Fresh wave of Russian-linked threats hits Czechia online and off

Czechia is facing a continuing risk of Russian-directed sabotage, while increasingly sophisticated online campaigns are being used to spread pro-Russian narratives and stir tensions with neighboring countries, Czech counterintelligence says.

The warning comes as the Security Information Service (BIS) publishes its 2025 annual report. Separately, a new disinformation campaign targeting Czech-Polish relations has used fake websites, social-media profiles and artificial intelligence to create the appearance of rising tensions between the neighboring countries.

BIS said the risk of Russian-directed sabotage remains focused particularly on companies involved in the production or distribution of aid to Ukraine.

The number of sabotage operations organized from Russia fell during the first half of 2025 but began rising again in the second half, according to the report.

BIS uses the term “one-time agents” for people recruited to carry out individual operations who can be disavowed by Russia if they are caught. They are often inexperienced and recruited primarily for money.

“They are often inexperienced amateurs and at the same time people of lower social status, or with criminal experience. The predominant motivation is the prospect of receiving a financial reward,” BIS said.

Agents typically receive specific instructions only after telling their handlers what targets they can access, making the threat difficult to detect, BIS said.

There is an important caveat: none of the Czech security incidents investigated in 2025 for possible Russian coordination was reliably confirmed as a Russian-directed sabotage attack.

BIS said Russia uses sabotage not only to cause physical damage but also to create fear and uncertainty and encourage the idea that supporting Ukraine is not worth the economic or security costs.

The dominant Russian actor in the sabotage campaign is the country's military intelligence service, the GRU, according to BIS.

BIS also identified a network of TikTok accounts spreading pro-Russian and anti-system narratives before last year's Czech parliamentary elections.

The network had been built over an extended period, with mostly fake accounts interconnected through mutual follows and by sharing the same content. BIS said the artificial coordination was designed to increase the reach of the material.

The network did not have a significant impact on the election result, however.

BIS said most disinformation in Czechia is actually produced and circulated by Czech actors themselves, motivated by financial, ideological or political interests. Russia and China nevertheless continued to cultivate relationships with some domestic disinformation actors.

The BIS report comes as a separate disinformation campaign targeting Czech-Polish relations has emerged.

According to ČT24, unknown attackers have created fake websites and social-media profiles designed to make it appear that relations between Czechia and Poland are deteriorating.

One fake Facebook account, using the name Adam Sikora, promoted an alleged anti-Polish demonstration in Třinec on Saturday. But local officials said no such demonstration had been reported.

The attackers also breached the website of Polish regional broadcaster Radio PiK and published a fabricated article claiming that Poland planned to occupy 600 hectares of Czech territory.

The story exploits a genuine historical dispute over 368 hectares along the Czech-Polish border. Prague and Warsaw have discussed the issue since 1992, with Foreign Minister Petr Macinka saying in February that the two countries were looking at resolving it through a joint flood-protection project rather than territorial or financial compensation.

Polish Foreign Minister Radosław Sikorski responded directly to the campaign, writing on X: “Let's not be divided.”

He recalled Poland's 2009 public apology for its historical annexation of territory in the region.

Prime Minister Donald Tusk also responded with an image of Czech cartoon character Krtek alongside Polish character Reksio, writing that Poland and Czechia are “true friends.”

According to ČT24, the campaign was unusually sophisticated by Czech standards.

Seznam Zprávy reporter Lukáš Valášek said the operation involved a chain of fabricated identities and media outlets: first a fake profile impersonating the Czech ambassador to Poland, then a fake Czech Radio website quoting that supposed ambassador, followed by a fake profile promoting the nonexistent demonstration.

“The campaign required coordination,” Valášek said.

Polish domain administrator NASK said the attackers' methods were consistent with those known to be used by Russia, although the perpetrator has not been definitively identified.

The Czech Foreign Ministry is investigating the incident.