Poland hit by disinformation attack after Russian drone incursion

A wave of coordinated disinformation struck Poland after Russian drones entered its airspace in early September, overwhelming social networks with false narratives and anti-NATO messaging. Authorities say the campaign is one of the largest hybrid operations seen in Europe this year.

Russian drones trigger hybrid escalation

In the early hours of 9–10 September 2025, Polish radar detected 19 to 23 drones entering from the east. The Ministry of Defence confirmed that several were downed while others crashed in rural zones. Although unarmed, the drones disrupted civilian air traffic near Warsaw and Lublin and caused minor property damage.

NATO later confirmed the incident as a deliberate provocation rather than a navigational error. Poland invoked Article 4 of the NATO treaty, initiating emergency consultations under Operation Eastern Sentry — a readiness exercise to strengthen defences along the eastern flank. The sequence echoed earlier incursions discussed in KLM Data Breach Highlights Aviation’s Growing Cyberattack Exposure, which detailed vulnerabilities across Europe’s interconnected systems.

Surge in coordinated disinformation

Within hours of the drone event, researchers recorded an explosion of roughly 200,000 social media posts across Polish-language networks. Fact-checkers from Le Monde and Euronews traced many accounts to known pro-Kremlin clusters recycling pre-fabricated narratives.

The campaign’s central claims:

• Ukraine staged the drone incursion to force Poland into war.
• NATO had lost control of its airspace and credibility.
• The Polish government manipulated information to mask incompetence.

These posts flooded domestic channels, often repeating identical phrasing and imagery. Analysts at Poland’s Disinformation Resilience Council described the activity as a “multi-vector hybrid offensive” combining online propaganda with aerial provocation.

Political reaction and internal turbulence

Prime Minister Donald Tusk condemned the manipulation effort, warning that amplification of Russian narratives by domestic figures risked “national destabilization.” Several far-right politicians publicly repeated unfounded claims that the government fabricated parts of the incident. The Prime Minister’s office later released verified radar and recovery imagery to counter misinformation.

NATO Secretary General Mark Rutte reaffirmed alliance unity, stating that “information warfare is now inseparable from kinetic testing.” Officials drew parallels to the persistent operations attributed to ransomware and influence groups like Rhysida: ransomware-as-a-service with multi-sector impact and steady 2025 cadence, where coordinated messaging supports broader strategic goals.

Key metrics from official reporting

Broader hybrid strategy context

Experts see the campaign as part of Moscow’s wider testing of European resilience. It follows patterns observed in previous incidents — a limited physical breach paired with an information flood to erode trust in institutions.

Polish security agencies identified the reuse of prior botnet infrastructure linked to influence operations in 2023–2024. Posts were timed to coincide with public briefings and news bulletins, maximizing confusion.

Analysts note that these methods mirror Russian “reflexive control” doctrine, which aims to manipulate an adversary’s perception and decision-making. By blending drone incursions with coordinated narratives, the attackers achieved strategic ambiguity: escalation without crossing a conventional warfare threshold.

European response and ongoing monitoring

The European External Action Service (EEAS) announced plans to expand its Hybrid Rapid Response Team network to Warsaw, enabling faster attribution and counter-messaging support. Meanwhile, the NATO StratCom Centre of Excellence in Riga has begun cataloguing digital evidence from the campaign for cross-member study.

Poland’s government continues to track bot clusters and data amplification trails through state-owned social-media analysis systems. Early findings suggest heavy reliance on automation and pre-positioned Telegram groups seeded weeks before the incident.

Future outlook

Diplomatic observers expect further hybrid episodes ahead of the 2025–2026 election cycles across Central Europe. For Warsaw, the current case reinforces how digital manipulation can follow physical provocation within hours — a hallmark of modern grey-zone tactics.

The disinformation surge, while contained, underscores a reality long observed by intelligence analysts: when information becomes a battlefield, speed and credibility decide the first victories.