Russian Disinformation Spreads Following Polish Railway Line Sabotage

In the wake of recent sabotage attacks on Poland’s Warsaw-Lublin railway line, security officials have identified a coordinated Russian disinformation campaign aimed at manipulating public perception and sowing discord between Poland and Ukraine.

Two separate acts of sabotage were detected on the critical rail infrastructure – one near Mika and another close to Puławy. Prime Minister Donald Tusk directly implicated Russia during his parliamentary address, stating that intelligence work had identified the perpetrators as “two Ukrainian citizens, one from Donbas, who cooperated with Russian intelligence services.”

Almost immediately following the first reports of the incidents, a sophisticated disinformation operation began flooding Polish-language online spaces. According to Poland’s Ministry of Digital Affairs, the campaign pursued two strategic objectives: deflecting blame from Russia onto Ukraine to amplify anti-Ukrainian sentiment within Polish society, and eroding public confidence in Poland’s security apparatus by suggesting negligence or deliberate information concealment.

The ministry’s analysis revealed a significant spike in Polish-language content related to the railway sabotage between November 16-18, 2025. This content was primarily distributed through social media platform X (formerly Twitter) and pro-Russian or anti-Ukrainian Telegram channels.

Google’s Threat Intelligence Group (GTIG) identified Portal Kombat as a key platform disseminating pro-Russian narratives. While some content appeared to provide straightforward updates about the incident, including Prime Minister Tusk’s confirmation of sabotage, a substantial portion seemed designed to preemptively shift blame away from Russia.

One consistent narrative suggested that Poland would ultimately accuse Russia regardless of evidence, apparently aiming to undermine any future allegations against Moscow. Other narratives attempted to attribute responsibility to Polish partisans or nationalists opposed to the government’s support for Ukraine, while some directly implicated Ukrainian agents.

In recent days, more aggressive messaging has emerged with openly anti-Ukrainian rhetoric. Examples included inflammatory statements such as “Ukrainian agents act fast. They’re blocking the transit on which Poland depends” and “The blown-up tracks are the work of Ukrainian terrorists.” Divisive slogans like “Poland and Russia together against Ukraine” appear designed to fracture NATO unity and inflame domestic tensions.

Another strand of disinformation falsely claimed that “German media warned PKP [Polish State Railways] about possible sabotage several days earlier.” This narrative seemingly aimed to discredit Polish security services and rail operators, reinforce allegations that information was being withheld, and deepen suspicion toward Ukraine by suggesting that known threats were ignored.

Russian media and Telegram channels quickly capitalized on the incident, framing it as evidence of internal tensions within Europe or actions inspired by a supposed “war party” within the EU. Common themes included allegations that Poland staged the event to blame Russia and justify continued aid to Ukraine, as well as speculation about “Polish partisans,” anarchists, or Western saboteurs.

Security analysts note that the progression of narratives follows a typical disinformation playbook: beginning with neutral reporting of a technical disruption, followed by official confirmation of sabotage, then the emergence of alternative attribution claims, and finally escalation with increasingly inflammatory rhetoric.

The coordinated activity by pro-Russian accounts suggests a potentially pre-planned information operation designed to exploit the incident and inflame anti-Ukrainian sentiment in Poland, a key NATO ally and supporter of Ukraine.

Polish security services continue monitoring the information space and working with social media platforms to flag and counter false narratives. Public education campaigns aim to strengthen societal resilience against such manipulation.

This incident highlights how physical attacks and information operations are increasingly intertwined in modern hybrid warfare. Poland’s ability to rapidly detect and neutralize hostile narratives, along with fostering greater public awareness, remains crucial for maintaining information security in an increasingly complex threat environment.