The information campaign that unfolded in Poland and the Czech Republic in August 2026 around Cieszyn Silesia bears the hallmarks of a coordinated influence operation. It combined the hacking of a legitimate media outlet, a cloned Czech media website, fake diplomatic accounts, a forged official document, AI-generated content, a fictitious local activist, and paid advertising for a non-existent demonstration. Poland’s NASK has noted similarities between the methods used and known Russian operations, although there has not yet been a definitive technical attribution. Czech sources likewise treat a Russian connection as a working hypothesis. (Seznam Zprávy)
The campaign’s strength lies in its use of genuine historical and legal material. It merges three separate issues into a single narrative: the Polish-Czechoslovak conflict over Cieszyn Silesia in 1919-1920, Poland’s occupation of Zaolzie in 1938, and the contemporary issue of the so-called Czech ‘territorial debt’ to Poland amounting to 368.44 hectares. The latter was indeed discussed by Polish lawmakers, but it has no connection to any Warsaw claim on Zaolzie. (Sejm RP)
Of particular importance is the fact that media linked to Russia’s information infrastructure had focused on the territorial-debt issue even before the current campaign. In 2025, the Telegram channel NeCT24 circulated statements by the Polish side about the need to settle the matter. Czech intelligence, BIS, has linked NeCT24 to Russian state information infrastructure. This does not prove that the 2025 and 2026 episodes were directed by the same operator, but it does indicate thematic continuity.
Taken together, the indicators make the Russian hypothesis plausible, but for now it should be treated as analytical attribution rather than established fact. The most likely immediate operational layer is the GRU or a contractor network associated with it and specializing in information and psychological operations. At the same time, the cloning of media outlets, fictitious identities, and coordinated amplification strongly resemble operations associated with the Social Design Agency/Structura ecosystem (‘Doppelganger’), which has been linked to the Russian Presidential Administration. Some elements also resemble Storm-1516 methods. A multi-layered model therefore cannot be ruled out, in which the political sponsor, cyber operator, and information contractors belong to different structures.
There is no evidence that the campaign was designed specifically to ‘destroy the Visegrad Group.’ It is more likely that any weakening of V4 is part of a broader objective: increasing the number of fault lines within Central Europe, NATO, the EU, and the coalition of states supporting Ukraine. For Moscow, the functional fragmentation of V4 may be considerably more useful than its formal collapse.
Architecture of the Operation
The campaign’s central narrative was the claim that Poland was allegedly preparing territorial demands against the Czech Republic and considering the return of part of Cieszyn Silesia.
On August 16, unidentified actors gained access to the content-management system of the Polish regional broadcaster Radio PiK and replaced a published item with an article headlined ‘Poland Plans to Occupy Czech Territory.’ Radio PiK confirmed the intrusion and stated that its newsroom had nothing to do with the publication. Poland’s Central Bureau for Combating Cybercrime opened an investigation. (Polskie Radio PiK)
Before that, a website impersonating the Czech public broadcaster iRozhlas had been created. It used an almost identical domain name and circulated a story about an alleged Polish-Czech territorial dispute. According to Czech journalists, the domain was registered in early August through a German registrar under a fictitious name and a non-existent Prague address. (Seznam Zprávy)
At the same time, accounts appeared impersonating the Czech ambassador to Poland, Bretislav Dancak, and Polish Deputy Foreign Minister Artur Harazim. They circulated an image of what purported to be an official Polish government document containing territorial demands. One version contained a revealing error: the final sentence of the Czech-language document was written in Polish. The file was later replaced with a corrected version. (Euronews)
The next stage sought to create the impression that the supposed territorial dispute was already generating a real public reaction in the Czech Republic. An account using the name ‘Adam Sikora’ announced a demonstration in Trinec under the slogans ‘Cieszyn Silesia is Czech’ and ‘We Live Here, We Stay Here.’ The event was promoted through paid Facebook advertising. However, the Trinec municipality said that no legally required notification for the demonstration had been filed. The promotional video also used the KOVO trade-union logo without authorization; the union distanced itself from the event.
To reinforce the ‘Sikora’ persona, the account also posted an advertisement for the sale of a house in Ropice, claiming that residents feared a future Polish annexation. According to Czech journalists, the images used were AI-generated and the existence of the property could not be verified. (Seznam Zprávy)
The campaign therefore went beyond the dissemination of a single piece of fake news. It created a system of mutually reinforcing elements:
fake diplomat -> forged document -> cloned media website -> compromise of a real media outlet -> fictitious local activist -> manufactured protest -> paid amplification.
