On October 21, 2025, authorities in Poland and Romania announced the detention of three Ukrainian nationals accused of collaborating with Russian intelligence services in a covert plot to smuggle explosives into Ukraine. The arrests, which form part of a sweeping investigation into sabotage and espionage across Europe, underscore the growing threat posed by Russian intelligence operations targeting countries that openly support Ukraine in its ongoing conflict with Moscow.
The alleged plot, as detailed by the Polish National Prosecutor’s Office and reported by multiple news outlets including Associated Press, Ukrinform, and RFM24, centered on a group of Ukrainians working on behalf of Russian agencies. Their mission: to send shipments containing explosive and incendiary materials, designed to ignite or detonate during transit, into Ukraine. The intended effect was both chilling and strategic—intimidate populations, disrupt supply chains, and destabilize European Union countries providing aid to Kyiv.
One of the suspects, identified as 21-year-old Danylo H., lived near Warsaw and worked in a warehouse. According to the Polish National Prosecutor’s Office, Danylo H. and his colleagues—also Ukrainian nationals—mapped out a route for transporting the dangerous cargo through Poland and Romania. Their plan unraveled when authorities, acting on intelligence, apprehended Danylo H. in Poland and his two alleged accomplices in Bucharest, Romania.
Romanian authorities described the operation in stark terms. The country’s intelligence agency, SRI, stated that the two Ukrainians arrested in Bucharest, aged 21 and 24, acted under the direct coordination of Russian secret services. The pair had deposited parcels containing improvised explosive devices at an international courier company. Thanks to swift intervention by Romanian intelligence specialists, the devices were safely defused before any harm could occur. The suspects were placed under preventative arrest for 30 days by a local court, while the Warsaw District Court ordered a three-month detention for Danylo H. on October 17, 2025.
Polish Prime Minister Donald Tusk addressed the arrests on social media, confirming that eight individuals had been detained in recent days on suspicion of preparing acts of sabotage across various regions of Poland. Tusk emphasized the seriousness of the threat, noting that “further operational activities are ongoing.”
Tomasz Siemoniak, Poland’s minister coordinating special services, elaborated on the scope of the investigation. He explained that the suspects were involved in “conducting reconnaissance of military facilities and critical infrastructure, preparing resources for sabotage, and directly carrying out attacks.” The Polish National Prosecutor’s Office echoed these concerns, stating that the group’s ultimate aim was to intimidate the population and destabilize EU member states that support Ukraine.
Jacek Dobrzynski, spokesperson for Poland’s Special Services, told reporters that the three Ukrainian nationals among the eight arrested had “created a sort of network to transport explosives across Poland and Romania to Ukraine.” He also highlighted that, over the past several months, the Polish Internal Security Agency (ABW) had detained a total of 55 individuals suspected of acting against the country in the interests of Russia. “These people who acted to the detriment of Poland have all been charged under Article 130 of the penal code, which pertains to espionage and sabotage,” Dobrzynski said.
The pattern of Russian-directed sabotage and espionage is not confined to Poland and Romania. According to data collected by The Associated Press and corroborated by European security agencies, Moscow and its proxies have staged dozens of attacks and incidents across the continent since Russia’s full-scale invasion of Ukraine in February 2022. These incidents have ranged from the seemingly minor—such as stuffing car tailpipes with expanding foam in Germany—to the more alarming, including arson attacks on stores, hacking campaigns targeting politicians and critical infrastructure, and even attempts to plant explosives on cargo planes. In one notable case earlier in 2025, six German military trucks were set ablaze in Erfurt, an act widely suspected to be Russian sabotage.
Romanian prosecution unit DIICOT provided further details on the recent arrests, noting that the two Ukrainians in Bucharest had left packages containing explosives at an international delivery company. The operation was foiled before any shipment could reach its destination, preventing potential tragedy in Ukraine or along the transport route.
Polish officials have repeatedly described the country as being on the “front line” of a “hybrid war” waged by Russia—a campaign that blends traditional espionage with sabotage, cyberattacks, and disinformation. “Russian special services are constantly active. Poland is on the front line,” Dobrzynski emphasized, adding that Russian operatives often recruit Ukrainians and Belarusians living in Poland, usually for financial incentives rather than ideological reasons.
To counter these ongoing threats, Poland has stepped up efforts to educate its citizens and residents about the tactics used by Russian intelligence. Informational materials are now distributed at border crossings, explaining how Russian agents may attempt to make contact and where to report suspicious approaches. This preventative strategy reflects a broader recognition that Moscow’s intelligence network is expanding across Central and Eastern Europe, with a particular focus on logistics routes, energy infrastructure, and military facilities in NATO countries.
The broader European context is equally fraught. Several EU countries have reported a surge in drone incursions this autumn, leading to airport closures in Germany and Denmark. In response, the European Union is considering the development of a “drone wall” on its eastern borders to counter the threat posed by cheap, weaponized drones—an acknowledgment that traditional, multimillion-euro air defense systems are ill-suited to the evolving nature of hybrid warfare.
Other European nations have also faced similar challenges. In September, Lithuanian prosecutors dismantled a Russia-linked network planning arson and explosive attacks in multiple EU states. Latvia’s security service recently detained a man suspected of passing military intelligence to Russia, while British authorities arrested three individuals accused of running sabotage and espionage operations for Moscow. The United Kingdom, in particular, has repeatedly accused Russia of orchestrating sabotage and spy activities on its soil and beyond—a charge the Kremlin routinely dismisses as “Russophobia.”
Against this backdrop, Polish Prime Minister Donald Tusk has pledged to urgently upgrade the country’s air defenses, especially after NATO forces shot down several drones over Polish territory last month. The EU’s preliminary agreement on the European Defence Industrial Programme (EDIP), which allocates €1.5 billion for 2025-2027 to boost defense capabilities and cooperation with Ukraine, is just one example of the bloc’s determination to meet this challenge head-on.
As the investigation into the Ukrainian suspects and their Russian handlers continues, authorities across Europe remain on high alert. The recent arrests in Poland and Romania serve as a stark reminder that the battle lines of modern conflict are as much about clandestine networks and sabotage as they are about open warfare. For now, vigilance, intelligence sharing, and international cooperation appear to be the best tools available to keep these threats at bay.
