FACT-CHECK: Poland warns of Russia exploiting Ukrainian refugees as hybrid weapons

Introduction: When Russia turns refugees into shadow soldiers

Poland's July 1 alert

On July 1, 2026, Poland's Minister-Coordinator of Special Services, Tomasz Siemoniak, issued a serious public warning: Russia is actively using Ukrainian refugees living in Poland to run influence operations, undermine trust in President Volodymyr Zelensky, and stoke tensions between Warsaw and Kyiv. The declaration, made on Polish radio station RMF FM and picked up by European Pravda, comes against a backdrop of already complex diplomatic tensions between the two countries.

Behind the warning lies a documented mechanism: Poland's Internal Security Agency (ABW) confirmed it has "identified a recruitment mechanism" used to enlist Ukrainians in Poland for actions financed and initiated by Moscow. This is no longer theory. These are arrests, expulsions, and dismantled operations. Eleven individuals — nine Ukrainian citizens and two Belarusians — have been detained and are being expelled.

Why this fact-check matters

When claims this grave are made, it is essential to distinguish what is established and verified from what amounts to inference or political narrative. Hybrid wars feed precisely on the confusion between facts and interpretations. My role here is not to blindly validate the Polish minister's statements — it is to examine them with rigor, cross-reference sources, and identify the limits of what can be stated with certainty.

This fact-check draws on public statements made by Siemoniak on RMF FM, ABW findings, and reports from Ukrainian Pravda, the Kyiv Post, and Euromaidanpress. All claims are classified by verification level — confirmed fact (F), cautious inference (I), or editorial framing (E).

Claim 1: Russia is using Ukrainian refugees in Poland as influence agents

What Minister Siemoniak said — exactly

Tomasz Siemoniak stated on RMF FM: "Of course, yes. This information war has reached a significantly higher level. Right now, it is very easy to stoke the embers, and that is a problem, because Russia's dream has always been and remains to maximize tensions between Poland and Ukraine. We must keep in mind that Russian intelligence services will try to exploit these tensions." He specified that the mechanism aims to "undermine the trust of Ukrainians in Poland in the current Ukrainian authorities and President Zelensky" and to "stoke tensions in Polish-Ukrainian relations."

Verdict on this claim: PARTIALLY CONFIRMED (F+I). The arrests are a documented fact. Attribution of the operation directly to Russian intelligence command is confirmed by the ABW — but the detailed chain-of-command evidence has not been fully made public for understandable operational reasons. The complete causal link remains a strong inference by Polish intelligence, not a public judicial proof at this stage.

The ABW confirms: a mechanism identified

Poland's Internal Security Agency (ABW) published its own conclusions: it "identified a mechanism using Ukrainian refugees in Poland for actions initiated and financed by Russia." This is not a political allegation — it is an official conclusion from a counterintelligence service. That distinction matters.

The mechanism described involves recruiting Ukrainians for "paid participation in rallies" on Moscow's instructions. In plain terms: paid demonstrators, recruited from the Ukrainian diaspora, acting on Russian orders to create the appearance of an organic opposition to Ukrainian authorities from abroad. This is a textbook move from Russia's disinformation playbook — but applying it to refugees fleeing the very war Russia launched represents a new level of cynicism.

Claim 2: Nine Ukrainians and two Belarusians have been arrested in Poland on these grounds

The arrests: a documented fact

Verdict: CONFIRMED (F). Tomasz Siemoniak publicly confirmed that 11 individuals — nine Ukrainian citizens and two Belarusians — have recently been detained in Poland and are being expelled. These individuals are accused of having recruited Ukrainians for "paid participation in rallies" on Russian instruction.

It was not specified whether formal criminal proceedings have been initiated or whether administrative expulsion is the only measure being taken. In the context of Polish anti-espionage legislation and extradition conventions, administrative expulsion is often preferred over a public trial that would expose intelligence methods. The absence of a trial does not mean an absence of evidence — it means services chose operational discretion.

The context of Russian influence operations in Central Europe

This is not an isolated incident. In 2023-2024, several European countries — including Germany, Latvia, Estonia, and the Czech Republic — documented similar Russian influence operations targeting Ukrainian diasporas and Russian-speaking minorities. The bot-farm networks associated with these operations are now well documented by organizations such as the EU Disinformation Lab and the Global Disinformation Index.

What is new here is the intensity and specific targeting: tensions between Poland and Ukraine — real, historically complex, fueled by disagreements over Volhynia, agricultural policy, and migrant workers — offer a particularly fertile ground for Russian interference. Moscow does not invent these tensions: it buys them, amplifies them, and weaponizes them.

Claim 3: Russian bot farms intensified their activity around the Zelensky-Nawrocki tensions

What the Polish minister confirms and qualifies

Siemoniak explicitly confirmed that Russian bot farms have "considerably intensified their activity" around tensions between Polish President Karol Nawrocki and Ukrainian President Zelensky. Verdict: CONFIRMED by official statement (F), but the underlying technical data is not public.

What is publicly known: tensions between Nawrocki and Zelensky peaked visibly on Polish and Ukrainian social media in June 2026. Coordinated accounts, tracked by independent analysts such as those at the Digital Forensic Research Lab (DFRLab), amplified certain exchanges by taking them out of context to maximize inflammatory effect. Russia had an objective interest in that amplification — a strong inference (I), even though direct attribution evidence remains classified.

The structural vulnerability of Polish-Ukrainian relations

Understanding why this operation specifically targets Poland requires confronting history. Tensions between the two countries are not a Russian invention — they have deep roots, notably around the memory of Volhynia (1943-1945), the presence of Ukrainian workers on the Polish labor market, and recent political disagreements. Russia does not create these fractures — it buys them, amplifies them, and arms them.

Poland is simultaneously one of Ukraine's greatest military and humanitarian supporters since 2022 — it has taken in more than 1.5 million Ukrainian refugees — and a country with which Kyiv maintains sometimes tense relations. Destabilizing that relationship is a first-order Russian strategic objective. If Poland turns against Ukraine, the entire eastern flank of NATO begins to wobble.

Claim 4: Moscow wants to "maximize tensions between Poland and Ukraine"

Siemoniak's exact quote and its context

The phrase is directly attributed to the Polish minister: "Russia's dream has always been and remains to maximize tensions between Poland and Ukraine." Verdict: CONFIRMED OFFICIAL STATEMENT (F) — Siemoniak said it. The question is: is he right? Historical and geopolitical analysis suggests yes, with a very strong convergence of circumstantial evidence.

Declassified documents from Western intelligence services, reports from think tanks such as the Centre for European Policy Analysis (CEPA) and Bellingcat analyses confirm a consistent Russian strategy of sowing division among Ukraine's allies. Poland holds a particular place in that strategy: the largest conventional military power in Central Europe, the principal logistics corridor for aid to Ukraine, a NATO member with the longest borders with the relevant post-Soviet space.

The precedents: a documented strategy on other fronts

The same strategy has been documented elsewhere: in Finland (migrants instrumentalized at the border in 2023-2024), in Estonia (cyberattacks coordinated with domestic political tensions), in Moldova (interference in the 2024 elections). In every case the pattern is identical: identify an existing internal fault line, amplify it through paid or manipulated actors, exploit the moment of crisis to push narratives favorable to Moscow.

In Poland, the targeted fracture is twofold: on one side, the historical Polish-Ukrainian tensions; on the other, resistance among part of the Polish electorate to permanently hosting refugees in a difficult economic climate. Russia is playing both tables simultaneously — with a sophistication that should concern capitals well beyond Warsaw.

Claim 5: The operations specifically target trust in Zelensky

Undermining presidential legitimacy as an objective

Siemoniak specified that one of the central goals of the operation is to "undermine the trust of Ukrainians in Poland in the current Ukrainian authorities and President Zelensky." Verdict: CONSISTENT WITH PRECEDENTS (F+I). This target is logical within Russia's strategy: weakening Zelensky's legitimacy abroad reduces the credibility of Ukrainian requests for international support and creates divisions within the diaspora.

Documented Russian disinformation operations — notably the Secondary Infektion and Ghostwriter campaigns, attributed to Russian services by the EU External Action Service — have always targeted the credibility of pro-Western Ukrainian leaders. Zelensky is a priority target precisely because his international popularity is a considerable diplomatic asset for Ukraine. Weakening him means weakening support for the war.

Disinformation for internal use: Ukrainians against Ukrainians

The refinement of this operation is that it primarily targets a Ukrainian audience, not a Polish one. By recruiting Ukrainians to spread anti-Zelensky messages within the Ukrainian community in Poland, Moscow creates the illusion of organic intra-Ukrainian opposition. A Ukrainian in Krakow or Warsaw who reads criticism of Zelensky written or funded by compatriots — without knowing they are paid by Moscow — is more likely to believe it than obvious pro-Russian messaging.

This is the characteristic sophistication of modern influence operations: never appear as the author, always as the amplifier. The apparent source is Ukrainian. The funding is Russian. The narrative is Muscovite. The result: seemingly authentic disinformation, difficult to counter without appearing to silence the Ukrainian diaspora itself.

Claim 6: The information war has reached a "significantly higher level"

The minister's formulation and what it reveals

"This information war has reached a significantly higher level," declared Siemoniak. Verdict: CONSISTENT WITH AVAILABLE DATA (I). Without access to ABW classified data, it is impossible to precisely quantify "higher" relative to what reference period. But organizations tracking Russian influence operations in Europe — notably EUvsDisinfo, the Alliance for Securing Democracy, and the Helsinki Centre — all document an intensification since the start of 2026.

Observable correlations include: an increase in coordinated accounts on TikTok targeting the Ukrainian diaspora in the Ukrainian language since January 2026; a multiplication of fake opinion pieces attributed to fake "Ukrainians in Poland" criticizing Zelensky; growing use of paid influencers in countries hosting Ukrainian refugees. These elements are documented by independent bodies, not solely by Polish services.

Poland as a laboratory for a European-wide strategy

What is happening in Poland is not isolated — it is a case study that Russia could replicate in every country hosting Ukrainian refugees: Germany (more than one million Ukrainian refugees), the Czech Republic, Italy, Spain. Every Ukrainian diaspora community is a potential target for this type of operation. The Polish warning must resonate in every European capital, not only in Warsaw.

Poland's response — arrests, expulsions, public communication by the minister — is a model of democratic response: transparency about the threat, legal action, public awareness. It deserves to be replicated across all affected countries, with European coordination that is still lacking.

What this fact-check cannot confirm

The legitimate zones of uncertainty

This fact-check has limits that must be named clearly. First: the detailed evidence of the Russian command chain behind these operations remains classified. Siemoniak says the ABW has "identified the mechanism" — but the underlying technical files are not public. Attribution to specific Russian services (GRU, FSB, SVR?) remains unknown to the public.

Second: we do not know whether the 11 arrested individuals were conscious agents, manipulation victims, or opportunists recruited without knowing the true origin of the funding. That distinction matters morally and legally. Third: the real scale of the operation — how many agents are still active, what financial infrastructure exists, what coordinator network — remains unknown to the public. What we see is the exposed tip of an iceberg whose size is undetermined.

What can be stated with certainty

At the conclusion of this fact-check, here is what is established with a high level of confidence: (1) individuals recruiting Ukrainians for paid demonstrations were arrested in Poland; (2) Polish services attribute this operation to Russia; (3) the declared objective is to destabilize Polish-Ukrainian relations and undermine trust in Zelensky; (4) this type of operation is consistent with Russia's historically documented playbook elsewhere.

What is carefully inferred (I) but not publicly proven: the precise level of Russian intelligence involvement, the identity of the coordinators, the exact scope of the still-active network. These uncertainties do not refute the alert — they call for vigilance and patience as more complete data becomes available.

The institutional responses required

What Warsaw has done — and what remains

Poland has responded exemplarily: clear public communication from the minister, documented arrests, expulsions underway. The logical next step is enhanced cooperation with Ukrainian services to identify the coordinators on the Moscow side and any potential accomplices still unidentified on Polish soil. That cooperation requires mutual trust — which is precisely what Moscow is trying to destroy.

At the European level, the EEAS (European External Action Service) and Europol should take this case as a pilot to develop shared protocols for counter-interference in Ukrainian diaspora communities. What happened in Poland can happen in Germany tomorrow, in France the day after. Prevention demands cooperation.

Ukraine's response and the question of trust

The revelation of these operations places Ukraine in a delicate position: it needs Poland as an ally and logistics corridor, but must also acknowledge that Ukrainian citizens were recruited into operations directed against its own interests. The Zelensky government must handle this with full transparency — disavowing these individuals without stigmatizing the diaspora as a whole, while fully cooperating with Polish services.

Russia is counting precisely on this episode creating tensions, mistrust, and mutual accusations. The best response is displayed cooperation and joint condemnations. Siemoniak said: "We must keep in mind that Russian intelligence services will try to exploit these tensions." That is a call for shared vigilance, not mutual suspicion.

The broader geopolitical context of hybrid war

Russia is fighting several wars simultaneously

What Siemoniak describes fits a global strategy that analysts call "full-spectrum warfare" or "hybrid war": Russia is not fighting only on the military battlefield in Ukraine. It is simultaneously fighting in the information space (disinformation), the economic space (energy, sanctions), the political space (electoral interference), and now the diaspora space. Every Ukrainian refugee in Europe is potentially both a target and a vector.

This reality imposes a dual obligation on European governments: protect the refugees — the vast majority are perfectly innocent, victims of the same Russia — while identifying the infiltrated or recruited elements. That is a delicate balance requiring sophisticated intelligence services and close international cooperation. Neither collective paranoia nor institutional naivety are acceptable responses.

