A recruiter linked to a Russian telephone number offered up to $30,000 to carry out an arson attack against a Polish factory producing military drones for Ukraine, according to an undercover investigation by journalists working for Polish public broadcaster TVP. The alleged operation targeted Flytronic, part of Poland’s WB Group defence manufacturer, whose reconnaissance drones are used by Ukrainian forces fighting Russia’s invasion.
Image note: The featured image is an AI-generated illustration. The Telegram messages, factory signage and scene are fictional, not screenshots or photographs from the investigation.
The investigation was published on 15 October by Vot Tak, TVP’s Russian-language investigative news service, after one of its reporters responded to an online recruitment advertisement and posed as a Belarusian resident of Poland looking for work.
- Find more news from Poland on our Homepage .
The journalist was contacted by a Russian-speaking recruiter using the pseudonym “Joker”, who initially offered payment for setting fire to vehicles with Ukrainian registration plates.
When the reporter expressed reluctance, the recruiter proposed a much more serious operation: attacking a facility manufacturing drones for Ukraine’s armed forces.
The recruiter subsequently identified Flytronic’s factory in Gliwice, in southern Poland, and offered between $20,000 and $30,000 for an attack on the site.
He also claimed that the person carrying out the operation could receive an official decoration in Belarus because of his alleged connections to the country’s authorities.
Vot Tak says the recruiter supplied surveillance footage taken near the factory by an unidentified person, suggesting that some preliminary reconnaissance had already been undertaken.
No attack on the Gliwice factory has been confirmed in connection with the uncovered recruitment attempt. The identity of the recruiter remains unknown, and there is no independently established evidence that Russian or Belarusian intelligence services directly ordered the proposed operation.
The findings nevertheless raise serious security concerns about efforts to recruit individuals through social media to target Poland’s defence industry and its military assistance to Ukraine.
Journalist approached through a Telegram job advertisement
The undercover investigation began after an advertisement offering well-paid work appeared on 4 October in a Belarusian-language Telegram group.
A Vot Tak reporter responded while pretending to be a Belarusian living in Warsaw.
The recruiter offered $1,000 for each car with Ukrainian number plates that the reporter was willing to set alight.
The proposed operation subsequently escalated to a defence-industry target after the journalist indicated he was not interested in attacking vehicles.
According to the original Russian-language investigation published by Vot Tak, the recruiter asked about factories producing drones used by Ukrainian forces and offered considerably greater payment for an attack on one of those facilities.
Flytronic’s site in Gliwice was then identified in the exchanges.
The recruiter promised a payment of up to $30,000 and suggested that a decoration from Belarusian leader Alexander Lukashenko’s government could provide an additional reward.
Those statements are evidence of what the recruiter claimed during the exchange, not confirmation that the Belarusian president or his administration had any knowledge of the proposed operation.
The journalist continued the conversation as part of the investigation.
Vot Tak subsequently published its findings, including extracts from the correspondence, and reported that the proposed attack had not been carried out.
Recruiter claimed factory had already been watched
One of the investigation’s most significant findings concerns video footage supplied during the correspondence.
Vot Tak reported that the recruiter sent the undercover journalist recordings apparently showing an unidentified individual carrying out reconnaissance around the Flytronic facility.
The footage suggested that the person arranging the attack had access to information gathered before contacting the reporter.
However, the journalists could not publicly identify the person who made the recordings, and an independent official assessment of their authenticity and circumstances has not been disclosed.
The correspondence also included requests for the proposed attack to be filmed as proof that the assignment had been completed.
These details suggest an effort to commission and document an act of sabotage rather than merely express hostility towards the company.
They do not establish how advanced the operation was, whether an attacker had already been recruited or whether the person directing the exchanges possessed the resources to carry it out.
The English-language account published by TVP World reported that the recruiter initially discussed a more destructive attack before focusing on arson.
Why the Flytronic factory matters to Ukraine
Flytronic is part of WB Group, one of Poland’s leading privately owned defence companies.
The Gliwice business specialises in unmanned aircraft technology and is closely associated with the FlyEye reconnaissance drone.
FlyEye is used by both Poland’s armed forces and Ukraine’s military. Its surveillance capabilities allow operators to observe battlefield conditions, identify potential targets and support military decision-making.
The system has been supplied to Ukraine for more than a decade, including during the country’s defence against Russia’s full-scale invasion.
In an official announcement in August 2025, WB Group confirmed that it had also established FlyEye production in Ukraine through its local subsidiary.
The company said Ukrainian forces were among the system’s largest users and that domestic manufacturing had been introduced to meet rising wartime demand.
WB Group also manufactures Warmate loitering munitions, which are designed to engage targets directly rather than perform only reconnaissance missions.
