Report: Poland as a target of Russian hybrid attacks

Poland has long been one of the primary targets of Russian hybrid operations. This has been a pattern that predates Russia’s aggression against Georgia in 2008 and Ukraine in 2014. It is important to stress, however, that the frequency of these attacks has increased dramatically since 2022, coinciding with Poland’s transformation into the main logistical hub for assistance to Kyiv. The inventory and scope of tools and methods employed is extremely broad and represents a genuine hybrid of threats. Poland has effectively become a laboratory for hybrid warfare, with some experts arguing that the country is already experiencing „Phase 0” of war.  

Hybrid warfare is still warfare, conducted by other means, but with the same objective: to paralyse decision-making processes, polarise society, test military responses, and continuously expand the scope and intensity of attacks. The report Poland as a Target of Russian Hybrid Attacks is the first systematic compilation of incidents from 2020 to 2025. It demonstrates that these are not isolated events, but rather a long-term Kremlin strategy aimed at testing the resilience of Poland, NATO’s and the EU’s eastern flank.

The study is based on interviews, primary sources, expert analyses, and a wide range of data and cases that had not previously been collated in a single public report. It seeks to answer questions that are increasingly prominent in public debate: What actions is Russia undertaking? How many individuals have actually been convicted in Poland for diversionary or espionage-related activities? Is it true that the majority of incidents involve foreigners, including Ukrainian citizens? Is Poland already in the first phase of conflict with Russia? How should international cooperation be developed, and how should the public be informed?

The purpose of the present report is to present hybrid attacks on Poland conducted between 2020 and 2026, with particular emphasis on their intensification after 24 February 2022. This escalation is directly linked to Russia’s full-scale invasion of Ukraine and Poland’s emergence as the principal logistical centre for support to Kyiv. Given the nature of the events and the timing of publication, the report also includes several incidents that occurred in January and early March 2026.

Hybrid attacks have become one of the principal instruments of great-power competition in the 21st century. Actions conducted below the threshold of war, combining cyberattacks, information operations, intelligence activities, and sabotage, enable the potential aggressor to achieve strategic objectives without resorting to open armed confrontation. Not only does the effectiveness of such operations stem from the difficulty of definitively attributing responsibility, but also from the limited scope for a proportionate military response and the ability to exert gradual, cumulative pressure on society, the economy, and state structures.

Poland has for years ranked among the key targets of Russian hybrid operations. However, following Russia’s full-scale aggression against Ukraine in 2022, both the scale and sophistication of these activities have grown sharply. The authors note that the official picture of the threat is incomplete, many investigations have not been brought to a conclusion, partly due to staffing shortages in the security services. Consequently, the true scale of Russian operations is significantly higher than suggested by public statements.

The report provides a foundation for the development of a coherent national policy on countering hybrid threats and aspires to serve as a reference point for further analysis, strategic decision-making, and public debate.

To counter Russian narratives, a comprehensive strategy for responding to hybrid threats is required. The said strategy shall be grounded in strong deterrence and offensive responses. Equally important are a consistent information policy, the strengthening of military capabilities, greater efforts to protect the civilian population, and the robust safeguarding of critical infrastructure. Poland is capable of counter-attacking, and elements of such operations have already begun.

FULL REPORT TO DOWNLOAD: