-NATO states. Several international organisations have already shed light on the misuse of shipping containers for drug smuggling and counterfeit goods. Yet, it is not just maritime routes that are of concern, as, in the case of Ukraine’s attack on Russia, the drones were smuggled across Russia’s borders. We should also consider that drones can be procured and weaponised within a country, thus throwing light on the need to monitor in-country suppliers.

Given such risks, it is worth considering whether the EU and/or NATO are prepared. While resilience has become a major part of NATO’s work, there is nothing specific in its approach to resilience that points to a strategy for countering Pre-deployed Covert Payloads, even though such payloads could hamper the Alliance’s ability to meet its seven baseline resilience requirements. If it has not already done so, it would be wise for NATO’s Resilience Committee to consider the experiences of Ukraine’s and Israel’s covert military attacks, and to devise strategies to ensure that similar tactics are not used on NATO territory. For the EU, there is also a need to take such risks seriously but there is no direct reference to the risk from Pre-deployed Covert Payloads. The good news, however, is that the EU is taking the general threat from drones seriously. Its Internal Security Strategy states that drones are being used for espionage and attacks, and that the European Commission will develop counter-drone systems; this builds on and emphasises the conclusions of the Union’s counter-drone strategy.

The EU’s Preparedness Strategy for the Union does not directly mention the risk from Pre-deployed Covert Payloads, but there is much in the strategy that can guard their deployment and use. This includes close civil-military preparedness mechanisms, the increased reporting of hybrid threats and the use of space-based assets to chart and detect malicious movements and activities within the EU. Here, the EU Satellite Centre can play a key role in making available its geospatial tools and expertise. What is more, the EU’s White Paper for European Defence – Readiness 2030 stresses the importance of space assets too, but it also underlines the need for investments in counter-drone technologies and air and missile defence over the Union. And here, existing defence innovation and capability projects within the European Defence Fund and Permanent Structured Cooperation are well-suited to combating Pre-deployed Covert Payloads including E-CUAS/U-CAS and DES and the focus on directed energy and counter-drone sensors.

Preliminary observations

While the idea of Pre-deployed Covert Payloads may seem like the stuff of sci-fi novels and films, the recent wars between Ukraine and Russia and Israel and Iran highlight that European governments need to ensure that no surprise attacks from covert drone or missile batteries can occur on their territories during future conflicts. At the core of any strategy against Pre-deployed Covert Payloads is good, old-fashioned, (counter-)intelligence. Europe’s intelligence agencies need to specifically monitor suspicious movements of cargo and transportation into and around EU/NATO territories. Russian security services have already demonstrated an ability to conduct “grey zone” operations in Europe. This will call for enhanced border management and supply chain surveillance within EU and NATO territories.

Another way of defending against Pre-deployed Covert Payloads is to invest in a more targeted fashion in detection technologies and protocols such as x-ray, backscatter and wave scanners. Such technologies can assist with scanning inside transport containers, crates and vehicles. What is more, electronic signature detection devices can pick up drone signals even when they are inactive by detecting global positioning and navigation signals, battery magnetic fields and residual heat signals. Here, technologies can be deployed close to sensitive military installations and critical infrastructure in case Pre-deployed Covert Payloads are activated. For example, radio frequency jammers, directed energy weapons, interceptor drones, geofencing and drone net guns can be utilised. Surveillance systems should be deployed close to critical infrastructure sites to detect sudden movement or power-up activities.

Finally, physical inspections can be increased through more frequent container, crater and vehicle inspections and the use of trained canines. “Smart tagging” can be enhanced so that containers or vehicles are equipped with GNSS-enabled seals that alert authorities to premature or diverted cargo. Personnel should also be trained in response protocols backed by predetermined alert and response procedures. Here, an additional emphasis is needed on civil-security-military protocols and standards, as any lapse in civilian procedures can enable the deployment of Pre-deployed Covert Payloads. Such measures, while not completely removing the risk of these payloads, can go some way into deterring such deployments in the first place. As Ukraine and Israel have shown, the element of surprise is perhaps the biggest benefit of using Pre-deployed Covert Payloads.

__________