Since 2014, a hybrid intelligence war has been unfolding between Poland and Russia without an official declaration of war. Following the 2014 crisis in Ukraine and the annexation of Crimea, tensions between Moscow and the West escalated, placing Poland—situated on NATO’s eastern flank—at the forefront of an intelligence confrontation. This conflict spans a wide spectrum, from traditional espionage operations to disinformation campaigns conducted through social media. Although relations between Warsaw and Moscow have formally remained within diplomatic boundaries, behind the scenes, agents, hackers, and propaganda apparatuses have been locked in a battle of influence. Russia’s intelligence interest in Poland grew notably after the Ukraine crisis.

As early as 2014, Poland uncovered and arrested a senior military officer who had been spying for Russia. The captured Polish lieutenant colonel (whose identity was not disclosed) was sentenced in 2016 to six years in prison for treason. The investigation revealed that he had leaked sensitive personnel lists from the Polish army to Russia’s military intelligence agency, the GRU, and provided information about soldiers with disciplinary issues. Tracked step by step by Polish counterintelligence for two years, the officer’s arrest became one of the first concrete proofs that Moscow was targeting the Polish army in its struggle for regional influence. Around the same period, a Warsaw-based lawyer with dual citizenship was also detained on suspicion of spying for the GRU. It was revealed that he had collected information about strategic projects such as the Swinoujscie LNG terminal, built to reduce Poland’s dependence on Russian gas. These arrests demonstrated how audacious Russia’s intelligence operations across Central and Eastern Europe had become after 2014.

In the following years, Poland faced numerous espionage cases of varying scale. Russia was not only attempting to infiltrate the military but was also working to establish networks within state institutions and civilian structures. For example, between 2017 and 2022, an archivist employed by the Warsaw City Hall was found to have abused his access to official documents by providing data to Russian agents that could be used to create fake identities. When the official was arrested in March 2022, it became clear that Russian intelligence had even penetrated historical population records to plant non-official cover agents in Poland. Polish security sources emphasized that it remained unclear how many Russian spies might have entered the country using forged Polish identities, describing this form of identity theft as invaluable to Moscow’s operations. Due to such incidents, Poland tightened its counter-espionage laws in 2023, increasing the maximum penalty for working on behalf of foreign intelligence services to life imprisonment. Warsaw was determined to establish strong legal and diplomatic deterrence on this front of the hybrid war.

The spy hunt also had a diplomatic dimension. Over the past decade, Polish authorities have repeatedly declared members of Russian diplomatic missions persona non grata. Notably, immediately after Moscow’s full-scale invasion of Ukraine in March 2022, Poland expelled 45 Russian diplomats on the grounds of “engaging in espionage activities.” The Internal Security Agency (ABW) announced that these individuals had been gathering intelligence under the cover of diplomatic status. Although the Russian ambassador denied the accusations, this mass expulsion—the largest since the Cold War—demonstrated Warsaw’s determination to dismantle Russia’s espionage network at its roots. At the same time, NATO and EU member states neighboring Poland took similar measures in solidarity. Poland had also joined Europe-wide responses by expelling Russian diplomats following the 2018 assassination attempt on Sergei Skripal in the UK and the 2021 Vrbětice ammunition depot sabotage crisis in the Czech Republic. These coordinated actions aimed to send Moscow a clear message: the price of espionage would be diplomatic isolation.

Russia’s actions toward Poland were not limited to covert agents; they also included a broad campaign of disinformation and cyberattacks. Beyond the traditional balance of military power, the Kremlin intensified information operations aimed at influencing public perception and undermining political stability within Polish society. From 2017 onward, security experts began uncovering a campaign known as “Ghostwriter.” This combined cyber and propaganda operation targeted media outlets in Poland and the Baltic states, hacking news websites to plant fabricated stories. For instance, in May 2020, attackers infiltrated several Polish news sites and published fake reports containing alleged statements from the U.S. Commander of European Forces. The fabricated article falsely claimed that the American general had insulted the Polish army. To lend credibility to the fake story, the hackers sent forged emails to other media organizations and public institutions in Poland, attempting to spread the disinformation further.

