Senior Analyst at Ambrey, Tomas Alexa, stated:
“Ambrey assesses that regional surveillance and air-defence measures have not yet been able to prevent UAV attacks on merchant shipping in the Romanian and Bulgarian EEZs. The nine strikes in October, the latest about 16NM off Constanța, show that low-cost UAVs can reach vessels close to NATO coasts. This reflects a change in the threat rather than the failure of any one system. Detecting and intercepting UAVs that are designed to work in contested airspace remains a complex problem, and merchant vessels cannot be assured of protection.”
Executive Summary
- A Comoros-flagged ore and oil carrier was struck by a UAV about 16NM east of Constanța at approximately 07:05 UTC on 23 October and capsized; one crew member is dead, nine are rescued and three are missing, with search and rescue (SAR) ongoing
- It is the ninth merchant vessel recorded as struck in Romanian and Bulgarian waters in October, and the closest to Constanța, Romania’s main port
- Ambrey assesses it HIGHLY LIKELY that Russian forces conducted the attack. The vessel had made multiple port calls at Ukrainian Danube Delta ports in 2026, and the Russian targeting profile is unchanged
- Deliberate targeting of a vessel with no link to Ukrainian trade remains EXTREMELY REMOTE, and misidentification HIGHLY UNLIKELY. However, the risk to unrelated vessels rises when they operate near a stricken vessel or are tasked to SAR, because of unexploded ordnance (UXO), secondary explosions and the possibility of follow-on strikes
- Attacks closer to NATO coasts, UAVs entering Romanian airspace and growing allied military activity raise the risk of miscalculation.
- Ambrey does not assess direct Russian–NATO engagement as imminent
Situation
At approximately 07:05 UTC (10:05 local time) on 23 October, a Comoros-flagged combined ore and oil carrier, northbound from Ereğli, Türkiye, to Sulina, Romania, laden with steel, turned abruptly to port, broadcast a Mayday on VHF reporting a UAV impact and capsized about 16NM east of Constanța. Its AIS stopped at 07:10 UTC and two SAR vessels arrived at about 07:56 UTC. One crew member has died, nine have been rescued and three are missing; figures are provisional.
It is the ninth merchant vessel recorded as struck in Romanian and Bulgarian waters in October: three on 5–6 October, two on 12–13 October, three on 14–15 October and this one. A tanker was also struck at berth in Izmail, Ukraine, on 14 October. The incidents have extended the maritime threat well beyond Ukrainian and Russian waters, increasing uncertainty for shipping throughout the Western Black Sea.
On 17 October two Romanian F-16s shot down two Russian Geran-type UAVs over Romanian territorial waters about 45NM east-south-east of Sulina. On 20 October, NATO announced additional maritime patrol aircraft, radar systems, UAVs and intelligence and forensic teams for the Black Sea after a North Atlantic Council discussion.
Romania and Bulgaria, with Türkiye in the Mine Countermeasures Black Sea Task Group, continue to expand surveillance and cooperation against attacks on vessels, UXO and sea mines. Nine strikes in October, the latest about 16NM off Constanța in daylight, show that these measures are not yet preventing UAV attacks on shipping close to NATO coasts. Ambrey assesses that low-cost UAVs are difficult to detect and intercept over open water, and that merchant vessels in the EEZ cannot be assured of protection.
Assessed
Ambrey assesses that the Russian targeting profile remains unchanged. Vessels trading with Ukrainian ports, including those in the Danube Delta, continue to face a significant threat of deliberate targeting. The spread of attacks into Romanian and Bulgarian waters, and now to within about 16NM of Constanța in daylight and close to the approaches used by vessels with no Ukrainian links, raises wider concerns for shipping in the Western Black Sea.
The likelihood of a vessel with no link to Ukrainian trade being deliberately targeted remains EXTREMELY REMOTE. The threat to unrelated vessels increases, however, near a stricken vessel, particularly if tasked to SAR, which may expose them to UXO, secondary explosions and further attacks. Ambrey has recorded vessels attacked more than once within hours, and on 15 October imagery indicated Russian forces continued to observe a casualty vessel as a Romanian SAR vessel left. Misidentification of a SAR vessel during an attack sequence also remains, albeit assessed HIGHLY UNLIKELY.
