Poland Arrests Two Ukrainians Accused of Spying and Sabotage for Russia — Cars Set on Fire With Fake Army Plates

Poland has arrested two Ukrainian men accused of spying and carrying out sabotage on behalf of Russian intelligence, in a case investigators say was designed to turn Poles against Ukrainians.

Poland’s Internal Security Agency, known as the ABW, announced the arrests on Tuesday, 10 November 2026. The two men, aged 24 and 25, were detained on 3 November in Minsk Mazowiecki, a town east of Warsaw. Both have been charged with espionage for a foreign intelligence service and with sabotage. If convicted, they face between 10 years in prison and life imprisonment.

Prosecutors say the men scouted military sites and critical infrastructure across Poland, set fire to cars after fitting them with number plates made to look like Ukrainian military plates, and were paid for their work, including in cryptocurrency. A court has ordered both men held in detention for three months while the investigation continues.

The case is the latest in a long string of sabotage and spying arrests in Poland since Russia’s full-scale invasion of Ukraine in 2022. Polish officials say Moscow is waging a quiet, deniable campaign against the country — one that uses arson, spying and disinformation instead of soldiers and tanks.

What happened

The operation was carried out by ABW officers on 3 November in Minsk Mazowiecki, near Warsaw. Poland’s Minister-Coordinator of Special Services, Tomasz Siemoniak, disclosed the case on 10 November.

According to the ABW, the two men carried out tasks for Russian intelligence services that included “reconnoitring critical infrastructure and military facilities throughout the country”. Investigators say they also photographed the sites they scouted.

Prosecutors charged both men with engaging in espionage on behalf of a foreign intelligence service against Poland, as well as committing acts of sabotage. The charges were filed on 4 November, and a court ordered the two men held for three months. The Lodz branch of Poland’s National Prosecutor’s Office is supervising the investigation.

During searches, officers seized electronic data storage devices and narcotic substances, according to reports of the case.

The Russian embassy in Warsaw did not immediately respond to a request for comment from Reuters.

It is important to stress that these are charges, not a verdict. The men have not been convicted, and the full circumstances of the case — including the identity of the alleged Russian handlers — remain under investigation.

The fake plates and the fires

The detail that has drawn the most attention is the number plates. Investigators say the men set fire to cars in one of Poland’s large cities after first replacing the vehicles’ number plates with ones resembling those used by the Ukrainian military.

Prosecutors said in a separate statement: “The investigation has established that the acts of sabotage were carried out at the behest of Russian intelligence services and were intended to fuel anti-Ukrainian sentiment.”

In other words, the alleged plan was not only to cause damage, but to make it look as if Ukrainians were responsible — and to stir up hostility towards the large Ukrainian community living in Poland.

Poland hosts more than a million Ukrainian refugees who fled the war, as well as many Ukrainian workers who lived in the country before 2022. Public support for helping Ukraine remains strong in Poland, but there have been tensions over jobs, housing and welfare, and anti-Ukrainian sentiment is a fault line that Russian disinformation has repeatedly tried to exploit.

That is what makes this case different from a simple arson investigation. If the prosecutors’ account is correct, the fires were a message as much as an attack: burn a car, leave a Ukrainian plate behind, and let suspicion do the rest.

What is hybrid warfare?

Polish officials describe the campaign against their country as “hybrid warfare”. The term sounds complicated, but the idea is simple: a country pressures its enemy using a mix of methods that fall short of open war — cyberattacks, sabotage, disinformation, spying and political interference — so that it can cause damage while denying responsibility.

Poland has long accused Russia and its ally Belarus of waging exactly this kind of campaign against it since Moscow launched its full-scale invasion of Ukraine in 2022. Russia has repeatedly denied the accusations.

Because hybrid attacks are small, scattered and often carried out by people recruited online rather than by uniformed soldiers, they are hard to stop and hard to prove. A fire at a warehouse, a damaged railway line or a hacked supermarket fridge may look like an accident or a local crime. Only when investigators piece several incidents together does a pattern emerge.

