Arrests in Warsaw and Bucharest Reveal Deepening Kremlin-Linked Network Targeting EU Infrastructure and Transit Support for Ukraine

In a striking escalation of Europe’s shadow conflict, authorities in Poland and Romania have arrested three Ukrainian citizens in connection with what investigators describe as a Russian-orchestrated sabotage and espionage network aimed at European infrastructure and transport corridors supporting Ukraine. The revelations highlight how Moscow’s covert operations are increasingly targeting the arteries of Europe’s logistical and defense systems.

Officials in both countries confirmed that the arrests were part of coordinated security sweeps following intelligence warnings about attempts to disrupt key supply routes. The individuals — one detained in Poland and two in Romania — are suspected of conducting reconnaissance, transferring materials, and preparing devices intended to damage or disrupt critical infrastructure.

A web of espionage across borders

Poland’s National Prosecutor’s Office said the detained suspect is linked to a wider group working under the direction of Russian intelligence services. Investigators allege the network was gathering information about transport hubs, energy facilities, and military convoys supporting Ukraine’s defense. The Polish Internal Security Agency (ABW) has intensified such investigations in recent months, with dozens of suspects already facing charges of espionage or sabotage.

In Romania, authorities reported that the two arrested Ukrainians had deposited parcels containing improvised explosive devices with an international courier company. The packages were intercepted and neutralized before reaching their destinations. Security sources believe the parcels were part of a plot to ignite small-scale but symbolically disruptive incidents designed to undermine confidence in European logistics systems.

Officials say the two cases are connected and form part of a wider intelligence picture involving networks operating across several EU and NATO member states.

Why Poland and Romania?

The focus on Poland and Romania underscores their critical role in the European security landscape. Poland serves as the main overland conduit for Western military and humanitarian assistance to Ukraine, while Romania’s Black Sea ports and Danube routes have become lifelines for trade and energy flows into and out of the embattled country.

Analysts say disrupting these routes could slow the transfer of ammunition, equipment, and supplies — while sowing fear within European transport sectors already strained by the war. “This is hybrid warfare at its most insidious,” one European security official told reporters. “The aim is to cause uncertainty and self-doubt within the systems that keep Ukraine connected to the West.”

Sabotage by parcel: a new front

Investigators in both countries have drawn attention to the evolving tactics used by suspected Russian proxies. Instead of large-scale attacks, operations increasingly rely on civilian networks — such as freight and courier services — to move or deliver explosive or incendiary materials. Such methods blur the line between military and civilian targets, making detection and prevention far more difficult.

The approach reflects a strategic shift toward “distributed disruption,” where even minor acts — a fire at a rail depot, an unexplained explosion at a warehouse — can have an outsized psychological and logistical impact. By targeting Europe’s infrastructure indirectly, Moscow can pressure EU states without open confrontation.

Political tremors and diplomatic caution

The arrests have already sparked political ripples across European capitals. Both Warsaw and Bucharest have pledged transparency while reaffirming coordination with NATO allies and Ukrainian authorities. The involvement of Ukrainian nationals complicates the narrative, potentially providing Moscow with propaganda fodder to claim that “Kyiv cannot control its own agents.”

However, early intelligence assessments suggest the suspects were recruited or coerced by Russian handlers operating through criminal intermediaries. Western analysts note that Russian intelligence has increasingly relied on non-Russian nationals — particularly from neighboring countries — to obscure its footprint inside the EU.

Kyiv has publicly condemned any such operations and vowed to assist in the investigation. Ukrainian officials emphasized that Russia’s use of Ukrainian nationals for sabotage is a deliberate tactic meant to fracture trust between allies.

The broader European concern

These developments come amid growing warnings from Western intelligence services that Russian hybrid activity inside the EU is expanding. From cyberattacks and disinformation to arson and rail sabotage, Moscow’s efforts to weaken European resolve are no longer limited to propaganda. Security agencies in Germany, the Czech Republic, and the Baltic states have also reported attempts to infiltrate logistics and energy infrastructure.

For Poland and Romania — frontline NATO states — the arrests serve as a stark reminder that the war’s boundaries are porous. The frontlines may lie hundreds of kilometers to the east, but the contest for control increasingly extends into Europe’s civilian backbone: its railways, ports, and supply networks.

The new invisible front

Experts warn that these operations mark the emergence of a “second front” in Europe’s defense of Ukraine — one fought not with tanks or missiles, but through sabotage, espionage, and coercion. The goal is not only to damage infrastructure but to exhaust Europe’s vigilance, forcing allies to divert resources from open military aid to internal security.

The arrests in Poland and Romania suggest that European governments are beginning to adapt. Intelligence sharing between NATO members has intensified, with new emphasis on transport and energy security. Logistics operators are now working with counter-terrorism units to identify suspicious patterns within freight and courier systems.

The road ahead

While officials remain cautious, the exposure of this network may deter future attempts — at least temporarily. But few believe the threat will disappear. As one senior European security source put it, “For Russia, the war in Ukraine is not confined to the battlefield. It extends to every route, every shipment, and every signal that connects Europe to Kyiv.”

The battle for Ukraine’s future, it seems, is increasingly being fought on Europe’s own soil — through the shadows of its infrastructure, and in the quiet vigilance of those guarding it.