Poland Says It Identified GRU Unit Behind Russian Hybrid Operations in Europe
Poland says it has identified a Russian GRU unit involved in hybrid operations across Europe and warns that further escalation is being planned.
Polish Foreign Minister Radosław Sikorski says authorities have identified a specific Russian military intelligence unit linked to hostile activities in Europe and have information indicating that Moscow is planning further escalation.
Poland has identified a specific unit of Russia's military intelligence service, the GRU, that it believes is responsible for hostile operations targeting European countries, according to Foreign Minister and Deputy Prime Minister Radosław Sikorski.
Speaking in an interview with CNN's Fareed Zakaria broadcast on October 25, Sikorski warned that Russia was conducting a continuous campaign of hybrid operations against Poland and other European countries, involving sabotage, espionage, cyberattacks and reconnaissance of critical infrastructure.
"We know which specific GRU unit is behind this, and we know they are planning escalation," Sikorski said, according to remarks reported by Poland's PAP news agency.
The foreign minister did not publicly identify the GRU unit, specify the intelligence supporting Warsaw's assessment or provide details of the alleged escalation plans. His statement therefore represents a public assertion by a senior Polish government official rather than an independently verified identification of the intelligence personnel involved.
Poland Warns of Sabotage and Intelligence Operations
Sikorski described a range of incidents that Polish and other European authorities have been confronting, including suspected arson, attempted attacks on transport infrastructure, cyber intrusions and the collection of information about strategically important facilities.
He cited an attempted railway attack and referred to cyberattacks affecting hospitals, financial institutions and energy infrastructure. He also pointed to drone incursions and suspected reconnaissance of critical maritime infrastructure.
One example concerns sabotage incidents on Poland's Warsaw–Dorohusk railway corridor in November 2025. An explosive device damaged railway tracks near Mika, while another incident near Gołąb forced a passenger train carrying 475 people to brake after damage was discovered on the line.
The railway corridor is strategically important because it connects Poland with Ukraine and forms part of the wider transportation network supporting cross-border civilian and military logistics.
Sikorski's latest remarks did not establish that the newly referenced GRU unit was responsible for every incident he discussed. He did not provide a public case-by-case attribution or identify the unit's commanders.
European Defense Industry Faces Wider Intelligence Threats
The warning comes as European intelligence and law enforcement agencies investigate suspected Russian activities involving defense manufacturers, military infrastructure, communications networks and logistics facilities.
Polish investigators have examined several incidents involving infrastructure connected to military support for Ukraine, including a suspected arson attack on a Starlink ground station and a separate fire at a WB Electronics production facility.
As previously reported by AdriaDefense, Polish prosecutors opened an investigation into the August fire at WB Electronics under provisions covering suspected foreign intelligence activity and terrorism. Authorities have not publicly established Russian responsibility for that incident.
Separately, German investigators have examined possible cross-border links involving suspected sabotage activity in Germany, Poland and Serbia.
The available evidence does not establish that these separate cases were coordinated by the same GRU unit. Nevertheless, they illustrate the range of security investigations facing European authorities as defense production and military assistance to Ukraine expand.
The security concerns extend beyond conventional espionage. Intelligence collection targeting production facilities, personnel, transport routes and telecommunications infrastructure can also provide information relevant to planning future sabotage operations.
Warsaw Calls for Continued Support to Ukraine
Asked whether European governments should respond more aggressively to Russian provocations, Sikorski said European democracies would not adopt the methods he attributed to Moscow.
Instead, he argued that additional assistance to Ukraine remained Europe's most effective response and called for greater pressure on Russia to end the war.
His comments follow growing European efforts to restrict suspected Russian intelligence activity operating under diplomatic cover.
In September, Sikorski called for tougher restrictions on Russian diplomats across Europe, including limitations on diplomatic personnel and their freedom of movement. The issue was also addressed in AdriaDefense's reporting on the reduction of Russia's diplomatic mission to the European Union.
No operational details of the GRU unit cited by Sikorski have been publicly released. It remains unclear whether Warsaw intends to disclose its identification, announce additional counterintelligence measures or coordinate further action with European partners.
