Lyce · Hybrid Watch

hw_34f4f1087d137cab

Poland and Romania detain a sabotage crew suspected of working for Russia.

Polish and Romanian authorities announced the detention of eight individuals suspected of preparing sabotage operations on behalf of Russian intelligence services. Among the arrested were several Ukrainian nationals and one Colombian citizen linked to the placement of explosive parcels into Ukraine-bound convoys via Poland’s logistics network. The plan reportedly involved routing detonable packages through courier services and using civilian parcel infrastructure to undermine supply-chains in support of Ukraine. Polish national security sources stated the cells had been active for months and that Russia had actively funded recruitment, training and procurement of dual-use equipment. While no public explosion has yet been reported, the dismantling of the network exemplifies the hybrid-warfare model: clandestine preparation, infrastructure targeting, and use of proxies. The dynamics reveal a shift in Russian hybrid tactics from visible drone incursions to covert logistical sabotage inside NATO territory.

Occurrence
2025-09-09
Publication
2025-09-08T22:00:00Z
First observed
2026-09-24T06:09:10.079Z
Review status
Not assessed
Countries
PL, RO
Updated
2026-09-27T23:56:59.668Z

E/M/R/S scores

  • EExistence0/4 · Not assessed
  • MIntent0/4 · Not assessed
  • RRussian actor link0/4 · Not assessed
  • SRussian state responsibility0/4 · Not assessed

Facts

No facts

Sources

  1. Role
    discovery_lead
    Date
    2025-09-08T22:00:00Z

    Polish and Romanian authorities announced the detention of eight individuals suspected of preparing sabotage operations on behalf of Russian intelligence services. Among the arrested were several Ukrainian nationals and one Colombian citizen linked to the placement of explosive parcels into Ukraine-bound convoys via Poland’s logistics network. The plan reportedly involved routing detonable packages through courier services and using civilian parcel infrastructure to undermine supply-chains in support of Ukraine. Polish national security sources stated the cells had been active for months and that Russia had actively funded recruitment, training and procurement of dual-use equipment. While no public explosion has yet been reported, the dismantling of the network exemplifies the hybrid-warfare model: clandestine preparation, infrastructure targeting, and use of proxies. The dynamics reveal a shift in Russian hybrid tactics from visible drone incursions to covert logistical sabotage inside NATO territory.