From drone strikes to sabotage: Russia targets the rail corridor linking Ukraine and Poland

In collaboration with Cristian Vlas, ACLED Analyst for Europe.

After more than four years of Russia’s full-scale invasion, Ukraine’s railway has become a lifeline for the country. A source of resilience and connectivity throughout the war, Ukraine’s railway network is now under mounting pressure from increasingly precise and intensified Russian drone strikes. While not unprecedented, the new wave of Russian strikes on the Ukrainian railways managed to challenge the previous assumption that train travel in Ukraine was safe beyond the frontline regions and that Ukraine could rely on its main rail corridors to Poland to move essential supplies and exports. Across the border, Poland’s railway infrastructure has remained one of the areas of particular interest to the Russian security services. This is no coincidence. Poland is one of the most important transit countries for aid destined for Ukraine, and the railway links leading eastwards are used for both passenger traffic and the transport of military and humanitarian aid. From Russia’s perspective, disrupting this system could simultaneously hinder support for Ukraine, impose costs on Poland, and heighten the sense of threat among the public.

Inside Ukraine, Russia uses drones and missiles against locomotives, stations, and transport infrastructure to destroy the country’s supply routes and the safest way for civilians to travel, while inside Poland, a NATO state, it relies on reconnaissance, proxy recruitment, sabotage, and information operations. Different tools are used, but essentially the same objective is pursued—to disrupt Ukraine’s connectivity with Europe and increase the costs of supporting Kyiv. This is why attacks on Ukrainian railways and Russian sabotage operations in Poland should not be analysed separately. They are different parts of the same pressure campaign against the infrastructure connecting Ukraine with Europe.

Railways became part of the war

The Ukrainian railway infrastructure proved to be a backbone of the country’s resilience to the full-scale invasion in 2022. Its extensive and reliable network allowed the movement of civilians away from areas close to active fighting that were exposed to sustained long-range shelling, transporting them to safer regions of Ukraine and across the border into neighbouring countries offering temporary protection. Its extensive network was also one of the first pieces of civilian infrastructure that came under rather indirect Russian strikes, armed clashes, and Ukrainian retreat bombings in the initial days of the invasion.

Since 2022, Russia has developed a pattern of targeting trains and train stations in towns serving as railway hubs that are crucial for Ukraine in transporting military gear and troops as well as passenger trains in frontline regions. The deadliest Russian strikes occurred on 8 April 2022 at a train station packed with evacuating civilians in Kramatorsk, killing 61 civilians, at a train stop in Chaplyne on 24 August 2024, killing 25 civilians, and at the evacuation train and train station in Kherson city on 3 May 2023, killing 24 civilians. Frequent strikes also targeted railway hubs close to the front line, such as Balakliia, Lozova, and Slovyansk, but also targeted key cities of Odesa, Dnipro, and Zaporizhia. Railway junctions in Fastiv, Kozyatyn, and Smila, as well as Kovel, among others, were also hit by barrages of precise Russian drone and missile strikes during attempts to disrupt both passenger and cargo train movements across the country. Russia has also reportedly employed local Ukrainians and even Moldovan nationals (through social media channels) to conduct railway sabotage operations on Ukrainian railways with limited success. These attacks consisted mostly of attempted arson and destruction in over 40 instances aimed at relay cabinets and signalling equipment, but also rails and railway bridges in various regions of Ukraine. Hiring often unwitting, vulnerable civilians to carry out even minor sabotage on railways has enabled Russia to spread disruptions across a vast network without spending on expensive long-range weaponry, while relying heavily on plausible deniability, a tactic increasingly rolled out by Russia across wider Europe.

With each year of the war, attacks on Ukraine’s railway system have intensified, yet the system continues to function despite growing risk to railway workers, physical damage, and financial losses. According to Ukrzaliznytsia, Ukraine’s national railway company, Russian strikes damaged over 1500 railway facilities and killed at least 60 railway workers, with strikes accelerating sharply in 2026. However, the escalation is not only about the number of attacks. Their nature has also changed, with Russian forces increasingly targeting railway infrastructure and locomotives beyond the frontlines. Despite Ukraine’s proven ability to keep the system running under pressure, this change in the nature of attacks on railway networks, combined with attacks on road and sea logistics and infrastructure, matters. It leaves Ukraine with few safe, reliable alternatives for rerouting the movement of people, goods, and supplies.

