In late August 2023, Polish authorities revealed that Russian intelligence targeted Poland with hybrid attacks including railway sabotage and espionage involving recruited locals, some Ukrainian refugees.

Intelligence & EspionageHuman Intelligence (HUMINT)Recruitment of locals

Aggressor

Summary

At the end of August 2023, Polish railway traffic near Stettin was disrupted after an unknown party broadcasted a Russian victory chant and national anthem via a shortwave radio signal, triggering an emergency remote stop that halted over 20 trains and suspended regional freight transport. Polish domestic intelligence (ABW) investigated, and shortly thereafter, two men were arrested near Bialystok, one being a Polish police officer, suspected of sending the stop signal. Poland, leveraging its role supporting Ukraine militarily and as a transit hub for weapons, has been increasingly targeted by Russian espionage and sabotage. Since March 2023, Polish authorities dismantled a spy ring accused of spying for Russia and involvement in a criminal organization, with 16 people arrested by late August. Many suspects are foreign nationals, including Ukrainian refugees recruited for money rather than trained agents, with replacement recruitment ongoing as arrests occur. Polish officials, including State Secretary Zbigniew Hoffmann, stressed that these hybrid attacks come from the Kremlin and Belarus, encompassing diverse tactics like cyberattacks and border provocations, aimed at destabilizing Poland. Notably, in Rzeszow, a key transit hub to Ukraine, contamination of drinking water by legionella bacteria caused 18 deaths under suspicious circumstances, prompting secret service investigations into possible deliberate poisoning. The overall security situation in Poland reflects ongoing, multi-domain hybrid threats attributed to Russian and Belarusian actors to create destabilization and chaos.

Classification

Confidence: High

The article specifically describes a discrete hybrid attack effort attributed to Russian intelligence targeting Poland involving espionage, sabotage of rail traffic, and recruitment of locals, with named actors and concrete events including arrests and investigation.

Source URL

https://tagesschau.de/ausland/polen-russische-geheimdienste-100.html

Open source

Provenance

Publisher: extension
Submitted: Apr 28, 2026, 13:45 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Aug 31, 2023, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "c9206604-3752-4608-bc41-269dfc760058",
  "url": "https://tagesschau.de/ausland/polen-russische-geheimdienste-100.html",
  "source": "extension",
  "status": "approved",
  "category": "Intelligence & Espionage",
  "subcategory": "Human Intelligence (HUMINT)",
  "incident_type": "Recruitment of locals",
  "country": "Poland",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Poland",
    "Russia",
    "espionage",
    "railway sabotage",
    "hybrid warfare",
    "russian intelligence operations",
    "Ukrainian refugees",
    "ABW",
    "cyberattacks",
    "Wagner Group",
    "water contamination",
    "Rzeszow"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [
    "Poland"
  ],
  "where_text": "Land",
  "headline": null,
  "description": "In late August 2023, unknown agents used a shortwave radio to broadcast the Russian anthem near Stettin, Poland, triggering a remote emergency stop that suspended over 20 trains and freight traffic. Polish domestic intelligence (ABW) investigated and arrested two men near Bialystok, one a police officer, suspected of sending the signal. Poland's role as a transit hub for Ukraine has brought it into the spotlight of Russian intelligence operations, with ongoing arrests of a spy ring composed mostly of foreign nationals including Ukrainian refugees recruited as informants. Officials warn of permanent hybrid aggression from Russia and Belarus, combining cyberattacks, border threats, and espionage to destabilize Poland. Separately, a water contamination in Rzeszow caused 18 deaths and remains under secret service investigation, possibly an attack.",
  "summary_short": "In late August 2023, Polish authorities revealed that Russian intelligence targeted Poland with hybrid attacks including railway sabotage and espionage involving recruited locals, some Ukrainian refugees.",
  "summary_extended": "At the end of August 2023, Polish railway traffic near Stettin was disrupted after an unknown party broadcasted a Russian victory chant and national anthem via a shortwave radio signal, triggering an emergency remote stop that halted over 20 trains and suspended regional freight transport. Polish domestic intelligence (ABW) investigated, and shortly thereafter, two men were arrested near Bialystok, one being a Polish police officer, suspected of sending the stop signal. Poland, leveraging its role supporting Ukraine militarily and as a transit hub for weapons, has been increasingly targeted by Russian espionage and sabotage. Since March 2023, Polish authorities dismantled a spy ring accused of spying for Russia and involvement in a criminal organization, with 16 people arrested by late August. Many suspects are foreign nationals, including Ukrainian refugees recruited for money rather than trained agents, with replacement recruitment ongoing as arrests occur. Polish officials, including State Secretary Zbigniew Hoffmann, stressed that these hybrid attacks come from the Kremlin and Belarus, encompassing diverse tactics like cyberattacks and border provocations, aimed at destabilizing Poland. Notably, in Rzeszow, a key transit hub to Ukraine, contamination of drinking water by legionella bacteria caused 18 deaths under suspicious circumstances, prompting secret service investigations into possible deliberate poisoning. The overall security situation in Poland reflects ongoing, multi-domain hybrid threats attributed to Russian and Belarusian actors to create destabilization and chaos.",
  "actor_primary": "Russian intelligence",
  "target_primary": null,
  "location_text": "Near Stettin and Bialystok, Poland",
  "location_region": null,
  "location_coordinates_lat": 53.4285,
  "location_coordinates_lon": 14.5528,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article specifically describes a discrete hybrid attack effort attributed to Russian intelligence targeting Poland involving espionage, sabotage of rail traffic, and recruitment of locals, with named actors and concrete events including arrests and investigation.",
  "event_time_utc": "2023-08-31T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T13:45:01.451Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighIndependence confirmedTime: Same dayLocation: Approximate