That is why Polish prosecutors and intelligence officers pay such close attention to who is paid, how they are paid and who benefits from the confusion. In this case, the payment in cryptocurrency and the fake Ukrainian plates are, for investigators, the clues that point to a foreign hand.

A growing pattern

This week’s arrests are not an isolated case. Poland has seen a steady run of sabotage and espionage cases over the past two years, many of them involving people investigators say were recruited by Russian intelligence.

In late October 2026, Polish anti-terrorism officers detained a 25-year-old Ukrainian man in Warsaw under a European Arrest Warrant issued by Romania. Romanian authorities allege the man was involved in an arson attack on 14 September on premises belonging to Carfil, a subsidiary of the state-owned defence company ROMARM, in the city of Brasov. Germany detained two Belarusian citizens in connection with the same attack. Romania’s Intelligence Service said the fire was the work of a sabotage network coordinated from Russia, made up of citizens from former Soviet states living in the European Union.

In September 2026, a fire broke out at a Starlink satellite internet terminal in Wola Karbowska, about 50 kilometres south of Warsaw. Starlink is the satellite system Ukraine relies on for battlefield communications. Two Turkish citizens suspected of setting the fire were later arrested in Germany at Poland’s request. Siemoniak said there was “no doubt whatsoever that Russian intelligence services are behind this act of sabotage.” Poland has also blamed Russia for arson at a drone production plant belonging to WB Electronics.

In October 2026, a 55-year-old Russian man was arrested in Swidnica, in south-western Poland, after police spotted him photographing trains and railway facilities. Officers found 250,000 photographs on his seized storage devices — images of railways, locomotives, stations, airports and communications facilities, not only in Poland but in other countries too. He was charged with acting on behalf of a foreign intelligence service and ordered held for three months. He has denied the charges.

In November 2025, an explosive device detonated on the Warsaw–Lublin railway line, a route used to transport aid supplies to Ukraine. Prime Minister Donald Tusk said at the time that two Ukrainian suspects acting on orders from Russian intelligence had carried out the attack.

The scale of the problem is reflected in the official figures. Polish authorities say that since 2024 they have designated 90 people as suspects in espionage and sabotage investigations — including nationals of Russia, Belarus, Ukraine and Poland.

Poland has also tightened its defences. Since April 2026, the country has enforced a system restricting unauthorised photography at around 25,000 sites, including military bases, weapons production facilities, power plants and bridges.

A separate case announced last week

The two Ukrainians detained in Minsk Mazowiecki should not be confused with another case announced just days earlier. On 5 November, Polish authorities uncovered a group of six people suspected of spying for Russia and illegally supplying components for the production of Russian ammunition. The shipments were transported to Russia’s Kaliningrad region via Lithuania. Four of the six face espionage charges.

Investigators say the two cases are separate, and the Minsk Mazowiecki arrests are not connected to the smuggling group.

Why Poland is a target

There is a reason Poland keeps appearing in these cases. Since 2022, the country has been Ukraine’s most important neighbour and its main logistics hub. Weapons, aid and supplies for Ukraine pass through Polish territory, and Poland hosts key military and transport infrastructure used by NATO allies.

That makes Poland a prime target for anyone who wants to slow the flow of aid to Ukraine — or to frighten the Polish public into questioning whether supporting Ukraine is worth the risk.

It also makes Poland a testing ground. The methods seen there — small fires, photographed infrastructure, fake plates, crypto payments — are cheap, deniable and repeatable. Similar arson and sabotage cases linked to Russia have been reported in Estonia, Latvia and Lithuania, and Estonian investigations into such incidents are still running.

What happens next

The two men will remain in detention for three months while prosecutors build their case. Investigators are still working to identify the alleged Russian handlers and to establish the full circumstances of the alleged crimes.

