Poland Links Russian Sabotage Network to Wider Europe Plot

Poland’s Internal Security Agency has disclosed new details connecting its investigation into Russian-linked sabotage with a wider network operating across Europe, including a suspect accused of helping recruit and direct operatives in multiple countries. The Polish investigation centers on arson attacks in Warsaw and Radom and forms part of a broader counterintelligence effort examining sabotage, reconnaissance and other covert activity attributed by European authorities to Russian intelligence.

The Internal Security Agency, known by its Polish abbreviation ABW, said on September 17 that it has investigated the Polish branch of the network since 2024. Its latest statement followed new information released by the United States Department of Justice and an international investigation into operations extending beyond Poland.

At the center of the Polish case are two fires at building-material warehouses in Warsaw and Radom in May 2024. Investigators determined that a Colombian national carried out the attacks, but ABW says its investigation subsequently identified a person linked to Russian special services who assigned, supervised and financed the operations.

The Colombian operative was later arrested in the Czech Republic and is serving an eight-year prison sentence there. Polish authorities continue to investigate the people who directed his activities.

Polish investigators identify a suspected international coordinator

The latest ABW disclosure adds an important name to the investigation.

Polish authorities have brought charges against Oemis R.D., who is now a suspect in proceedings before the Polish justice system. ABW said the same individual appears in a United States investigation and in findings produced by an international group of European journalists.

The cross-border investigation identified the suspect as a Cuban national living in Russia who allegedly participated in recruiting operatives, organizing their travel and directing assignments in several European countries.

ABW has not presented the network as a collection of isolated attacks. Polish investigators previously worked with authorities in other European states to identify common coordinators and organizers behind incidents using similar methods.

The wider investigation has connected suspected Russian-directed sabotage activity in Poland, the Czech Republic, Romania and Lithuania. Authorities in several of those countries have attributed elements of the network to Russian military intelligence.

The targets varied by country. Investigators have examined attacks and reconnaissance involving civilian facilities as well as companies supporting Ukraine, including a bus depot in Prague and Lithuanian businesses supplying equipment to the Ukrainian military.

Foreign recruits reduce direct links to Russian intelligence

The network illustrates a model that European counterintelligence services increasingly describe as the use of disposable agents.

Instead of deploying trained intelligence officers to carry out every operation, handlers can recruit individuals with no traditional intelligence background and give them limited tasks such as photographing a location, transporting equipment, setting a fire or conducting surveillance.

An investigation coordinated by the European Broadcasting Union found that recruits were approached through social media, employment platforms and online forums. Some were young or financially vulnerable people looking for work in Europe, while others had expressed interest in traveling to Ukraine.

The structure can make attribution more difficult. The person carrying out an attack may have no direct contact with a Russian intelligence officer and may understand only a small part of the wider operation.

Polish investigations into separate Russian-linked cases have documented similar methods. In one case that reached court in July, ABW said operatives were recruited through internet messaging services and received payments in cryptocurrency through exchanges registered in Russia and China.

That investigation covered 47 alleged criminal acts between November 2024 and August 2025. Polish authorities also accused the defendant of preparing sabotage activity involving an unmanned aircraft.

The cases do not establish that every Russian-linked operation in Poland uses the same command structure. They do, however, show recurring reliance on remotely recruited intermediaries, digital communications and operatives who can be replaced without exposing intelligence personnel directly.

Warsaw and Radom fires also served an information operation

The Polish warehouse fires illustrate how physical sabotage can be combined with information operations.

According to ABW, footage of the Warsaw and Radom fires was subsequently distributed by Russian-language online media and falsely presented as evidence of attacks against NATO military infrastructure.

The warehouses themselves stored building materials rather than serving as NATO military facilities.

That distinction is important because the operation could generate two effects from the same incident. The physical attack caused damage in Poland, while images of the fires could subsequently be repackaged for an online audience under a different description.

Polish investigators have continued following the chain beyond the individual who physically started the fires. ABW says proceedings against both the Colombian suspect and the people directing him remain active.

Poland becomes a central counterintelligence battleground

Poland has particular exposure to Russian intelligence activity because of its position on NATO’s eastern flank and its role as a major logistical corridor supporting Ukraine.

That makes military movements, transport infrastructure, defense production and facilities connected to assistance for Ukraine potential intelligence targets. It also gives hostile services an incentive to conduct operations intended to disrupt Polish-Ukrainian relations or create public uncertainty about security inside the country.

Recent ABW investigations show that Polish counterintelligence is increasingly dealing with operatives who do not fit the traditional image of a foreign spy working under diplomatic or commercial cover.

The individuals identified in different investigations have included citizens of countries outside Russia and Belarus, as well as people recruited remotely for individual assignments.

This creates a different counterintelligence problem. Security services must identify not only professional intelligence officers but also loosely connected individuals recruited online to perform reconnaissance, sabotage or logistical tasks.

The September 17 disclosure provides another piece of that picture. Poland’s warehouse fires are no longer being investigated simply as two domestic arson incidents. Polish authorities now place them within an international investigation into a network whose suspected organizers recruited and directed operatives across several European states.

The investigation remains active, and allegations against individuals who have not been convicted remain subject to judicial proceedings.

Questions about the Russian sabotage network in Poland

What did the suspected network do in Poland?

Polish investigators linked the network to fires at building-material warehouses in Warsaw and Radom in May 2024. ABW says a Colombian national carried out the attacks under the direction of a person connected to Russian special services.

Who is Oemis R.D.?

Polish authorities identify Oemis R.D. as a suspect in their investigation. An international journalistic investigation describes him as a Cuban national living in Russia who allegedly helped recruit operatives, arrange travel and coordinate assignments in several European countries.

Which European countries are investigating related sabotage?

Investigations have connected suspected members or operations of the wider network with Poland, the Czech Republic, Romania and Lithuania. Authorities and investigators have identified similarities in recruitment, coordination and operational methods across the cases.

What are disposable agents?

The term describes operatives recruited for relatively limited intelligence or sabotage assignments without becoming professional intelligence officers. They can be recruited remotely to conduct surveillance, arson, transportation or other tasks, reducing direct exposure of the intelligence service directing the operation.