By Olha Hembik | 2025-11-21

WARSAW -- A pair of Ukrainian citizens didn't draw much attention as they moved through Polish cities -- until investigators discovered the devices they had hidden, the photos they had sent and the stream of intelligence flowing back to their Russian handler. What looked like ordinary life, authorities said, was a two-year espionage operation unfolding in plain sight.

On October 27, Poland's Internal Security Agency said it had arrested a 32-year-old man and a 34-year-old woman who allegedly gathered information on Polish military personnel and critical infrastructure "for a foreign intelligence organization."

Officials said the pair installed covert surveillance devices and showed particular interest in transport corridors that support Ukraine's military and logistics needs, according to evidence collected by the Military Counterintelligence Service.

The two were detained in Katowice, where officers seized their communication equipment. A court has ordered them held for three months as a preventive measure during the investigation.

Jacek Dobrzyński, spokesman for the minister overseeing Poland's intelligence services, said the arrests are part of a broader pattern. In recent months, Internal Security Agency officers have detained 55 people suspected of operating on behalf of Russian intelligence.

Polska Agencja Prasowa reported that every detainee acted under orders from Moscow.

Intimidating Europe

Poland’s Internal Security Agency says its latest operation uncovered three saboteurs who "created... a route for transporting explosives."

Agents arrested 21-year-old Ukrainian Danylo H. on October 16 after determining he had conducted espionage in Poland and Romania. Romanian authorities later detained two other Ukrainians linked to him.

Investigators say the group, acting on orders from Russian intelligence, assembled packages containing "incendiary devices and chemical substances capable of causing a fire or explosion" and shipped them toward Ukraine, intending for the devices to detonate in transit.

Romanian intelligence services intercepted the packages before they could reach their destination.

The operation was designed to intimidate the public and destabilize European Union countries that back Ukraine, European intelligence officials said.

Sergei Zhukov, an analyst with the Center for Strategic Communications and Information Security, said the tactics amount to blackmail meant to dissuade Europeans from "get[ting] involved with Russia."

"This is part of an operation whose logical conclusion is supposed to be: don't touch Russia, since our own government can't protect us," Zhukov told Kontur.

A form of terrorism

Tomasz Siemoniak, Poland's minister coordinating intelligence agencies, told TVN24 in October that sending explosive packages to Ukraine through Poland and Romania was "one of the most serious issues."

He said investigators consider the suspects "saboteurs" who use arson attempts, incitement and explosives, and noted that because "a foreign state is behind" the acts, he views them as a form of terrorism.

Siemoniak said a similar attempt occurred last year, when packages prepared by criminals tied to Russian intelligence exploded in Germany, Poland and Britain.

On October 9, authorities indicted Russian citizens Igor R. and his wife, Irina R., for transporting and receiving a package of explosive materials.

Investigators said it contained "hidden Soviet-made military-style electric detonators, initiating devices," nitroglycol, a metal thermos with a shaped charge and aluminum powder -- components for a shaped-charge bomb capable of "piercing sensitive fuel tanks, building ceilings, strong steel structures."

Siemoniak said Russian services have resumed "very intensive and dangerous activity" after a brief lull.

Jerzy Rejt, former chairman of the Polish Union of Ukrainians, said the Kremlin has worked to destabilize Poland since the start of the full-scale invasion because Warsaw strongly supports Kyiv.

He said Moscow seeks a network of operatives in Poland "not only to spread disinformation, but also to conduct espionage."

"The situation won't change in the near future. The Kremlin's resources will be directed at Poland, and people working for Russia will also destabilize Poland," Rejt told Kontur.

Disposable agents

Siemoniak described the people recruited by Russian intelligence for sabotage as "greedy disposable agents." He said they take on assignments for relatively small sums and added that "no Russian services will extract them."

On Polsat News, he addressed the arrests of Ukrainians accused of spying for Russia, saying the "sad truth" is that Russian operatives "most often… recruit Ukrainian citizens." He urged viewers "not to fall for the deceit" of Russian intelligence.

He said Moscow targets a mix of people -- some with criminal backgrounds, others simply seeking quick money -- and noted that "ordinary citizens whom no one suspected of anything" have also been drawn in. Recruitment typically happens through online messages.

Siemoniak added that Russian services "are killing two birds with one stone" by both organizing sabotage and stoking divisions between Poles and Ukrainians.

Political scientist Mykola Davydiuk said the tactic fits a long-standing pattern of Russian intelligence pitting ethnic groups against each other.

"By doing this, they help form the opinion among locals that Ukrainians are always saboteurs. And then suddenly this allegation is being spread in Poland," he told Kontur.

Siemoniak said the Polish Foreign Ministry is weighing "various options for responding" to Russian sabotage. He noted that Poland previously closed Russian consulates in Poznan and Krakow and said "undoubtedly, there will be some kind of response."