The company’s contribution to Ukrainian military capabilities helps explain why its facilities could be of interest to individuals seeking to disrupt defence supplies.
An attack on a manufacturing or development site could potentially affect production, equipment or personnel, although no such disruption has been confirmed at the Gliwice facility in connection with the alleged plot.
Russian telephone number raises questions about the recruiter
Vot Tak’s investigation traced the Telegram account used by “Joker” to a Russian telephone number associated with the Saratov region.
The broadcaster also identified advertisements linked to the account in multiple European countries.
Speaking to Polish radio journalists on 16 October, Vot Tak journalist Bogdan Andruszczenko said the newsroom had established the Russian registration of the account but had not identified the individual behind it.
He also explained that the recruiter had provided apparent reconnaissance material from around the factory, raising the possibility that other people were involved.
The evidence establishes a connection between the recruitment account and a Russian telephone number.
It does not independently establish the nationality of the person operating the account, the identity of any intermediary or whether the operation was controlled by Russian state agencies.
Likewise, the recruiter’s claim of good relations with the Belarusian leadership has not been independently corroborated.
Those distinctions are important because identifying the person responsible, establishing the authenticity of their claims and determining whether an intelligence service was involved are separate questions.
Recruitment advertisements appeared across Europe
Vot Tak’s investigation also identified a wider pattern of recruitment activity associated with the same Telegram account.
Over approximately one month, the newsroom found at least 160 advertisements in roughly 122 Telegram groups offering apparently straightforward, well-paid work.
The advertisements appeared in groups used by migrants and other communities across Europe.
The investigators reported activity involving Poland, Slovakia, Bulgaria and Romania, alongside recruitment advertisements in Britain, France and other countries.
Some messages offered payments for comparatively minor acts of vandalism, while the proposed attack in Gliwice involved a much larger financial incentive.
The findings suggest that the recruiter was attempting to reach people across different countries rather than concentrating exclusively on Poland.
However, the number of advertisements should not be interpreted as evidence of an equivalent number of recruited saboteurs or completed attacks.
The investigation does not establish how many people responded, accepted assignments or carried out unlawful acts.
The case nevertheless resembles methods that European security agencies have warned about: temporary recruitment through online platforms, financial incentives and the use of intermediaries whose relationship to the ultimate organiser may be difficult to establish.
Separate WB Group factory fire already under investigation
The new allegations emerged weeks after a serious fire at another WB Group facility in Poland.
On 31 August, a fire damaged a WB Electronics site in Skarżysko-Kamienna, a town in south-central Poland.
The National Prosecutor’s Office announced a criminal investigation into suspected foreign intelligence activity and an alleged deliberate fire involving incendiary materials.
Prosecutors said storage premises had been destroyed and initially estimated the damage at no less than PLN 15 million.
The investigation is being conducted with Poland’s Internal Security Agency (ABW) and police.
At the time of its initial announcement, the prosecution said that no one had been formally charged.
The earlier fire is particularly relevant because it affected another facility belonging to the defence group now identified in the Vot Tak investigation.
There is no verified evidence that the Telegram recruiter was involved in the August fire or that the two incidents were coordinated.
The cases must therefore be treated separately unless investigators establish a connection.
The latest revelations also come amid broader concerns about Russia-linked sabotage in Europe, including attacks and suspected plots involving communications infrastructure and companies supporting Ukraine.
Polish and other European security officials have repeatedly warned that Russia’s campaign against Ukraine extends beyond the battlefield through cyber operations, disinformation and suspected acts of sabotage.
Moscow has denied allegations that it is responsible for such activities.
Has anyone been arrested over the alleged factory plot?
The reporting establishes that journalists documented an apparent attempt to recruit someone for an attack, but several important questions remain unanswered.
No publicly verified announcement was identified confirming an arrest, criminal charge or prosecution specifically arising from the Flytronic recruitment attempt.
Nor has a new public statement from WB Group been identified explaining whether the company received the footage, changed its security arrangements or experienced any operational disruption.
It also remains unclear whether investigators have independently identified the Telegram account’s operator or the individual alleged to have recorded the factory’s surroundings.
For Polish security authorities, the findings provide potential leads concerning online recruitment and threats against a company involved in military production.
Any criminal investigation would need to establish who was responsible, whether the proposed attack represented a genuine operational conspiracy and whether foreign state actors directed or supported it.
For Poland and its NATO allies, the wider issue is the vulnerability of defence production and supply chains supporting Ukraine.
The undercover investigation has exposed what appears to be an attempt to commission an attack on a strategically relevant Polish company.
Whether that attempt was part of an organised foreign intelligence operation remains to be established.