The purpose of this construction is to create the impression that the same story is being independently corroborated by diplomatic, media, and grassroots sources.
Why Zaolzie Was Chosen
Cieszyn Silesia presents an almost ideal historical vulnerability for this type of influence operation. The conflict was real, left a mark on the collective memory of both countries, and is linked to national minorities and borders, yet today it is poorly understood by the wider public. That makes it possible to use genuine historical facts while altering only their contemporary interpretation.
After the collapse of Austria-Hungary, Poland and Czechoslovakia both laid claim to Cieszyn Silesia. The region mattered because of its mixed Polish-Czech population, industry, coal deposits, and the Kosice-Bohumin railway, which was strategically important to Czechoslovakia.
In January 1919, the two states fought a brief armed conflict. In 1920, the region was divided. A substantial Polish community found itself on the western, Czechoslovak side of the Olza River – the territory known in the Polish tradition as Zaolzie.
The dispute continued to damage relations between Warsaw and Prague throughout the interwar period. Its most painful episode came in 1938. After the Munich Agreement, Poland presented a weakened Czechoslovakia with an ultimatum demanding the transfer of Zaolzie. Polish troops entered the area on October 2. Poland’s Institute of National Remembrance acknowledges that Warsaw exploited Czechoslovakia’s extremely difficult post-Munich position to pursue its own territorial objectives. (IPN)
The year 1938 remains the most sensitive part of this historical memory. In the Czech narrative, Poland took advantage of the country’s dismemberment by Nazi Germany. In 2009, Polish President Lech Kaczynski described Warsaw’s actions as a mistake. Following the current information campaign, Polish Foreign Minister Radoslaw Sikorski again drew attention to that episode. (WP Wiadomości)
The operator therefore did not need to invent a historical trauma. It only had to move the 1938 conflict from the realm of historical memory back into the category of a present-day threat.
368.44 Hectares: A Real Fact Used to Support a False Narrative
The figure of 368.44 hectares became the campaign’s key ‘anchor of credibility.’
On June 13, 1958, the Polish People’s Republic and Czechoslovakia signed an agreement on the final delimitation of the state border. During technical border adjustments, Poland transferred approximately 1,205.90 hectares to Czechoslovakia and received about 837.46 hectares in return. The difference – 368.44 hectares – became known as the Czech ‘territorial debt.’ (European Legislation Identifier)
The issue did not disappear from the Polish-Czech agenda. In April 2026, a group of members of the Sejm again asked the Polish government what steps were being taken to settle it. (Sejm RP)
This is, however, an administrative and legal issue arising from border demarcation, not a Polish claim to Zaolzie. There is no credible evidence that the Polish government intends to demand the transfer of Trinec, Cesky Tesin, or other localities with Polish minorities, or to revise the existing state border.
The operation is built precisely on conflating these two separate issues:
a real territorial debt of 368.44 hectares -> an alleged present-day territorial claim -> Zaolzie -> the threat of Polish annexation.
The way the correct figure was introduced into the campaign is particularly revealing.
The initial fabricated materials cited 638.44 hectares. An account impersonating Polish Deputy Foreign Minister Artur Harazim then published a ‘correction,’ claiming that the proper figure was 368.44 hectares.
This created a pseudo-fact-checking effect. A fake official source corrected one obvious error and, in doing so, sought to increase confidence in the main false claim: that contemporary Polish territorial demands actually existed.
The correct figure had been publicly available long before the operation. It appeared in parliamentary documents in 2025 and 2026 and in the Polish press. The operator therefore needed only to extract a genuine fact from the open information environment and place it inside a different causal narrative.
At present, the fake Harazim account is the earliest publicly identified bridge between the real figure of 368.44 hectares and the false narrative of contemporary Polish territorial expansion.
More importantly, published evidence suggests that the impersonation infrastructure had been prepared in advance. CyberDefence24 reported that profile and background images for the fake diplomatic accounts appeared on May 22 and May 25, 2026 – several months before the campaign’s active phase.
If confirmed by technical investigation, this would significantly weaken the hypothesis that the campaign was a spontaneous disinformation response to events in August and would strengthen the assessment that it was prepared in advance.
Had Russia Used the Issue Before?
One of the most significant indirect arguments supporting the Russian hypothesis is that Russia-linked information channels had focused on the Polish-Czech territorial-debt issue before August 2026.
