Made in Europe, Dropped on Kyiv: The Companies Keeping Russia's Drone War Flying

A joint investigation by OCCRP and partners has mapped the anatomy of Russia's deadliest weapon in Ukraine - and found that components from 19 European companies are inside every Geran-2 drone that cuts Ukraine's power grid. Here is how 672 shipments of sanctioned parts got there anyway.

The aftermath of drone strikes on Ukrainian residential areas. Moscow's Geran-2 campaign hit 34,000 times in 2025 alone. Credit: Unsplash

Tetiana Kavinova's apartment on Kyiv's Left Bank has had no reliable electricity or heat since January. She sleeps under three blankets. She thinks about putting on gloves. "I wish it was evening so I could fall asleep and forget," she told reporters from the Kyiv Independent.

She is one of over a million Ukrainians plunged into freezing darkness by Russia's winter drone campaign - a systematic, industrial-scale assault on Ukraine's energy infrastructure using a weapon called the Geran-2. On nine days in all of 2025, Ukraine was not struck by these kamikaze drones. In those same twelve months, Russia launched 34,000 of them.

Now a joint investigation by OCCRP, the Belgian newspaper De Tijd, the Kyiv Independent, Paper Trail Media, the Irish Times, Infolibre, and The Times has traced what is inside those drones - and identified components manufactured by 19 European companies in eight EU and European countries that enable Russia's campaign of winter terror.

The parts include microchips, GNSS receivers, transistors, diodes, antennas, and a fuel pump. Their manufacturers include household names in European technology: Infineon Technologies, NXP Semiconductors, ST Microelectronics, u-blox, Bosch, and Taoglas. None of these companies is accused of violating sanctions law. None exported directly to Russia. And yet their products are found in the charred wreckage of drones that destroyed Ukrainian hospitals, schools, and power plants.

The investigation documents 672 shipments of sanctioned components produced by these European firms being sent to Russia between January 2024 and March 2025 - transiting through 178 companies based predominantly in China and Hong Kong. The EU's sanctions regime, constructed to starve Russia's weapons factories, has a structural hole. And Russia knows exactly where it is.

The Poor Man's Cruise Missile

The Geran-2 is Russia's rebranding of Iran's Shahed-136. It is cheap, expendable, and devastating. At a production cost of $20,000 to $50,000 per unit, it is what weapons analysts call "the poor man's cruise missile" - capable of striking targets up to 2,500 kilometers away, flying low to evade radar, and detonating in a cluster pattern designed to overwhelm air defense systems and open corridors for more expensive ballistic missiles.

The weapon entered mass production at a factory in Russia's Republic of Tatarstan after a technology transfer from Iran. According to Ivan Kirichevsky, a serving Ukrainian military officer and weapons expert at the Kyiv-based think tank Defense Express, the Geran-2 is in a class of its own. "If we consider literally all known drones of a similar class in the world - meaning long-range kamikaze drones - the Shahed and its derivatives are truly the best," Kirichevsky told reporters.

The Russian military deploys them by the hundreds in single sorties, launching waves designed to exhaust Ukraine's limited air defense munitions before the real missiles arrive. The United Nations documented 682 civilian casualties from long-range weapons in 2025. According to Ukraine's Air Force, the Geran-2 was responsible for the majority.

The scale of production required to sustain this campaign is enormous. Thousands of components per drone, hundreds of drones per week, means hundreds of thousands of individual parts flowing into Tatarstan's assembly lines. Many of those parts cannot be made domestically. Russia's electronics manufacturing base was hollowed out by decades of oil-wealth dependence and atrophied by the Soviet collapse. To build a modern drone at scale, Moscow needs the West - or, more precisely, it needs the supply chain infrastructure that was built to serve the West.

"Without Western technologies, Russia would not be able to produce the Geran-2."

- Vladyslav Vlasiuk, Ukraine's Sanctions Commissioner under President Zelenskyy

Microchips and circuit board components found in Geran-2 drones are manufactured by European firms who say they comply fully with sanctions law. Credit: Unsplash

The European Components: Who Makes Them

Ukraine's military intelligence agency, HUR, has systematically dissected every downed Geran-2 drone it can recover. The results are published on a specialized public database and shared, in fuller detail, with investigative partners. The component inventory from these wrecked weapons reads like a who's who of European industrial electronics.

