German services detained two Turkish citizens on 12 October over the 23 September arson attack on a Starlink ground station in Wola Krobowska, near Warsaw, Poland’s Internal Security Agency (ABW) said. Both are suspected of arson, and Polish officials blame Russian intelligence. RMF24 later reported that German police also detained two more people who may be connected to the attack.

Poland is one of the main corridors for Western aid to Ukraine, and Polish Foreign Minister Radosław Sikorski has said Poland spends about $50 million a year on Ukraine's Starlink service. That puts Polish infrastructure in the path of a Russian campaign that already hacks cameras to track arms heading east.

Fingerprints, DNA, and a route out

The men were held under European arrest warrants and now await transfer to Poland. Interior Minister Marcin Kierwiński wrote that the suspects would face charges of “subversion, sabotage on behalf of a foreign intelligence service” after their transfer to Poland. Polish authorities issued European arrest warrants for the suspects, who were subsequently detained in Germany.

Działania @PolskaPolicja i @ABW_GOV_PL we współpracy ze służbami niemieckimi (BKA) doprowadziły
do zatrzymania na terenie Niemiec 2 obywateli Turcji odpowiedzialnych za podpalenie stacji Starlink w Woli Krobowskiej. Zarzut-dywersja, sabotaż na rzecz obcego wywiadu. @CBSPolicji

— Marcin Kierwiński (@MKierwinski) October 12, 2026

Police chief Marek Boroń said investigators reconstructed how the suspects prepared the attack and fled. “We have secured recordings pointing to this specific action. We have fingerprints, the perpetrators’ DNA, how they moved, when they came to Poland, and when they were evacuated from our country,” he said. One suspect lives in Germany, and the other had been ordered to leave the country, he added.

Warsaw points at Moscow

Prime Minister Donald Tusk called the fire another act of Russia's hybrid war and promised the saboteurs will answer to Polish justice.

Na zlecenie polskich służb niemiecka policja zatrzymała dwóch obywateli tureckich podejrzanych o podpalenie stacji Starlink na Mazowszu. To kolejny akt wojny hybrydowej. Sprawcy sabotażu odpowiedzą przed polskim wymiarem sprawiedliwości.

— Donald Tusk (@donaldtusk) October 12, 2026

“We have no doubt that Russian intelligence services are behind this act of sabotage,” said Tomasz Siemoniak, the minister coordinating Poland’s special services.

Those services increasingly turn to people tied to the criminal world, he added.

Two more possible links

German counterterrorism officers detained a woman in Berlin, and a man is also in German custody, Polish radio RMF FM reported, citing its reporter. Both may be linked to the arson. The woman allegedly picked up the Turkish men near Łódź after they entered Poland from Germany, then drove them to Wola Krobowska. The man’s role is still being examined.

Poland has launched a nationwide security operation after three knife attacks at educational institutions left one woman dead and more than a dozen people injured. Police have detained 117 people amid a wave of online threats, while intelligence officials are examining whether Russian disinformation networks exploited the violence to spread panic.

Poland is confronting an unprecedented school security crisis after a succession of violent attacks by young people triggered widespread fear, school closures and a nationwide police mobilisation. By Sunday, 11 October, officers had detained 117 people and conducted nearly 64,000 security checks at educational establishments, as the authorities attempted to contain both genuine threats and an escalating campaign of intimidation on social media.

The crisis reached its height on Friday, 9 October, when warnings circulated about a supposed nationwide killing campaign known as “Bloody Friday”. Videos, threatening messages and lists of potential targets spread through TikTok, messaging platforms and school discussion groups, prompting parents to keep children at home and several local authorities to suspend classroom teaching.

Although police have found no evidence of an organised nationwide conspiracy, the violence that preceded the rumours was real. Three separate attacks took place between 7 and 10 October, while investigators are examining hundreds of other incidents involving threats or suspected criminal activity.

Two attacks that triggered nationwide panic

The first major incident occurred on Wednesday, 7 October, at a vocational school in Ostrołęka, north-east of Warsaw. A 19-year-old student armed with a machete attacked pupils, teachers and other people in and around the building, injuring nine victims before harming himself.

