From Disinformation to Espionage – Russia’s Hybrid Actions Against Poland

Why It Matters

Poland’s security posture is a bellwether for NATO’s eastern flank, and escalating Russian hybrid tactics threaten EU stability and critical infrastructure. The pressure forces Western allies to reassess defensive coordination and resilience measures.

Key Takeaways

• Russia spent $2‑4 billion yearly on cognitive operations
• Over 3,000 cyber attacks hit Poland daily Jan 2026
• 62% Russians view Poland as hostile, poll shows
• 71% Poles fear election manipulation by disinformation
• 50+ sabotage suspects detained in late 2025

Pulse Analysis

Russia’s hybrid warfare model blends traditional espionage with digital aggression and narrative control, creating a multi‑vector threat that exploits Poland’s NATO membership and its support for Kyiv. By allocating between $2 billion and $4 billion annually to cognitive operations, Moscow funds a sophisticated ecosystem of state‑run media, social‑media bots, and covert intelligence assets. Recent penetrations of the Ministry of National Defence illustrate how physical espionage complements cyber campaigns that now average 2,000‑4,000 attacks per day, targeting government portals, energy grids, and water systems. This convergence amplifies the strategic pressure on Warsaw, eroding public trust and complicating crisis response.

The cyber dimension has become especially pronounced. Check Point Research reports that in January 2026 Poland repelled roughly 3,100 attacks weekly, far outpacing neighboring states. Notable incidents include the December 2025 Electrum‑linked strike that disrupted 30 district‑heating facilities, exposing vulnerabilities in renewable‑energy distribution. While Polish cyber‑defence teams have earned high ratings, the sheer volume and persistence of assaults strain resources and raise the risk of collateral damage to civilian services. Such activity fuels broader EU concerns, as Eurobarometer data show 71% of Poles fear election tampering, reflecting a regional anxiety that could destabilise democratic processes.

Policy makers are responding with a mix of diplomatic, legal, and technical measures. The European Democracy Shield programme aims to bolster resilience against disinformation, while NATO’s enhanced forward presence in Poland seeks to deter kinetic escalation. However, experts warn that hybrid actions can quickly transition to conventional conflict, underscoring the need for integrated threat‑sharing, rapid incident response, and investment in critical‑infrastructure hardening. Strengthening public‑media literacy and expanding joint cyber‑exercise frameworks will be essential to blunt Russia’s multi‑layered pressure and preserve security on the EU’s eastern border.

From disinformation to espionage – Russia’s hybrid actions against Poland

7 February 2026, 14:10

7 min read

Recent cases of espionage on behalf of Russia detected in the last few days (including within an important department of the Ministry of National Defence — MON), together with accompanying cyber‑attacks, acts of sabotage and manifestations of disinformation, are having a significant impact on Poland’s security. An additional element are the threats that have been uttered particularly frequently recently by key figures of the Russian political scene.

Photo: Kremlin.ru

Threats from Russia's political elites

A telling example of Russian rhetoric are the threats voiced on 15 January by Sergey Karaganov, a long‑time adviser to Vladimir Putin and the main ideologue on international affairs. During the podcast The Tucker Carlson Show he commented, among other things, on possible reactions of the Russian Federation if it were to begin losing the war in Ukraine within the next year or two. He warned that Russia in such a situation could use nuclear weapons against selected European countries. He named the United Kingdom, Germany and Poznań as the first targets. By pointing to a specific Polish city he referred, among other things, to the American military presence there, saying:

„If we carried out a nuclear strike on Poznań, the Americans still would never respond.”

Karaganov also accused European leaders of recklessness, arguing that it is the European Union — not Ukraine — that is the real opponent of Russia.

A few days later (20 January) Russia’s foreign minister Sergei Lavrov referred to this while summarising Russian diplomatic activity in 2025 during a press conference. He emphasized, among other things, that the principles of the Western world order no longer exist and that the law of the strongest now applies. He added that most Western countries intend to continue using „the authorities in Kyiv to conduct an armed confrontation with Russia. The goal of driving us to strategic defeat is no longer invoked so often, but everything indicates that it still resides in the minds and plans, especially of European leaders.” Consequently, Russia does not intend to change its narrative toward the West or Ukraine.

On 28 January Dmitry Peskov, the spokesman for Vladimir Putin, also commented on anti‑Polish statements. As reported by the Russian News Agency TASS, in a conversation with Alexandr Yunashev, Peskov spoke about Poland and the Baltic states. He criticised these entities, accusing them of hostility toward Russia and of demonising it. In his view the strained relations have historical roots, and the lack of cooperation with Russia is a political mistake.

„Take Poland for example. We really face challenges connected with Poland,” he said, adding that Poland is one of the countries with which Russia „for centuries has lacked friendly relations.” He added that „whoever comes to power there begins to hate Russia and Russians.”

