Decoding the news. Polish security services have detained nine Ukrainian nationals and two Belarusians for immediate removal from the country, accusing them of running an influence operation aimed at Ukrainian refugees living in Poland.
- According to Poland’s Internal Security Agency, or ABW, the group had operated since autumn 2025, recruiting and paying people to attend demonstrations in several cities, including Warsaw, Wroclaw, Krakow, Zakopane and Bydgoszcz. Polish authorities say the funding and strategic direction came from Russia.
- The official notice does not describe the conclusion of a criminal trial. Rather, it announces administrative removal measures based on an intelligence and security assessment. But the political message from Warsaw is clear: the operation was designed to influence Ukrainian refugees in Poland and channel existing frustrations into anti-Kyiv political mobilisation.
Why it matters: The alleged scheme is notable less for its scale than for its target.
- Poland is not only Ukraine’s main European logistical rear area but also a frontline Nato state. It is also home to the largest Ukrainian refugee community in the European Union after Germany. At the end of April, 971,255 people fleeing Ukraine were under temporary protection in Poland, equivalent to 26.6 per 1,000 residents – among the highest ratios in the EU.
That makes the refugee community both a strategic asset and a potential pressure point:
- Four years into the war, the issues available for manipulation are numerous: fatigue with displacement, tensions over social assistance, corruption scandals in Ukraine, questions around military mobilisation, and the broader political debate over how long European societies can sustain support for Kyiv.
- The objective, Polish authorities suggest, was not necessarily to create mass unrest. It was to slowly introduce political slogans into an already sensitive social environment, widening the distance between Ukrainian refugees, Polish society and Ukraine’s institutions.
The broader pattern. The Polish case fits a wider assessment by Warsaw that Russia is expanding its hybrid toolkit.
- In a report released in May, the ABW said it had opened 69 espionage investigations in 2024 and 2025 — the same number as in the three decades between 1991 and 2023. The agency also warned that Russian services were moving beyond ad hoc online recruitment and toward more structured networks involving organised crime figures and people with military or security backgrounds.
- That shift matters because influence operations and sabotage are not separate tracks. They serve the same strategic purpose: raising the political, economic and psychological cost of supporting Ukraine.
A railway incident in Poland in late 2025, affecting a line serving traffic to Ukraine, revealed the material side of that campaign. The alleged effort to mobilize paid demonstrators illustrates the social side. One targets infrastructure. The other targets trust. Both seek to weaken the internal cohesion of countries that have become essential to Ukraine’s survival.
The Italian angle. Italy faces a different exposure from Poland. It is not Ukraine’s immediate logistical rear area and does not sit on Nato’s northeastern flank. But Rome remains a political, military, and diplomatic supporter of Kyiv — and a country where Russian influence networks have long sought space in the media, political, and social debates.
- This is not a new concern. In 2022, Italy’s parliamentary intelligence committee, Copasir, warned of Italian actors functioning as agents of influence and disinformation while maintaining links to Russian political, media and cultural channels. The point was not that every critical voice on sanctions, military aid or the war was acting on Moscow’s behalf. It was that influence operations often work through a much less visible ecosystem of intermediaries, amplifiers and willing or unwitting messengers.
- Italy has also been identified by its own security apparatus as exposed to hybrid threats conducted through non-state actors operating as proxies, across the information, cyber, economic and intelligence domains. There is no public evidence that a Russian-funded operation comparable to the Polish case is active among Ukrainian refugees in Italy. The Polish investigation should not be used to manufacture one.
- Its relevance for Rome lies elsewhere. It shows how established influence ecosystems can intersect with a vulnerable community, local grievances and online mobilisation. Small payments, intermediaries, emotionally charged themes and coordinated amplification can turn authentic concerns — over housing, welfare, integration, conscription or corruption in Ukraine — into a political instrument aimed at weakening support for Kyiv.
For Italy, the task is therefore twofold:
- Protect Ukrainian communities from being exploited as a pressure point, and avoid allowing pre-existing influence networks to frame legitimate social tensions as proof that support for Ukraine has become unsustainable.
- That requires closer coordination between security authorities, local administrations, Ukrainian associations and the platforms where recruitment, amplification and paid mobilisation can begin.
- Italy faces a different exposure from Poland. It is not Ukraine’s immediate logistical hinterland and does not sit on Nato’s northeastern flank. But Rome remains an important political, military and diplomatic supporter of Kyiv — and it hosts a Ukrainian population that has grown again in recent months.
- Eurostat recorded an increase of 7,020 people under temporary protection in Italy between March and April 2026, a rise of 20.8%, one of the largest monthly increases in the European Union.
The battlefield. Russian cognitive war shows how a foreign influence campaign can work below the threshold of a traditional security threat: not through spectacular propaganda, but through small payments, local intermediaries, emotionally charged themes and the exploitation of genuine grievances.
- For Italy, the lesson is not to treat Ukrainian communities as a security problem. It is to avoid allowing legitimate social concerns — over integration, welfare, housing, the war or Ukraine’s domestic politics — to be turned into instruments of external manipulation.
- That requires closer coordination between security authorities, local institutions, Ukrainian associations and platforms where recruitment or paid mobilization can begin. It also requires distinguishing clearly between authentic dissent and coordinated activity designed to create distrust between refugees, host societies and European governments.
The bottom line. Poland’s operation is a reminder that Moscow’s pressure campaign against Europe does not rely on cyberattacks, sabotage or disinformation websites, but it also operates through communities already carrying the burdens of war.
- For countries supporting Ukraine, including Italy, the challenge is increasingly domestic: protecting social cohesion without treating every disagreement as a foreign plot — while recognising that foreign actors are prepared to exploit every unresolved fracture they can find.
