Russia’s Zaolzie Disinformation Campaign Failed: How Poland and the Czech Republic Defeated a Kremlin Hybrid Attack

The operation combined a breach of a Polish regional broadcaster's content management system, a convincing clone of the Czech public broadcaster's website, forged diplomatic documents and automated social-media networks. Its central fiction was that Poland was preparing to seize the Zaolzie region by force.

For Moscow, the choice of target was revealing. Poland is the principal logistical artery for support to Ukraine, while the Czech Republic has played a leading role in sourcing artillery ammunition. Creating mistrust between them would have attacked the infrastructure of the European coalition without firing a shot.

Instead, the attempt exposed something potentially more important: the emergence of a Central European model for dealing with hybrid warfare in real time.

The attack was built for credibility, not scale

The operation did not depend on persuading millions of people that a Polish invasion was imminent. It depended on creating enough apparently independent evidence to make the claim difficult to dismiss before it spread.

Attackers compromised the CMS of Radio PiK, a regional Polish public broadcaster in Bydgoszcz, and another news site, using the access to publish a fabricated report alleging that Warsaw had issued an ultimatum to annex Zaolzie. Elsewhere, a highly precise visual copy of the Czech public broadcasting portal iRozhlas.cz was deployed.

The technical architecture mattered as much as the message.

A forged letter attributed to Poland's foreign ministry supplied an apparently authoritative document. A fake account impersonating a Czech diplomat added another layer of credibility. Botnets then pushed the material across TikTok, Facebook and X, amplifying claims of an impending 600-hectare invasion and inventing protests and fleeing Czech border residents.

This is the logic of modern influence operations: compromise trusted infrastructure first, manufacture official-looking evidence second, and allow automated networks to create the impression that a story is already being discussed everywhere.

The historical content was deliberately chosen to fit the machinery.

Zaolzie is not an active territorial dispute between Poland and the Czech Republic. But it is a real historical wound. In 1938, following the Munich Agreement, Polish forces occupied the Zaolzie region of Cieszyn Silesia. That history gave Russian operators something far more useful than a generic accusation: a genuine episode that could be stripped of its context and repurposed as evidence of an alleged Polish territorial ambition.

The operation was therefore not inventing history. It was weaponising history that had already been politically settled.

The border issue was almost designed to be misunderstood

The other historical reference exploited by the campaign was even more obscure.

In 1958, Poland and Czechoslovakia agreed to adjust and straighten their shared border. Poland transferred 1,206 hectares and received 837 hectares, leaving a technical difference of 368.4 hectares in Prague's favour.

In normal diplomatic life, this is administrative business, not a casus belli.

Since the 1990s, a joint bilateral demarcation commission has dealt with the matter. Discussions concern unpopulated forest and water-management parcels rather than towns or communities. Some of the exchanges are linked to joint flood-prevention projects. The two sides periodically examine possibilities for balancing the remaining discrepancy through land swaps.

That mundane reality was precisely what made the material useful to an influence operation. A technical border adjustment can be made to sound like an unresolved territorial claim if the institutional context is removed.

Russia's choice of narrative points to a broader evolution in its information tactics in Central Europe. When grand ideological messages become easier for audiences to recognise as propaganda, smaller and more locally specific grievances can offer a better route into public discourse.

The objective is not necessarily to make people believe a complete alternative reality. It can be enough to make them question the motives of a neighbour.

Warsaw and Prague refused to play separate roles

The decisive weakness in the operation was that its targets did not respond independently.

Polish cybersecurity agency NASK and Czech counterintelligence traced the technical signature to Russian state networks. Investigators identified indicators associated with the EU-sanctioned Social Design Agency, known as Structure, and the GRU. Anonymous registrars, automated cross-posting patterns, and machine-translation errors characteristic of Russian-origin material helped connect apparently separate parts of the campaign.

That attribution gave the political response something rare in disinformation crises: speed combined with confidence.

