Threat Intelligence

Brief: Russian Disinformation Surrounding Drone Incursions into Poland

by ZeroFox Intelligence
Brief: Russian Disinformation Surrounding Drone Incursions into Poland
10 minute read

Executive Summary

Between September 9–10, 2025, there were at least 19 overnight violations of Polish airspace due to drone incursions, which closed at least four Polish airports.  In the aftermath of these drone incursions, well-known Russian propaganda networks flooded social and traditional media channels, amplifying pro-Russia, anti-NATO, and anti-West narratives surrounding the airspace violations and shifting the blame to Ukraine. ZeroFox assesses this coordinated effort was likely aimed at deflecting blame from Moscow, undermining NATO unity, and weakening public support for Ukraine, particularly in frontline states like Poland.

Details

Between September 9–10, 2025, there were at least 19 overnight violations of Polish airspace due to drone incursions, which closed at least four Polish airports.1,2,3 Following the drone incursions into Poland, pro-Russia mouthpieces flooded social and traditional media channels seeking to amplify narratives that shifted blame to Ukraine, painting NATO as ineffective and stirring doubt, disrupting the NATO alliance, and muddying the real intent behind these airspace violations. The narratives questioned the origins of the drones and included speculation about Ukraine and NATO trying to provoke a greater conflict with Russia, with likely objectives of influencing public opinion and furthering Russia’s broader agenda of shifting public support away from Ukraine and its allies.

  • An article on Pravda Lithuania, a well-documented Russian disinformation channel, claimed that reports of Russian drones entering Poland are exaggerated or staged for political provocation. The article claims Western and Polish leaders used the incident to block potential U.S.–Russia negotiations, pressure NATO, and fuel anti-Russian sentiment rather than responding to a real military threat.4,5
  • Another article claims that Poland exaggerated Russian-Belarusian drills to stir fear and hide domestic failures, while its own military exercises provoke tension. It suggests drone incidents are misrepresented and that Ukraine or NATO, not Russia, pose the real threat.6 The article was published in Niezależny Dziennik Polityczny (NDP), a Polish-language, self-styled “independent political journal” that has been known to propagate anti-NATO narratives.7,8
  • Another news outlet allegedly associated with Russia’s persistent and large-scale influence operation “Doppelganger” published an article claiming the drones that “invaded” the Polish airspace were Ukrainian. It also alleged that Poland’s support for Ukraine now harms its own economy and security.9
  • Several posts on the X account of RT (formerly Russia Today), a Russian state-controlled international media network, add to the disinformation campaign by amplifying multiple disinformation narratives, including false-flag accusations against Ukraine and NATO.10,11,12 RT is widely identified by academics, governments, and fact-checkers as a major outlet for Russian government propaganda and disinformation.13

ZeroFox has observed an influx of comments on videos about the drone incursions on various social media platforms holding Ukraine and NATO accountable for the drones. These comments are almost certainly aimed at influencing public opinion about the drone incursions. Most of the accounts publishing such comments exhibit bot-like activity, which aligns with previous Russian disinformation campaigns.14,15

  • ZeroFox observed several statements under a TikTok video with almost 6,000 comments and more than 511,000 likes claiming the drones that entered the Polish airspace were Ukrainian. Some other commenters blamed NATO for the incursions.16
  • ZeroFox observed TikTok user “house_of_scott1” referencing reports that claim the drones were “shot from Ukraine using old Russian drones.” The TikToker also added that Belarus had warned Poland about the drone attack and helped Poland shoot the drones down. They further emphasized that investigations have not been able to verify that they were Russian drones and that the aircraft actually came from Eastern Ukraine.17

Russia-aligned pundits also doubled down, pushing a narrative about a house they claimed was destroyed by a storm before the drone incursions when reliable reporting suggested that it was most likely destroyed by a Polish missile deployed against a Russian drone.18,19  Such disinformation is likely aimed at discrediting official statements and shifting blame away from Russia.

  • Multiple X posters shared screenshots and left comments refuting claims that the house was destroyed by drone incursions, with purported residents stating the damage occurred during a storm two months prior. ZeroFox observed these posts use the same evidence to fortify their claims, which is likely an indication that the posts are bot-generated.20

Other disinformation tactics include deliberate misstating of the range of the drones and suggestions that the drones are being sold on the Ukrainian black arms market, with the likely goal of deflecting attribution away from Russia. The Gerbera is a low-cost, long-range drone reportedly assembled in Yelabuga, Russia, using kits from a Chinese manufacturer.21 While multiple reputable sources have stated the range of the Gerbera drones used in the incursions is 373 miles (600 km), ZeroFox observed various social media accounts claiming the range is 185 miles (300 km) instead—implying that the drones could not have covered the distance between Russia and Poland.22

Another narrative propagated across social media and Russian state-sponsored channels is that the drone incursion was a Ukrainian false flag operation carried out with NATO’s help to provoke Russia and justify escalation. This narrative also tries to shift blame away from Russia and aims to establish Ukraine as the provocator in the conflict. 