In the weeks preceding the September 2026 strikes in the Volyn region, Russia used jet-powered drones to strike at least four passenger trains in the Sumy, Kharkiv, and Zaporizhia regions, killing one train attendant and two passengers and injuring over 18 others. The frequent and intensified strikes on trains leaving the city of Sumy forced the national railway company to introduce a bus replacement service for passengers. This makes it the third regional capital (after Kherson and Zaporizhia) without direct train service within government-controlled Ukraine. The continuation of strikes on passenger trains and key railway infrastructure in the Kharkiv, Mykolaiv, and Odesa regions underscores the prediction that attacks on railways are on another upward trajectory. This could lead to a possible record number of strikes since the start of the full-scale invasion and further disruption of passenger rail and dual-use logistics in the frontline regions, such as the Kharkiv or Mykolaiv regions. It could also affect the grain-exporting regions of Odesa, Kirovohrad, and Cherkasy.

Russia’s previous waves of strikes in late 2025 and early 2026 on railway depots and locomotives in northwestern and central Ukraine have not been fully effective at disabling Ukraine’s connectivity. The country’s energy and thermal infrastructure, especially in the city of Kyiv, took heavy hits, impacting millions of civilians during the particularly harsh winter. At the time, the Ukrainian military had relatively good air defence and a plentiful supply of interceptor missiles against cruise missiles, ballistic missiles, and swarms of drones. Now, due to a lack of US-made interceptor missiles and locally developed interceptor drones, Ukraine is straining to contain a new vector of risk coming from jet-powered drones as well as the increased number of ballistic missiles. And Russia currently has an advantage in the aerial war through its scaled-up production of ballistic missiles and jet-powered drones and chooses to use it extensively against a range of civilian targets sitting in dual-use infrastructure. Its reinforced aim is making railway and transport infrastructure, more generally, unsafe beyond the frontline regions and key industrial hubs. Whether Moscow can also threaten Ukraine’s links to its allies and commercial partners, such as Poland, remains to be seen. But, even symbolically, singular strikes near Ukraine’s western borders prove useful to Russia. Without diminishing the danger posed by the more recent Volyn region strikes, it must be noted that, along with the much-publicized Oreshnik missile strike on Lviv, events near Poland and in the territories of other Ukrainian-allied countries do affect threat perception among Western publics and governments. They can force governments and societies to shift attention and increase financial allocations to major air defence projects against Russia’s drone and missile targeting (whether accidental or intentional). Some governments may also consider pushing for an accelerated ceasefire in Ukraine without negotiations of the new security framework.

The pressure is moving west

The most recent strikes on railway infrastructure in the northwestern corridor to Poland may even further strain the few remaining alternatives for safe travel to Ukraine’s western borders. On the morning of 13 September, Russian jet-powered drones struck the locomotive of a Kyiv-Warsaw passenger train, a truck, and a gas station near a checkpoint in the Volyn region at the border with Poland. NATO and Poland condemned the strikes as reckless and reiterated their support for Kyiv and intentions to improve air defence to tackle further drone incursions at their border. While the strikes did not result in any injuries, their proximity to Poland and the possibly intended targeting of a diplomatic train make these events stand out. Coupled with strikes on railway stations in Lutsk and Kovel, two other locomotives in northwestern Ukraine, they point to an expanded Russian campaign on one of Ukraine’s main rail connections with its staunch supporter and economic partner, Poland. Subsequent strikes on the Yahodyn border crossing (28 September), gas stations in the northwest, a railway bridge, and a key pontoon crossing in the Dniester River estuary in the southwest suggest a broader effort to disrupt all modes of transportation to Ukraine’s western borders. The security of the rail corridor, however, is under severe strain from the constant threat of strikes from jet-powered Geran drones, remotely controlled by Russian pilots via mesh networks in Belarus.

