Borrowed plates: a Russian sabotage plot in Poland built to point at Ukraine

Poland's Internal Security Agency (ABW) has detained two Ukrainian citizens suspected of spying and setting cars on fire on behalf of Russian intelligence. Investigators say the burned vehicles carried number plates altered to resemble those of the Ukrainian army. That detail is what makes the case worth attention.

Baltic Security Monitor | Security Watch · 10 November 2026, 14:00 EET

The facts

Tomasz Siemoniak, Poland's minister coordinating the special services, disclosed the case on 10 November. ABW officers detained the two men, aged 24 and 25, in Mińsk Mazowiecki, east of Warsaw.

Both have been charged with taking part in Russian intelligence activity against Poland and with sabotage, specifically arson attacks on cars in one of Poland's large cities. A court ordered them held for three months. The Łódź branch of the National Prosecutor's Office is supervising the investigation.

According to investigators, the suspects:

• scouted and photographed critical and military infrastructure across Poland;
• set fire to cars after swapping their plates for ones resembling Ukrainian military registrations;
• were paid for their tasks, partly in cryptocurrency.

Polish officials say the plate swaps may have been meant to hide the real origin of the attacks and shift suspicion onto Ukraine, material that could later feed disinformation.

These are charges, not a verdict. The identity of the Russian handlers and the full circumstances remain under investigation.

A familiar playbook with a new twist

The model itself is well known in Poland: recruits found online, paid in crypto, tasked with small-scale sabotage. ABW broke up a series of such cells in 2024–2025. This case is also separate from the group ABW exposed on 5 November over suspected smuggling of military components to Russia.

What is new is the staging. On the investigators' account, the arson was designed not only to do damage but to carry a return address. A burning car with a recognisably "Ukrainian military" plate does its real work afterwards, online, where a single image travels faster than any correction.

BSM analysis

For Moscow, the prize in an operation like this is not a burned-out car but Polish distrust of Ukrainians. Poland remains the main logistics corridor for aid to Ukraine, and public tolerance for that role is a strategic asset. Every incident in which a "Ukrainian" appears to harm Poles chips away at it.

The choice of Ukrainian nationals as perpetrators is not a paradox but a method. Recruiting among financially vulnerable migrants is cheap, and the perpetrator's passport amplifies the intended narrative by itself. That is why the information response has to be as fast as the police one. ABW's public explanation of the fake plates is exactly that kind of response.

Why it matters for the Baltic states

Estonia, Latvia and Lithuania have their own record of Russian-commissioned arson and sabotage cases, and Estonian investigations into such incidents are still running. A scheme that fakes Ukrainian attribution transfers easily to any country with a large Ukrainian community. For security services across the region, the Polish case is a reminder to ask not only who carried out an attack, but whom witnesses and cameras were meant to see.

What to watch

• further ABW investigative steps and the formal charges with sentencing ranges;
• whether investigators link this cell to other European arson networks (no such link has been established so far);
• whether footage of the "Ukrainian-plated" arson surfaced on social media before ABW's announcement.

Bottom line

Hybrid warfare in Europe is less and less about targets and more and more about trust. Insurers can replace burned cars. Nobody can repair trust between Poles and Ukrainians if the fake is believed before it is exposed.

Baltic Security Monitor (osint-baltic.com) is an analytical publication covering security on NATO's northeastern flank.
Prepared from automated open-source monitoring with independent verification.