The principal concern is not a confirmed change in Russian targeting intent, but the growing exposure of commercial shipping to the consequences of attacks: secondary strikes, UXO, SAR-related risks and misidentification.
Recommendations
PRESSURE ON NATO ALLIES AND RUSSIA–NATO TENSIONS RECOMMENDATIONS
- Attacks are moving closer to NATO territory. The 23 October strike was about 16NM from Constanța, just beyond the 12NM territorial sea limit and the 14 October strike was 11.9NM from Sulina. Romania issued air-raid alerts for Constanța (9 October) and Tulcea County (14 October), and on 17 October Russian UAVs entered Romanian airspace over territorial waters. Russian UAV activity aimed at Ukraine-linked shipping now crosses into NATO airspace and waters.
- Allied thresholds are not aligned. President Nicușor Dan has said that “there will be a reaction from the Romanian state”. On 6 October Bulgarian Prime Minister Rumen Radev said the first attacks off Bulgaria were not grounds for NATO Article 4 or 5, as they occurred about 130km (70Nm) offshore in waters he called neutral, and after the 12–13 October strikes he asked the Russian ambassador to explain them; she said she had no information and did not rule out a “provocation by a third country”. Ambrey assesses that this ambiguity lowers Moscow’s political cost of striking beyond 12NM, but each strike nearer the coast narrows it and raises pressure on Bucharest and Sofia for a visible response. Ambrey does not assess direct Russian–NATO engagement as imminent. An attack inside territorial waters, or one killing state SAR or military personnel, would change the calculation.
- Allied military activity is growing in the same space. NATO is adding aircraft, radars and UAVs; Bulgarian F-16, MiG-29, Su-25 and L-39 aircraft patrol Bulgarian territorial waters; Romanian F-16s are intercepting UAVs; Bulgaria plans to join NATO’s Drone Edge project this month and has commanded the Mine Countermeasures Black Sea Task Group since July. More allied platforms operating among Russian UAVs, electronic warfare and observation of casualty sites raises the chance of an incident involving a military asset, whether through misidentification, collision or an interception that drops debris or warheads into shipping lanes. Romanian SAR vessels have already responded close to active attack areas on 14, 15 and 23 October. Ambrey does not assess direct Russian–NATO engagement as imminent, but miscalculation cannot be discounted.
- Russian signalling is deniable. The Kremlin denies responsibility, and NATO has not formally attributed the attacks. Ambrey records that on 15 October the Russian Ministry of Defence released footage of Geran-type UAVs striking a tanker.
- Ambrey assesses that Russian intent is to disrupt Ukrainian trade rather than provoke NATO, and that deniability lets Moscow raise the cost of Ukraine’s Danube route, without a clear trigger for allied action.
- Ambrey recorded five UXO sightings off Bulgaria and Romania in October; this adds to the workload of navies already flying patrols and supporting NATO surveillance. On 20 October, the Bulgarian Fleet Commander, Rear Admiral Kiril Mihaylov, said the Navy has destroyed or retrieved more than 100 UAVs or UAV parts this year. He said 35 of the parts were dangerous and were destroyed, and that two patrol ships are searching for mines and debris. The strain is cumulative: every sighting needs a vessel or aircraft to assess, warn shipping and, where necessary, neutralise the object, which competes with air patrols and surveillance of Russian UAV activity. Any object near a port approach or shipping lane, or a merchant vessel damaged by UXO in NATO waters, would also be politically significant and hard to attribute, since it could be a legacy mine, UAV remnants or a deliberately laid device.
Operational Considerations
- Conduct a dynamic, voyage-specific risk assessment covering route, port calls, cargo origin, proximity to Ukrainian-linked traffic, current Russian and Ukrainian activity, and collateral effects or UXO following attacks nearby.
