Poland Becomes Focal Point in Russia’s Expanding European Sabotage Campaign
Poland is increasingly the primary target of a widespread sabotage campaign orchestrated by Russia across Europe, according to a recent report by the International Centre for Counter-Terrorism (ICCT). The ICCT identified 151 sabotage cases between February 2022 and February 2026, with 31 – representing 21% – occurring in Poland, more than any other nation.
A Surge in Recent Incidents
The trend has accelerated, with over a quarter (11) of the 41 newly identified cases since September 2025 taking place within Poland. This confirms a clear escalation in Russian activity focused on Polish territory. Authorities acknowledge the actual number of incidents is likely higher, as investigations often capture time and attribution can be challenging.
Railway Sabotage and Explosive Plots
Recent high-profile incidents in Poland include the November 2025 explosion that damaged a railway line. Investigations revealed the attack was carried out by Ukrainian nationals acting on behalf of Russian intelligence, aiming to disrupt rail transport. Polish authorities have issued Interpol red notices for the two suspects, who have since fled to Belarus.
Further demonstrating the scope of the campaign, Polish and Romanian authorities jointly thwarted a plot to send explosive packages in October 2025. In January 2026, five individuals – four Ukrainian citizens and one Russian national – were indicted for involvement in a similar scheme to deliver explosive courier packages.
The Broader European Context
While Poland is the most heavily targeted country, the ICCT report highlights a broader pattern of sabotage across Europe. France follows with 20 incidents, while Lithuania and Germany each recorded 15. The United Kingdom and Estonia have experienced 12 and 11 incidents respectively. The report notes a strong correlation between targeting and the level of political and military support each country provides to Ukraine.
The Rise of “Disposable” Operatives
The ICCT’s analysis reveals a concerning trend: the vast majority (95%) of alleged perpetrators are ordinary civilians with no direct ties to Russian intelligence agencies. These individuals are described as “disposable” agents, easily recruited through platforms like Telegram and compensated with cryptocurrency. This approach allows Russia to maintain deniability and minimize risk.
Recruitment tactics involve escalating involvement, starting with small payments for minor tasks before progressing to more serious acts like arson or explosive attacks. The study identifies several categories of recruits: young adults lured by quick money, members of diaspora communities, individuals recruited from prisons or criminal networks, pro-Kremlin sympathizers, and “travelers” who enter a country solely to carry out an operation.
Poland’s Response and Diplomatic Fallout
In response to the escalating sabotage, espionage, and cyberattacks, Poland has taken decisive action, closing all three of its Russian consulates. Russia has retaliated by closing the three Polish consulates operating within its borders.
Polish prosecutors have filed five charges against a Russian man accused of running an espionage and sabotage network in Poland.
He is alleged to have coordinated a group of at least 30 operatives on behalf of Russia’s Federal Security Service https://t.co/BMpdFFLFQg
— Notes from Poland 🇵🇱 (@notesfrompoland) December 2, 2025
Who is Being Recruited?
Approximately half of the suspects identified were not residents of the country where the attack occurred. In Poland, Ukrainians and Belarusians – the country’s two largest immigrant groups – are disproportionately targeted for recruitment by Russian operatives.
FAQ
Q: What is the primary goal of Russia’s sabotage campaign?
A: The campaign aims to destabilize European nations, undermine support for Ukraine, and sow discord within the region.
Q: How is Russia recruiting individuals for these operations?
A: Russia primarily uses online platforms like Telegram and cryptocurrency to recruit individuals, offering small payments for escalating levels of involvement.
Q: What is Poland doing to counter this threat?
A: Poland has closed Russian consulates, issued Interpol red notices for suspects, and charged individuals involved in sabotage activities.
Q: Are other European countries also being targeted?
A: Yes, France, Lithuania, Germany, and the United Kingdom are among the other countries experiencing similar sabotage activities.
Did you know? The ICCT report highlights the increasing use of non-state actors and “disposable” operatives in Russia’s hybrid warfare strategy.
Explore more insights into Polish security and international relations here.
