Agnieszka Lipińska, head of the Disinformation Analysis Center at NASK, Poland’s national cybersecurity and research institute, told PAP that the second half of 2025 saw a sharper rise in false and misleading claims than the first, largely around narratives linked to Russia’s war against Ukraine.
She said outside actors, including Russian and Belarusian centers, sought to influence public opinion in countries supporting Ukraine through cyber warfare operations that included disinformation.
Drony, sabotaż i fake newsy – jak sześć fal dezinformacji zdominowało 2025 r. [ANALIZA] #PAPInformacjehttps://t.co/KsDIkxRqUq
— PAP (@PAPinformacje) January 1, 2026
One prominent wave followed reports that drones violated Polish airspace during a Russian strike on Ukraine in September. A widely shared claim argued that Gerbera-type drones found hundreds of kilometers from the Polish-Ukrainian border could not have come from Russia because their range was said to be around 500 kilometers.
That line was used to suggest, without evidence, that Ukraine was trying to draw Poland into the war.
Mariusz Cielma, editor-in-chief of the monthly magazine Nowa Technika Wojskowa, told PAP that while the drone’s nominal range is around 600 kilometers, simple modifications can extend it significantly.
He said images and prosecutors’ information indicated the drones found in Poland did not carry warheads or reconnaissance equipment, reducing weight and increasing range. Cielma said Russia has at times replaced a roughly 5-kilogram warhead with additional fuel tanks, including improvised solutions, to allow longer flights.
In November, disinformation activity intensified after two railway sabotage incidents. In one case, an explosive device damaged the track, raising the risk of a derailment. In another, a train carrying 475 passengers had to brake suddenly because of damage to the line.
Online narratives sought to shift blame onto Ukraine and discredit Polish security services, including claims that the national railway operator PKP had been warned in advance and that Ukrainian services were behind the attacks.
Another strand promoted the idea that “partisans in Poland” were targeting rail routes to disrupt military supplies and signal opposition to Poland’s Western alliances.
Jakub Olchowski, from a research team on propaganda and disinformation at Maria Curie-Skłodowska University (UMCS) and the Institute of Central Europe in Lublin, eastern Poland, told PAP that such stories fit Russian and Belarusian narratives portraying Poles as tired of Ukraine and critical of their own authorities.
He said the framing was quickly amplified by various groups, including the far-right Confederation party.
The third wave was tied to Poland’s 2025 presidential election.
A PAP report published in April, a month before the vote, warned that the Kremlin had an interest in destabilizing democratic processes by backing specific candidates and fueling disinformation.
Government efforts under the “Election Umbrella” program included monitoring through Arakis-Gov, an early warning system for online threats, and the work of CSIRT NASK, the incident response team at NASK.
Officials reported large numbers of cyber threat alerts, as well as false SMS campaigns and reported breaches of Poland’s election silence rules.
They also said thousands of fake social media accounts were neutralized, including profiles which were impersonating candidates.
Even so, a June poll cited by PAP found that 40.1 percent of adult Poles believed the presidential election may have been rigged, while an August Pew Research Center report stated that 85 percent of Poles saw disinformation as a greater threat than terrorism or disease, placing Poland among the highest of 25 countries surveyed.
A fourth wave focused on energy, with officials warning that false claims can undermine public trust and complicate the country’s energy transition.
Digital Affairs Minister Krzysztof Gawkowski said in October that in the first half of 2025 up to 5 million users may have encountered untrue information about the energy sector.
Energy Minister Miłosz Motyka said nuclear power, renewable energy, and alleged health effects of power grids were frequent targets.
A fifth wave centered on migrants, particularly Ukrainians living in Poland, with repeated claims spread over months rather than a single spike.
The General Staff of of the Polish Armed Forces warned in October of an “intensive Russian cognitive operation” aimed at damaging emotional ties between Poles and Ukrainians and stoking anti-Ukrainian sentiment, citing online hate, cyberattacks, arson and GPS signal disruptions as part of a broader pattern.
6️⃣9️⃣6️⃣– tyle zgłoszeń zagrożeń cyberbezpieczeństwa otrzymał CSIRT @NASK_pl minionej doby🚨.
Spośród nich zidentyfikowano 2️⃣9️⃣6️⃣ nowych incydentów, które są obecnie obsługiwane.@CERT_Polska wpisał również 1️⃣9️⃣7️⃣ domen na listę ostrzeżeń – to strony, które wyłudzają dane i… pic.twitter.com/OPtHHvx2V1
— Ministerstwo Cyfryzacji (@CYFRA_GOV_PL) January 2, 2026
Lipińska also pointed to a sixth wave in health-related disinformation, linked to debates over health education in schools and vaccines against human papillomavirus (HPV).
She said medical disinformation often rises in late winter and in autumn, in line with seasonal vaccination cycles.
Asked about likely developments in 2026, Lipińska said the scale of fake news and disinformation campaigns could grow if the European Union’s Digital Services Act is not effectively implemented, and the major internet platforms do not strengthen moderation.
She also warned about an increase in artificial intelligence-generated fake content, as exemplified by recent TikTok videos in which AI-generated representations of attractive young women make anti-EU pronouncements.
Potwierdzam, że Komisja Europejska zwróciła się do nas z prośbą o przekazanie materiałów w sprawie masowego zamieszczania treści generowanych przez AI, niezgodnych z regulaminem TikToka. To element przygotowania do podjęcia postępowania. https://t.co/b5oJJ4DV2D
— Dariusz Standerski (@DStanderski) January 2, 2026
n a statement, the ministry said Poland’s online information space is being continuously monitored by security agencies, which are in regular contact with major social media platforms.
According to officials, false narratives are being identified and blocked, and the public has been urged to treat any information about the incidents with particular caution, especially when they appear on social media.
