Poland conducted as many counter-intelligence investigations in 2024 and 2025 as it had in the previous three decades, the Internal Security Agency (ABW) reported on May 6. The surge reflects an unprecedented wave of Russian hybrid attacks that began with cheap, deniable 'single-use agents' and has since evolved into complex sabotage cells. 'It's very cheap, offers a veneer of deniability, and the spread can be huge,' a Polish official told The New Yorker in February.
The ABW report, published this week, names Russia, its close ally Belarus, and China as the primary actors behind the espionage surge. The document marks the first comprehensive official accounting of a campaign that European law enforcement began noticing in 2022. Job offers started appearing in online chat groups, usually on Telegram, directed at Russian-speaking populations—Russians, Belarusians, and Ukrainians alike.
Polish intelligence services coined a term for these isolated recruits: jednorazowi agenci, or 'single-use agents.' They were amateurs. Unwitting or desperate people lured by cash to carry out small, deniable acts. Graffiti.
Poster campaigns. Minor arson. The shift came fast.
By 2024, the ABW noted a deliberate pivot toward more 'professional' networks. These new cells relied on 'closed structures' like those found in organized crime. The report cited a preference for individuals with law enforcement experience—former soldiers, police officers, or mercenaries from paramilitary organizations like the Wagner Group. 'Disposable spies are very useful for generating chaos, radicalising public opinion, strengthening intergroup antagonisms, distracting attention and testing the resilience of the state apparatus,' said Arkadiusz Nyzio, a Polish researcher and author of a separate report on Russia's use of middlemen to create chaos in Europe.
They also mapped the terrain for what came next. Nyzio described these agents as 'complementary cogs in a machine, not as replacements.' Their rapid neutralization, and the public's reaction, provided Moscow with a live diagnostic of Poland's defenses. 'The speed and way they were neutralised, as well as the public's reaction, provided valuable insights into the resilience of the state and society,' Nyzio said. The sabotage escalated in scale and consequence.
On May 12, 2024, a fire destroyed Marywilska 44, one of Warsaw's largest shopping centers. Nearly 1,200 boutiques burned. No one died, but the charred remains stood as a blackened monument for nearly two years before being razed.
Prime Minister Donald Tusk stated plainly on X that Poland knows 'for sure' that Russian special services ordered the arson. Last November, an explosion damaged a major Polish railway line. Tusk called it an 'act of sabotage.' A train driver noticed an issue with the track and warned others in time.
Mass casualties were averted by seconds and a single alert worker. The objective is not always physical destruction. 'If you say every day, 'Russia is attacking us,' then they don't really have to attack us anymore,' a European intelligence official told The New Yorker. The fear itself is the weapon.
The paranoia is the point. Behind the diplomatic language lies a specific political target. Nyzio warned that Russia, working with Belarus, hopes to influence Poland's upcoming parliamentary elections. 'There is a strong possibility that next year's elections will result in the formation of a far-right government, featuring prominent anti-Ukrainian and anti-European politicians who propagate every conceivable conspiracy theory,' he said.
Such a government, Nyzio argued, would represent a 'dream scenario for Russia'—a geopolitical realignment that abandons or significantly weakens Polish support for Ukraine. The tactical layering is deliberate. Different actors handle different tasks. 'While disposable spies spread anti-Ukrainian propaganda—like putting up posters with anti-Ukrainian or anti-NATO messages—the 'professionals' sabotage railway infrastructure and intelligence officers, operating under particularly deep cover, infiltrate state institutions,' Nyzio explained.
Settlers Force Palestinian Family to Exhume Father's Body in West Bank
The amateur poster campaign and the professional railway bomb are not separate threats. They are the same operation, running at different speeds. The economic toll extends beyond the immediate damage.
The Marywilska 44 fire alone wiped out the livelihoods of hundreds of small business owners, many of them Vietnamese immigrants who had built their lives around those 1,200 boutiques. The policy says one thing. The reality says another.
A fire in a shopping mall is not just a fire. It is a message to every immigrant entrepreneur that the state cannot protect their corner of the economy. What this actually means for your family.
The railway sabotage nearly killed commuters. The shopping mall fire displaced workers. The anti-Ukrainian posters on your street corner are not random vandalism—they are the visible edge of a campaign designed to make you distrust your neighbors.
The Polish government is now fighting a shadow war where the battlefield is public psychology. Both sides claim victory. Here are the numbers.
The ABW's counter-intelligence caseload over two years matched the total for the previous thirty years. That statistic cuts both ways. It demonstrates an aggressive and capable security response.
It also reveals the sheer volume of the assault. Russia is testing every seam in the Polish state simultaneously. Why It Matters: A successful Russian destabilization campaign in Poland would fracture the NATO eastern flank.
Poland serves as the primary logistics hub for Western military aid to Ukraine. A far-right, anti-Ukrainian government in Warsaw—the scenario Nyzio warns of—would sever that supply line and give Moscow its most significant strategic victory since the full-scale invasion began. The sabotage is not a sideshow.
It is the preparatory bombardment before a political offensive. - Poland's ABW handled as many spy cases in 2024-2025 as in the prior 30 years, driven by Russian, Belarusian, and Chinese operations. - Russia has shifted from amateur 'single-use agents' spreading propaganda to professional sabotage cells targeting infrastructure and public spaces. - The campaign aims to destabilize Poland ahead of parliamentary elections that could bring a far-right, anti-Ukraine government to power. - The sabotage serves a dual purpose: causing physical damage and generating public fear that erodes trust in the state. The next twelve months are the critical window. Poland's parliamentary elections will test whether Russia's hybrid campaign can translate chaos into political power.
It is a warning flare. The shift from disposable spies to professional cells means the attacks will likely grow more sophisticated, not less. Watch for further sabotage of energy infrastructure as winter approaches.
Watch for information operations targeting the election. The weaker, more internally conflicted Poland is, the better for Moscow. That objective has not changed.
Key Takeaways
— Poland's ABW handled as many spy cases in 2024-2025 as in the prior 30 years, driven by Russian, Belarusian, and Chinese operations.
— Russia has shifted from amateur 'single-use agents' spreading propaganda to professional sabotage cells targeting infrastructure and public spaces.
— The campaign aims to destabilize Poland ahead of parliamentary elections that could bring a far-right, anti-Ukraine government to power.
— The sabotage serves a dual purpose: causing physical damage and generating public fear that erodes trust in the state.
Source: The New Yorker / ABW report via France24