For Ukraine, the renewed targeted strikes on railway infrastructure, including railway workers, locomotives, and passenger trains, present a new challenge after years of Russia’s strategy of degrading every layer of Ukrainian infrastructure. This aims to erode Ukraine’s will to fight and its ability to juggle with practical wartime logistics. Amid the continuous strikes on locomotives, the narrowing choice of wide-gauge (1520 mm) rolling stock and locomotives available in Ukraine presents another limiting factor to the operations of the Ukrainian railways. As more than 500 locomotives were reportedly damaged by Russian strikes since 2022, repairing and, more importantly, supplementing the number of locomotives will be a key logistical challenge in the near future. Ukraine’s diplomacy is already focused on requesting support from Kyiv’s allies for the repair and supplementation of wide-gauge locomotives. Unfortunately, very few countries that are sensitive to Ukraine’s pleas operate such fleets and are in a position to offer spare parts or locomotives. Ukraine’s efforts to switch to the standard European railway gauge on some sections do help reduce friction in its links with the rest of Europe and broaden its rolling stock options, but the solution cannot be replicated across its entire rail network, one of the largest in Europe. A decreasing and increasingly targeted workforce and continuous repair needs contribute to the ever-expanding burden on Ukraine’s railways.

Unless Ukraine is equipped with sufficient interceptor missile and drone capabilities, this trend of devastating Russian strikes on railways is likely to continue to endanger civilian travel across the country. As strikes spread to regions further from the front line, Ukraine’s logistics crisis will become a national issue, and incursions by straying drones will threaten neighbouring countries, including Poland, Romania, and Moldova. Strikes on road infrastructure and gas stations beyond the usual frontline regions will lead to even fewer alternatives for safe civilian movement and critical supply transport. All of these strikes should be viewed in the context of Russia’s campaign to destroy Ukraine’s transport infrastructure, isolate its people, and erode its economy, while also undermining the security of Ukraine’s neighbours through threats of drone incursions and clearly directed attempts of railway sabotage on key routes.

The Polish-Ukrainian border does not end this campaign; it changes its form. Russia can use missiles and drones against railway infrastructure inside Ukraine because it is already conducting an open war there. Using the same methods in Poland would mean a fundamentally different level of escalation against NATO. On the Polish side, the pressure therefore shifts towards reconnaissance, recruited proxies, sabotage, and information operations.

On the Polish side, the methods change

One of the best-documented examples of Russian interest in the Polish railways remains the case of the so-called “camera men”. Uncovered in 2023, the group comprised at least 30 people, and officers from the Internal Security Agency (ABW) arrested 16 of its members. Among them were citizens of Ukraine, Belarus, and Russia. According to the findings of the Polish authorities, the group was acting on behalf of the Russian intelligence services, carrying out reconnaissance, preparing acts of sabotage and subversion, and carrying out propaganda tasks.

Significantly, the group’s interest centred specifically on infrastructure related to the transport of aid to Ukraine. CCTV cameras were installed at Rzeszów-Jasionka Airport, the railway station in Rzeszów, and along selected railway lines used to transport military and humanitarian aid. A military unit in Przemyśl and a terminal at the Polish-Ukrainian border crossing at Malhowice–Niżankowice were also surveilled. According to the Internal Security Agency’s findings, the group was led from Russia by Mikhail Mirgorodsky, who was acting on behalf of the FSB.

It was not merely a matter of surveillance. The group’s activities included preparations to cause a disaster in land transport by derailing trains carrying weapons and humanitarian aid for Ukraine. It was already apparent at that time, therefore, that for the Russian security services, the railways in Poland were not merely a source of information on transport routes. They could also be a direct target for acts of sabotage.

This was confirmed by the events of November 2025. Two serious acts of sabotage took place on railway line No. 7 between Warsaw East and Dorohusk. On the evening of 15 November, near the Mika railway stop on railway line No. 7 (Warsaw East–Dorohusk), on track No. 1 (towards Dęblin), C4 explosive was planted and detonated beneath a passing freight train. By the early hours of the morning, at least four passenger and freight trains had passed through the scene of the incident. In the early hours of 16 November, the driver of the fifth train noticed a gap in the rail, but the train came to a halt with its second carriage positioned over the gap. Meanwhile, at around 8 pm, near the Gołąb passenger stop, 22 kilometres past Mika in the direction of Lublin, there was a theft of the overhead contact line, resulting in damage to a PKP Intercity train bound for Rzeszów. During an inspection of this section of the railway line carried out three hours after the incident, one kilometre past the Gołąb halt, railway staff found a metal sheet (cut open by passing trains) mounted on the rail of track No. 1, as well as a smartphone with a power bank attached to a component of the railway safety system. This incident was classified by the State Commission for the Investigation of Railway Accidents as “actions bearing the hallmarks of a terrorist act”. Both incidents were recorded by cameras left at the scene.

