Poland’s security chiefs have warned for months that the country is entering a pre-war phase of hybrid pressure. The coordinated sabotage attacks on the Warsaw–Lublin line over the weekend show what that pressure looks like in practice.
Within 24 hours, two linked attacks hit the same strategic corridor to the Ukrainian border, combining explosive damage near Mika with a deliberate attempt to cripple and derail an Intercity train near Puławy.
JOIN US ON TELEGRAM
Follow our coverage of the war on the @Kyivpost_official.
By Monday, Prime Minister Donald Tusk said investigators had “confirmed beyond a doubt” that the first incident was caused by an explosive device, adding “we are dealing with an act of sabotage”, and that the events near Puławy formed a second stage of the same operation.
The attacks are an escalation of the grey-zone activity that has been building in Poland since the full-scale invasion of Ukraine.
Initial appraisals suggest that the intention of the attackers was to genuinely derail the trains. If there was a propaganda motive, it seems to be working, with early online research revealing many Poles believe Ukraine was behind the attacks. Some even believe Poland itself was responsible.
Escalation point
Investigators have now pieced together the early picture of what happened. In the first incident, they recovered sheared bolts, metal fragments and wiring consistent with a detonation device, along with a second explosive that failed to go off. A long electrical lead lay beside the break in the rail.
‘You Will Be Left to Suffer and Die’: Rutte Warns Young Russians Against Fighting in Ukraine
Forensic teams later confirmed that the two charges were designed to be triggered remotely. Polish radio station RMF24 reports that officers secured the SIM cards found in the devices, allowing them to identify the passport data used to register both cards with a Polish operator.
Further down the route, police and railway security found a metal bar bolted to the track and damage to the overhead lines caused by a deliberately thrown chain. Both scenes were treated as linked crime sites.
Prosecutors have opened proceedings for “acts of sabotage of a terrorist nature, directed against railway infrastructure and committed on behalf of a foreign intelligence service.”
PM Tusk announced in parliament on Tuesday that investigators are following up on two Ukrainians who collaborated with Russian intelligence and fled to Belarus.
Russian playbook
The attacks follow more than two years of Russian-linked grey-zone activity on Polish territory. The clearest example was the fire at the Marywilska 44 shopping complex in Warsaw, which the Internal Security Agency and prosecutors later tied to individuals acting on behalf of Russian services. The operation destroyed hundreds of small businesses, and it was immediately accompanied by an online campaign blaming Ukrainians.
Before that, Polish officers had broken up a “railway spies” network recruited to monitor sidings, rail junctions and movements towards the Ukrainian border. Arrests in 2023 and 2024 included citizens of Belarus, Ukraine, Georgia and several Latin American countries, all working for small payments and with only fragmentary knowledge of what they were contributing to.
Russian intelligence no longer relies on officers operating under diplomatic cover. Instead, it builds loose, expendable networks from people with no ideological commitment and limited financial means. Many are migrants, casual laborers or individuals with minor criminal backgrounds who can be contacted through messaging apps like Telegram and paid in cash or cryptocurrency.
Security specialist at the University of Wrocław Dr. Michał Piekarski says Russia is now investing in a dispersed sabotage model in which “the group is anonymous, interchangeable and resistant to infiltration, because it often does not know the full context of what it is doing.”
They are initially asked to perform simple tasks: place a package, observe a depot, disrupt a railway signal, or ignite a small fire. Most do not know who is tasking them or how their actions fit into a wider plan. This makes the system deniable, cheap and hard to infiltrate.
If one fails or is arrested, another can be found with minimal risk to the organizers.
Propaganda front
Polish experts note that after almost every physical grey-zone incident, Russian troll accounts become active within minutes. After a September drone incursion into Poland, false claims blaming Ukraine reached an estimated eight million people. The same narratives reappeared after the weekend railway attacks.
Paulina Piasecka, Director of the Terrorism Research Center at Civitas University, argues that Russia’s aim is to “sow terror, hit strategic links with Ukraine, and at the same time incite hostility against Ukrainians and set Poles against one another.”
The online reaction to the rail sabotage follows that script. Monitoring carried out by Data House Res Futura shows that 42% of online reactions suggested Ukraine was responsible for the sabotage and 19% even suggested Poland itself was behind it. These figures show how fertile the ground has become for narratives designed to erode social trust.
Some politicians from the far-right, Russia-friendly Confederation party echoed this framing by hinting at Ukrainian responsibility.
Russia does not need to persuade a majority. It only needs to plant doubt about the government’s credibility and about the logic of Poland’s support for Ukraine, and social media posts claiming that “the prime minister is known for lying, so he must be lying now” show how easily that doubt spreads.
Security gaps
The attacks exposed how difficult it is to defend a nationwide rail network against coordinated sabotage. Dr. Piekarski points out that the regulations governing critical infrastructure protection were written “20 years ago” for thieves, vandals and conventional terrorists, not for hybrid operations planned abroad and executed through dispersed intermediaries.
Poland’s rail system adds its own structural vulnerabilities. A senior general quoted by the Polish daily Rzeczpospolita notes that rail routes “are not protected along their entire length.”
Thousands of kilometers run through open countryside with limited fencing, no continuous monitoring and heavy reliance on periodic inspections and the vigilance of train crews.
Even so, Dr. Piekarski argues that the overall effectiveness of Polish services remains “quite high,” with several sabotage networks already disrupted and multiple arrests.
Politics under strain
The latest sabotage comes at a moment when Polish politics is at its most polarized in years. The conflict between Prime Minister Donald Tusk and President Karol Nawrocki has hardened into open friction, and a dispute over officer promotions in the special services is the latest front in the political war. Nawrocki’s refusal to sign the promotions of 136 intelligence and counterintelligence graduates has been read by senior commentators as weakening the very services now tasked with responding to foreign-directed sabotage.
The result is a country that looks more fragmented abroad. The tension between the government and the presidency makes Poland appear less predictable and less coordinated at a time when it needs to show steadiness to allies.
What comes next?
Security specialists argue that Poland is facing a long campaign. The likely next steps include tighter protection of railway and energy infrastructure, additional resources for counterintelligence, closer NATO and EU coordination on hybrid threats, and a more deliberate approach to communicating risks and responsibilities to the public.
You can also highlight the text and press Ctrl + Enter
