Drones over Poland: Google reveals the inside story of a Russian operation
Photo. Press Service of the President of the Russian Federation / Creative Commons Attribution 4.0
The most recent analysis by the Google Threat Intelligence Group (GTIG) points to specific actors that executed Russian information operations during the incident in which drones violated Polish airspace. The team’s findings reveal the mechanisms and speed with which pro-Russian information networks exploit current events to shape public opinion.
On 9th-10th September 2025, Polish airspace was violated by Russian drones; this was accompanied by a massive disinformation campaign, which we wrote about on CyberDefence24.
In its latest analysis published on the Google Cloud blog, the Google Threat Intelligence Group (GTIG) set out its findings, identifying specific actors that carried out particular information operations.
Many of those monitored by GTIG began promoting related narratives in the immediate aftermath of the incident. While this is not definitive proof of coordination between groups, it indicates that influence actors within the pro-Russian ecosystem have learned to react quickly to major geopolitical events.
Kombat Portal
One actor conducting information activities about the drone incident at that time was Kombat Portal (also known as the “Pravda Network”). Its activity has been described since at least 2024 as a network of domains that serve as amplifiers for content circulated within the pro-Russian ecosystem, focusing mainly on Russia’s invasion of Ukraine.
According to Google’s team, Kombat’s messaging during the violation of Polish airspace centered on undermining the credibility of the incident and attributing political motives to it. In one published article, it questioned whether the drones could have originated in Russia at all, arguing that their technical range would not have allowed them to reach Polish territory.
Another piece suggested that Polish and Baltic authorities had deliberately politicized the event, portraying it as a threat to NATO in order to scuttle possible negotiations between the U.S. and Russia over the war in Ukraine. The article also insinuated that the drone footage shown in Polish media was fake and that Russia in fact had no aggressive intentions toward Poland.
A further article cited alleged remarks by a Ukrainian military expert who supposedly suggested that the incident’s aim might have been to shift Europe’s attention away from Ukraine and toward its own defence, which could, the article argued, weaken support for Kyiv.
Doppelgänger
GTIG also identified activity by an actor called Doppelgänger, which created a network of inauthentic media outlets and news sites intended to influence audiences in Europe, the United States, and elsewhere. These sites often have a specific topical or regional profile and publish content in local languages.
GTIG noted at least two instances in which Polish-language and German-language sites belonging to the Doppelgänger network disseminated content about the drone incident.
An article in Polish published on the site Polski Kompas suggested that Poles do not support the government’s policy toward Ukraine because it burdens the budget and threatens the country’s security.
Meanwhile, a German-language article on Deutsche Intelligenz claimed that Europe’s reaction to the incident was exaggerated and intended to intimidate Europeans into accepting the possibility of conflict with Russia. The piece added that Russia had warned about the drones and NATO used this as a pretext to increase its military presence in the region, which allegedly threatened Russia’s security and could lead to war.
Niezależny Dziennik Polityczny (NDP)
Another actor identified in the GTIG analysis is Niezależny Dziennik Polityczny (NDP, Independent Political Daily), which focuses on Polish domestic and foreign politics. It is the main channel used by a long-running pro-Russian influence campaign of the same name, which GTIG designates as NDP.
NDP is known as an active promoter of anti-NATO disinformation and has recently become one of the key channels of pro-Russian propaganda in Poland concerning the war in Ukraine.
GTIG recorded an article published under the byline of a persona linked to NDP that portrayed Poland’s reaction to the incident as an expression of “war hysteria” intended to divert public attention from domestic problems.
The article also described NATO’s actions in the region as disproportionate and destabilizing. Additionally, NDP promoted content on its social channels suggesting that Poland had been warned about the drones in advance, that the authorities’ reaction was exaggerated, and that most Poles blame Ukraine, NATO, or their own government for the incident.
Objectives of the Disinformation Campaign
According to GTIG, the observed messaging around the incident with Russian drones in Polish airspace pursued many, often overlapping influence objectives consistent with historical patterns of pro-Russian information operations:
- Promoting a positive image of Russia — content focused on amplifying narratives that deny Russia's responsibility for the incident.
- Blaming NATO and the West, reframing events to serve Russia's strategic interests, including accusing Poland or NATO of fabricating a pretext to pursue their own political goals.
- Undermining public trust in the Polish government: messages intended to weaken public support for authorities by suggesting their actions, both regarding the incident and the broader conflict in Ukraine, harm the country's stability.
- Weakening international support for Ukraine — content aimed at eroding Polish public backing for the government's foreign policy toward Ukraine.