According to the National Public Prosecutor’s Office, the direct perpetrators were two Ukrainian nationals, Oleksandr K. and Yevhenii I., who have been charged with carrying out acts of sabotage of a terrorist nature on behalf of the intelligence services of the Russian Federation. Their actions posed a direct risk of derailment and a threat to the lives and health of many people. After carrying out the attacks, the suspects left Poland and travelled to Belarus.

Equally important are the findings regarding the preparation of these operations. In November 2025, Volodymyr B. was arrested; according to investigators, a few months earlier he had helped to reconnoitre the area where the attacks were planned. He was to have transported one of the subsequent perpetrators to the vicinity of Mika and Gołąb, enabling the selection of a location for planting the explosive, installing a camera, and placing a metal clamp on the rails. This shows that this was not a spontaneous act by individual perpetrators, but an operation preceded by reconnaissance and preparation.

The significance of railway line No. 7, Warsaw East–Dorohusk, itself must be emphasised. It forms part of a corridor running through eastern Poland towards the border with Ukraine and on to Kyiv. This is precisely why the Warsaw–Lublin–Chełm–Dorohusk route, and more broadly, the entire corridor from Warsaw to Kyiv, cannot be treated as a mere passenger service. It connects Poland with a country at war and remains a key part of the infrastructure enabling the continued transport of people and supplies to Ukraine.

In this context, it must be assumed that the Warsaw–Kyiv corridor will remain a target of Russian interest. Previous incidents already demonstrate the full sequence of actions: reconnaissance of the infrastructure, installation of surveillance equipment, recruitment of operatives, preparation of sabotage operations, and subsequent actual damage to the tracks and overhead lines. We are therefore not talking about a hypothetical scenario: Russian actions against the Polish railways have already been planned and carried out.

Equally important, Russia may exploit both the attack itself and its subsequent media fallout. Following the sabotage on the Polish railways in November 2025, narratives emerged in the Polish-language media attempting to shift the blame onto Ukraine and to use the nationality of the direct perpetrators to stoke Polish-Ukrainian tensions. The Ministry of Digital Affairs pointed out that, following confirmation of the sabotage, messages appeared implicating the Ukrainian side and discrediting the actions of the Polish security services.

Information chaos works in the Russians’ favour. In the afternoon of 16 November, a spokesperson for the Ministry of the Interior and Administration claimed that there were “no grounds” for allegations of third-party involvement, yet around a dozen hours later, Prime Minister Donald Tusk confirmed that the incident in Mika was an act of sabotage. According to an analysis carried out by the “Polityka w Sieci” profile on X (formerly Twitter), as many as 62 percent of comments cast doubt on the official version of events (not the fact of Russian involvement itself), which may have been the result of inconsistencies in government statements.

The protection of the Polish railway network must therefore go far beyond simply responding to damage to the tracks. Routes leading towards Ukraine, the largest transport hubs, and infrastructure directly related to the maintenance of rail services require particular scrutiny. In its report on the incidents near Gołąb, Poland’s State Commission for the Investigation of Railway Accidents (PKBWK) recommended that the infrastructure manager step up patrols, inspections, and other preventive measures (as of 18 September, the investigation into the incident in Mika is still ongoing). At the same time, it is essential to detect attempts to conduct reconnaissance, recruit operatives online, and prepare further acts of sabotage.

The cases described above show one campaign conducted under two different risk calculations. In Ukraine, Russia can act openly and accept attribution. In Poland, it needs distance, deniability and intermediaries. The methods are different, but the infrastructure being targeted belongs to the same transport system.

One corridor, several Russian tools

Whereas direct Russian drone strikes are unlikely in the near future to target railway infrastructure in NATO and EU countries, such as Poland, the risks arising from the destruction of transport infrastructure in Ukraine are relevant to the rest of Europe. Sabotage conducted by individuals remotely employed by Russia, incursions by Russian drones straying into NATO territory, and congestion on road routes are only some potential issues accumulating as Ukraine’s railways take the hit. Russia will seek vulnerabilities wherever exploiting them could hinder Poland’s support for Ukraine. The railways remain one such area. Experience to date shows that the threat to the Polish-Ukrainian rail corridor is not merely a forecast for the future; rather, we assess that the Kremlin will launch missile strikes right on the Polish border in Ukraine, whilst simultaneously seeking to carry out further acts of sabotage on Polish territory.