Similarly, in April 2020, the website of Poland’s War Studies University was hacked, and a fake open letter supposedly written by its rector was published. The letter, which called on Polish officers to “resist the American occupation,” was designed to discredit NATO’s Defender Europe exercise. Soon after, the fabricated content was circulated across pro-Russian websites and social media accounts—some even translated into English to reach an international audience. Although NATO acknowledged awareness of such disinformation attacks, it refrained from directly blaming Russia. Still, it was evident that the transatlantic alliance faced a systematic effort to damage its public image and erode trust among its member states.

During critical periods in Poland, Kremlin-origin information operations intensified. Before and during the 2020 presidential election, coordinated disinformation efforts linked to Russia and Belarus were detected. A report by the Stanford Internet Observatory revealed that the cyberattack and fake letter incident targeting Poland’s War Studies University two months before the election were part of a broader plan to interfere with the electoral process. Polish intelligence also exposed several online portals that, while posing as “independent news sites,” were in fact connected to Russian intelligence services. Fortunately, these campaigns failed to achieve their intended effect on the broader Polish public.

Nevertheless, Russia’s attempts to meddle in democratic processes set off alarm bells in Warsaw. Following the 2020 elections, the Polish government continued to warn against similar threats and strengthened its mechanisms for monitoring disinformation. By 2021, Russia’s hybrid tactics had expanded into a new front: the hacking and leaking of private correspondence belonging to senior Polish officials. In June 2021, Michał Dworczyk, the Head of the Chancellery of the Prime Minister, confirmed that his personal email account had been hacked and that some documents were leaked via Telegram. Dworczyk described the incident as “part of a broader disinformation campaign.” Indeed, the hackers had mixed authentic and falsified materials allegedly belonging to Dworczyk to construct a narrative suggesting that Poland was interfering in Belarus’s internal affairs.

Polish authorities assessed the attack as part of a hybrid warfare effort conducted by a neighboring country—implicitly pointing to Russia or Belarus. Around the same period, several other ministers and members of parliament were targeted in similar cyberattacks. Their social media accounts were hijacked and used to post inappropriate or anti-government content. For example, offensive fake posts appeared on a minister’s Facebook page, while false announcements were made from a lawmaker’s account. Although the perpetrators consistently remained unidentified, all signs pointed eastward—to the Moscow-Minsk axis. Following these incidents, the Russian ambassador admitted that relations with Poland had reached “their lowest point since World War II,” marking the beginning of a chilling new phase in bilateral ties.

Poland faced not only cyber and intelligence attacks but also hybrid threats along its physical borders. The migrant crisis that erupted in the summer of 2021 and escalated in the autumn along the Belarusian border was described by Warsaw as a “hybrid war orchestrated by Lukashenko and the Kremlin.” The Belarusian regime brought thousands of migrants from the Middle East and Africa and directed them toward the borders of Poland, Lithuania, and Latvia, creating an artificial humanitarian crisis. The goal was to destabilize these countries and sow division within the European Union. As images of crowds pushing against barbed wire fences on the Polish border circulated through international media, pro-Russian networks launched a propaganda campaign accusing Warsaw of mistreating migrants. Behind the scenes, however, it became evident that Belarus had deliberately organized the influx and that Russia had at least politically supported and encouraged the operation.

In fact, many of the migrants attempting to cross into Poland were found to have been flown directly to Minsk from Moscow. During this crisis, Poland simultaneously strengthened its border security through military measures—such as the construction of a wall and the declaration of a state of emergency—while also exposing, on international platforms, the tactic of using irregular migration as a weapon by Russia and Belarus. Western leaders, including the NATO Secretary General, condemned Belarus’s actions as a “hybrid attack weaponizing human beings.” In doing so, Poland demonstrated to the world that it was once again on the front line of a war fought through unconventional means.

When Russia launched its full-scale invasion of Ukraine in 2022, Poland’s strategic importance—and the level of threats it faced—increased exponentially. Due to its geographic position and political stance, Poland became the main logistical hub for military and humanitarian aid flowing from the West into Ukraine. The airport near Rzeszów became the key transit point for U.S. and NATO deliveries, while thousands of trucks and trains carrying supplies to the front passed through Polish territory. This role placed Poland squarely in Moscow’s crosshairs for intelligence and sabotage operations. The Polish government officially announced that, due to its support for Ukraine, the country had become a prime target for Russian and Belarusian agents. In the first months of the war, suspicious activity was detected around critical infrastructure: unauthorized drone flights near railways, arrests of suspicious individuals around military depots, and an uptick in reconnaissance activity on cyber networks.