Reporters identified 19 companies across eight countries whose manufactured parts have been documented inside Geran-2 drones by Ukrainian military intelligence. The list spans the breadth of European technology manufacturing:

Note: REMA Group and Diotec Semiconductor told reporters the components identified as theirs were not in fact their products. Reporters presented images of the components to all companies identified in this investigation.

The presence of Pierburg - a subsidiary of Rheinmetall, one of Germany's largest defense contractors - is perhaps the most striking detail in this list. Rheinmetall's parent company manufactures the artillery shells Ukraine uses to fight Russian forces. A subsidiary's fuel pump components are helping power the drones that kill Ukrainian civilians. Rheinmetall has stated it complies fully with all export controls and did not comment further on the specific components identified.

The China Bridge: How Banned Parts Reach Russia

China and Hong Kong serve as the primary re-export hub for sanctioned EU components destined for Russian weapons factories. Credit: Unsplash

The EU's sanctions against Russia are among the most comprehensive export control regimes ever assembled in peacetime. Since the February 2022 invasion, successive packages have banned the export of thousands of dual-use goods - products with commercial applications that can also be adapted for military use. Semiconductors, positioning systems, communications modules: all technically blocked from reaching Russia.

The mechanism that circumvents these controls is straightforward, industrially scaled, and hiding in plain sight: China.

Trade data obtained by reporters from the Import Genius platform documented 672 separate shipments of sanctioned EU-origin components traveling to Russia between January 2024 and March 2025 - an average of roughly 50 per month. These shipments originated from 178 different companies. The vast majority of those companies are based in China and Hong Kong.

The pattern is consistent: a European manufacturer sells components to a Chinese distributor or trading firm, either directly or through authorized distributors in third countries. The Chinese firm then sells to a Russian importer. At no point does the European company legally "export to Russia." At every point, Russian weapons factories get what they need.

This is what trade compliance experts call the "gray channel" - not quite black market smuggling, not quite legal commerce. It occupies a space between jurisdictions where Western law runs out and Russian procurement begins.

"We will not ignore cases of our sanctions being systematically circumvented through the jurisdictions of third countries. This is why, in my role as Sanctions Envoy, I have been actively engaged in outreach with third countries to prevent that their jurisdiction would be used for the sale, supply, transfer or export to Russia of these specific high-risk goods of EU origin."

- David O'Sullivan, EU Chief Sanctions Envoy, statement to reporters

O'Sullivan's statement is carefully worded. It acknowledges the problem. It describes outreach. It does not describe enforcement. In the two years since the EU expanded sanctions to include dual-use components, the Chinese re-export corridor has not been shut down. It has grown.

The u-blox Case Study: Tracing a Single Component

To understand exactly how the supply chain works in practice, reporters traced the journey of one specific component: a GNSS receiver manufactured by u-blox, a Swiss company headquartered in the small town of Thalwil near Zurich.

The u-blox receiver is the drone's navigational brain. It processes satellite signals to give the Geran-2 its precise positioning, velocity, and targeting data. Without it - or without something equivalent - the drone cannot reliably hit its targets. U-blox is one of the world's leading manufacturers of this type of component.

U-blox has issued clear public statements about Russia. The company "strongly condemns" the invasion of Ukraine. It stopped all sales to Russia, Belarus, and occupied Ukrainian territories immediately after February 2022. It extended this ban to the countries of the Eurasian Economic Union. It has a "strict company policy" prohibiting the use of its products in military drones. On paper, u-blox has done everything right.

The actual supply chain documented by reporters tells a different story:

The Yusha Group was eventually sanctioned by the European Union in May 2025 as part of the 17th sanctions package. Neither Yusha nor Norkap responded to requests for comment from reporters. By the time Yusha was blacklisted, the damage was done - and other Chinese trading firms had already filled the gap.

"Either these components were purchased before sanctions were in place or excess inventory was sold on by customers to brokers in countries not applying sanctions against Russia and then shipped into Russia; or smuggled into Russia; or they have been de-mounted from other equipment," u-blox said in a statement that reporters reviewed.