The ministry called on users to check the source of any information before sharing it and not to pass on material from unverified accounts.
It also warned against reacting emotionally to photos or videos, noting that such material may be edited, falsified or taken from completely different situations than their descriptions suggest.
Officials said that Polish services responsible for public safety are providing verified and confirmed information on an ongoing basis and reminded citizens that suspicious content can be reported via a dedicated government website run by NASK, the state research institute responsible for cybersecurity.
According to the ministry, reports about the railway sabotage quickly spread into Russian media and onto Telegram channels, a popular messaging platform often used for propaganda.
These outlets increasingly use the incidents in their messaging about the war in Ukraine.
Russian-language and pro-Russian narratives have focused on portraying the sabotage as a sign of deepening internal tensions in Europe and as the work of a supposed “war party” within the European Union.
In many messages, Poland is depicted as a country provoking incidents in order to later accuse Russia and justify further military support for Ukraine.
At the same time, suggestions have been circulated that the sabotage could have been carried out by “Polish partisans,” anarchists, Western agents or other unnamed saboteurs.
Some Russian media also referred to Germany, implying that Berlin might be sabotaging military deliveries to Ukraine as revenge for the Nord Stream 2 gas pipeline explosion, which was of economic importance to Germany.
Other false stories recalled earlier attacks on infrastructure in Germany, France and the Czech Republic, claiming that Europe is now a victim of chaos supposedly created by its own support for Ukraine.
The ministry said the dominant thesis in Russian messaging is that sabotage is being carried out by citizens of EU countries themselves, allegedly expressing growing frustration and opposition to their governments’ policies on Ukraine and Russia.
⚠️ Uwaga na dezinformację dotyczącą sabotażu polskich linii kolejowych.
W internecie pojawia się fałszywy przekaz, który próbuje przerzucić na Ukrainę odpowiedzialność za sabotaż polskich linii kolejowych i podważyć pracę polskich służb.
Polskie służby monitorują przestrzeń… pic.twitter.com/aLS2L1WCC6
— Ministerstwo Cyfryzacji (@CYFRA_GOV_PL) November 18, 2025
Data collected by specialists showed that between November 16 and 18 Polish-language online spaces carried a wave of posts about damage to railway tracks on the Warsaw-Lublin line, soon described as an “act of sabotage.”
These messages were amplified by accounts on the X platform and by Telegram channels, particularly those with clearly pro-Russian and anti-Ukrainian profiles.
Officials reported a noticeable spread of narratives accusing Ukrainian security services of sabotage.
After Polish authorities confirmed that an “act of sabotage” had taken place, these narratives intensified on both X and Telegram.
Numerous posts appeared that downplayed Russia’s role and shifted accusations toward Ukraine, often using highly emotional language.
In the last 24 hours, according to the ministry, more aggressive and openly pro-Russian messages have appeared that link the sabotage exclusively to Ukraine.
💬 Mamy do czynienia z celową, strukturalnie wykorzystywaną dezinformacją, której celem jest podsycanie emocji w Polsce. Za wieloma z tych działań stoją rosyjskie trolle i służby, często wspierane przez stronę białoruską. Na stronie Ministerstwa Cyfryzacji można zobaczyć, jak… pic.twitter.com/l6NUgoukZe
— Ministerstwo Cyfryzacji (@CYFRA_GOV_PL) November 19, 2025
The statement listed examples of disinformation slogans circulating online, including claims such as “Ukrainian agents are working fast. They want to block the transit that Poland lives off,” “Ukrainian services have thousands of agents in Poland,” and accusations that “blowing up the tracks is the work of Ukrainian terrorists.”
Some posts used even more extreme language, including the slogan “Poland and Russia together against Ukraine,” which the ministry described as a classic element of Russian propaganda operations designed to fracture support for Kyiv.
False claims also spread that “German media warned Polish rail operator PKP about possible sabotage several days earlier.”
According to the ministry, this narrative appears aimed at undermining trust in Polish services, suggesting that information was concealed, and at further strengthening suspicions directed at Ukraine.
Officials said the escalation of messaging followed a pattern typical of disinformation campaigns of pushing an alternative narrative, and direct accusations against Ukraine.
Since the official confirmation of sabotage, the rhetoric has hardened significantly, with phrases such as “Ukrainian terrorist attack on Poland” now appearing in some posts.
Experts at the ministry say the behavior of pro-Russian accounts suggests an attempt to coordinate activity across both X and Telegram, or at least a rapid effort to join the discussion and inflame emotions against Ukraine.
Image: Polskie Radio
The warnings come after two acts of sabotage on the busy Warsaw-Lublin rail route.
In the first incident, an explosive device destroyed tracks, in what investigators believe may have been an attempt to derail a train.
In a separate incident, a passenger train carrying 475 people was forced into an emergency stop because of damage to the rails.
Prosecutors have opened an investigation into acts of sabotage of a terrorist nature in connection with the damaged infrastructure.
On Tuesday, speaking in the Sejm, the lower house of the Polish parliament, Prime Minister Donald Tusk said that individuals suspected of involvement in the railway sabotage were Ukrainian citizens working with Russian services.
He added that he had asked the foreign ministry to launch immediate diplomatic steps to secure the extradition to Poland of those suspected of the terrorist attack.
As a result of the investigation, we now know it was the Russian Secret Services that commissioned the blast of the Polish railway and recruited two Ukrainians to do it. We also know the identities of the perpetrators who immediately fled Poland for Belarus.
— Donald Tusk (@donaldtusk) November 18, 2025
The Washington-based Institute for the Study of War (ISW) said on Tuesday that the sabotage attacks on Poland’s rail network were part of Russia’s intensifying campaign to destabilize Europe.
(rt/gs)