In March 2023, a striking operation confirmed these fears. Poland’s Internal Security Agency (ABW) announced the dismantling of a large espionage and sabotage network operating on behalf of Russia. The 16-member cell, hiding within Poland, had been gathering intelligence and preparing operations primarily in areas near the Ukrainian border. The group had been observing and filming the airport and train stations in Rzeszów—the heart of NATO’s supply traffic—and tracking the routes of aid convoys heading to Ukraine. Evidence showed that the group had planned to sabotage ammunition and weapons transports by placing explosive devices on trains.

They had also engaged in acts of provocation such as spraying pro-Russian, anti-government slogans on walls and carrying out arson attacks against selected targets. Most of the arrested agents were Ukrainian citizens, with several Belarusians and only one Russian national among them. According to the Rzeczpospolita newspaper, Russian intelligence had recruited these Ukrainians in their home country and smuggled them into Poland using fake refugee identities. The cell’s coordination was overseen via Telegram by an FSB officer codenamed “Andriej,” who issued instructions in exchange for cryptocurrency payments. The court sentenced all detainees to prison for espionage and preparation for terrorist acts. Polish security services described the case as one of the largest espionage operations in the country’s history, emphasizing that the Kremlin had increasingly adopted the tactic of using third-country nationals as pawns in its covert operations.

As Poland entered 2024, it continued to face similar threats. In March 2024, an international joint operation revealed that Russia had been building extensive propaganda and influence networks across Europe. Coordinated by Poland’s Internal Security Agency (ABW) and Czech intelligence, simultaneous raids in Warsaw and Prague exposed a network of influence agents—funded by the Kremlin—that had even managed to penetrate the European Parliament. The investigation uncovered that an individual embedded within Polish political and media circles had been receiving instructions and funding from Russian intelligence to conduct disinformation campaigns aimed at undermining the EU’s support for Ukraine and weakening Poland’s international image. Using Russian funds, this agent organized propaganda activities designed to sow division within Polish society and delivered pro-Russian messages to decision-makers across Europe.

This development demonstrated that Moscow’s covert influence operations knew no geographical or institutional boundaries, extending their reach all the way to Brussels. By dismantling these networks, Poland and its allies are attempting to strike a blow against Russia’s strategy of establishing spheres of influence within Europe.

At the same time, in the tense atmosphere brought by the war, the volume and intensity of Russian disinformation targeting Poland reached unprecedented levels. Kremlin-affiliated media outlets and social media accounts were mobilized to sow fear and distrust in the minds of the Polish public. According to an analysis by the Warsaw-based think tank Warsaw Institute, since the invasion in February 2022, Russia’s propaganda against Poland has sharply increased along the lines of “fear, uncertainty, and emotional manipulation.”

This propaganda focuses on five main themes: the threat that Poland might be dragged into war, the alleged social crisis caused by Ukrainian refugees, the discrediting of the Ukrainian state, the economic and energy turmoil resulting from the war, and the revival of historical grievances. The goal in each case is to provoke panic, exhaustion, and division within Polish society. For example, Russian media constantly portrays Poland as “NATO’s forward outpost,” suggesting that by acting as Washington’s pawn, the country has made itself a target for Moscow. By distorting Poland’s support for Ukraine as an alleged “intention to wage war against Russia,” the Kremlin’s narrative tries to create the impression that the conflict could spill into Poland at any moment.

Another major line of propaganda targets Ukrainian refugees. Kremlin-linked trolls spread false claims portraying the presence of more than a million Ukrainians in Poland as a security threat. Baseless narratives such as “Ukrainians are taking Polish jobs, receiving more benefits than Poles, and increasing crime rates” circulate widely on social media. The aim is to stir public anger against those fleeing the war and to weaken the spirit of Polish-Ukrainian solidarity. Historical sensitivities are also exploited as part of Russia’s information warfare. The old wounds of the Volhynia massacre and former border disputes are frequently reopened. Russian narratives push conspiracy theories claiming that Poland has ambitions over Ukraine’s western territories and will eventually “seek to annex Lviv.” The aim is to sow distrust among Ukrainians toward Poland and to erode Poles’ confidence in their neighbor.