The ranks of Poland’s critics also include the spokeswoman of the Russian Foreign Ministry, Mariya Zakharova. First, on 28 January she accused the President of the Republic of Poland, Karol Nawrocki, of „distorting history and shifting responsibility for the outbreak of World War II onto the USSR.” This referred to his speech during the commemorations of the 81st anniversary of the liberation of the German Auschwitz concentration camp. Then, on 31 January, she demanded that Poland take action in the case of the Ukrainian national Volodymyr Zhuravlov, suspected of blowing up the Nord Stream gas pipeline, noting that a Polish court had refused his extradition to Germany. She also stated that Russia had hoped Poland would not grant asylum to a man suspected of this attack. Concluding this thread, she noted that Russia „does not uncritically accept the theory that only Ukrainians are behind the Nord Stream blasts, and the theory of involvement by Western intelligence services requires appropriate investigation.”

Russian hybrid threats

The further hardening of Russian rhetoric toward Poland stems from many different factors. Because of its geopolitical significance and international engagement, including cooperation with the United States and support for Ukraine, Poland is one of the key targets of hostile operations such as cyber‑operations, espionage and disinformation. Decisions such as the closure of Russian consulates or the judicial refusal to extradite and the release from custody of the aforementioned W. Zhuravlov have also played an important role in this context.

Russia spends between 2 and 4 billion USD annually on various cognitive operations. In addition to classic propaganda or disinformation campaigns carried out through a range of channels including social media, the statements of representatives of Russian political and social elites also deserve attention. They have an indirect or direct propagandistic reflection in Russia. For example, a recent poll by the Levada Centre shows that as many as 62 % of Russians indicated Poland and Lithuania as the most hostile countries.

Russian disinformation generates major social concerns in the countries of the EU’s eastern flank. The latest Eurobarometer study indicates that in almost all countries of this region a majority of inhabitants fear, among other things, the distortion of election results by false or misleading information. In Poland 71 % of respondents expressed such concerns. By comparison, 82 % of respondents in Hungary, 75 % in Lithuania, 74 % in Slovakia and Bulgaria, 68 % in Latvia, and 65 % in Romania voiced similar worries. Attempts to counter this are being made not only by individual member states but also by EU institutions, which have launched, among other initiatives, the European Democracy Shield programme.

Statements by Russian politicians may further intensify a range of hybrid actions aimed at Poland. This could mean, for example, further large‑scale cyber‑attacks targeting energy, water or communications systems, the dispatch of drones or balloons, acts of espionage or sabotage. It is worth recalling that, according to official data, in just the last months of 2025 more than 50 people suspected of planning sabotage acts were detained in Poland. Meanwhile, a survey conducted at the end of last year found that as many as 68 % of Poles expect further Russian manifestations of sabotage.

Particular attention should be paid to cyber‑attacks carried out by Russia or entities supporting it (including false‑flag operations). According to various sources Poland experiences between 2 000 and 4 000 attacks daily. As reported by Check Point Research, Poland repels significantly more attacks against, for example, the governmental sector than most countries in the region. In October 2025 this amounted to about 2.5 thousand incidents weekly, and by January 2026 the figure had risen to around 3.1 thousand — far higher than in the Czech Republic, Austria or Germany.

A telling manifestation of actions in cyberspace are Russian strikes against critical infrastructure, including hospitals, water systems and energy grids. For example, a coordinated cyber‑attack in December 2025 against many facilities of the Polish energy network was most likely carried out by a Russian hacker group known as Electrum. A report from the firm Dragos indicates that the attack targeted district‑heating systems and infrastructure involved in distributing energy from, among others, wind and solar farms. Despite effective and highly rated Polish cyber‑defence, hackers managed to disrupt the operation of about 30 such facilities, which is undoubtedly a serious alarm signal.

One of the heads of German intelligence, Martin Jäger, aptly characterised Russia’s hybrid actions, stating that the current „cold peace” between Russia and the European Union can at any moment turn into a „heated confrontation” in which hybrid actions will transform into typically military operations.

„We cannot sit idly by and assume that a possible Russian attack will occur no earlier than 2029. We are already under fire today.”

---

Author:

Sebastian Wojciechowski — Head of the Department of Strategic Studies and International Security at the Faculty of Political Science and Journalism, Adam Mickiewicz University; Chief analyst at the Western Institute in Poznań; OSCE and NATO DEEP eAcademy expert on internal and international security; Editor‑in‑chief of Przegląd Strategiczny (Strategic Review). He recently published an article entitled The Evolution and Escalation of the Hybrid Terrorist Threat in the European Union (pressto.amu.edu.pl/index.php/ps/article/view/51395/41706).