Report: Poland, the main target of Russia's hybrid strategy in Europe

Russia does not need to wage open war to regularly and significantly attack Poland.

In recent years, we have witnessed a series of acts of sabotage, cyberattacks, subversion, intelligence operations, and information campaigns that are on the verge of armed conflict. This constitutes “Phase 0” of warfare and the constant testing of methods and tools within the framework of hybrid attacks.

Poland has long been a key target of Russian hybrid operations. This has been a pattern that predates Russia’s aggression against Georgia in 2008 and Ukraine in 2014. However, it is important to note that the frequency of these attacks has increased significantly since 2022, coinciding with Poland’s transformation into a major logistical hub for aid to Kiev. The inventory and scope of the means and methods used is extremely broad and represents a true hybrid of threats. Poland has effectively become a laboratory for hybrid warfare, with some experts arguing that the country is already experiencing “Phase 0” of the war.

Hybrid warfare is still warfare, waged by different means, but with the same objective: to paralyze decision-making processes, polarize society, test military responses, and continually expand the scope and intensity of attacks. The report Poland as a Target of Russian Hybrid Attacks is the first systematic compilation of incidents from 2020 to 2025. It shows that these are not isolated events, but rather a long-term strategy of the Kremlin aimed at testing the resilience of Poland, the eastern flank of NATO and the EU.

The study is based on interviews, primary sources, expert analysis, and a wide range of data and cases that have not previously been collected in a single public report. It seeks to answer questions that are increasingly prominent in the public debate: What actions is Russia taking? How many individuals have actually been convicted in Poland for activities related to sabotage or espionage? Is it true that most of the incidents involve foreigners, including Ukrainian citizens? Is Poland already in the first phase of conflict with Russia? How should international cooperation develop and how should the public be informed?

The purpose of this report is to present hybrid attacks against Poland carried out between 2020 and 2026, with a particular emphasis on their intensification after February 24, 2022. This escalation is directly related to Russia’s full-scale invasion of Ukraine and the emergence of Poland as a key logistical hub for Kiev’s support. Given the nature of the events and the timing of the publication, the report also includes several incidents that occurred in January and early March 2026.

Hybrid attacks have become one of the main instruments of competition between great powers in the 21st century. Actions carried out below the threshold of war, combining cyberattacks, information operations, intelligence activities and sabotage, enable the potential aggressor to achieve strategic objectives without resorting to open armed confrontation. The effectiveness of such operations stems not only from the difficulty of final attribution of responsibility, but also from the limited possibility of a proportional military response and the ability to exert gradual and cumulative pressure on society, the economy and state structures.

Poland has been listed for years among the main targets of Russian hybrid operations. However, after Russia’s full-scale aggression against Ukraine in 2022, both the scale and sophistication of these activities have increased significantly. The authors note that the official picture of the threat is incomplete, with many investigations not completed, partly due to a lack of personnel in the security services. Despite the great importance, the true scale of Russian operations is significantly higher than suggested by public statements.

The report provides a basis for development of a coherent national policy for combating hybrid threats and aims to serve as a reference point for further analysis, strategic decision-making and public debate.

To counter Russian narratives, a comprehensive strategy to respond to hybrid threats is required. The aforementioned strategy must be based on strong deterrence and offensive response. Equally important are a consistent information policy, strengthening military capabilities, greater efforts to protect civilians, and robust protection of critical infrastructure.

Poland is capable of counterattacking and elements of such operations have already begun.

The Geopost