- Vessels trading to or from the Danube ports, including Romanian ports handling Ukrainian-origin cargo, should treat the full Western Black Sea passage as part of the high-risk voyage, not only the port call.
- Crews should remain within the designated Safe Muster Point (SMP) during UAV, USV and missile attacks, located above the waterline, amidships, and low down in the superstructure.
- Vessels asked to assist a casualty should consult the company security officer first, ask the MRCC which assets are on scene, limit time on scene and agree withdrawal triggers in advance (a new air-raid alert, a UAV sighting, ordnance in the water, approaching darkness).
- Do not approach, retrieve or fire at any suspected mine or UXO. Keep at least five cables from the reported object south of Cape Emine and from derelict vessels, and report sightings to the relevant MRCC.
- Maintain an enhanced lookout for UAVs, USVs, floating debris and drifting vessels; monitor Romanian and Bulgarian navigational warnings; expect GNSS and AIS interference and keep independent position fixing. Review AIS policy with the company security officer, as Ambrey is aware that vessels are withholding AIS during port calls, but rescuers rely on it.
- Review war risk cover and notification requirements for the JWLA-035 Listed Area, noting that Romanian and Bulgarian territorial waters are excluded from the listing but not from the risk. Engage an intelligence provider for route planning and threat awareness.
Frequently Asked Questions
1. What happened to the merchant vessel near Constanța, Romania, on 23 October 2026?
On 23 October 2026, a Comoros-flagged combined ore and oil carrier was struck by an unmanned aerial vehicle (UAV) about 16 nautical miles east of Constanța, Romania, at approximately 07:05 UTC. The vessel capsized. One crew member has died, nine have been rescued and three are missing. These figures are provisional and search and rescue (SAR) operations are ongoing. Ambrey assesses it HIGHLY LIKELY that Russian forces conducted the attack. The vessel had made multiple port calls at Ukrainian Danube Delta ports in 2026.
2. How many merchant vessels have been attacked in Romanian and Bulgarian waters in October 2026?
Ambrey recorded nine merchant vessels struck in the Romanian and Bulgarian exclusive economic zones between 5 and 23 October 2026, and attributes all nine to Russian forces. The Kremlin denies responsibility and NATO has not formally attributed the attacks. The 23 October strike was the closest to Constanța, Romania’s main port. A tanker struck at berth in Izmail, Ukraine, on 14 October is not included in this count.
3. Are merchant vessels without links to Ukrainian trade at risk in the Western Black Sea?
Ambrey assesses that Russian forces are targeting vessels linked to Ukrainian trade. Deliberate targeting of a vessel with no such link is assessed as EXTREMELY REMOTE, and misidentification as HIGHLY UNLIKELY. However, the risk to unrelated vessels rises when they operate near a stricken vessel or are tasked to SAR, because of unexploded ordnance (UXO), secondary explosions and the possibility of follow-on strikes.
4. Do recent UAV attacks increase the risk of direct conflict between Russia and NATO?
Ambrey attributes the attacks to Russian forces and assesses that attacks closer to NATO coasts, UAVs entering Romanian airspace and growing allied military activity raise the risk of miscalculation. Ambrey does not assess direct Russian–NATO engagement as imminent, but miscalculation cannot be discounted. An attack inside territorial waters, or one that killed state SAR or military personnel, would change the calculation.
5. What security measures should shipping operators take in the Western Black Sea?
Ambrey recommends conducting voyage-specific maritime security risk assessments, maintaining enhanced surveillance for UAVs and unexploded ordnance, and monitoring Romanian and Bulgarian navigational warnings. Operators should also review search and rescue procedures, prepare for GNSS and AIS interference, assess war risk insurance requirements and obtain updated maritime threat intelligence before transit.
CONTACT INFORMATION
Ambrey: +44 203 503 0320, intelligence@ambrey.com
AMBREY – We Prepare, Support, Respond – For Every Seafarer, Every Vessel, Everywhere.