Targeting Poland: Russia escalates its shadow war below NATO’s threshold

Russia's hybrid warfare campaign against Poland has entered a perilous new phase marked by direct military involvement alongside covert subversion.

Russia’s hybrid warfare campaign against Poland has entered a perilous new phase marked by direct military involvement alongside covert subversion.

In the past two years, Moscow has intensified sabotage, espionage, cyberattacks and disinformation aimed at Poland, a frontline NATO state and key supporter of Ukraine.

The recent Russian drone strike on a Polish-owned factory in Barlinek stands out as a threshold-testing escalation carried out openly by Russian forces.

At the same time, Polish authorities are grappling with a spate of mysterious fires, espionage rings and digital onslaughts across the country.

This is no future risk. Poland is already the front line of Russia’s war. While much of the West still debates whether Russia’s aggression might spill into NATO territory, Moscow is systematically testing how far it can go below the threshold of open conflict with NATO.

The Barlinek attack and recent fires reveal a deliberate escalation aimed at destabilising Poland, probing NATO’s unity, and undermining confidence in Western deterrence.

Russia’s evolving hybrid toolkit is playing out in Poland through sabotage, espionage, cyberattacks and propaganda, while Polish institutions and NATO scramble to respond.

Behind this campaign lies Moscow’s strategic logic: to destabilise Poland, probe NATO’s limits, and push as far as possible without provoking an Article 5 military response.

Barlinek attack as escalation

The drone strike on the Barlinek factory in Vinnytsia on 16 July was a threshold-testing act of Russian aggression.

Five drones approached the Polish-owned wood flooring plant from three directions, striking a civilian facility that had no military function.

Polish Foreign Minister Radosław Sikorski condemned the attack as a deliberate escalation, warning that it marked a shift from covert sabotage to open targeting of Polish assets.

Ukrainian officials confirmed that 28 drones were launched on Vinnytsia that night, but the precision and pattern of the attack on Barlinek suggest it was no accident.

As Paulina Piasecka, director of terrorism research at Civitas University, noted speaking on TVP World, “I don’t really think that anything in military planning is a coincidence.”

Russian state propaganda immediately claimed that the factory was a foreign cover for arms production, a narrative designed for domestic consumption to justify the targeting of civilian infrastructure.

At the same time, Poland itself has faced a surge of suspicious fires at industrial and residential sites, including in Mińsk Mazowiecki, Ząbki near Warsaw, and Siemianowice Śląskie. These incidents follow the 2024 arson attack that destroyed Warsaw’s Marywilska shopping centre, a fire Polish authorities later attributed to Russian intelligence.

Interior Minister Tomasz Siemoniak said, “Every significant incident, fire or attempted arson is being assessed as a potential act of sabotage”

Poland as test case

Poland has emerged as Russia’s preferred pressure point in its hybrid war for clear strategic reasons.

As NATO’s largest frontline state and the logistical backbone of Western support to Ukraine, Poland is both indispensable to Kyiv’s war effort and uniquely exposed to asymmetric attack.

Poland’s geography makes it the key transit corridor for Western weapons and humanitarian aid flowing into Ukraine.

Since the start of Russia’s full-scale invasion in 2022, tens of thousands of trucks, convoys, and flights have passed through Polish territory. This role has only deepened over time, placing enormous strain on infrastructure near the Ukrainian border and at hubs like Rzeszów-Jasionka airport.

Russia’s information operations and propaganda outlets routinely frame Poland as the main Western enabler of Ukraine’s resistance. Moscow’s narrative paints Warsaw as a hostile power seeking confrontation, reflecting Poland’s uncompromising diplomatic and military support for Kyiv.

As Paulina Piasecka observes, “We are one of the countries of the region that are targeted most… because we are this transportation and logistics hub that serves as the way into Ukraine when it comes to sending in arms, weapons and support.”

This profile has made Poland the natural laboratory for Russia’s evolving hybrid toolkit.

The hybrid war toolkit

Russia’s campaign against Poland has become a masterclass in modern hybrid warfare. Moscow applies a range of tools designed to destabilise, intimidate and divide, all while operating below the threshold of open conflict.

In addition to headline-grabbing cases like the Marywilska shopping centre fire and recent factory blazes, Polish authorities have uncovered a broader pattern of covert attacks.

In 2024, a Russian-linked network was implicated in setting fire to a paint factory in Wrocław. The same year, investigators disrupted a plot to derail a train carrying military aid to Ukraine, with operatives installing surveillance cameras along rail routes near Rzeszów-Jasionka airport.

Cheap operatives, constant pressure

A key feature of Russia’s hybrid espionage campaign is its reliance on proxies. Many of those arrested for spying and sabotage inside Poland are not Russian nationals but Belarusians, Ukrainians, or even Poles.

This recruitment strategy gives Moscow plausible deniability and reduces its operational exposure.

Russian handlers exploit Telegram channels and dark web forums to identify and recruit petty operatives, often paying them just a few hundred euros to carry out missions such as photographing military facilities or tracking transport routes.

