Are Ukrainian citizens responsible for most sabotage in Poland?

On one hand it is hard to claim that Ukrainians are the dominant perpetrators of attacks in Poland, given the scale of support provided to Ukraine at the state level (military equipment, loans, financial transfers, diplomatic backing) and, above all, at the civic level, where thousands of Polish people opened their homes, organised collections and provided refugees with essentials. On the other hand, the close Polish–Ukrainian relationship makes Ukrainians a natural target for foreign services, which also take advantage of rising anti-Ukrainian sentiment in Poland.

Russian hybrid activities against Poland and other NATO members are long-term and methodical. Their aim is not to provoke an immediate crisis but to systematically erode state stability and to probe resilience across every domain, from the information environment and cyberspace to critical infrastructure.

The deliberate exploitation of particular nationalities, notably Ukrainians, seeks to disrupt ties between Kyiv and Warsaw and to amplify anti-Ukrainian sentiment across the EU and beyond. At the same time, Russia seeks to mask its involvement by recruiting apparently inconspicuous operatives from outside the post-Soviet space, for example, individuals of Russian origin in Spain or citizens of Canada or Colombia.   

Agents who once formed long-term networks are now less frequently used; instead, so-called proxy agents or one-off recruits are increasingly common.

Those most vulnerable to recruitment by Russian services tend to originate from areas such as:

• territories occupied since 2014: Donbas (Donetsk and Luhansk oblasts) and Crimea;
• territories occupied since 2022 or frontline regions (Zaporizhzhia, Kherson and
• Dnipropetrovsk oblasts);
• areas of mixed cultural identity (Kharkiv, Mykolaiv, Odesa
• and Sumy oblasts).  

Factors influencing decisions to cooperate with Russian intelligence include:

• susceptibility to Russian narratives,
• possession of a Russian passport,
• offers of financial reward,
• promises of work abroad,
• blackmail,
• recruitment into local militias or other paramilitary structures,
• placement in filtration camps
• and the necessity to leave one's home.

Recruits are typically young men with prior military or paramilitary experience and, often, links to criminal environments.

Recruitment and subsequent communication mainly take place via social media and messaging apps (for example, Telegram, VK, the Russian social network, TikTok and others), using false profiles and online job adverts. Recruitment also occurs through organised-crime networks. Russia additionally recruits collaborators in Poland via video games; one of the objectives is to reduce the attacked country’s will to resist in the event of large-scale aggression. 

Perpetrators of hybrid attacks are most often paid in cryptocurrency, which permits cheap and rapid international transfers. Informal and unregulated over-the-counter (OTC) crypto exchange services are especially important to the process: they can move tens of millions of dollars quickly and operate almost openly, advertise on Instagram and often demand little or no identity verification or proof of source of funds.    

Fees for attacks vary with complexity: from a few dollars for graffiti to about $400 for installing a camera, and up to $10,000 for serious offences such as murder. Financial gain is the primary motivator in roughly 95% of recruitment cases in Poland.

Investigations by the security services, including findings shared by the Internal Security Agency (Agencja Bezpieczeństwa Wewnętrznego, ABW), indicate a shift in how foreign intelligene services, particularly Russian ones, operate: they now increasingly initiate and coordinate sabotage actions with a terror-like character. Their targets are frequently civilian facilities such as warehouses and large retail outlets. 

This approach allows Moscow to keep operational costs below the threshold of overt warfare. Perpetrators commonly come from former Soviet states, including Ukraine, Belarus and Russia, and are often connected to criminal networks. An analysis by the ICCT showed that 27% of perpetrators of Russian kinetic attacks had prior convictions or were involved in illegal activity, ranging from minor offences such as drug trafficking to organised-crime and, in some cases, violent crimes including assault and murder. That profile makes it much harder to identify the true sponsors of operations.   

Understanding that Russia will continue to recruit people in financial need, Kremlin-sympathisers, anti-Western elements and those with mental-health vulnerabilities is vital, because the scale and intensity of operations are growing while NATO responses remain ad-hoc, fragmented and not always united. A systemic and decisive approach is required.

Analysing cases of diversion, sabotage and espionage shows many arrested suspects are Ukrainian citizens recruited by Russian services or operating through intermediary networks. Russia pragmatically and persistently uses Ukrainian nationals, particularly young people, to advance its interests. 

The Ukrainian State Bureau of Investigation has registered roughly 1,500 criminal proceedings since 2022 for treason, involving officials, judges, military personnel and law-enforcement officers. If one adds arrests for collaboration with Russian services in diversion, espionage and sabotage, and the many perpetrators who were never identified or apprehended, the number of Ukrainians acting for the Kremlin runs into the thousands.

For years Russian services have recruited according to three repeatable profiles: criminals, heavily indebted people and young, malleable individuals. Motivation is almost always financial, rarely ideological. Operating within post-Soviet societies gives the Kremlin psychological and linguistic advantages that make recruitment simpler and more effective. It is also important to stress that holding a Ukrainian passport is not synonymous with loyalty to Kyiv;

 before the war more than 17% of Ukraine’s population were ethnic Russians. Citizenship is not the same as allegiance, just as Polish citizenship does not always equate to acting in Warsaw’s interests. This complexity is reflected in the observation that many of those detained in Poland holding Ukrainian passports were acting to the benefit of the Kremlin.      