If the case goes to trial, prosecutors will need to prove not only that the men carried out the surveillance and the arson, but that they did so on the instructions of a foreign intelligence service. The seized electronic devices and the trail of cryptocurrency payments are likely to be central evidence.

For Poland, the case is also a public warning. Each arrest is announced loudly, with ministers and prosecutors explaining the alleged Russian link in detail. The message is aimed at two audiences at once: at would-be recruits, who are told they face life in prison; and at the Polish public, who are told to be sceptical of crimes that seem designed to inflame tensions between Poles and Ukrainians.

Frequently asked questions

Who was arrested?

Two Ukrainian men, aged 24 and 25. They were detained by Poland’s Internal Security Agency (ABW) on 3 November 2026 in Minsk Mazowiecki, east of Warsaw. Their names have not been released.

What are they accused of?

Espionage on behalf of a foreign intelligence service and sabotage. Prosecutors say they scouted and photographed critical infrastructure and military facilities across Poland, set fire to cars after fitting them with fake Ukrainian military-style number plates, and were paid for the work, including in cryptocurrency.

What punishment do they face?

If convicted, they face between 10 years in prison and life imprisonment. A court has ordered them held in detention for three months while the investigation continues.

Why would anyone fit fake Ukrainian plates to a burned car?

Prosecutors say the sabotage was intended to fuel anti-Ukrainian sentiment in Poland — in other words, to make it look as if Ukrainians were behind the attacks and to stir up hostility towards the Ukrainian community.

Is this the first case of its kind?

No. Poland has reported a series of similar cases since 2022, including arson at a Starlink terminal and a Romanian defence company’s premises, an explosion on a railway line used for aid to Ukraine, and the arrest of a man found with 250,000 photographs of infrastructure. Since 2024, Polish authorities have designated 90 people as suspects in espionage and sabotage investigations.

Has Russia responded?

Russia has repeatedly denied accusations that it is waging a sabotage and disinformation campaign against Poland. The Russian embassy in Warsaw did not immediately respond to a request for comment on this case.

Conclusion

The arrest of two Ukrainian men accused of spying and sabotage for Russia is a small case with a large message. The alleged crimes — scouting military sites, burning cars, fitting fake number plates — are modest in scale. But prosecutors say the purpose was not the damage itself. It was to make Ukrainians look like the culprits and to poison relations between Poland and the people it has sheltered since the war began.

Whether the charges hold up in court remains to be seen. What is already clear is that Poland’s shadow war is not slowing down. Ninety suspects since 2024, a string of arson attacks, and now a case built around fake plates and crypto payments: the pattern is one of small, deniable acts, repeated often enough to add up to a campaign.

For Poland, the challenge is not only to catch the people carrying out these acts, but to stop the suspicion they are designed to create.

Sources

• Reuters, “Poland arrests two Ukrainians over alleged Russian espionage, sabotage”, 10 November 2026: https://www.reuters.com/world/poland-arrests-two-ukrainians-over-alleged-russian-espionage-sabotage-2026-11-10/
• The Hindu, “Poland arrests two Ukrainians over alleged Russian espionage, sabotage”: https://www.thehindu.com/news/international/poland-arrests-two-ukrainians-over-alleged-russian-espionage-sabotage/article71685864.ece
• Militarnyi, “Poland detains two Ukrainians suspected of carrying out sabotage for Russia”: https://militarnyi.com/en/news/poland-detains-two-ukrainians-suspected-of-carrying-out-sabotage-for-russia/
• EconoTimes, “Poland Charges Two Ukrainians in Alleged Russian-Directed Sabotage Case”: https://econotimes.com/Poland-Charges-Two-Ukrainians-in-Alleged-Russian-Directed-Sabotage-Case-1774405
• OSINT Baltic, “Poland sabotage: Ukrainian plates”: https://osint-baltic.com/poland-sabotage-ukrainian-plates-en/

This article is for general information and education only. It is not legal or financial advice.