On Thursday, 17 September 2026, Poland’s Internal Security Agency (ABW) issued a statement in response to a 15 September press release by the US Department of Justice concerning a network linked to Russian intelligence services that commissioned assassinations, reconnaissance activities, and terrorist acts in the United States and Europe.
Image: ABW
However, this is not a story Poland is only now learning about from US documents. Its Polish component has been under investigation by the Internal Security Agency (ABW) since 2024. It was in the course of the Polish investigation that the Agency established the circumstances surrounding the arson attacks on building material warehouses in Warsaw and Radom in May 2024. The direct perpetrator was a Colombian national, but the investigation did not stop with the person who carried out the attacks. ABW findings indicated that his actions had been commissioned, supervised, and financed by a person linked to Russian intelligence services.
The investigation also made it possible to reconstruct the modus operandi used by the Russian services. Through online messaging applications, individuals were recruited and paid to conduct reconnaissance of designated locations, carry out arson attacks, and document their effects. Materials from these operations were subsequently used by Russian-language media for disinformation and propaganda activities (Russia-Backed Colombian Behind Terror Attacks in Poland, According to Polish Authorities).
In cases like these, identifying the direct perpetrator does not end the work. Often, it is only the beginning
Investigators must determine who recruited the perpetrator, who provided instructions and money, what the next targets were, and who was actually directing the operation. They must also establish whether the same people organized similar activities in other countries.
That is why this case has long had an international dimension.
Poland, the Czech Republic, Lithuania, and Romania are cooperating within a joint investigation team. This has made it possible to link incidents in individual countries, establish a common modus operandi, and identify coordinators and those commissioning the acts. Eurojust also confirmed that the Polish investigation uncovered the activities of a Colombian national responsible for the arson attacks in Warsaw and Radom, and that proceedings against him and those behind him remain ongoing (Eurojust statement on the joint investigation).
ABW also reported these findings in January 2026. The joint investigation team established that incidents in several countries had been carried out by the same group, using similar methods and linked to Russian intelligence. Common coordinators and those commissioning acts of sabotage were also identified (read more: Terrorist group responsible for arson attacks across Europe brought before court).
Today, ABW can disclose more. Oemis R.D., whose name now appears in the US proceedings and in findings by foreign media, has been charged and is a suspect in proceedings before the Polish justice system.
An international journalistic investigation by Deutsche Welle and public broadcasters from Lithuania, the Czech Republic, and Spain describes Oemis R.D. as a Cuban national living in Russia who allegedly took part in recruiting operatives, organizing their travel, and directing tasks in several European countries. Deutsche Welle investigation: Cuban directed sabotage attacks against the EU from Russia.
Oemis R.D. is also one of five defendants in the US case that has now been disclosed. The US Department of Justice accuses him of participating in a network acting on behalf of Russian intelligence services, including involvement in a conspiracy related to the financing of terrorism.
This illustrates how countering modern sabotage works in practice. The network operates across borders, so the services must also cooperate across borders. One partner identifies an operative, another reaches the next link in the chain, and another secures information about the organizers. Only by combining this knowledge is it possible to reconstruct the structure and operating mechanism of the network.
There is no competition between the services here. There is information sharing, joint findings, and partnership.
The Polish investigation remains ongoing. Due to its nature and the operational activities being conducted, ABW cannot currently disclose all the information in its possession.
This story did not begin with the US indictment. The individuals and mechanisms now described by foreign media and the US justice system are also the subject of the Polish investigation conducted by ABW. The case remains ongoing, and cooperation with international partners is making it possible to move from the direct perpetrators to successive links in the network.
