Sabotage preparation, remote recruitment, and data collection on military sites account for a significant share of Poland's espionage docket, and public arrests have not dented the pace, RBC-Ukraine reported on 15 September. The published figures cover only the highest-complexity investigations, so with district prosecutors' cases counted in, the real scale of Russian activity is larger still.

Russia's covert campaign inside the EU has escalated from online disinformation into physical attacks since the full-scale invasion of Ukraine—arson at defense plants, assassination plots, and bomb-rigged drones found at European airports.

Recorded sabotage incidents across Europe tripled between 2023 and 2024 alone. Poland, as NATO's primary overland corridor for Western military aid to Ukraine, sits at the center of that pressure—its railway routes near the Rzeszów logistics hub have drawn particular attention.

What the prosecutors count as espionage

Poland's National Prosecutor's Office opened 67 criminal cases under Article 130 of the Criminal Code—espionage and activity on behalf of a foreign intelligence service—during 2025, spokesperson Przemysław Nowak told RBC-Ukraine. In the first eight months of 2026 alone, prosecutors added at least 40 more.

At that pace, 2026 could yield roughly 60 new cases, RBC-Ukraine noted, concluding that the tempo of recruitment and sabotage preparation is not slowing but staying steadily high despite public detentions and strengthened counterintelligence.

Courier bombs and expendable operatives

Earlier, Polish law enforcement exposed two Russian citizens prosecutors say worked for Russian special services. One of them planned to send an explosive device through a delivery service—part of a wider Russian sabotage campaign that recruits low-cost, expendable operatives for arson and disruption across the EU.

Ukraine's military intelligence agency, HUR, published data on 54 Russian enterprises within KRET, a defense holding under Russia's state-owned Rostec corporation, on 15 September. More than a third of KRET's enterprises face no sanctions from any country in the international sanctions coalition, HUR reported on 15 September.

Russia's defense industry is vast, and sanctions have targeted companies and individuals across the sector in multiple rounds since the full-scale invasion to restrict its ability to produce and finance weapons. But complex networks of state-owned holdings and subsidiaries can leave gaps, allowing some companies involved in military production to remain outside international sanctions. An August report by the anti-corruption organization NAKO found that the EU had sanctioned only 23% of 482 Rostec-linked entities.

What KRET makes for Russia's military

• KRET makes electronic warfare systems, friend-or-foe identification systems and onboard electronics for Russian fighter jets and helicopters, HUR said. Its companies also make other military equipment, including anti-drone systems and remotely operated machine guns.
• KRET also supports Russia’s missile production. The Signal plant in Stavropol makes compact jamming stations for 9M723 Iskander-M missiles, and the Kaluga Research Radio Engineering Institute makes electronic protection systems for 3M22 Zircon missiles.
• KRET’s main organization covers funding shortfalls for state defense contracts carried out by its companies, according to HUR.

Unsanctioned companies make missile and drone parts

HUR also named several of the 19 unsanctioned companies that it says are involved in Russian weapons production. 

Among those firms, HUR identified manufacturers of navigation systems for Kh-59M2 and Kh-59M2A guided air-launched missiles and Orion drones, gyroscopes for 9M727 cruise missiles used in the Iskander system, and electric motors for drones.

The enterprises include JSC Inertial Technologies of Technokompleks, JSC Tambov Plant Elektropribor, and JSC Ulan-Ude Instrument-Making Production Association.

HUR calls for broader sanctions

The intelligence agency called for more defense companies to be added to international sanctions lists, better monitoring of compliance, and punishment for violations. KRET is the 10th Rostec holding whose enterprises HUR has published on its War&Sanctions portal. The portal now lists 764 Rostec enterprises, UNN reported.

On 8 September, HUR published data on 155 enterprises belonging to Roselektronika, another Rostec holding. Nearly half were not under international sanctions.