Source reliability

Info credibility

Event time

Aug 31, 2023, 00:00 UTC

Event time confidence

pm24h

Location

Near Stettin and Bialystok, Poland

Primary actor

Russian intelligence

Country

Poland

Countries

Poland

Tags

Poland, Russia, espionage, railway sabotage, hybrid warfare, russian intelligence operations, Ukrainian refugees, ABW, cyberattacks, Wagner Group, water contamination, Rzeszow

Nodes

Node 1: Borders, Node 2: 5th Column

Loading signal...

{ "id": "c9206604-3752-4608-bc41-269dfc760058", "url": "https://tagesschau.de/ausland/polen-russische-geheimdienste-100.html", "source": "extension", "status": "approved", "category": "Intelligence & Espionage", "subcategory": "Human Intelligence (HUMINT)", "incident_type": "Recruitment of locals", "country": "Poland", "source_reliability": "B", "info_credibility": "3", "tags": [ "Poland", "Russia", "espionage", "railway sabotage", "hybrid warfare", "russian intelligence operations", "Ukrainian refugees", "ABW", "cyberattacks", "Wagner Group", "water contamination", "Rzeszow" ], "nodes": [ "Node 1: Borders", "Node 2: 5th Column" ], "countries": [ "Poland" ], "where_text": "Land", "headline": null, "description": "In late August 2023, unknown agents used a shortwave radio to broadcast the Russian anthem near Stettin, Poland, triggering a remote emergency stop that suspended over 20 trains and freight traffic. Polish domestic intelligence (ABW) investigated and arrested two men near Bialystok, one a police officer, suspected of sending the signal. Poland's role as a transit hub for Ukraine has brought it into the spotlight of Russian intelligence operations, with ongoing arrests of a spy ring composed mostly of foreign nationals including Ukrainian refugees recruited as informants. Officials warn of permanent hybrid aggression from Russia and Belarus, combining cyberattacks, border threats, and espionage to destabilize Poland. Separately, a water contamination in Rzeszow caused 18 deaths and remains under secret service investigation, possibly an attack.", "summary_short": "In late August 2023, Polish authorities revealed that Russian intelligence targeted Poland with hybrid attacks including railway sabotage and espionage involving recruited locals, some Ukrainian refugees.", "summary_extended": "At the end of August 2023, Polish railway traffic near Stettin was disrupted after an unknown party broadcasted a Russian victory chant and national anthem via a shortwave radio signal, triggering an emergency remote stop that halted over 20 trains and suspended regional freight transport. Polish domestic intelligence (ABW) investigated, and shortly thereafter, two men were arrested near Bialystok, one being a Polish police officer, suspected of sending the stop signal. Poland, leveraging its role supporting Ukraine militarily and as a transit hub for weapons, has been increasingly targeted by Russian espionage and sabotage. Since March 2023, Polish authorities dismantled a spy ring accused of spying for Russia and involvement in a criminal organization, with 16 people arrested by late August. Many suspects are foreign nationals, including Ukrainian refugees recruited for money rather than trained agents, with replacement recruitment ongoing as arrests occur. Polish officials, including State Secretary Zbigniew Hoffmann, stressed that these hybrid attacks come from the Kremlin and Belarus, encompassing diverse tactics like cyberattacks and border provocations, aimed at destabilizing Poland. Notably, in Rzeszow, a key transit hub to Ukraine, contamination of drinking water by legionella bacteria caused 18 deaths under suspicious circumstances, prompting secret service investigations into possible deliberate poisoning. The overall security situation in Poland reflects ongoing, multi-domain hybrid threats attributed to Russian and Belarusian actors to create destabilization and chaos.", "actor_primary": "Russian intelligence", "target_primary": null, "location_text": "Near Stettin and Bialystok, Poland", "location_region": null, "location_coordinates_lat": 53.4285, "location_coordinates_lon": 14.5528, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article specifically describes a discrete hybrid attack effort attributed to Russian intelligence targeting Poland involving espionage, sabotage of rail traffic, and recruitment of locals, with named actors and concrete events including arrests and investigation.", "event_time_utc": "2023-08-31T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-04-28T13:45:01.451Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }