Belarusian KGB recruits in Polish cities. From occupation leaflets to reconnaissance of military facilities

The first assignment appears relatively harmless. Recruits are instructed to print and distribute between 10 and 100 leaflets, receiving one euro for each. The materials feature the Polish national emblem and the Warsaw skyline, while their content concerns „rules of safe behaviour in the event of occupation”. Poles are advised, among other things, not to photograph military equipment, block roads or obstruct military convoys. Only after completing this test assignment are recruits offered opportunities to photograph specific facilities and undertake further tasks.

This is important (and particularly interesting) because the first stage does not necessarily have significant value in itself. However, it allows the recruiter to test the individual, obtain personal information, verify their willingness to follow instructions and gradually push the boundaries of subsequent assignments – in other words, towards more offensive activities.

Find out more about hybrid attacks in Poland: HERE

Payments are reportedly made through services such as Wise or direct transfers to payment cards, which also allows additional information to be collected about individuals agreeing to cooperate. This creates a risk that such information could subsequently be used to exert pressure or blackmail them. A single instance of cooperation with intelligence services can later be exploited in various ways. The person receiving the assignment or payment does not know who is on the other side.

Similar methods have already been used in Poland

In our report, Poland as a Target of Russian Hybrid Attacks, we highlighted that Russian and Belarusian intelligence services increasingly exploit individuals with no previous intelligence experience. Recruitment can begin with simple, well-paid assignments before progressing to infrastructure reconnaissance, intelligence gathering or sabotage. One particularly important example was the so-called „camera network” case, which also involved Belarusian citizens.

One of them was P. Uladzislau. Together with Maksym L., he participated in activities involving the installation of recording devices near Rzeszów-Jasionka Airport, Rzeszów railway station and railway lines used to transport military and humanitarian assistance to Ukraine. The group also conducted reconnaissance of ports, industrial facilities, a military unit in Przemyśl and the Malhowice-Nyzhankovychi border crossing. P. Uladzislau was sentenced to two years and ten months in prison.

Another case involved Daria Astapienka, a Belarusian citizen arrested in Poland in December 2023. According to investigators, she provided the Belarusian KGB with information about opposition groups operating in Poland, including their structures and financing. The information was subsequently used by the regime in Minsk to produce propaganda targeting the Belarusian opposition and Poland. She was sentenced to one year and eight months in prison.

In February 2026, Poland’s Internal Security Agency (ABW) arrested another Belarusian citizen, Pavlov T., suspected of working for Belarusian military intelligence. He allegedly conducted reconnaissance of critical infrastructure and locations important to the security of Poland and NATO, with his activities also extending to Germany and Lithuania. This demonstrates that the interests of Belarusian intelligence services are not limited to opposition communities, but also include critical infrastructure.

Another previously arrested individual was Arsenij T., a Belarusian citizen who, together with a Russian national, conducted reconnaissance of Polish military units. They collected information about the strength and equipment of the Polish Armed Forces and military activities along the border with Belarus, which was subsequently passed to Russian intelligence. In 2024, both men were sentenced to four years in prison for working for the GRU.

The latest offensive recruitment campaign must be treated very seriously. Recruiting Belarusians living in Poland gives intelligence services in Minsk the opportunity to exploit individuals who can move freely around the country, take photographs and initially remain outside the attention of security services. The first assignment may involve distributing a leaflet for one euro, but the next could involve photographing infrastructure, military transports or other facilities.

Polish security services must assume that Minsk will continue developing such activities beyond Belarusian territory. The KGB has a large pool of potential recruitment targets among Belarusian citizens residing in European Union countries, while Russia and Belarus have cooperated closely in security and intelligence matters for years.

It must also be emphasised that recruitment is taking place among Ukrainians, thousands of whom have left their country since 2022, and they too will remain targets for intelligence services. When Ukrainian citizens are recruited to carry out acts of sabotage, the consequences also include undermining Polish-Ukrainian relations. We must remember that Russia is deliberately exploiting this situation.

As has been emphasised repeatedly, the key is to identify recruitment at an early stage, before „other activities” carried out for a few dozen euros turn into acts of subversion and sabotage in which Polish citizens lose their lives. After all, the plan to blow up railway tracks – followed by an escape to Belarus – was designed to cause the greatest possible destruction (just as in the case of Marywilska Hall and many other incidents).

Vigilance and response. Today, threats can begin with an online bot…