Russian disinformation after polish railway line sabotage
Photo. Kancelaria Prezesa Rady Ministrów
Following the act of sabotage on the Polish railway network, a coordinated disinformation campaign has been identified targeting public perception of the incident. Its primary objective is to shift responsibility onto Ukraine and to undermine public trust in the Polish security services.
Two acts of sabotage were detected on the Warsaw-Lublin railway line - one near Mika and another close to Puławy. During his address to the parliament, Prime Minister Donald Tusk stated that Russia was behind the attacks.
“The intensive work of our intelligence services, police and prosecutors has allowed us to identify those responsible. They are two Ukrainian citizens, one from Donbas, who cooperated with Russian intelligence services,” the Prime Minister said.
Almost immediately after the first reports appeared, disinformation began circulating online. According to the Ministry of Digital Affairs, the campaign pursues two main goals. First, it tries to deflect blame from Russia onto Ukraine, amplifying anti-Ukrainian sentiment in Polish society. Second, it seeks to erode confidence in Polish security agencies by implying negligence or alleged “information concealment.”
What types of narratives were disseminated?
The ministry noted that between 16 and 18 November 2025, Polish-language content on the rail sabotage spiked. The topic was amplified mainly by X accounts and by pro-Russian or anti-Ukrainian Telegram channels.
As noted by the Google Threat Intelligence Group (GTIG) in its latest analysis, “Pro-Russia IO Activity Leveraging the Reported Sabotage of a Polish Railroad as of November 17, 2025,” one of the platforms spreading pro-Russian disinformation is Portal Kombat.
The content promoted by Portal Kombat includes updates about the incident itself, such as highlighting Prime Minister Donald Tusk’s statement confirming that an act of sabotage occurred. Beyond these ostensibly informational posts, a significant portion of the content appears designed to preemptively shift blame.
First, some narratives suggest that Poland will ultimately accuse Russia, seemingly aiming to undermine any future allegations directed at Moscow. Second, other narratives attempt to attribute responsibility to Polish partisans or nationalists opposed to the government’s support for Ukraine. Third, additional narratives imply that Ukrainians themselves were behind the act of sabotage.
Anti-Ukrainian Disinformation
In recent hours, more aggressive, openly pro-Russian messages have appeared, explicitly linking the sabotage to Ukraine. Examples include:
- “Ukrainian agents act fast. They’re blocking the transit on which Poland depends.”
- “Ukrainian intelligence has thousands of agents in Poland.”
- “The blown-up tracks are the work of Ukrainian terrorists.”
- “These are the consequences of tolerating Ukrainian terrorism.”
Hostile slogans such as “Poland and Russia together against Ukraine” are designed to fracture allied unity and inflame domestic tensions.
Read more
False References to German Media
Another strand of disinformation repeats a false claim that “German media warned PKP about possible sabotage several days earlier.” The narrative aims to:
- discredit Polish security services and rail operators,
- reinforce allegations of withheld information,
- deepen suspicion toward Ukraine by suggesting that known threats were ignored.
Disinformation in the Russian Information Sphere
Russian media and Telegram channels quickly seized on the incident, framing it as evidence of supposed internal tensions in Europe or as actions inspired by a “war party” within the EU. Typical themes include:
- allegations that Poland staged the event to blame Russia and justify aid to Ukraine;
- speculation about “Polish partisans,” anarchists or Western saboteurs;
- references to previous infrastructure attacks in Germany, France and the Czech Republic to argue that Europe now suffers chaos of its own making;
- suggestions that Berlin may be sabotaging supplies to Ukraine in retaliation for the Nord Stream 2 explosion.
A dominant line is that “ordinary Europeans” are striking back against their governments’ policies.
Read more
Narrative Development Mechanism
The progression fits a typical disinformation playbook:
- Neutral reporting - initial technical coverage of the disruption.
- Official confirmation - authorities label the incident sabotage.
- Alternative attribution - claims arise that actors other than Russia, notably Ukrainian intelligence, are to blame.
- Escalation - rhetoric intensifies, accusing Ukraine of a terrorist attack on Poland.
Activity by pro-Russian accounts on X and Telegram suggests at least coordinated efforts to inflame anti-Ukrainian sentiment, and possibly a pre-planned information operation.
Response and Recommendations
Polish security services continue to monitor the information space and cooperate with social-media platforms. False narratives are being flagged and countered, while public education campaigns aim to strengthen societal resilience.
The sabotage of Poland’s railway infrastructure once again shows how kinetic actions and information operations are intertwined. Rapid detection and neutralisation of hostile narratives, along with greater public awareness, remain crucial for the country’s information security.
