Foreign intelligence services highly active in Poland, ABW report reveals

Summary

Poland's ABW reports heightened foreign espionage activity in 2024–2025 from Russian, Belarusian, and Chinese intelligence services, including sabotage and cyberattacks.

The Internal Security Agency (ABW) of Poland released a public report covering 2024-2025 revealing intensified foreign intelligence operations on Polish soil. Russian intelligence, cooperating closely with Belarusian services, reportedly conducts large-scale espionage with tactics resembling special forces operations, including reconnaissance and sabotage potentially causing casualties, aiming at both military targets and critical civilian infrastructure. Russian espionage increasingly employs one-time low-cost agents recruited via Telegram and paid in cryptocurrency. Belarusian intelligence focuses on mass recruitment and coercion within Belarus and attempts to infiltrate Poland. Meanwhile, Chinese intelligence builds influence campaigns, especially among the Chinese diaspora, and cooperates with Russian actors in cyber and informational warfare. Notably, Russian and Belarusian threat actors deploy advanced persistent threat cyber groups (APT28, APT29, UNC1151) targeting Poland’s critical infrastructure and data systems. ABW conducted 69 espionage investigations in two years, with a sharp increase in 2025, and identified 91 suspected spies, charging 82 with criminal offenses under Polish law. Additionally, ABW highlights the rising radicalization of youth and isolated cases of jihadi-inspired terrorism linked to forced migration from Belarus. Arrests include teenagers planning bomb attacks inspired by ISIS. These developments indicate a broad hybrid warfare campaign against Poland involving kinetic, cyber, informational, and human intelligence threats, posing significant security challenges for national stability.

Evidence

“Years 2024–2025 were characterized by intensified activity primarily of Russian and closely cooperating Belarusian special services, as well as Chinese services.” – ABW report.
“Russian intelligence increasingly uses methods typical of special forces, including reconnaissance and sabotage.”
"Russian special services escalated their activities, accepting the occurrence of fatalities."
“Belarusian services conduct mass recruitment within their own territory and attempt to move agents to Poland, applying blackmail and direct coercion.”
“Chinese intelligence is active in Poland, aiming mainly at the Chinese diaspora whose members are used for intelligence operations.”
“The most active cyber groups are Russian APT28 (Fancy Bear), APT29 (Midnight Blizzard), and Belarusian UNC1151.”
“In the past two years, ABW handled 69 espionage cases, with 48 initiated in 2025 — equal to all cases initiated from 1991 to 2023 combined.”
“As of today, 91 persons suspected of espionage have been identified. Charges were filed against 82, with 62 detained.”
“ABW arrested a 19-year-old Mateusz W. in November 2025, who prepared a terrorist attack using explosives in Poland.”
“ABW in 2025 recorded 40,000 potential cyber incident reports and saw a record 5.5 million security alarms, an 18% rise.”

Classification

Confidence: High

The article explicitly describes hostile foreign intelligence and cyber operations by Russian, Belarusian, and Chinese actors in Poland, including planning of sabotage and terrorist acts, qualifying clear aggressor hybrid war signals.