On the night of May 2–3, 2023, two drones detonated over or near the Kremlin Senate dome in Moscow — an event that immediately produced three competing narratives from Russia, Ukraine, and Western analysts, none of which have since been conclusively established. President Vladimir Putin was not in the building; he was at his Novo-Ogaryovo residence outside Moscow. No casualties or injuries were reported.

The incident became public through unverified videos posted to Russian social media showing an object flying toward the Kremlin dome before a small explosion near a flagpole. According to the Institute for the Study of War's May 3, 2023 campaign assessment, Russian social media channels were initially silent — the footage surfaced only after the incident had already concluded, a sequencing ISW would later fold into its broader analytical argument.

Based on that footage, Samuel Bendett, a research analyst at the Center for Naval Analyses' Russian Studies Program, assessed the drone as likely either the Chinese-manufactured Mugin-5 — a commercially available fixed-wing UAS with a market value of approximately $9,500 — or Ukraine's domestically developed UJ-22 fixed-wing drone, according to an analysis cited by Haverford College's Political Science department. Neither platform is exotic. The UJ-22 had already appeared near Moscow before May 3: a UJ-22 crashed approximately 100 kilometers southeast of the city in late February 2023, and another UJ-22 carrying 17 kilograms of explosives was recovered roughly 30 kilometers east of Moscow on April 24, 2023. A Russian air base some 200 kilometers from Moscow had been struck in December 2022. That pattern of escalating long-range drone incursions into airspace around the capital formed a documented backdrop to the Senate dome event.

Three Competing Narratives, None Conclusive

Kremlin spokesman Dmitry Peskov characterized the incident immediately as "a planned terrorist act and attempt on the life of the president." Russia subsequently accused the United States of direct involvement; Peskov further stated: "We know that often it isn't even Kyiv that determines the targets, but Washington," according to The Moscow Times. NSC spokesperson John Kirby called those accusations "pure and simple" lying and denied any U.S. role in the operation.

Ukraine's position was categorical. President Volodymyr Zelensky stated: "We didn't attack Putin. We fight on our territory." Presidential adviser Mikhaylo Podolyak went further, alleging the event had been "staged" by Moscow itself. From a third direction, Kremlin critic Ilya Ponomaryov, cited by The Moscow Times, suggested Russian partisan groups operating in opposition to the Putin government may have been responsible.

Those three possibilities — a Ukrainian military or intelligence operation, a Russian-orchestrated false flag, a domestic anti-Kremlin action — were each advanced by credible voices in the days after May 3. None has since been proven or disproven. Political scientist Kirill Shamiev, arguing for the Ukrainian-origin theory, contended that such a strike aimed to "destabilize the domestic political situation in Russia," while International Crisis Group analyst Oleg Ignatov observed simply: "Nobody, not even in the Kremlin, is safe."

The Air Defense Problem — and What Russia's Own Response Implied

The analytically strongest challenge to the Ukrainian-operation theory came from ISW's contemporaneous campaign assessment. As of January 2023, geolocated imagery showed Pantsir surface-to-air missile systems deployed in multiple interlocking rings around Moscow. Given that architecture, ISW assessed it was "extremely unlikely" that two drones could have "penetrated multiple layers of air defense" around the city and detonated directly over the Kremlin Senate dome. This is not merely a technical quibble — it is a fundamental question of whether the attack as officially described is physically plausible at all.

ISW also flagged the Kremlin's reaction as structurally inconsistent with a genuine surprise attack. Russia's responses to actual military reverses — the fall of Balakliya, the loss of Kherson City in fall 2022 — had been historically disorganized, characterized by delayed and contradictory messaging. May 3 produced the opposite:

"The Kremlin's immediate, coherent, and coordinated response to the incident suggests that the attack was internally prepared in such a way that its intended political effects outweigh its embarrassment." — ISW campaign assessment, May 3, 2023

ISW concluded Russia "likely staged the attack" to mobilize domestic support ahead of Victory Day on May 9 and reframe the war as an existential threat to the Russian civilian population, citing a contemporaneous pattern of what it described as Russian disinformation operations in Bryansk and Kursk oblasts and in Transnistria.

Security analyst Mark Galeotti, writing in The Moscow Times, offered the most systematic counter to the false-flag reading. Galeotti argued it was "unlikely Putin would stage such a symbolic blow to himself" through a manufactured attack. Galeotti assessed the most probable scenario as an operation by domestic Kremlin opponents rather than a Ukrainian state or intelligence strike. He also noted that Putin "notoriously rarely goes to the Kremlin, let alone stays there overnight," which contextualizes the absence of a presidential target as unremarkable rather than suspicious.

What U.S. Intelligence Said — and Didn't

A preliminary U.S. intelligence assessment, reported by GlobalSecurity.org citing U.S. media reporting from late May 2023, attributed the attack with low confidence to "one of Ukraine's special military or intelligence units." The qualifier is load-bearing. Low-confidence assessments reflect incomplete information and preliminary analysis — they are not established conclusions. Analysts could not identify which specific Ukrainian unit was responsible. They could not determine whether President Zelensky had knowledge of or ordered the operation, a significant gap given his explicit public denial. The assessment reportedly relied partly on intercepted communications between Russian and Ukrainian officials discussing the incident after the fact, not on direct evidence of operational planning or perpetration. That evidentiary base does not close the attribution chain.

Why It Matters

Whatever the source of the May 3 drones, the immediate strategic effect was measurable. Moscow and St. Petersburg banned all drone flights in the aftermath. At least 21 Russian cities canceled their Victory Day military parades — for the first time in years, according to C4ISRNET reporting — citing security concerns. The parades function as a central annual display of regime legitimacy and military strength; their cancellation represented a concrete propaganda cost to Moscow regardless of who bore operational responsibility for triggering the security response.

On May 30, 2023, a second major drone attack reached Moscow directly. Russian officials reported eight drones targeting the city; five were shot down and three were jammed and veered off course, causing what Moscow Mayor Sobyanin described as "insignificant damage" to several buildings with two people requiring medical attention, according to C4ISRNET. Andrei Kartapolov, a senior Russian lawmaker, called the May 30 attacks "an intimidation act aimed at the civilian population...designed to create a wave of panic." Russia attributed both incidents to the "Kyiv regime." The May 30 event was a distinct operation from May 3, but the two together established that Moscow's airspace was not, in practice, hermetically defended.

The Kremlin drone incident remains one of the most disputed episodes of the Russia-Ukraine war. Three years after the event, no party has produced definitive forensic, signals, or documentary evidence establishing beyond reasonable doubt who launched the drones or authorized the mission. Russia's attribution to Ukraine served its wartime framing of the conflict as an existential defensive struggle; Ukraine's denial and counter-accusation of staging served its own. ISW's false-flag analysis rests on probabilistic inference — about air defense penetration physics and response-quality comparison — rather than direct evidence. The U.S. intelligence community arrived at a low-confidence attribution and acknowledged it could not close the chain of custody to any specific unit or decision-maker. Every claim about the Kremlin drone incident — including the claim that it was a false flag — must be carried with its source attached.

Sources