Czech Foreign Minister Jan Lipavský's ministry issued formal clarifications and an analytical infographic, explicitly rejecting the invasion narrative and describing Poland as a primary strategic ally. It also made clear that Prague had no territorial dispute with Warsaw.

Radosław Sikorski went further. Rather than simply denying the fabricated ultimatum, Poland's foreign minister addressed the historical material the operation was trying to exploit. He described Poland's 1938 action as one of its greatest foreign-policy mistakes and recalled President Lech Kaczyński's 2009 apology at Westerplatte.

That was an important communications choice. Denying the present claim while refusing to discuss the historical episode would have left the propaganda narrative intact. By acknowledging the uncomfortable part of the history and explicitly declaring it closed, Warsaw deprived the operation of its most credible raw material.

The response was diplomatic, technical and political at once.

That combination marks a significant change from the familiar model in which a government discovers false information, issues a correction and hopes the correction travels as far as the original claim.

Then the politicians made the propaganda unusable

Donald Tusk's intervention was less institutional but arguably just as effective.

The Polish prime minister posted in Czech that Reksio and Krtek had known for a long time that the two countries could not be turned against one another. The reference was to two familiar cartoon characters: Poland's dog Reksio and the Czech Republic's Little Mole.

The choice was almost deliberately unserious.

That was its strength.

Instead of allowing the Russian narrative to dictate the emotional register - territorial anxiety, historical grievance, and fear of invasion - Polish and Czech politicians converted the story into a shared cultural joke. Czech political figures, including Andrej Babiš and Lipavský, as well as official foreign-ministry channels, joined the response. Social media users followed with memes depicting Krtek and Reksio together driving away a Russian bear or wolf.

Counter-propaganda rarely has the same emotional velocity as propaganda. Official corrections are accurate but often dull. A shared cultural reference can travel differently because it does not ask audiences to study a rebuttal; it gives them a way to ridicule the premise.

The Kremlin operation tried to manufacture division. The public response supplied a ready-made symbol of solidarity instead.

From bilateral coordination to a regional defence layer

The more consequential development is not the failure of one fabricated story. It is the institutional machinery that made the failure possible.

Poland and the Czech Republic are establishing a joint bilateral working group focused on foreign information manipulation and interference and cyber threats. The significance lies in the combination of capabilities: technical detection by cybersecurity specialists, intelligence attribution, diplomatic clarification and direct intervention by political leaders.

That is increasingly what defending the information space of NATO's eastern flank looks like.

The region has already faced a wider pattern of Russian hybrid activity. In mid-2026, Polish and Czech intelligence services arrested Russian-recruited operatives accused of planning arson attacks against transport and logistics hubs. Earlier disinformation campaigns had exploited disputes around the Turów coal mine as well as historical memories involving Transcarpathia and Volhynia.

The methods are different, but the underlying proposition is similar: existing tensions can be turned into strategic vulnerabilities.

The Poland-Czech operation shows the limits of that proposition when institutions are prepared to coordinate before the narrative acquires a life of its own.

For Russian intelligence, the costs are also more tangible than a failed social-media campaign might imply. Compromised websites, botnet infrastructure, and digital assets used to conduct the operation have been exposed. More importantly, the operation revealed the technical signatures and working methods of the actors behind it while producing no diplomatic fracture between its intended targets.

There is a lesson here for the wider European security architecture.

The defence against foreign interference is no longer confined to cyber agencies trying to keep attackers out of networks, nor to diplomats correcting false claims after they appear. The boundary between cyber defence, intelligence, public diplomacy and political communication is becoming increasingly difficult to maintain.

That is particularly true on NATO's eastern flank, where an information operation can move from a compromised local website to a national diplomatic crisis faster than traditional government structures are designed to respond.

The Russian campaign was built around the assumption that an old grievance could outrun modern institutions. Warsaw and Prague demonstrated the opposite: when detection, attribution and political communication operate in the same time frame, a historical fault line can become a point of resistance rather than fracture.