According to Seznam Zpravy, in 2025 the Telegram channel NeCT24 circulated information about Poland’s intention to pursue a settlement of the Czech territorial debt. (Seznam Zprávy)
In its 2024 annual report, the Czech BIS placed NeCT24 among channels linked to Russian state information infrastructure that emerged after Russian state outlets, including Sputnik, were blocked. BIS also pointed to Moscow’s long-term use of domestic Czech events and social tensions to provoke distrust and dissatisfaction. (BIS)
This suggests a possible sequence:
2025 – Russia-linked information channels focus on the territorial debt -> spring 2026 – the issue returns to the Polish parliament -> May – elements of the fake-account infrastructure are created -> August – the administrative issue is transformed into an annexation narrative -> false corroborating evidence is produced -> an attempt is made to move the conflict into physical space.
This sequence is significant, but by itself it does not prove that NeCT24 and the August campaign were controlled by the same operator. Thematic continuity must be distinguished from a single operational chain.
Russia nevertheless has a documented record of exploiting comparable historical disputes.
In the summer of 2026, Polish security authorities again highlighted Russian efforts to exploit the Volhynia tragedy to intensify Polish-Ukrainian hostility. The ABW reported a case involving an individual accused of acting on instructions from Russian intelligence services, including operations intended to inflame national animosity and desecrate memorial sites. (ABW)
Reuters also reported an increase in Russian information activity around Polish-Ukrainian historical disputes. (Reuters)
The mechanism is very similar to the one observed around Zaolzie:
a real historical trauma -> emotional reactivation of the dispute -> selective use of accurate facts -> addition of fabricated evidence -> transfer of a historical grievance into contemporary interstate relations.
In this sense, Zaolzie can be viewed as a local adaptation of an approach already used elsewhere.
How Convincing Is the Russian Attribution?
At this stage, it is more accurate to say not that ‘Russian intelligence conducted the operation,’ but that the totality of indicators corresponds to a known Russian operational pattern.
NASK explicitly noted similarities between the operators’ behavior and Russian methods, while at the same time stressing that no final attribution had been made. This distinction is essential: a matching modus operandi increases the probability of a hypothesis, but it does not substitute for technical evidence.
Four principal indicators support the Russian hypothesis.
First, the combination of cyber intrusion, forged documents, impersonation, cloned media, and social-media amplification. The campaign is not limited to spreading disinformation but uses several mutually reinforcing channels.
Second, the use of a legitimate media outlet. Compromising Radio PiK allowed the operators to place false material inside a trusted information environment, which is considerably more powerful than simply creating a fake website.
Third, the exploitation of historical trauma and a national minority. In its 2014 and 2016 reports, Czech intelligence highlighted Russian practices involving local intermediaries, questions of national self-determination, minorities, and domestic conflicts in ways designed to make an externally driven operation appear to be an internal public debate. (BIS 2014) (BIS 2016)
Fourth, the attempt to create not only a virtual but also a physical conflict by advertising a demonstration.
This last element deserves particular attention. Had real people attended the announced rally, photographs and video could have been used as ‘evidence’ of a Czech grassroots movement opposing Polish territorial demands. Those materials could then have triggered a response from Polish nationalist accounts.
The resulting chain would have looked like this:
manufactured narrative -> real participants -> real photographs -> renewed information amplification -> real political reaction.
In such a scenario, the operator does not need to convince a majority of the population. It is enough to transform a small, artificially created episode into information content capable of sustaining itself.
Who Could Be Behind the Operation?
If Russian attribution is confirmed, the most likely explanation is not a single isolated structure but a multi-layered state-and-contractor network.
The GRU and Associated Infrastructure
The GRU is one of the most plausible candidates, primarily because the operation combines cyber and information components.
The campaign includes the compromise of the real Radio PiK website, impersonation of diplomats, a forged official document, a cloned media outlet, AI-generated personas, and an attempt to create a physical event. The combination of technical penetration and psychological influence is closer to the toolkit of military intelligence than to that of a conventional propaganda campaign.
Russian military intelligence has historically maintained units specializing in psychological and information operations. Of particular interest is Military Unit 54777, which the EU has linked to psychological operations and to the InfoRos information network.
There is not enough evidence, however, to claim that this particular unit was involved in the Zaolzie operation. A more accurate formulation would be a GRU-associated influence architecture, possibly involving an external cyber contractor.
The Presidential Administration, SDA/Structura, and the Doppelganger Model
At the same time, the information component of the operation bears strong similarities to the infrastructure of the Social Design Agency and Structura, known from the Doppelganger campaign.
These entities have been documented creating replicas of European media outlets, false websites and personas, fake accounts, and artificially amplifying the content they produce. U.S. authorities have linked their activity to the Russian Presidential Administration.