A significant consequence of attacks carried out by people using Ukrainian passports is their corrosive effect on Polish-Ukrainian relations. In the Polish infosphere the immediate headline is often „a Ukrainian citizen carried out the sabotage”, and any nuance, that the person may only have used a Ukrainian passport or may have been unaware of the full nature of their actions as part of a larger, Russia-directed hybrid campaign, is lost.

From a national-security perspective, Poland’s initial policy after the outbreak of war in 2022, allowing virtually all arrivals to enter, often without meaningful checks, including many from Ukraine, has left gaps. As a result, Polish authorities now lack the tools to determine whether some individuals on Polish territory holding Ukrainian passports are actually Russian citizens, or whether they are wanted by the justice systems of those countries. The case of the so-called „camera guys” spy group exposed how insufficient verification procedures allowed many to be recruited in Ukraine and to enter Poland as refugees, while already collaborating with Russian intelligence. 

That response was driven by the need for immediate humanitarian action in the face of Russian aggression, but it also meant Poland lost control over some arrivals. At present state institutions do not have adequate means to verify whether a person is Russian but holds a Ukrainian passport. 

Public discourse therefore tends to focus on the nationality indicated on identity documents rather than on the true actors. While the responsibility of the Russian Federation must be emphasised, statistics and media reports that foreground particular nationalities will increasingly polarise societies already strained by historical disputes and will require urgent governmental and civil-society intervention. As long as arrests in Poland continue to disproportionately involve Ukrainian citizens and there is no coherent, coordinated communication from both capitals, resentment and misunderstanding will grow — precisely the conditions the Kremlin seeks to exploit.   

Russian services consistently pair operational activity with disinformation campaigns, using every incident to build alternative narratives. Following reports of a detained courier of Russian intelligence carrying TNT in canned sweetcorn, or after a suspected sabotage attempt in Katowice, claims of a „Ukrainian provocation” quickly circulated. This is a classic propaganda mechanism: a fragment of truth becomes the vehicle for a larger falsehood. The aim is not to persuade people of a single thesis but to sow doubt, erode trust in the state and shift blame from aggressor to victim.

Another important aspect of counterintelligence operations remains cooperation between the Polish and Ukrainian services. When analysing individual cases and the profiles of perpetrators, this cooperation appears to be limited. The Ukrainian side must be fully aware that the vast majority of military and logistical assistance for Ukraine is transited through Poland, which at the same time constitutes the eastern flank of NATO and the European Union. Relations between Warsaw and Kyiv are crucial for effective competition with Russia.

Polish services require strengthened and continuous contacts with their Ukrainian counterparts in order to identify and neutralise threats at the earliest possible stage. The exchange of information concerning Ukrainian citizens and individuals who may have links to Russian special services should take place regularly, on a broad scale and in a structured manner. Information remains one of the key resources of state security.      

Maintaining strong relations between Kyiv and Warsaw is essential from the perspective of both governments. Ukrainians must respond to the number of attacks carried out by their citizens; even if those individuals are merely holders of a Ukrainian passport, without any genuine sense of belonging to the Ukrainian nation.

Unfortunately, the Ukrainian authorities are doing too little, even at the rhetorical level, to demonstrate that they are committed to conducting joint efforts to counter hybrid attacks. Poland, too, should have a strong interest in deepening relations based on mutual understanding in order to continue fulfilling its primary logistical role in delivering assistance to Ukraine. 

At the same time, the planned launch of a logistical hub in Romania brings both significant benefits and potential consequences for Poland. On the one hand, diversification of supply routes for assistance to war-affected Ukraine increases the resilience of the entire support system, reduces the risk of disruption, sabotage and military-political pressure, and decreases the concentration of military transports on Polish territory, which directly enhances the state’s security. 

On the other hand, reducing Poland’s role as the main and indispensable transit hub may, in the long term, weaken its negotiating position vis-à-vis Ukraine by limiting the ability to use its logistical importance as an instrument of influence in political, economic or infrastructure disputes. As a result, although the diversification of logistical hubs is beneficial from the perspective of NATO and the stability of the system supporting Ukraine, for Warsaw it may require seeking other durable means of influence and strengthening its position. 

From Warsaw’s perspective, relations between Ukraine and Poland should be based on partnership and pragmatism. On issues crucial to Polish security – such as hybrid attacks – there is a clear need for greater assertiveness and for openly presenting Poland’s own interests. Proper communication by both the Ukrainian and Polish sides constitutes the foundation here.  

At present, within the Polish information space, whenever an act of sabotage occurs, claims immediately appear suggesting that the perpetrator must certainly be a Ukrainian citizen. This negatively affects relations between Kyiv and Warsaw. Therefore, joint communication and the strengthening of cooperation in the security dimension will be crucial for the security of both states. If this is lacking, polarisation and resentment will only grow, which the Russia will undoubtedly exploit.