Each of these explanations is legally defensible. None of them is reassuring. And the third possibility - that components are being stripped from consumer electronics purchased legally and repurposed into military hardware - illustrates the fundamental challenge of controlling dual-use goods in a globalized economy.

The Sanctions Architecture and Its Failures

The European Commission in Brussels has tightened sanctions in successive packages - but the Chinese re-export corridor has continued to grow. Credit: Unsplash

The European Union implemented its first comprehensive sanctions on dual-use goods following Russia's invasion in March 2022. By the time of the investigation, 17 packages of sanctions had been passed, each adding new categories of goods, new named entities, and new compliance requirements for European exporters.

The 17th package, passed in May 2025, added a long list of Chinese companies - including Yusha Group - to sanctions lists for facilitating circumvention. It also required European firms to insert "no re-export to Russia" clauses in contracts with non-EU buyers. This provision shifts some legal liability toward the original exporter if their products end up in Russian weapons via documented intermediaries.

But the architecture has structural weaknesses that no single sanctions package has fixed.

First: China is not subject to Western sanctions. Beijing has not joined the sanctions regime. Chinese companies that buy European electronics through legal channels and resell them to Russia are, under Chinese law, breaking no rules. The EU can blacklist individual Chinese firms - and has - but China has hundreds of thousands of trading companies. Whack-a-mole enforcement cannot keep pace with market demand.

Second: the EU's enforcement mechanism relies on member states. Seventeen different national export control agencies, with seventeen different levels of resources, political will, and technical expertise, are supposed to implement a unified regime. The result is predictably uneven. Countries with smaller economies and larger trade relationships with Russia's neighbors have historically been slower to enforce.

Third: the complexity of global electronics supply chains makes genuine due diligence almost impossible for manufacturers. A u-blox GNSS receiver might pass through six different distributors, three different countries, and four different corporate entities before reaching Russia. At each step, the paperwork looks legitimate. Only a comprehensive, coordinated intelligence operation - the kind that law enforcement agencies rarely mount for trade compliance - can follow the trail in real time.

Vladyslav Vlasiuk, Ukraine's Sanctions Commissioner, is unambiguous about the stakes. "Sanctions work," he told reporters. "Take the example of cruise missiles. Russia would love to scale up production, but they couldn't. Why? Because they couldn't get the required Western parts." He points to the Geran-2 as a case where they found an alternative route.

The Corporate Response: "We Can't Control Our Supply Chains"

Every European company named in this investigation was contacted by reporters and asked to respond to the specific components identified in downed Geran-2 drones. The responses followed a consistent pattern: denial of deliberate wrongdoing, acknowledgment that global supply chains are difficult to control, and statements of commitment to sanctions compliance.

The companies' responses are not necessarily dishonest. The global electronics market is genuinely complex. A semiconductor manufactured in Germany today may pass through a Singapore distributor, a Hong Kong trading house, a Vietnamese electronics assembler, and a Polish industrial supplier before reaching a Russian end user - and at no point in that chain will anyone stamp the paperwork "destination: Russian drone factory."

But "complex" is not the same as "uncontrollable." And the investigation raises questions about whether European companies have invested adequately in the compliance infrastructure needed to police their supply chains in wartime conditions.

NXP Semiconductors, the Dutch chipmaker whose processors appear in Geran-2s, told reporters it has not delivered products to Russia since the 2022 invasion and complies with sanctions law. It acknowledged that "parts can reach Russia through third countries or non-authorized distributors without their knowledge." NXP has a sophisticated global compliance program. It has still not been able to stop its components appearing in Russian weapons.

Infineon Technologies, Germany's largest semiconductor company and a supplier to every major automotive and industrial company in Europe, issued similar statements about compliance and acknowledged the challenge of monitoring third-party distribution.

The Pierburg case - the Rheinmetall subsidiary - deserves special scrutiny. Rheinmetall is simultaneously one of Europe's largest defense contractors, supplying artillery shells, armor, and vehicles to Ukraine, and a company whose subsidiary's components help power the drones Ukraine is trying to shoot down. Rheinmetall told reporters it complies with all applicable export controls. That is almost certainly true. It is also almost certainly insufficient.

