The Many Ways Russia Is Waging Hybrid War in Poland

After European governments expelled dozens of Russian operatives, the Kremlin shifted tactics and began recruiting vulnerable individuals, criminals, and extremists tied to far-right networks to carry out sabotage, arson, and even targeted killings designed to destabilize Europe from within.

Poland faced a severe attack on its energy infrastructure in December 2025, which nearly triggered a nationwide blackout affecting half a million people. The coordinated cyber operation targeted 30 energy facilities, including combined heat and power plants and renewable energy management systems.

Poland’s Deputy Prime Minister and Minister for Digital Affairs, Krzysztof Gawkowski, described it as a form of “digital tanks” crossing the border. 

Everything indicates we were dealing with Russian sabotage, which must be called by its real name—an attempt to destabilize Poland.

Krzysztof Gawkowski

Deputy Prime Minister and Minister for Digital Affairs

Our October 2025 report on a joint study, “Russia’s Crime Terror Nexus,” by the International Centre for Counter-Terrorism (ICCT) and GLOBSEC, highlights Moscow’s hybrid war as central to its foreign policy. 

Their latest study exposes how Poland has become the primary target of Russian activity in Europe. As a key logistics corridor and diaspora hub for Ukraine, Poland sits at the heart of Kyiv’s support network. From the Kremlin’s perspective, GLOBSEC says, the objective is simple: “punish the dog that barks the loudest.”

Hybrid Russian attacks in Poland

Polish authorities arrested a long-serving official from the nation's Ministry of National Defense on suspicion of collaborating with Russian and Belarusian intelligence in February 2026. The 60-year-old had worked at the ministry since the 1990s, holding multiple mid-level roles, including in the department of strategy and planning, placing him inside the very institution responsible for Poland’s national security posture.

In May 2024, Poland detained and indicted nine people accused of belonging to a Russian intelligence-linked spy ring. The suspects—citizens of Belarus, Poland, and Ukraine—were allegedly involved in beatings, arson, and attempted arson targeting not only Poland but also Lithuania, Latvia, and possibly Sweden.

That month, in response to Russian destabilization efforts, Poland’s Prime Minister, Donald Tusk, allocated an additional 100 million złoty, estimated $28million, to strengthen the country’s civil and military counter-espionage services.

Meanwhile, investigators tracking “Russia’s Crime Terror Nexus” identified 12 new Kremlin-linked incidents in Poland. Five occurred after monitoring intensified in July 2025, while seven occurred between February 2022 and July 2025. The operations ranged from sabotage and planned arson to propaganda campaigns and reconnaissance targeting critical infrastructure. 

Some of the attacks most recently published in “Russia’s Crime Terror Nexus” include:

Polish prosecutors charged five individuals with conducting reconnaissance for Russian intelligence. Authorities say the suspects photographed and transmitted images of critical infrastructure between March 2024 and February 2025. The group also hung propaganda posters and painted graffiti to destabilize public order on behalf of Russian intelligence services. 

A 27-year-old Belarusian citizen was detained in July 2025 after filming, photographing, and gathering information on a warehouse. He later admitted that these acts served as preparation for a planned arson attack against the warehouse on behalf of a foreign intelligence service.

Authorities arrested a 17-year-old Ukrainian citizen in August 2025 recruited by Russia. The charges—promoting Nazi ideology to inflame anti-Ukrainian sentiment. Prosecutors allege he painted extremist graffiti, desecrated monuments, and placed provocative flags on buildings in Wrocław, Warsaw, and Domostawa—actions believed to be aimed at fueling "discord between Poles and Ukrainians.”

Coordinated explosions damaged two sections of the railway line on November 16, 2025 connecting Warsaw and Lublin—a key route used for civilian and strategic transport, and for supplying Ukraine An engineer discovered the damage before trains reached the site. GLOBSEC reports that the blasts could have derailed approaching passenger trains and caused mass casualties if officials had not intervened in time. Polish authorities accused Russia of orchestrating the sabotage.

Russia has been weaponizing migration to destabilize Europe as another hybrid warfare tactic. Polish border authorities found Belarus using the same method—reinforced, sophisticated tunnels to smuggle migrants into European Union territory.

On December 11, 2025, over 180 foreign nationals crossed through one such tunnel, and authorities apprehended 130 of them at the time of reporting. The use of migrant flows is aimed at straining Polish border resources and public cohesion.

Who is conducting these attacks?

Between February 2022 and February 2026, 172 individuals were tied to 151 confirmed Kremlin-linked cases across Europe.

Poland has recorded 31 confirmed cases, while France recently saw a surge, bringing its total to 20 cases. Germany and Lithuania follow closely with 15 confirmed incidents each. GLOBSEC notes the real number is likely significantly higher, as most cases only become public once investigators can definitively link them to Moscow. In 2025 alone, Germany reported 320 suspected sabotage attempts, though most remain unattributed. 

95% of perpetrators had no formal ties to Russian intelligence. Financial gain drives many of these actors—often minors recruited through social networks like TikTok and Telegram, lured by challenges and promises of quick money. 

The strategy is two-fold: outsourcing sabotage abroad makes it harder to trace back to Moscow, while economic hardship in Eastern Europe makes it easier to buy, the Russia’s Crime Terror Nexus report revealed.

More than one-third of the individuals in the report’s dataset had a prior criminal record, ranging from petty offenses to serious violent crime, including murder.

Around half of the perpetrators travelled specifically to the target country for the operation and left immediately after. Most originated from Central, Eastern, or Southern Europe, particularly Moldova, Serbia, and Bulgaria.

A newer trend shows Colombians increasingly involved in Russian sabotage across Central-Eastern Europe and the Baltics, coinciding with their growing presence on the battlefield in Ukraine. 

Colombians also make up the largest contingent of foreign volunteers fighting for Ukraine, with approximately 7,000 personnel deployed across various units.

Ukrainians—many displaced by war and Russian occupation—have also been hired for sabotage, alongside Belarusians and dual Russian–European citizens. Most were in their thirties to fifties and lived in precarious socio-economic conditions, often unemployed, indebted, or working in blue-collar jobs. For Ukrainians from Russian-occupied territories, a common recruitment tactic involves contact by someone they knew before the war who remains under the occupation and works for groups like Russia’s GRU . These operatives leverage trust and coercion.

GLOBSEC told UNITED24 Media that Belarusian-linked attacks were likely ordered in Moscow and coordinated through Minsk, exploiting networks already embedded in Poland.

Europe’s battle isn’t just on the frontlines in Ukraine—cyberattacks replace artillery, sabotage replaces tanks, but Russia’s aim is the same: to weaken Europe from within. Hybrid operations across Poland and beyond show that Moscow’s war is already unfolding across the continent.

On the Frontline of Truth

Our reporters work on the frontlines to show what’s really happening in Ukraine. Your support helps them keep reporting.

SUPPORT FRONTLINE REPORTS