In late February 2025, a Ukrainian man was sentenced by a Polish court to eight years in prison for planning arson on Russia’s behalf. Recruited via Telegram, he was promised $4,000 to set fire to a paint factory in Wrocław. He sent his Russian handlers live video of the fire as proof of execution.

This tactic allows Russia, at minimal cost, to force Polish security services to devote significant resources to tracking and dismantling low-level networks.

Cyber attacks

Cyberattacks are another core component of the Kremlin’s toolkit. According to Digital Affairs Minister Krzysztof Gawkowski, cyberattacks against Poland more than doubled in 2025 compared to the previous year, targeting water and sewage systems, energy infrastructure, and government networks.

Recent incidents include cyber intrusions at POLSA (Poland’s space agency) and the anti-doping agency POLADA, where cyber saboteurs are suspected of aiming to “paralyse the country in the political, military, and economic spheres,” according to Gawkowski.

Fake news

At the same time, disinformation campaigns have sought to polarise public opinion on key issues like migration and Poland’s support for Ukraine.

Kremlin-backed outlets and troll farms have amplified anti-migrant narratives and false claims about NATO’s alleged plans to deploy nuclear weapons on Polish soil.

Together, these tactics represent a comprehensive hybrid playbook—calibrated to spread anxiety, weaken state resilience, and sow division without provoking an overt NATO response.

What Moscow is really testing

Russia’s hybrid offensive against Poland is a systematic proke-and-test strategy designed to expose and exploit vulnerabilities.

Each drone strike, act of sabotage, cyber intrusion and disinformation campaign serves a clear purpose: to test where Poland’s resilience cracks, how far NATO’s thresholds can be pushed, and whether EU unity holds under sustained pressure.

By targeting Polish-owned assets abroad, such as the Barlinek factory, and soft targets inside Poland, Moscow is observing Warsaw’s reaction.

Simultaneously, these attacks measure NATO’s cohesion and willingness to respond to aggression that remains below the threshold for invoking Article 5.

Paulina Piasecka has pointed to the attacks are designed to “weaken our ability in supporting Ukraine; and weaken political will of the citizens that feel targeted because of the help that we are lending to Ukraine.”

At the same time, Russian operations seek to exploit political tensions inside the EU, including migration disputes and disagreements over burden-sharing for Ukraine’s defence.

Why NATO is unprepared

NATO was built to deter and respond to overt military aggression that clearly triggers Article 5, the alliance’s collective defence clause.

But Russia’s hybrid warfare operates deliberately in the “grey zone”, using deniable proxies, sabotage, espionage, cyberattacks and disinformation to create disruption without crossing into overt conflict.

NATO has long acknowledged the hybrid threat, saying, for example, last year that “[t]hese occurrences are part of an escalating campaign throughout the Euro-Atlantic region, including on alliance territory and through proxies.”

Yet, there is still no unified doctrine for countering it. The problem is compounded by diverging threat perceptions within NATO itself.

While countries like Poland and the Baltic states view Russia’s hybrid activities as existential, others, such as France and Germany, still see them as peripheral security issues.

The concept of a “cumulative threshold”, that a sustained series of hybrid attacks could, in aggregate, amount to an armed attack triggering Article 5, has been floated within NATO but remains largely theoretical.

Poland’s resilience

Poland has responded to Russia’s escalating hybrid campaign with aggressive counter-intelligence measures and diplomatic retaliation.

ABW has dismantled spy rings tasked with sabotaging military logistics and targeting critical infrastructure. After confirming Russian involvement in the 2024 Marywilska shopping centre arson, Warsaw expelled Russian diplomats and ordered the closure of Russia’s consulate in Kraków.

At the same time, Poland is investing heavily in resilience. Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski announced nearly PLN 10 billion in funding to strengthen cybersecurity and protect critical infrastructure, saying: “This year alone, we have already recorded over 80,000 incidents, a 100% increase compared to 2023.”

He also warned: “There is no other country in the European Union that faces similar threats… an unprecedented attempt to interfere… spreading disinformation in combination with hybrid attacks on Polish critical infrastructure.”

But vulnerabilities remain. Soft targets such as municipal facilities and privately owned industrial plants remain exposed.

Disinformation campaigns continue to exploit deep political polarisation, particularly regarding migration and the EU.

Poland is holding the line, but this shadow war is intensifying. What Moscow is testing is not just Poland’s resilience but the readiness of NATO and the EU to confront a sustained, calibrated campaign that deliberately stays below the threshold.

A version of this article first appeared at TVP World.

Poland and Central and Eastern Europe are now at the heart of European politics. As the continent’s centre of gravity shifts eastward, understanding this region is key to understanding Europe itself.

Poland Watch is your guide. With in-depth analysis, sharp insight, and clear explanations, I help readers make sense of the strategies, tensions, and turning points shaping Poland and its neighbours today.

Subscribe for regular coverage of the region’s political shifts, power plays, and emerging trends.