Investigators subsequently discovered a homemade explosive device inside his backpack. The suspect was arrested, and prosecutors brought nine charges against him, including attempted murder. The discovery of explosives raised further questions about the extent of his preparations and the possibility of a substantially higher death toll.

The following day, a 15-year-old former pupil entered a primary school in Leszczydół-Nowiny, near Wyszków, and attacked three members of staff with a knife. A 37-year-old caretaker died from her injuries, while two teachers, including the headteacher, were wounded.

According to investigators, the teenager wore a helmet-mounted camera, raising suspicions that he intended to record the assault. The official prosecution statement confirmed the victim’s death and the detention of the suspect.

The attacks were followed by threatening messages from other teenagers, including a video attributed to a 17-year-old in the Przasnysz district who claimed to be participating in a competition involving killings. Police subsequently detained him. In Sierpc, another 17-year-old was arrested after allegedly discussing plans for violence at school; officers discovered two knives.

Thousands of schools under police surveillance

The rumours produced an immediate reaction. Schools in Wyszków, Ciechanów, Pułtusk and other municipalities cancelled classroom teaching or introduced remote lessons. Elsewhere, parents independently withdrew their children, leaving some classrooms largely empty.

Police launched an extensive preventive operation, deploying additional officers around schools and investigating online threats.

According to the figures released on 11 October, the authorities had recorded 275 incidents requiring investigation, detained 117 people and carried out nearly 64,000 checks at schools, nurseries and other educational facilities.

The situation deteriorated further on Saturday, 10 October, when a 21-year-old student attacked three people at a post-secondary educational institution in Warsaw. Two 17-year-old girls and a 24-year-old woman were injured. One victim required hospital treatment, although none of the injuries was considered life-threatening.

Interior Minister Marcin Kierwiński subsequently stated that investigators had established no links between the recent attacks. The authorities nevertheless remain concerned about imitation offences, particularly where threatening material circulates among teenagers through closed online communities.

Russia’s possible role in spreading panic

The events have also raised questions about whether hostile foreign actors deliberately amplified the crisis. Tomasz Siemoniak, Poland’s minister responsible for coordinating the intelligence services, warned that Russian organisations routinely exploit domestic emergencies to spread disinformation and undermine confidence in public institutions.

In his statement on 9 October, Siemoniak acknowledged the possibility of foreign involvement but stressed the need for evidence before assigning responsibility.

There is, at present, no publicly established evidence that Moscow organised the school attacks or directed the subsequent threats. Nevertheless, the rapid circulation of alarming videos, fabricated warnings and unverified target lists illustrates how genuine violent incidents can be exploited to disrupt everyday life without further physical attacks.

The episode also presents a challenge for European regulators. Poland is examining measures against dangerous online content, while its existing obligations under the EU Digital Services Act provide a framework for addressing systemic risks associated with major platforms.

For Donald Tusk’s government, the immediate priority is preventing further attacks as schools reopen under heightened security. The longer-term challenge concerns the interaction between online radicalisation, copycat violence and disinformation capable of transforming isolated crimes into a national emergency.

Intelligence services from five European countries warn that Russia is expanding assassination and sabotage operations against defence manufacturers supplying Ukraine. The threats coincide with an alleged plot against Poland’s prime minister and defence minister, raising concerns about Moscow’s efforts to undermine European military assistance through intimidation and political destabilisation.

European intelligence agencies have warned that Russia is intensifying efforts to assassinate executives of defence companies supplying Ukraine, extending its campaign of sabotage and intimidation into the European military-industrial sector.

According to intelligence assessments obtained from five European security services, Moscow has ordered an expansion of covert operations targeting senior figures at major arms manufacturers and smaller companies producing drones and military components. Germany’s domestic intelligence agency, the BfV, has reportedly advised executives to strengthen personal security, while some manufacturers have already increased protection for senior personnel.

The warnings emerged alongside reports of an alleged assassination plot against Polish Prime Minister Donald Tusk and Defence Minister Władysław Kosiniak-Kamysz. Polish authorities convened an emergency security meeting and subsequently detained a suspect. No connection between the Polish case and Russian intelligence has been established.