In the Zaolzie case, the sequence is strikingly similar:
cloned website -> fabricated article -> fake official source -> social-media accounts -> coordinated amplification.
The cloning of iRozhlas is particularly characteristic.
The difference is that the Zaolzie operator did not stop at imitating a media outlet but gained access to the genuine Radio PiK site. This may indicate the involvement of an additional cyber operator.
Storm-1516
Some elements of the campaign also resemble the methods of Storm-1516 / CopyCop / False Facade. This Russia-aligned infrastructure has used fabricated media outlets, cloned websites, fake identities, staged content, and distribution through social networks.
Of particular interest is the tendency to create events or material in the physical world and then feed them back into the online environment as evidence supporting the original narrative. The attempt to organize a fictitious demonstration in Trinec is therefore a potentially important attribution indicator.
Why the SVR Is Less Likely
The SVR cannot be ruled out entirely, because the target is the relationship between two NATO and EU member states. The observed modus operandi, however, is more consistent with a large-scale cyber-enabled influence operation than with the traditional SVR profile of agent recruitment, elite networks, and covert political influence.
The SVR hypothesis would become considerably stronger if evidence emerged of funding for real political activists, contacts with parties, journalists, experts, or organizations representing the Polish minority.
The most likely working model is therefore:
political tasking -> information contractor -> cyber operator -> fake media and personas -> social amplification -> attempted offline activation.
This model explains the campaign’s complexity better than the assumption that it was carried out by a single group of pro-Russian online activists.
Link to the Visegrad Group
There is no direct evidence of a Russian directive to ‘destroy V4’ through a Polish-Czech territorial dispute.
The timing and strategic context nevertheless make an impact on the Visegrad Group a plausible secondary effect of the operation.
After several years of serious disagreements over Russia and Ukraine, V4 began showing signs of renewed political interaction in 2026. On June 23, the heads of government of Poland, the Czech Republic, Slovakia, and Hungary met in Hungary. The Czech government described the meeting as a return to a ‘revived V4 group.’ Discussions covered coordination ahead of the European Council, energy security, migration, and EU competitiveness. (Government of the Czech Republic)
On July 1, the V4 presidency passed to Slovakia, which identified strengthening practical regional cooperation and political dialogue as one of its goals.
Within weeks, an information operation began to unfold that sought to manufacture a dispute between two V4 members whose relations had been relatively stable in recent years.
The chronology is noteworthy:
June 23 – political revival of V4 -> July 1 – new presidency -> early August – fake iRozhlas infrastructure -> August 16 – Radio PiK compromise -> second half of August – promotion of an ‘anti-Polish’ demonstration.
This sequence does not prove causality. The potential benefit to Moscow, however, is clear.
Poland and the Czech Republic hold relatively similar positions on the Russian threat and support for Ukraine. Elsewhere in Central Europe, Moscow already has natural fault lines to exploit – Polish-Ukrainian historical disputes, the Hungarian-Ukrainian issue over Transcarpathia, and disagreements within V4 itself over Russia and Ukraine.
Creating an additional Polish-Czech dispute may therefore offer greater potential value than merely intensifying existing tensions.
The objective is likely broader than V4. A Polish-Czech dispute could simultaneously complicate bilateral defense cooperation, coordination on Ukraine, regional infrastructure projects, and political coordination within the EU and NATO.
A more accurate description is therefore not an ‘operation against V4,’ but an operation to expand the number of internal fault lines in Central Europe, with V4 as one of the structures affected.
Strategic Logic of the Operation
Zaolzie is a rational choice precisely because there is virtually no serious contemporary territorial dispute between Poland and the Czech Republic.
A successful influence operation does not always benefit from working with the most acute existing conflict. In some cases, greater effect can be achieved by creating a new line of polarization between states that had previously cooperated successfully.
Zaolzie offers an almost ideal combination for this purpose:
the 1919 war + the 1920 division of the region + Poland’s 1938 occupation + an existing Polish minority + a real territorial debt of 368.44 hectares + the absence of a contemporary territorial dispute.
The last element is especially important. Because no real dispute exists, the appearance of one becomes news in itself. Any response by ministers, diplomats, or media outlets increases the topic’s visibility.
The operation can then develop according to the logic of manufactured controversy. First, a false claim is created. Real state institutions are then forced to deny it. The very fact of an official response makes the topic more visible. Information operators can then claim that the authorities are ‘making excuses,’ ‘hiding negotiations,’ or ‘trying to suppress the dispute.’
