Poland Escalates Crackdown on Russian Espionage Networks Amid Rising Hybrid Threats

 

Warsaw, October 22, 2025 – In a stark revelation underscoring the deepening shadows of hybrid warfare across Europe, Polish authorities announced Tuesday that internal security forces have detained 55 individuals in recent months on suspicions of espionage and sabotage activities linked to Russian intelligence. This figure marks a significant escalation from an initial report of eight arrests earlier in the day, highlighting the intricate web of overlapping investigations into Moscow's covert operations within NATO's eastern flank.

Jacek Dobrzyński, spokesperson for Minister Tomasz Siemoniak, who coordinates Poland's special services, detailed the broader scope during a press briefing in Warsaw. "These detentions stem from a series of multi-layered probes conducted by the Internal Security Agency (ABW) and other entities," Dobrzyński stated, emphasizing that all suspects face charges under Article 130 of Poland's Penal Code, which covers espionage and acts of sabotage punishable by up to 10 years in prison. He refrained from divulging specifics on individual cases, citing ongoing operational sensitivities, but confirmed the arrests span reconnaissance of military sites, preparation of incendiary devices, and direct execution of disruptive actions.

The announcement came hours after Prime Minister Donald Tusk took to the X platform—formerly Twitter—to alert the public to the initial eight detentions. "The ABW, in cooperation with other services, has detained eight people in various parts of the country in recent days, suspected of preparing acts of sabotage," Tusk posted, adding that the cases remain active with "further operational steps underway." Security Minister Siemoniak echoed the message on the same platform, specifying that the suspects were accused of "conducting reconnaissance of military facilities and critical infrastructure, preparing resources for sabotage, and directly carrying out attacks." Tusk's post, viewed over 1.5 million times within hours, served as a public reminder of Poland's frontline role in countering Russian aggression, blending transparency with a call for vigilance.

At the heart of the latest exposures lies a cross-border plot uncovered through intensified collaboration between Polish and Romanian intelligence. On October 16, ABW agents, working alongside Romania's Intelligence Service (SRI), arrested 21-year-old Ukrainian national Danylo H. near Warsaw. Prosecutors allege H. was orchestrating the shipment of parcels laced with explosives and incendiary materials destined for Ukraine, intended to ignite or detonate mid-transit and sow chaos in logistics networks ferrying Western aid. The Warsaw District Court promptly ordered H.'s pre-trial detention for three months, citing risks of flight and evidence tampering.

The operation extended into Romania, where SRI and the anti-organized crime unit DIICOT apprehended two additional Ukrainian suspects—aged 21 and 24—in Bucharest. These individuals, reportedly acting in concert with H. under direct coordination from Russian handlers, had deposited two packages containing homemade incendiary devices at an international courier office on October 15. The devices, designed to raze the facility by fire, were neutralized by explosives experts before any harm occurred. A Romanian court mandated 30 days of custody for the pair, pending extradition discussions and further interrogations. SRI described the foiled scheme as part of a broader effort to "prevent new sabotage acts on national territory," underscoring Moscow's alleged aim to disrupt EU solidarity with Kyiv.

This tri-national takedown exemplifies the transnational nature of Russia's "active measures," a Cold War-era doctrine revived with modern ferocity since the February 2022 invasion of Ukraine. Poland, sharing a 535-kilometer border with Ukraine and serving as the primary conduit for over $100 billion in Western military aid—including Leopard tanks, HIMARS systems, and artillery shells—has become a bullseye for such tactics. Rail sabotage, arson attempts on depots and historical landmarks, and recruitment of low-level spotters for surveillance have proliferated, officials say, mirroring patterns seen in Baltic states and Germany.

The cumulative tally of 55 detentions since early 2022 paints a sobering portrait of sustained infiltration. Early cases included the March 2023 dismantling of a nine-member GRU-linked cell in Przemyśl, accused of monitoring arms convoys and plotting railway disruptions to halt Ukraine-bound supplies. Six were charged with espionage and organized crime participation, while evidence pointed to payments from Russian intelligence for propaganda sowing discord between Poles and Ukrainians. By November 2023, prosecutors indicted 16 foreigners—mostly from former Soviet republics—for a sprawling network spying on seaports, military bases, and energy grids, with tasks encompassing both intelligence gathering and incendiary plots.

More recent incidents underscore the persistence. In May 2025, Poland shuttered Russia's consulate in Kraków after linking Moscow to a massive blaze at Warsaw's Marywilska 44 shopping center, which gutted 100,000 square meters and caused millions in damages. Investigations revealed accelerants consistent with prior GRU operations, prompting similar closures in Poznań the year before. Just last month, on October 9, authorities charged Tomasz L., a former Warsaw civil registry employee, with supplying falsified identities to Russian agents from 2017 to 2022, aiding their embedding in sensitive sectors. And in Gdynia, a suspect was nabbed for torching vehicles with Ukrainian plates, yielding a cache of explosives tied to broader arson campaigns.

These efforts reflect not isolated incidents but a deliberate strategy of attrition, what Polish officials term "hybrid warfare." By targeting transit hubs, energy infrastructure, and social cohesion, Russia seeks to erode support for Ukraine without direct confrontation, experts note. "Poland is on the front line," Siemoniak remarked, adding that investigations often reveal recruits—frequently Ukrainians or Belarusians—motivated by financial desperation rather than ideology. ABW and the Military Counterintelligence Service (SKW) operate under classified statutes, enabling swift pre-trial detentions while courts balance security with due process.

The revelations ripple beyond Poland's borders, amplifying calls for NATO-wide vigilance. Latvia's State Security Service detained a military leaker to Russia in September 2025, while British counterterrorism units arrested three in an espionage ring the same month. Czechia and the Baltics report parallel upticks, with cross-jurisdictional task forces—bolstered by EU funds for the European Defence Industrial Programme—sharing intelligence in real time. Romania's SRI, in particular, has deepened ties with Warsaw, as evidenced by the parcel plot's interception.

Prime Minister Tusk, whose center-left government has poured over 4% of GDP into defense since taking power in late 2023, framed the detentions as a testament to resilience. "We will not yield to intimidation," he declared in parliament Tuesday afternoon, urging allies to accelerate sanctions and arms deliveries. Yet challenges persist: resource strains on ABW, which handles over 200 active probes, and the psychological toll on a nation hosting 1.5 million Ukrainian refugees.

As autumn chill sets in along the Vistula, Warsaw's message is unequivocal: Russia's shadows lengthen, but Poland's resolve hardens. With trials pending and networks unraveling, the coming months will test whether Europe's eastern sentinels can outpace the Kremlin's covert gambits. For now, the 55 in custody stand as silent witnesses to a war fought not just in trenches, but in the quiet corridors of everyday life.