Europe becomes Moscow’s principal target

The apparent expansion of Russian covert operations reflects a shift in Moscow’s calculations concerning Western military assistance.

President Vladimir Putin had reason to anticipate that Donald Trump’s return to the White House would weaken American support for Kyiv. Trump repeatedly questioned US military expenditure on Ukraine and advocated a negotiated settlement with Russia. A substantial reduction in American weapons deliveries could have increased pressure on Ukraine to accept Moscow’s territorial demands.

Instead, European governments assumed greater responsibility for sustaining Ukrainian defence capabilities, including financing weapons purchases and expanding domestic production.

The European Union’s €90 billion support programme for 2026–2027 allocates €60 billion to defence procurement and industrial capacity. The EU has also established mechanisms allowing Ukraine to participate in European joint procurement programmes.

Disrupting European manufacturers therefore offers Moscow a means of restricting Ukraine’s military capabilities without directly confronting NATO.

Assassination threats can interfere with procurement even when attacks are never carried out. Large manufacturers can afford extensive security arrangements, but smaller companies producing electronics, drone components and specialised equipment often lack comparable resources.

Intimidation could delay contracts, discourage investment and persuade individual suppliers to withdraw from Ukrainian defence programmes.

Sabotage as an instrument of political pressure

Russia’s alleged interest in targeting defence executives is not unprecedented. In 2024, American intelligence reportedly uncovered a Russian plot to assassinate Armin Papperger, chief executive of Rheinmetall, one of Germany’s principal suppliers of ammunition and military equipment to Ukraine.

As EU Today previously reported, Moscow has also publicly identified European factories involved in Ukrainian drone production, increasing concerns that civilian industrial facilities could become targets of Russian operations.

European authorities have investigated suspected Russian involvement in arson, infrastructure attacks and clandestine networks. An earlier cross-border investigation into alleged assassination and sabotage preparations demonstrated how intermediaries could be recruited to conduct operations while obscuring their sponsors.

Such activity also carries political consequences. Attacks against infrastructure and industrial facilities can reinforce public fears about confrontation with Russia, particularly during elections when parties advocating accommodation with Moscow seek to exploit security concerns.

Poland has already experienced mounting Russian hybrid pressure, including threats to critical infrastructure and information operations intended to aggravate domestic political divisions.

Putin’s strategy against European rearmament

Ukraine’s continuing strikes against Russian refineries and military-industrial facilities have added economic and operational pressures to Moscow’s prolonged war effort. Russia retains substantial military production capacity, but the costs of sustaining the conflict remain considerable.

Interfering with European weapons manufacturing could serve two objectives: restricting Ukraine’s access to equipment and obstructing Europe’s longer-term rearmament.

The Kremlin does not necessarily need European governments to abandon Ukraine formally. Production delays, disrupted contracts and reluctant suppliers could reduce the practical effect of military assistance even while political commitments remain unchanged.

European governments have acknowledged the industrial challenge. In its June conclusions on European defence, the European Council called for accelerated manufacturing capacity, stronger supply chains and closer cooperation with Ukraine’s defence industry.

Russia’s apparent strategy seeks to exploit the dependence of these programmes on private companies and skilled civilian personnel.

The warnings from European intelligence agencies suggest that protecting defence executives, engineers and contractors is becoming part of the continent’s wider security responsibilities.

For Moscow, intimidation offers the possibility of weakening Ukrainian military resistance without an open confrontation with NATO. For European governments, preventing covert operations from disrupting weapons production is increasingly inseparable from their commitment to sustain Ukraine’s defence.

Russia is stepping up its hybrid war against Europe. From sabotage, drone incursions, and arson to plots (mostly foiled) to assassinate pro‑Ukraine activists and Russian dissidents on European soil, the Kremlin is testing the allied response, and incidents against NATO’s European partners are becoming more serious, such as the explosive‑laden drones found this summer at Leipzig Airport in Germany. That gray line between a hybrid attack and a conventional one is blurring, and several European intelligence sources warn of the risk that one of those incidents could escalate — either by a deliberate Kremlin decision or a miscalculation.

Seguir leyendo

© Kateryna Klochko (AP/LaPresse)