On the night of November 15, 2025, a steel clamp fixed across the rails near Mika, southeast of Warsaw, was intended to derail a freight train. The following night, a military-grade explosive detonated on the same line as a freighter passed. The Warsaw-Lublin corridor carries supplies bound for Ukraine. Polish prosecutors named two Ukrainian nationals working for Russian intelligence as the operatives. Both had entered Poland from Belarus. Both left through Terespol before they were identified.
Prime Minister Donald Tusk called it perhaps the most serious national security situation in Poland since the start of the full-scale war.
The story that followed framed this as a sabotage attack. It was. But the framing misses the structural point. The same Belarus border that absorbed nearly 30,000 attempted migrant crossings in 2025 also worked as a clean ingress and egress route for state-directed saboteurs targeting Ukraine’s supply line. The corridor handled both flows. It was designed to.
The corridor, not the migrants
Since 2021, Polish, Lithuanian, and Latvian officials have described the eastern frontier as the site of weaponized migration. The language was accurate when the operation was new. It is now too narrow.
What runs through the Belarus border is not a single weapon. It is a multi-use corridor that has carried at least five distinct payloads since 2021: third-country nationals flown into Minsk and pushed toward EU territory, state-directed saboteurs, sensor-probing drones and balloons, intelligence collectors operating under migrant cover, and electronic warfare originating from Belarusian territory. Each piece in isolation looks like a different problem. Together they describe one operation with one operator.
Poland is not facing a migration crisis with security spillover. It is facing a security campaign that uses migration as its cheapest layer.
The 2026 numbers seem to complicate the read. Polish military officials at the border reported a significant drop in attempted crossings this year, down from 29,869 in 2025 and a 2021 peak of 39,697. The drop is real. It is not a sign of de-escalation. The volume decline reflects a surface tactic that has been adapted around, not a campaign that has ended. The infrastructure built underneath the volume is what scale looks like now.
Vitebsk
On January 15, 2026, Latvia’s National Armed Forces published a primary-source disclosure that has not received the attention it warrants. The materials traced a documented operational link between the migrant flow and a specific Belarusian military unit.
Latvian border guards, during routine surveillance, detained an illegal border crosser carrying documents and communication equipment belonging to a Belarusian servicemember. Subsequent checks identified the materials as belonging to a member of the reconnaissance battalion of the 19th Guards Mechanized Infantry Brigade, stationed in the Vitebsk Region. The documents included internal unit records of issued materiel and logistical equipment.
This is not a smuggler with a fake ID. This is internal documentation from a Belarusian Armed Forces reconnaissance unit moving through a migrant corridor into NATO territory.
The same disclosure included photos pulled from detained migrants’ phones showing officials of the Belarusian State Border Committee posing with migrants inside military-type vehicles. Latvian forces have documented cases in which Belarusian border guard officials directly transported migrants to staging points used for crossings into Latvia.
Latvia’s Ministry of Defence drew the operational line explicitly. Anyone supporting the infiltration, transportation, or accommodation of illegal border crossers may, often unknowingly, assist operations organized by the intelligence services of states hostile to Latvia, aimed at conducting reconnaissance, sabotage, or other hostile activities in Latvia and elsewhere in Europe.
In March 2026, the head of Latvia’s security service Normunds Mežviets told the Telegraph that migrants were being trained in combat techniques at special camps inside Belarus before being pushed across EU borders. The campaign, he said, was becoming increasingly aggressive.
The Vitebsk evidence names a unit. It shows direct military involvement. It includes intelligence collection use of migrants. And it comes from a NATO member’s defense ministry in official primary text.
The pressure layer
The migration flow itself remains the cheapest weapon in the stack. The cost per unit is a one-way ticket from Damascus, Baghdad, Kabul, Karachi, or Mogadishu to Minsk. Tourist visas, state-affiliated handlers, transport to staging areas near the Polish, Lithuanian, or Latvian border, and a push across.
Volume has held in the tens of thousands. Origin countries remain consistent: Afghan, Pakistani, Syrian, Iraqi, Somali, Indian. The downstream effect is now visible inside Germany, where irregular crossings at the German-Polish border rose from 30 in January and February 2026 to 670 in April, according to WDR, NDR, and Süddeutsche Zeitung reporting based on national police figures. The portion of that flow routed through Russia is the segment that has European Union officials concerned.
