MIKA and WARSAW, Poland — The hike to the site of what local authorities believe to be Russia's latest act of rail sabotage on Polish soil leads police officer Piotr Pokorski trudging through a couple of feet of snow across a stark white farm field, through a thatch of dead cattails and across a frozen creek before he pauses underneath an embankment.
"The explosion happened here," he says, pointing to a small section of railroad track that catches the frozen sunlight, reflecting a bronze-colored sheen from a recent repair, "and this section of track was damaged. A train engineer noticed it just in time to stop his train and then he reported it to us. Fortunately, nobody was injured."
Thousands of people ride on passenger trains along this line every day, and so does military aid traveling from Warsaw to Ukraine. Shortly after the November attack, Poland's Prime Minister Donald Tusk said the country's security services identified two Ukrainian suspects believed to be hired by Russia, but he said they escaped to neighboring Belarus immediately after the attack. The Kremlin denied any involvement.
Whether it's shutting down airports with drones, cyberattacks, or sabotaging infrastructure, Russia's hybrid warfare against Europe has increased sharply since the country's full-scale invasion of Ukraine four years ago. Military experts say Russia is operating in a gray zone to undermine support for Ukraine, and the attacks are becoming more dangerous.
Poland Internal Security Agency spokesman Jacek Dobrzynski says the suspects in the November attack chose their target carefully. "It was on a viaduct right before a curve in the track," he said. "Had they succeeded in destroying the track, the consequences would have been serious. Dozens of people could have been killed."
Dobrzysnski says he sees the attack as a test. "The Russians want to see how much they can get away with," he says, "what the Polish response will be, how the media reacts, how our security services react, and what evidence we uncover."
Kremlin spokesman Dmitri Peskov responded that Russia is being blamed for what he called "all manifestations" of hybrid warfare in Poland, adding "Russophobia is flourishing there."
Dobrzynsnski says what is flourishing are Russian attacks. His office tracks dozens of attempts each day to test the country's electric, transportation, and digital infrastructure. He says before Russia's war in Ukraine, the attacks were conducted by agents trained by Russia – but in the past few years, the attacks have been waged by what he calls "Disposable agents"
"They recruit these disposables through the messaging app Telegram," Dobrzysnski says, "and they pay them a little money to do small things at first like observing rail routes and reporting back to them, or they spray-paint anti-EU graffiti in the city, things like that. And if they're good at it, then they'll ask them to do more serious things like setting fires to buildings."
That's how, he says, the Russians recruited a 27-year-old man from Colombia who was arrested last summer for arson attacks on two construction supply depots. Dobrzynski says Russian agents trained the man to make incendiary devices and had him film the fires he set for broadcast on Russian state television where it falsely reported that the fires were set to military depots filled with aid for Ukraine. "My sense is that these attacks are getting more visible because Russia is really trying to influence the general population in European countries," says Ulrike Franke, a security expert at the European Council on Foreign Relations. "The logic being that if the population gets scared and feels like their own security services, police, etc. isn't able to counteract these attacks, they may push for a more conciliatory stance towards Russia and maybe become less supportive of Ukraine in their defense efforts."
Franke says Russia has scaled up its hybrid attacks on Western Europe, too, with its army of drones. Germany was peppered with drone sightings at airports throughout Germany last autumn, leading to hundreds of cancelled flights. Franke says Russia's scaled-up its hybrid attacks on Europe because the Kremlin wants to send a signal to Europeans that their governments are unable to counter such attacks.
But at what point will Europe strike back? What if that attack would have succeeded, a passenger was derailed, and dozens were killed? "This is incredibly difficult to answer," says Franke. "The moment people get killed and it becomes clear that that is linked to Russia, we may be entering Article 5 territory, meaning that NATO's mutual defense clause might come into action. Of course, this never means any kind of automatic military reaction, but it would be quite a strong, strong signal."
So far, NATO has yet to invoke Article 5 – "an attack on one is an attack on all" clause – but Franke says that with every hybrid attack, Russia is getting closer to forcing Europe and NATO to consider a military response.
Grzegorz Sokol contributed to this report
Copyright 2026 NPR