The ultimate objective is not necessarily to convince society of a particular historical interpretation, but to increase distrust and the political transaction costs of cooperation.
In this sense, the functional fragmentation of V4 is considerably more useful to Moscow than its formal destruction.
If Poland, the Czech Republic, Slovakia, and Hungary continue to hold meetings but spend political capital on historical, ethnic, and territorial disputes, the format’s ability to produce common decisions declines without Moscow having to bring about its institutional collapse.
Assessment of the Likely Intent
The Zaolzie campaign is most likely an operation designed to manufacture a contemporary conflict out of historical material.
Its authors did not invent the basic components of the story. The 1919 conflict, the division of Cieszyn Silesia, Poland’s actions in 1938, the 1958 agreement, the 368.44-hectare territorial debt, parliamentary debate, and the Polish minority in the Czech Republic are all real.
The manipulation consists in linking these facts through a false causal chain and presenting them as evidence of an alleged contemporary Polish plan for territorial revision.
The strongest argument supporting Russian origin is therefore not a single technical indicator, but the convergence of three elements: objective, method, and historical narrative.
Russia-linked information infrastructure had previously shown interest in the territorial-debt issue. Russian structures have a documented record of exploiting historical traumas and interethnic conflicts in other countries. The current operation combines media cloning, impersonation, forged documents, cyber intrusion, and an attempt to move a virtual conflict into physical space.
At the same time, without technical data from NASK, Polish security services, the Czech BIS, or partner intelligence agencies regarding domain infrastructure, operators, financing, and the means used to compromise Radio PiK, Russian attribution cannot be considered definitively established.
Working probability that the operation was Russian in origin or coordination.
The probability that its primary objective was the direct destruction of V4 is significantly lower.
The probability that weakening V4 is regarded as one desirable outcome of a broader strategy to fragment Central Europe is assessed as considerably higher.
What Must Be Established for Definitive Attribution
The main direction of further investigation should not be additional analysis of the fake content itself, but the search for infrastructure overlaps with previously attributed Russian operations.
Of particular importance are registration data and DNS history for the fake iRozhlas domain, hosting/CDN infrastructure, SSL certificates, URL and UTM patterns, the creation history of the fake diplomatic accounts, Meta Ad Library data for the ‘Adam Sikora’ campaign, the sources used to pay for advertising, and technical evidence regarding the compromise of Radio PiK.
A separate key intelligence question concerns the origin of the figure 368.44 hectares inside the operation itself. It is necessary to establish who first linked it not to the territorial debt, but directly to Zaolzie and alleged Polish expansion.
So far, the earliest identified connecting element is the fake Artur Harazim account. If the technical infrastructure behind that account proves linked to Doppelganger, Storm-1516, GRU-associated clusters, or other previously attributed Russian networks, that would constitute much stronger evidence than thematic similarity alone.
Investigators should also monitor whether the narrative migrates to real political actors. Particularly significant indicators would include the appearance of fictitious or real Polish organizations demanding the ‘return of Zaolzie’; attempts to involve Polish minority organizations; new AI-generated audio or video involving politicians; funding of real activists; and synchronized dissemination of the topic by Russian state outlets and proxy networks.
If such elements appear, it would indicate a transition from creating an informational illusion of conflict to an attempt to create real political carriers of that conflict.
The Zaolzie campaign demonstrates a more sophisticated model of influence than ordinary disinformation. Its likely purpose is not to convince Czechs that Polish annexation is inevitable, but to create the very subject of a Polish-Czech dispute.
It does so by using historically accurate material and adding a small number of critically important false connections. The real 368.44 hectares become ‘evidence’ of territorial claims; a genuine historical conflict becomes proof of their inevitability; fake diplomats and media become confirmation; and a fictitious protest is used to suggest that the threat is already producing a public reaction.
If Russian attribution is confirmed, the most likely model is a multi-layered operation in which a state sponsor uses specialized information and cyber structures or contractors. The GRU is a serious candidate because of the combination of cyber compromise and psychological influence; infrastructure linked to the Presidential Administration and Doppelganger better explains the media cloning and fake identities; and Storm-1516 methods provide an additional parallel with the attempt to create offline evidence.
The connection to V4 should be assessed more cautiously. There is no evidence of a separate plan to destroy the Visegrad Group. However, creating a new dispute between Poland and the Czech Republic is fully consistent with a broader Russian interest in the functional fragmentation of Central Europe.This is the most likely strategic meaning of the operation: not to destroy V4 in a single blow, but to increase the number of contradictions among its members to the point where regional structures continue to exist formally while gradually losing their ability to act together.