The pressure works whether or not any individual migrant reaches Germany. It generates domestic political crises inside target states, forces NATO members to spend defensive resources on border infrastructure, and normalizes the violation of EU external borders as a baseline condition rather than an emergency.
The infrastructure turn
Poland’s 128-mile steel wall, completed in 2022 and reinforced over the following year with roughly 3,000 cameras, electronic monitoring, and motion sensors, was effective. Surface crossings became harder. The operation went underground.
Polish border guards in the Podlaskie Voivodeship discovered four tunnels in 2025. The first was reported in October. The largest was found near the village of Narewka in mid-December. It ran 50 meters on the Belarusian side of the frontier and 10 meters into Polish territory, stood 1.5 meters high, and was supported by wooden posts and metal rods. Roughly 180 migrants, mostly Afghan and Pakistani nationals, used the Narewka tunnel before Polish surveillance detected the movement pattern at the exit point. Around 130 were detained as they emerged.
Polish Deputy Interior Minister Czesław Mroczek framed the engineering itself as a metric. Digging these tunnels, he said in a Polish radio interview, means that Poland’s effectiveness in stopping migration is so high that it was decided to bring in specialists from the Middle East to dig them.
The attribution claim is where the public reporting becomes speculative. Major Rob Campbell, a former British Army sapper who analyzed the footage, told the Telegraph that if forced to speculate, he would name Hamas or Palestinian Islamic Jihad. Military historian Lynette Nusbacher said that for deep tunneling specialists, the Middle East is where one looks. Former Israeli intelligence officer Sarit Zehavi noted that while pro-Iranian groups are candidates, multiple regional actors, including Kurdish factions and Islamic State remnants, possess the relevant expertise. There is no definitive attribution.
The attribution question is interesting. It is not the important point. Polish officials are treating the tunnels as engineered infrastructure rather than improvised smuggling routes. Concrete-reinforced passages designed to outlast detection cycles are a capital investment. Minsk and Moscow are building for a campaign they expect to run for years.
Threshold mapping and access exploitation
Two other payloads run through the same corridor, and they serve different functions.
The first is threshold mapping. On September 10, 2025, Polish authorities recorded 19 Russian drone crossings into Polish airspace and became the first NATO member to actively engage Russian drones since 2022. Article 4 was triggered. Five days later, a drone was neutralized over Warsaw government buildings. Belarusian balloons crossed into Polish airspace on three consecutive nights, prompting Polish forces to describe the incidents as tests of air defense response. Latvia’s defense ministry reports regular electronic warfare originating from Belarus, affecting communication and navigation systems in the border area. These are not nuisance incidents. They map response timing, identify gaps, and normalize incursion as a baseline condition.
The second is access exploitation. The November 2025 rail sabotage is the clearest example. Two FSB-recruited operatives moved through the same Belarus corridor that handled thousands of migrants, executed two coordinated attacks on a rail line carrying supplies to Ukraine, and exited via Terespol before Polish authorities identified them. Polish soldiers report at least two incidents in which migrants threw Molotov cocktails near the border. One Polish serviceman was killed after being stabbed by a migrant at the frontier.
The same corridor. Different functions. Same operator.
Preparation, not nuisance
Polish ambassador Krzysztof Olendzki told Fox News Digital after a recent border visit that Poland considers itself at war. The language is rhetorical. The operational logic underneath it is not.
Sustained hybrid pressure forces NATO to spend defensive resources continuously, generates political crises inside target states that can be exploited through information operations, normalizes the violation of EU borders, and provides real-world response data for the operator. The alliance’s next war, Polish military officials say, may not begin with tanks crossing a border. It may begin with the systems the alliance has already been absorbing for five years.
That assessment describes what is already happening, just below the threshold of Article 5.
Close
The corridor is one piece of infrastructure being used five ways. The tunnels are a tell. They are not how an adversary behaves when they expect the campaign to wind down. The 2026 drop in attempted crossings does not mean the pressure is failing. It means the surface tactic has been adapted around. Tunnels, military-grade engineering, documented Belarusian Armed Forces involvement, electronic warfare, and the use of the same border as a saboteur corridor are what the operation looks like at scale.
The question for NATO is no longer whether this is hybrid warfare. Latvia’s Ministry of Defence has put that on the record. The question is at what point sustained pressure crosses the threshold from below-Article-5 harassment to a recognized act of war, and what changes when it does.