NATO facing the permanent hybrid challenge

The NATO summit scheduled for July 7-8, 2026 in Ankara should place hybrid warfare directed against Ukrainian diasporas on its agenda. Allied countries hosting Ukrainian refugees share a common vulnerability and must develop shared responses: intelligence sharing on influence networks, training law enforcement to detect these operations, public communication protocols for exposing operations without fueling stigmatization.

NATO's Strategic Communications Centre of Excellence (StratCom) in Riga already has the analytical tools to support this mission. What is missing is the political will to translate analysis into coordinated preventive action. The Polish case provides a concrete instance that should accelerate that awakening.

The implications for future elections across Europe

The diaspora as a targeted electoral battlefield

Ukrainian refugees in Poland are not only an influence target for Ukrainian-Polish questions — they are also a potential target for shaping Polish elections themselves. A Ukrainian diaspora divided, distrustful of Zelensky, agitated by Moscow-funded demonstrations, can contribute to destabilizing Polish political debate ahead of important electoral deadlines.

Poland faces significant internal political tensions between the government of Donald Tusk, backed by a pro-European majority, and a more nationalist opposition. Russia has an objective interest in weakening the Tusk government, one of Ukraine's firmest supporters in Europe. Destabilizing Polish-Ukrainian relations is therefore also a Polish electoral issue — that double effect makes this operation a strategic priority for Moscow.

The democratic stakes beyond Poland

More broadly, using refugees as influence instruments raises a fundamental democratic question: how do liberal democracies protect their public space from organized foreign interference without becoming surveillance states? The tension between freedom of expression, refugee protection, and national security is real and cannot be resolved with slogans.

Poland's response — targeting the recruiters, not the recruited; expelling identified agents, not stigmatizing the diaspora — points in the right direction. But it requires a surgical precision that not every government is necessarily equipped to exercise. That is where international cooperation becomes indispensable: sharing methods, not just alerts.

Final verdict of the fact-check

Summary of verdicts by claim

Claim 1 — Russia is using Ukrainian refugees as influence agents in Poland: PARTIALLY CONFIRMED (F+I). Arrests are documented, attribution to Moscow comes from Polish ABW, detailed evidence remains classified. Claim 2 — Eleven people arrested: CONFIRMED (F). Official ministerial statement. Claim 3 — Bot farms intensified around Zelensky-Nawrocki: CONFIRMED by official statement (F), technical data not public. Claim 4 — Russian objective to maximize Polish-Ukrainian tensions: CONFIRMED OFFICIAL STATEMENT consistent with precedents (F+I). Claim 5 — Targeting trust in Zelensky: CONSISTENT with documented precedents (F+I).

Overall verdict: Siemoniak's alert is credible, consistent with known patterns of Russian hybrid operations, and partially confirmed by verifiable facts. It is not proven in every detail — which is normal for ongoing operations involving classified intelligence. The level of public evidence available justifies taking this alert seriously, but not a definitive verdict without a transparent trial.

What Moscow hopes you do after reading this article

Moscow hopes you doubt everything: Siemoniak, the ABW, Ukraine, this fact-check itself. That is the purpose of modern disinformation operations — not to convince you of an alternative narrative, but to plunge you into a fog of uncertainty where nothing is true and inaction becomes the default response. The best answer is precisely what you just read: a rigorous examination of the facts, an admission of limits, and an honest conclusion.

Russia's hybrid war is not won through paranoia or naivety. It is won through accuracy, cooperation, and democratic vigilance. What Siemoniak did on July 1, 2026 by speaking publicly — that is exactly it. And it deserves to be heard.

Ukraine in hybrid war: how Kyiv pushes back against disinformation

Ukraine's counter-response against Russian manipulation of its diaspora

Kyiv has not been passive in the face of these operations. Since 2022, the Ukrainian government has maintained a Centre for Countering Disinformation attached to the National Security Council, tasked with documenting and countering Russian influence campaigns. The centre has published several reports detailing similar operations targeting Ukrainian diasporas in Germany, the Czech Republic, and the United Kingdom. Cooperation with Polish services on the operation documented by Siemoniak fits within that broader framework.

Zelensky himself has repeatedly stated that Russia invests as much in psychological warfare as in kinetic warfare. Every Ukrainian soldier who fires a shell costs Moscow money. Every anti-Zelensky narrative spread within a diaspora costs a few dollars. The economic asymmetry between physical war and information war is one of the reasons why Russia invests massively in hybrid operations.

