Poland Hit by Massive Russian Disinformation Attack After Drone Breach

Poland was hit by an unprece­dent­ed dis­in­for­ma­tion attack fol­low­ing a Russ­ian drone incur­sion on Sep­tem­ber 10, trig­ger­ing a wave of approx­i­mate­ly 200,000 social media mes­sages orig­i­nat­ing from Russ­ian and Belaru­sian accounts that blamed Ukraine or NATO for the inci­dent. On 8 Octo­ber 2025, Le Monde report­ed that the provo­ca­tion, dur­ing which around 20 Russ­ian drones vio­lat­ed Pol­ish air­space, was fol­lowed by what cyber­se­cu­ri­ty experts described as a tsuna­mi of dis­in­for­ma­tion coor­di­nat­ed with the mil­i­tary actions. The arti­cle begins:

Russian Influence Operations in Poland: From Ghostwriter to 2025 Election Interference

Russ­ian influ­ence oper­a­tions in Poland have evolved from ear­ly cyber-enabled cam­paigns tar­get­ing NATO nar­ra­tives to sophis­ti­cat­ed hybrid war­fare tac­tics aimed at dis­rupt­ing demo­c­ra­t­ic process­es. The Ghost­writer cam­paign tar­get­ed audi­ences in Lithua­nia, Latvia, and Poland with nar­ra­tives crit­i­cal of NATO’s pres­ence in East­ern Europe, lever­ag­ing cre­den­tial har­vest­ing and mal­ware deliv­ery through spear-phish­ing attacks against gov­ern­ment, mil­i­tary, and media orga­ni­za­tions. Begin­ning in 2017, this cyber-enabled oper­a­tion expand­ed beyond anti-NATO mes­sag­ing to com­pro­mise social media accounts of Pol­ish offi­cials to cre­ate domes­tic polit­i­cal dis­rup­tion. Tech­ni­cal evi­dence linked the cam­paign to UNC1151, a sus­pect­ed state-spon­sored cyber espi­onage group, with attri­bu­tions point­ing to both Russ­ian and Belaru­sian involvement.

Beyond cyber oper­a­tions, Rus­sia employed diverse influ­ence tac­tics. Orga­ni­za­tions asso­ci­at­ed with Russ­ian oper­a­tive Yevge­ny Prigozhin orga­nized a Baltic Sea Region Strate­gic Dia­logue con­fer­ence in Berlin, address­ing eco­nom­ic and envi­ron­men­tal issues affect­ing Poland and neigh­bor­ing states, rep­re­sent­ing “text­book trade­craft” by start­ing with polit­i­cal­ly uncon­tro­ver­sial top­ics before advanc­ing Krem­lin inter­ests. Sim­i­lar­ly, Belarus’s KGB used fake accounts to pose as jour­nal­ists and activists to inflame ten­sions about the migrant cri­sis at the Belarus-Poland bor­der, with Meta remov­ing 41 Face­book accounts using AI-gen­er­at­ed pro­file pic­tures. Pol­ish author­i­ties described the migrant influx as low-inten­si­ty hybrid war­fare, demon­strat­ing coor­di­nat­ed pres­sure from Rus­sia and its ally.

Dur­ing the 2025 pres­i­den­tial elec­tions, Pol­ish intel­li­gence doc­u­ment­ed over 50 inci­dents linked to Russ­ian inter­fer­ence tar­get­ing the May 18 vote, with Inte­ri­or Min­is­ter Tomasz Semonik warn­ing of online manip­u­la­tions aimed at under­min­ing gov­ern­men­tal trust. Oper­a­tions sought to inflame ten­sions between Pol­ish cit­i­zens and Ukrain­ian refugees, while 22 Pol­ish-lan­guage Telegram chan­nels with over 150,000 sub­scribers spread pro-Krem­lin pro­pa­gan­da, includ­ing staged videos and false claims deny­ing doc­u­ment­ed war crimes. These chan­nels repli­cat­ed con­tent from banned Russ­ian state media RT and Sput­nik, with sev­er­al oper­at­ed by for­mer Ukrain­ian secu­ri­ty offi­cers col­lab­o­rat­ing with Russia.

Despite the scale of Russ­ian efforts, most Krem­lin oper­a­tions failed to res­onate with Pol­ish vot­ers, as GLOBSEC polling showed that 86% of Poles con­sid­ered Rus­sia a threat. Oper­a­tion Dop­pel­ganger bot net­works failed due to 92% Pol­ish sup­port for increased defense, while pro-Putin can­di­date Maciej Maci­ak secured only 0.19% of the votes, despite exten­sive Russ­ian state media cov­er­age. Remark­ably, post-elec­tion analy­sis found inter­fer­ence attempts sig­nif­i­cant­ly low­er than gov­ern­ment warn­ings sug­gest­ed, with experts not­ing the absence of aggres­sive tac­tics seen else­where. Poland’s diver­si­fied social media land­scape and “elec­tion umbrel­la” strat­e­gy proved effec­tive in mit­i­gat­ing for­eign inter­fer­ence.

How­ev­er, nation­al­ist can­di­date Karol Nawrock­i’s nar­row vic­to­ry was aid­ed by for­eign-fund­ed Face­book ads and Tik­Tok manip­u­la­tion involv­ing over 2,400 fake accounts, cre­at­ing insti­tu­tion­al paral­y­sis that threat­ened demo­c­ra­t­ic reforms.

Exter­nal References:
— The Krem­lin’s Dou­ble Game: Russ­ian Attempts to Influ­ence Poland’s 2025 Elec­tion — GLOBSEC
— Ghost­writer Update: Cyber Espi­onage Group UNC1151 Like­ly Con­ducts Ghost­writer Influ­ence Activ­i­ty — Mandiant
— Poland fights dig­i­tal inter­fer­ence ahead of final round of pres­i­den­tial vote — France 24