The topic of the energy crisis forms another front. Kremlin propaganda constantly warns that Poland’s decision to cut off Russian gas will “leave Poles freezing in winter” and cause shortages of fuel and coal. Every time the weather turns cold, pro-Russian news sites and online trolls spread messages such as, “This is the price Poles pay for defying Moscow.” Although the Polish government managed to cope by securing alternative energy sources, the purpose of this disinformation was to create fatigue among the public and to make people question Warsaw’s firm stance against the Kremlin.

A concrete example of Russian-origin fake news occurred in June 2022. Pro-Russian hacker groups linked to the Ghostwriter campaign spread false reports claiming that “Ukrainian refugees in Poland would be forcibly sent back to their country and deployed to the front lines.” In this operation, hackers forged a document allegedly signed by Ukraine’s Minister of Defense, falsely suggesting that Poland was cooperating with Kyiv to deport young male refugees for military service. The fake letters and documents were circulated on Telegram under aliases such as JokerDPR and Beregini; some were even published from the hijacked social media account of a former Polish politician. Soon after, Russian state media picked up these fabrications and presented them as real, aiming to undermine trust in Poland.

The Polish government immediately issued a statement clarifying that the allegations were entirely false and part of a Russian-linked disinformation attack. This incident clearly demonstrated how far Moscow was willing to go in its efforts to drive a wedge between Poland and Ukraine. While Poland pursued a transparent communication strategy to debunk such lies, it also intensified intelligence sharing with its allies to identify the perpetrators behind these operations. All these developments prove that, for Poland, the concept of security now extends far beyond traditional military threats. Positioned as NATO’s “forward outpost” on the eastern flank, Poland stands high on Russia’s list of targets. Moscow views Poland not merely as a hostile neighbor but also as a crucial link in the Atlantic Alliance and a vital logistical hub sustaining Ukraine. Therefore, intelligence operations against Poland are in fact part of Russia’s shadow war against NATO and Western unity.

On this front, Warsaw acts both as a defender and, at times, as an active responder capable of countering and neutralizing hostile moves. Indeed, Poland has shown that it is not only exposing espionage activities within its borders but also cooperating with neighboring countries to dismantle Russian networks abroad. The establishment of the Cyberspace Defense Forces and national centers for countering disinformation reflects Poland’s commitment to strengthening its resilience in this domain. Through media literacy campaigns and bans on Russian state channels, the country is working to immunize society against information pollution. It is not expected that Russia’s hybrid warfare tactics targeting Poland will cease in the near future.

On the contrary, as the war in Ukraine drags on and Poland’s strategic importance in Eastern Europe continues to grow, Moscow’s covert operations are likely to persist. In the post-2023 period, Polish intelligence anticipates that Russian services will closely monitor Poland’s electoral processes and NATO’s military buildup in the region. Officials have already issued warnings for 2024 and beyond about Russian attempts to recruit Polish collaborators via the darknet and to meddle in upcoming elections. Warsaw is also aware that domestic political polarization is being deliberately exploited by the Kremlin. In response to all these threats, Poland is pursuing a dual strategy: strengthening its internal intelligence capabilities while maintaining close coordination with NATO and EU allies. At recent NATO summits, Poland has been among the leading voices calling for a collective response to hybrid threats originating from Russia—and it has gained strong support from its partners.

In conclusion, the decade spanning from 2014 to 2024 has proven that Poland remains locked in an unending shadow struggle with Russia. Spies have been caught and expelled; cyberattacks have been repelled; propaganda campaigns have been exposed and countered. Throughout this period, Poland has not only worked to safeguard its own security but has also served as a forward outpost defending Europe’s eastern frontier. Owing to its historical experience, Warsaw has long maintained caution toward Moscow—and in the face of this new generation of threats, it has demonstrated remarkable adaptability and resilience. Yet the geopolitical realities remain unchanged: under Russia’s shadow, Poland stands on the front line of an ongoing intelligence war.