In a recent analytical report, the Institute for the Study of War (ISW) warned of a likely increase in Russian sabotage and provocation activities within Poland during the 2026–2027 winter period. This is reported by RBC-Ukraine. According to the institute's experts, the primary targets of potential operations could include railway and logistics infrastructure, as well as key routes used to supply Western military and humanitarian aid to Ukraine. The report was prepared against the backdrop of an increasing number of hybrid-nature incidents in Eastern European countries over recent months.
“Winter Will Be a Test”: Warning from Former National Security Bureau Head
On October 16, Jacek Siewiera, former head of Poland's National Security Bureau, made a public statement pointing to a significant rise in hybrid operations in Europe specifically during the winter period. According to his assessment, the list of threats includes potential air attacks on critical infrastructure, administrative buildings, and civilian targets. Siewiera specifically noted that unmanned aerial vehicles could be employed as tools of influence, making the threat harder to detect and more complex for air defense systems to counter.
Tusk Names Specific Targets: Gas, Oil, Grain, and Railways
Commenting on intelligence warnings, Polish Prime Minister Donald Tusk stated that Polish, Ukrainian, and allied intelligence agencies are registering the possibility of a certain escalation, including during the Christmas period. Tusk listed potential targets: transportation routes for gas, oil, and food to Ukraine, as well as logistics hubs and railway infrastructure near the Polish-Ukrainian border. According to the Prime Minister, Moscow will likely attempt to test Warsaw's and its allies' reactions to such actions, evaluating NATO's readiness for a collective response.
Kyiv Notes Transition from Hybrid Operations to Military Actions
The Ukrainian side also provides context for the Polish warnings. On October 2, the Main Directorate of Intelligence of the Ministry of Defense of Ukraine issued a warning about Russia preparing new acts of sabotage in EU and NATO countries, naming military facilities, critical infrastructure, and communication systems—in particular, Starlink satellite internet ground stations—among potential targets. On October 12, Ukrainian Foreign Minister Andrii Sybiha stated that Russia's actions in Europe are already moving beyond classical hybrid operations and acquiring military characteristics: these are attacks that lead to casualties and target strategically important objects.
The Kremlin’s Strategic Calculation: Paralyzing Aid Logistics
ISW analysts point out that the logic behind potential Russian operations is based on calculation: sabotage attempts in European countries will complicate and slow down the delivery of Western aid to Ukraine, while distracting politicians and allied resources from supporting the Ukrainian army. Thus, even a minor incident on a railway or gas pipeline is capable of provoking a political reaction that requires additional resources for investigations, enhanced security, and the restructuring of supply chains. Under conditions where the winter period traditionally complicates the work of security services due to weather factors, the effectiveness of such operations could increase.
What This Means for Regional Security
The combination of statements—from ISW and Jacek Siewiera to Donald Tusk and Ukrainian intelligence services—paints a picture of a systemic increase in the threat level for NATO's eastern flank. Neither side claims a specific attack is being prepared with a specific date, but the consistency of assessments regarding the nature and probable targets of the operations indicates that the warnings are operational rather than speculative in nature. For Poland, which remains one of the key transit hubs for supplies to Ukraine in 2026, this means the need to further strengthen the protection of critical infrastructure and coordinate with NATO allies at the intelligence and operational planning levels.