Transparency as a weapon: the Siemoniak case

By choosing to speak publicly on RMF FM rather than quietly managing the arrests, Siemoniak adopted a deliberate strategy of offensive transparency. Revealing the existence of the Russian operation partially neutralizes it: it exposes the mechanism, inoculating public opinion against future messages from the same network. This is an application of the "pre-bunking" principle — exposing the manipulation before it settles in people's minds.

This approach is endorsed by researchers at the MIT Media Lab and the University of Cambridge, whose work on pre-bunking shows that exposing disinformation mechanisms before they reach individuals significantly reduces subsequent vulnerability. Siemoniak delivered public counter-espionage journalism — and that is exactly what Europe needs.

Conclusion: Truth as the first line of defense

What this fact-check reveals about modern hybrid warfare

At the end of this exercise, one certainty stands: Russia's hybrid war is sophisticated, systematic, and adapted to the specific vulnerabilities of each target. It does not strike at random — it seeks fractures, tensions, collective wounds, and precarious communities. Ukrainian refugees in Poland meet several of those criteria at once: displaced, sometimes economically precarious, attached to their country but physically distant from it, naturally sensitive to front-line news and controversies about their government.

Understanding that mechanism is already partial protection against it. Siemoniak's transparency about these operations is itself a countermeasure: an informed population is less vulnerable to manipulation. And a columnist who does the verification work contributes, modestly, to that line of defense.

The duty of vigilance in open democracies

Democracies have a structural vulnerability to hybrid operations: their openness, their freedom of expression, their protection of individual liberties are precisely the gaps that Moscow exploits. The answer cannot be to close those spaces — that would hand Putin an ideological victory beyond his wildest expectations. The answer must be a democracy that is more clear-eyed, faster at detection, better equipped to respond without betraying itself.

What Poland did on July 1, 2026 — naming, documenting, expelling, alerting — is a model. What Europe must now do is learn from that model and deploy it before the next incident, not after.

Final conclusion

Summary of verified facts

At the end of this fact-check: Tomasz Siemoniak's alert of July 1, 2026 rests on verifiable facts — 11 arrests, a "mechanism identified" by the ABW, public statements consistent with documented precedents of Russian hybrid operations. It is credible and serious. It has not yet been proven in every detail — which is normal for ongoing counterintelligence operations.

The appropriate response is neither panic nor indifference. It is clear-eyed vigilance, international cooperation, and a refusal to let Moscow harvest the fruits of its manipulation. Ukraine deserves a Poland that is both allied and clear-sighted — not a Poland divided and suspicious, shaped by Russian intelligence services.

A final call for collective clarity

The next time you see an anti-Zelensky demonstration organized by Ukrainians in Europe, ask yourself: who funds it? Who coordinates it? Who benefits? Those questions are not paranoia — they are basic journalism. And in a hybrid war that specifically targets our ability to distinguish truth from falsehood, asking those questions is the first act of democratic resistance.

Ukraine is holding its front. Europe must hold its own.

By Maxime Marquette, columnist

Columnist's transparency note

My stated biases and methodology

I am Maxime Marquette, an analyst-columnist specializing in geopolitics and defense. I am openly pro-Ukrainian: I believe a Ukrainian victory is in the interest of democracies. This bias may influence my reading of Russian influence operations — I acknowledge it and invite you to account for it. In this article, I deliberately attempted to counter that bias by applying a rigorous fact-check framework with three verification levels (F, I, E).

I have no financial or institutional ties to the Polish or Ukrainian governments, or to any intelligence service. All my sources are public and cited. I do not have access to classified ABW files or those of any other intelligence service.

Limits of this fact-check

This fact-check relies exclusively on open sources available as of July 1-2, 2026. With the Polish investigation ongoing, new elements could modify certain conclusions. I did not directly contact Polish services or the Ukrainian government for additional information — a significant limitation of this exercise. The verdicts in this fact-check are valid as of the publication date and may evolve as legal and administrative proceedings advance.

My method: read primary sources in full, cross-reference information from at least two independent sources, classify each claim by verification level, explicitly acknowledge uncertainties, never attribute quotes I did not find verbatim in the sources consulted.

Sources

Primary sources

Ukrainian Pravda — Poland warns Russia may exploit tensions with Ukraine for sabotage — July 1, 2026

Kyiv Independent — Ukraine war latest news — July 2026

Kyiv Post — Analysis of Russian interference in Poland — July 2026

Secondary sources

Euromaidanpress — Russian hackers and cyber-operations category — 2026

Euromaidanpress — Ukraine news — July 2026

Militarnyi — Ukraine defense news — July 2026