"Actually the easiest thing in the world to do" - British anti-money-laundering expert Graham Barrow, on how simple it was to create a fictitious company director in the UK's corporate registry. The same bureaucratic indifference that enables financial crime enables export control evasion.

- Graham Barrow, quoted in OCCRP investigation

The Scale of the Damage: Who Pays the Price

While sanctions lawyers and compliance officers debate liability standards, Tetiana Kavinova sleeps under blankets in a frozen apartment. She is the human ledger entry that never appears in any corporate compliance report.

The United Nations Human Rights Monitoring Mission in Ukraine documented 682 civilian casualties from long-range weapons in 2025 alone. These are people killed or maimed by drones and missiles. The Geran-2 accounts for the majority of drone casualties. Ukrainian hospitals, schools, thermal power plants, hydroelectric stations, and apartment buildings have all been struck.

In Kramatorsk, a secondary school was destroyed in a Geran-2 attack in October 2025. In Sloviansk, a residential neighborhood was leveled. In Kyiv, the repeated strikes on power generation facilities have created a rolling humanitarian crisis as millions of people cycle through days-long power outages in winter temperatures that can drop to minus 20 Celsius.

The Geran-2's targeting system - guided in part by that u-blox GNSS receiver - is precise enough to hit specific buildings. This is not indiscriminate bombing. It is a methodical campaign to destroy civilian infrastructure, and it works because the drone is sophisticated enough, cheap enough to produce at scale, and supplied with foreign components that Russia cannot make domestically.

According to Ukraine's Air Force, Russia launched more Geran-2 drones in 2025 than in 2022, 2023, and 2024 combined. Production capacity has continued to expand even as Western sanctions have multiplied. The Tatarstan factory reportedly produces several hundred per month under normal conditions, with surge capacity considerably higher.

Every component that arrives from Europe through a Chinese broker is another drone. Every drone is another power plant struck, another apartment block cold, another Tetiana Kavinova lying awake under blankets at 2am, hoping for morning.

What Comes Next: Tightening the Noose

The investigation has prompted responses from European officials, though none amounting to a fundamental restructuring of the enforcement architecture.

David O'Sullivan, the EU's Chief Sanctions Envoy, acknowledged the problem in his statement to reporters but described the response in terms of "outreach" and diplomatic engagement. This is the language of gradual persuasion, not aggressive enforcement. The EU has invested in a diplomatic approach to China - asking Beijing to pressure its companies to comply with Western sanctions - that has produced limited results. China has not joined the sanctions regime and has publicly criticized them as illegitimate unilateral measures.

More promising are two parallel tracks of reform. The first is the expansion of the Common Foreign and Security Policy's extra-territorial sanctions capacity - essentially, the EU's ability to sanction non-EU companies in third countries that help Russia evade the regime. The 17th package was a significant step. Further packages are in preparation.

The second is a push toward mandatory enhanced due diligence for European exporters of dual-use goods. Under proposals being considered by the European Commission as of early 2026, companies selling certain high-risk components would be required to conduct enhanced screening of downstream distributors and would face liability exposure if their products reach sanctioned destinations through identifiable intermediaries.

Vlasiuk, Ukraine's Sanctions Commissioner, says both tracks are necessary but insufficient without enforcement capacity. "Sanctions work when they are enforced," he said. "The problem is not the law. The problem is the implementation."

For the companies themselves, the investigation creates reputational exposure that regulatory pressure alone cannot generate. Being named as a component supplier in a weapon that kills Ukrainian civilians - even indirectly, even without legal fault - is not a position any major European technology firm wants to occupy. Industry bodies are already discussing voluntary enhanced compliance frameworks that would go beyond legal minimums.

Whether those frameworks move fast enough to matter is another question. Russia has built out its production capacity. The Chinese re-export corridor has diversified and deepened. The drones are already flying. And until the component flow stops, they will keep flying - guided by Swiss GPS receivers, powered by German fuel pumps, killing on behalf of a Russian state that cannot build what it needs without a supply chain that begins in the industrial heartland of its declared adversaries.