Poland has been identified as the "primary focus" of Russian sabotage operations targeting NATO members, according to an international intelligence assessment that documents a sustained campaign of arson, infrastructure attacks, and covert operations designed to undermine Western support for Ukraine.
The report, compiled by intelligence agencies from multiple NATO countries and shared with allied governments, catalogs dozens of incidents attributed to Russian military intelligence (GRU) and other security services operating on Polish territory. The assessment concludes that Poland's role as the primary logistics hub for Western military aid to Ukraine has made it the central target of Russian hybrid warfare.
"Poland is not just a NATO member being targeted by Russian operations," said Stanisław Żaryn, Poland's former Deputy Minister of Interior responsible for security. "It is the front line of a covert war that Russia is waging against the entire alliance."
The documented incidents include attempted arson at weapons storage facilities, sabotage of rail lines carrying military equipment to Ukraine, cyberattacks on Polish government systems, and efforts to recruit Polish citizens for espionage. In several cases, Polish security services have arrested individuals allegedly working for Russian intelligence, often citizens of third countries used as cutouts to obscure Moscow's involvement.
The pattern is systematic rather than opportunistic. Russian operatives have targeted specific choke points in the logistics network that supplies Ukrainian forces — rail junctions, storage depots, and border crossings. The objective appears to be disrupting the flow of Western weapons and creating the impression that supporting Ukraine carries unacceptable domestic security costs for NATO members.
"What we're seeing is a deliberate strategy to make support for Ukraine expensive and dangerous for Poland," said Konrad Muzyka, a defense analyst at Rochan Consulting in Warsaw. "If Russia can make Poles feel that every weapons shipment to Ukraine risks a sabotage attack on Polish soil, public support for that aid may erode."
Polish authorities have responded with enhanced security measures. Rail shipments of military equipment now receive armed escorts, key infrastructure has additional guards, and counter-intelligence operations have been expanded. However, the scope of Russian operations — involving multiple operatives, diverse targets, and constant adaptation — makes comprehensive prevention difficult.
The report identifies several specific incidents that illustrate the campaign's sophistication. In January, Polish authorities arrested three individuals allegedly planning to set fire to a warehouse containing artillery shells destined for Ukraine. In February, unknown saboteurs damaged rail tracks near the Ukrainian border, causing delays in weapons shipments. In March, a cyberattack disrupted logistics coordination systems, though the impact was quickly contained.
Each incident individually might be dismissed as criminal activity or technical failure. Collectively, they form a pattern that intelligence agencies assess with high confidence to be coordinated Russian operations.
"The forensics on several of these incidents lead back to methodologies and signatures consistent with GRU operations," said a Western intelligence official familiar with the assessment. "The level of coordination and targeting specificity indicates state-level planning, not random actors."
Poland's vulnerability stems from its geographic and political position. As Ukraine's western neighbor and a NATO member deeply committed to Ukrainian defense, Poland serves as the primary conduit for Western military aid. The Rzeszów-Jasionka Airport in southeastern Poland has become an unofficial logistics hub, with weapons arriving from across NATO and then being transported onward to Ukraine.
This concentration of activity creates attractive targets. Russian intelligence can observe the flow of shipments, identify infrastructure dependencies, and plan operations with reasonable confidence that disruption will impact Ukrainian military capabilities.
The hybrid warfare campaign extends beyond physical sabotage. Polish officials have documented Russian information operations designed to exaggerate the security costs of supporting Ukraine and amplify political divisions within Polish society. Social media accounts linked to Russian influence networks spread narratives suggesting that Poland is being drawn into a war not in its national interest.
"The sabotage operations and information operations are two sides of the same strategy," said Alina Polyakova, president of the Center for European Policy Analysis. "Russia wants to create actual security incidents and then amplify public fear of those incidents to change Polish policy."
So far, the strategy has not succeeded in altering Poland's support for Ukraine. Public opinion in Poland remains strongly pro-Ukrainian, and the government of Prime Minister Donald Tusk has maintained robust military aid despite the security challenges.
However, as the conflict extends and sabotage attempts continue, there are concerns that cumulative effects could erode support. If Polish citizens face persistent security threats linked to aid shipments, or if successful sabotage results in casualties, political pressure to scale back support could intensify.
The international report calls for enhanced counter-intelligence cooperation among NATO members, including more aggressive expulsion of suspected Russian intelligence officers operating under diplomatic cover and greater information sharing about sabotage methods and recruitment networks.
It also recommends that NATO formally recognize hybrid warfare operations as potential grounds for invoking Article 5, the alliance's mutual defense clause. Currently, sabotage and cyberattacks exist in a gray zone — clearly hostile but below the threshold of armed attack that would trigger collective defense.
"If a NATO member's critical infrastructure is being systematically sabotaged by a foreign power, at what point does that constitute an attack?" asked Benedikts Vāvere, a Latvian defense official whose country has also experienced suspected Russian sabotage. "We need to answer that question before the sabotage escalates to the point where we're forced to respond."
To understand today's headlines, we must look at yesterday's decisions. When Poland committed to serving as the primary logistics corridor for Western aid to Ukraine, it accepted risks that are now materializing. Russia views Poland not just as a NATO member but as a combatant in the Ukraine war by virtue of its logistics role. The sabotage campaign is Moscow's response — a form of warfare designed to achieve strategic objectives while remaining below the threshold that would trigger open conflict. For Poland, and for NATO, the challenge is determining how to respond to attacks that are undeniably hostile but carefully calibrated to avoid crossing red lines.