  • Russian officials, including Ministry of Foreign Affairs spokeswoman Maria Zakharova and diplomat Andrei Kelin, have used their positions to repeat the likely false narrative and have accused Ukraine of staging provocations to secure Western aid.23,24 
  • Maria Zakharova has been the spokeswoman of the Russian Federation’s Ministry of Foreign Affairs since 2015 as well as the director of its information and press department. Meanwhile, Andrei Kelin, a Russian diplomat since the 1970s, has been the Russian ambassador to the United Kingdom since November 2019.
  • ZeroFox observed several social media posts quoting a video in which Scott Ritter has pushed the idea that the drone incursions are Ukraine’s “act of desperation” to enable NATO intervention. Ritter is a former U.S. Marine Corps intelligence officer, UN weapons inspector, author, and commentator who served as a junior military analyst during Operation Desert Storm.
  • ZeroFox observed multiple X accounts amplifying the false-flag narrative, presenting alleged evidence of Ukraine using spoofing technology to disguise the drones as Russian and then redirect them toward Poland.

Poland’s position as one of Ukraine’s closest European allies and its location on NATO’s eastern flank is likely enough of a motive for Russia to not only target it in alleged drone attacks but also to focus Russian disinformation efforts on the Polish population. Poland shares a border with both Belarus and the Russian city of Kaliningrad, which likely increases its exposure to Russian provocations and incursions.

  • Poland hosts thousands of NATO troops and U.S. military assets and serves as a critical logistics and training hub for Ukraine’s defense operations.25
  • Among NATO members, Poland is one of the countries that spends the highest percentage of its gross domestic product (GDP) on defense and has one of Europe’s most capable land forces.26

Conclusion

Deliberate disinformation surrounding the September 2025 drone incursions into Poland almost certainly confirm Russian efforts to weaponize information in order to blur the lines of truth, deflect blame, and test NATO’s resolve. The coordinated narratives, ranging from false-flag claims to doctored evidence, are very likely to have real-world impacts that extend beyond risks in the digital sphere. Besides aiming to deflect blame away from Russia, these narratives have also likely been designed to undermine NATO’s credibility, create divisions within the alliance, and weaken public support for Ukraine, especially in frontline nations like Poland. If left unchecked, such disinformation campaigns are likely to disrupt NATO’s response coordination and encourage further Russian online and military provocations, while slowly chipping away at public trust in Ukraine and regional security efforts.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 11:00 AM (EST) on November 7, 2025; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

ZeroFox Intelligence Probability Scale 

All ZeroFox intelligence products leverage probabilistic assessment language in analytic judgments. Qualitative statements used in these judgments refer to associated probability ranges, which state the likelihood of occurrence of an event or development. Ranges are used to avoid a false impression of accuracy. This scale is a standard that aligns with how readers should interpret such terms.

  1. hXXps://www.theguardian[.]com/world/2025/sep/10/poland-shoots-down-drones-over-its-territory-amid-russian-attack-on-ukraine-says-military
  2. /advisories/35989/
  3. hXXps://www.bankinfosecurity[.]com/russian-disinformation-followed-drone-incursion-poland-a-29769
  4. hXXps://lt.news-pravda[.]com/en/russia/2025/09/10/21247.html
  5. hXXps://dfrlab[.]org/2025/02/24/russia-pravda-network-expands-worldwide/
  6. hXXps://dziennik-polityczny[.]com/2025/09/10/hanna-kramer-drony-manewry-i-teorie-spiskowe-polityka-strachu-i-kulisy-histerii-wokol-manewrow-zapad-2025/
  7. hXXps://www.cyberwarcon[.]com/niezaleny-dziennik-polityczny
  8. hXXps://vsquare[.]org/russia-related-accounts-and-a-cyberattack-in-poland/
  9. hXXps://polskicompas[.]net/2025/09/11/wsparcie-kijowa-nie-jest-priorytetem-dla-polakow-nadzwyczajne-posiedzenie-onz/
  10. hXXps://x[.]com/RT_com/status/1971273071014326393
  11. hXXps://x[.]com/RT_com/status/1971622188072710402
  12. hXXps://x[.]com/RT_com/status/1971999916055826527
  13. hXXps://www.nbcnews[.]com/investigations/rt-russian-state-media-waging-covert-info-war-biden-admin-says-rcna171081
  14. /advisories/24911/
  15. https://cloud.zerofox.com/intelligence/advisories/32773
  16. hXXps://www.tiktok[.]com/@horizongeopoliticalnews/video/7548425063544982806
  17. hXXps://www.tiktok[.]com/@house_of_scott1/video/7550093100182408470
  18. hXXps://www.reuters[.]com/business/aerospace-defense/polish-missile-likely-hit-house-during-russian-drone-incursion-says-minister-2025-09-17/
  19. hXXps://www.reuters[.]com/business/aerospace-defense/polish-couples-house-hit-by-drone-they-watched-tv-news-2025-09-10/
  20. hXXps://x[.]com/OlgaBazova/status/1966427594456264773?s=20
  21. hXXps://www.theguardian[.]com/world/2025/sep/11/ukraine-war-briefing-cheap-shahed-like-gerbera-drones-used-in-poland-violation
  22. hXXps://www.reuters[.]com/business/aerospace-defense/what-are-gerbera-drones-used-poland-incursion-2025-09-10/
  23. hXXps://x[.]com/LBC/status/1968590818035322919
  24. hXXps://t[.]me/MariaVladimirovnaZakharova/11468
  25. hXXps://www.gov[.]pl/web/national-defence/increasing-the-us-military-presence-in-poland
  26. hXXps://www.nato[.]int/docu/review/articles/2025/04/14/sharing-the-burden-how-poland-and-germany-are-shifting-the-dial-on-european-defence-expenditure/index.html

ZeroFox Intelligence

Tags: Threat Intelligence

See ZeroFox in action