Four individuals have been charged in connection with an attempted railway bombing in eastern Poland, an incident now believed to be linked to foreign intelligence services. Prosecutors accuse the suspects of assisting in a terrorist act and cooperating with an external spy agency. The case has raised concerns about the scale of Russian covert activity in the region amid ongoing tensions caused by the war in Ukraine.

Ukrainian Citizens from Donbas Acting for Russian Intelligence

According to investigators, the group consists of three men and one woman, all originally from the Donbas region of eastern Ukraine. The suspects had been living in Poland for some time and are believed to have been recruited by Russian intelligence via online communication platforms.

Onet reports—citing a source within Poland’s security services—that the group operated in a “compartmentalized structure”: the members did not know each other’s identities, and each was assigned a different task. One of these tasks involved procuring and delivering the explosives used in the attempted sabotage of railway tracks near Warsaw.

A Near Miss on the Tracks

The incident, which occurred on railway infrastructure under the capital, could have caused a significant disaster. Investigators suggest the group attempted to detonate explosive materials on the tracks, but the operation ultimately failed.

Two hypotheses are currently under consideration. The first posits that the group intended to derail a train but made an operational error. The second suggests the act was designed primarily as psychological warfare—a demonstration meant to intimidate the public and signal ongoing Russian influence operations inside Poland.

Security analysts note that this incident fits into a broader pattern of Russian hybrid activities across Europe, including sabotage attempts, cyberattacks, and misinformation campaigns. Polish authorities have previously reported provocations on or near railway lines, including planted dummy ammunition and suspicious gatherings near critical infrastructure.

Recruitment and Modus Operandi

According to the preliminary investigation, the suspects were recruited through anonymous internet channels often used by Russian handlers to reach vulnerable or financially struggling individuals in neighboring countries. Once selected, the operatives were given isolated assignments, reducing the risk that they could identify each other or reveal details of the broader operation.

“Each person had a clearly defined role, including obtaining and transporting explosive materials to the railway site,”.

Proceedings and Ongoing Investigation

All four suspects have been placed in pre-trial detention. Prosecutors are awaiting judicial decisions on the next steps, while counterintelligence agencies continue to analyze evidence and trace potential links to other recent incidents.

Authorities are also investigating whether the operation was part of a larger network, potentially connected to attempts to disrupt logistics corridors that support Ukraine’s defense effort.

Given Poland’s role as a major transit hub for military and humanitarian supplies bound for Ukraine, any disruption to railway infrastructure is viewed as a threat not only to domestic safety but also to broader European security.

The investigation remains ongoing.