In a situation of hybrid warfare, responsibility for railway safety rests not only with the emergency services but also with infrastructure managers—primarily PKP Polskie Linie Kolejowe (PKP Polish Railway Lines). The State Commission for the Investigation of Railway Accidents has pointed out that access to the railway infrastructure was easy—internal roads run parallel to the tracks along the entire length of the Gołąb–Puławy Azoty section. A similar situation exists, for example, on the Central Railway Line between Idzikowice, Opoczno, and Budków; just as on Line 7, it is not fenced off in undeveloped areas, and the speed on this line is set to be increased to 250 km/h in the coming years.

At the same time, measures aimed at protecting railway infrastructure must be carried out sensibly. An assessment of the situation covering only the period “between 8 and 16 November”—that is, between infrastructure inspections—indicates the need to carry out railway line inspections more frequently than once a week, a point reflected in the PKBWK’s recommendations. The example should also come from the government: whilst a CHARLIE alert was in force, the Minister for Infrastructure’s decision to post photographs of the interior of the Sędziszów LHS signal box online in connection with its official opening, a mere three weeks after the sabotage incident near Dęblin, does not appear to be appropriate behaviour.

When it comes to Polish-Ukrainian relations, the greatest vulnerability regarding the railway infrastructure and attacks directed against it is the exploitation of Ukrainian citizens themselves by the Russian security services. A sufficient sum of money is not merely payment for positioning a surveillance camera along a key route, planting an explosive device, or attaching a steel clamp. An added bonus is the creation of evidence that Ukrainians are acting against Poland, and the diligent exploitation of this in Russian media coverage. It is irrelevant that, according to Deputy Prime Minister Krzysztof Gawkowski’s statement in April 2025, those being recruited are people living in Poland and not just citizens of the country—for propaganda and disinformation, what matters is the mere fact that Ukrainians are taking part in these activities.

A further problem is the Russian recruitment model itself. Moscow does not need trained intelligence officers on the ground if it can find people willing to carry out individual tasks for several hundred or several thousand euros. Photographing infrastructure, installing a camera, transporting another person, or leaving an object near railway tracks may initially appear to be relatively minor activities. Together, however, they can form part of a much larger operation. The priority should therefore be to disrupt recruitment before a recruited individual reaches the target.

Cases involving Ukrainian citizens recruited by Russian services also show that intelligence exchange between Warsaw and Kyiv needs to become faster and more systematic. Polish authorities need better access to information concerning Russian recruitment networks, suspicious contacts, and individuals who may already have attracted the attention of Ukrainian services. Ukraine has accumulated enormous experience in identifying these networks. If Russia is recruiting Ukrainian citizens to conduct sabotage in Poland, both countries have an interest in identifying them before they reach the target.

The railway cases show that Russia is operating on two levels simultaneously. It wants to disrupt the routes sustaining Ukraine, but it also wants every Ukrainian passport appearing in such an investigation to become a political problem between Warsaw and Kyiv. Poland, therefore, has to protect the railway network, disrupt recruitment before an operative reaches the target, and improve intelligence exchange with Ukraine. Otherwise, even an unsuccessful act of sabotage can still achieve one of Moscow’s objectives.

On a larger level, protecting railways will require not only Ukrainian air defence and Polish railway security but also integrated early warning incident mechanisms, solid intelligence exchange, joint disruption of Russian recruitment networks, quick attribution, and coordinated protection of transport infrastructure on both sides of the border. If the rail corridors between the two countries and the supporting transport and border infrastructure are viewed as one system, ensuring the security of both Ukraine and Poland will be crucial to limiting and preventing the potential impact and spillover effects of damaging strikes and unexpected sabotage.

Both countries need to understand that physical damage is only one Russian objective. Moscow also wants fear, disruption and Polish-Ukrainian tensions. Otherwise, even an unsuccessful act of sabotage can still achieve part of the Kremlin’s objective.

In collaboration with Cristian Vlas, ACLED Analyst for Europe.