Full Report
He conducted reconnaissance of Rzeszów airport, a major hub for goods and people being transported in and out of Ukraine.
Analysis Summary
# Threat Actor: Paweł K. (Individual Collaborator)
## Attribution & Identity
* **Actor Identification:** Paweł K., a 51-year-old former Polish soldier.
* **Affiliations:** Established contact with Russian military intelligence officers and expressed a desire to join:
* **Unit 29155 of the GRU** (Russian Military Intelligence)
* **Wagner Group** (Mercenary organization)
* **Recruitment:** Allegedly recruited decades ago by Soviet-era services and motivated by pro-Soviet ideologies.
## Activity Summary
Between December 2022 and March 2024, Paweł K. engaged in espionage activities on behalf of the Russian Federation. His primary objective was to conduct physical reconnaissance of the Rzeszów-Jasionka airport in Poland. This intelligence gathering was intended to support a Russian plot to assassinate Ukrainian President Volodymyr Zelensky during his travels through Poland. He was detained by Poland’s Internal Security Agency (ABW) in April 2024 and sentenced to 5.5 years in prison in October 2026.
## Tactics, Techniques & Procedures
* **Physical Reconnaissance:** Gathering intelligence on airport security protocols and logistical movement at a critical transit hub.
* **Communication Security:** Utilizing email and instant messaging to coordinate with Russian military officers.
* **Insider Threat:** Leveraging his background as a former soldier to assess military and security infrastructure.
* **Sabotage Planning:** Expressed willingness to join "sabotage structures" for kinetic operations.
* **Counter-Interrogation/Deception:** Claimed his activities were a "double-agent" style attempt to trap Russian war criminals to justify his contacts.
## Targeting
* **Sectors:** Defense, Aviation, Government Leadership.
* **Geography:** Poland (specifically Rzeszów-Jasionka airport).
* **Victims:** Volodymyr Zelensky (Ukrainian President); logistics and security personnel at Rzeszów airport.
## Tools & Infrastructure
* **Communication:** Email and instant messaging platforms (specific platforms not named).
* **Ordnance:** Possession of illegal ammunition (found during arrest).
* **Logistics Hubs:** Rzeszów-Jasionka airport served as the primary physical target/infrastructure focus.
## Implications
This case highlights the persistent threat of "stay-behind" or long-term ideological recruits from the Soviet era being activated to support kinetic Russian operations in NATO territory. The targeting of Rzeszów airport—a vital node for Western military aid and diplomatic travel—demonstrates Russia's intent to use human intelligence (HUMINT) to facilitate high-value assassinations and disrupt Ukraine's leadership continuity.
## Mitigations
* **Personnel Security (PERSEC):** Rigorous background checks and continuous evaluation of former military personnel with access to sensitive logistics hubs.
* **Physical Security:** Hardening of security protocols at transit hubs like Rzeszów-Jasionka to mitigate the impact of gathered reconnaissance.
* **Counter-Intelligence (CI) Monitoring:** Enhanced monitoring of communications between domestic residents and known Russian intelligence conduits (Unit 29155).
* **Public Vigilance:** Reporting of suspicious individuals conducting photography or observation of critical infrastructure perimeters.