Lyce · Hybrid Watch
hw_aba10db31932d2dd
Russian-linked cyber operation accompanies drone incursions into Polish airspace.
On 10 September 2025, Poland experienced an intensive Russian-linked online operation coinciding with the incursion of Russian drones into Polish airspace. According to Digital Affairs Minister Krzysztof Gawkowski, the operation was the largest of its kind affecting Poland since Russia’s full-scale invasion of Ukraine in 2022. Russian-linked networks reportedly activated previously dormant automated accounts to circulate claims that Ukraine had deliberately sent drones into Poland to provoke a wider conflict. Polish authorities identified the activity as part of a coordinated attempt to manipulate public perceptions of the drone incident and undermine confidence in Ukraine and Poland’s security response. Gawkowski connected the operation to the broader escalation of Russian cyber activity against Poland. However, Reuters did not identify a specific compromised network, affected organisation, deployed malware or disruption to critical infrastructure associated with this particular operation.
Attribution
Official
Facts
No facts
Sources
-
- Role
- Discovery lead
- Publication
On 10 September 2025, Poland experienced an intensive Russian-linked online operation coinciding with the incursion of Russian drones into Polish airspace. According to Digital Affairs Minister Krzysztof Gawkowski, the operation was the largest of its kind affecting Poland since Russia’s full-scale invasion of Ukraine in 2022. Russian-linked networks reportedly activated previously dormant automated accounts to circulate claims that Ukraine had deliberately sent drones into Poland to provoke a wider conflict. Polish authorities identified the activity as part of a coordinated attempt to manipulate public perceptions of the drone incident and undermine confidence in Ukraine and Poland’s security response. Gawkowski connected the operation to the broader escalation of Russian cyber activity against Poland. However, Reuters did not identify a specific compromised network, affected organisation, deployed malware or disruption to critical infrastructure associated with this particular operation.