Google Exposes Russian Disinformation Blitz Over Poland Airspace Incursion Using Portal Kombat Network
Ddos 
Google’s Threat Intelligence Group (GTIG) has uncovered multiple coordinated pro-Russia information operations (IO) exploiting the September 9–10, 2025 drone incursion into Polish airspace. These campaigns—run by long-standing propaganda networks such as Portal Kombat, Doppelganger, and Niezależny Dziennik Polityczny (NDP)—have been amplifying false narratives designed to deflect blame from Russia, discredit NATO, and undermine public trust in the Polish government.
“The identified IO activity… appeared consistent with previously observed instances of pro-Russia IO targeting Poland—and more broadly the NATO Alliance and the West,” GTIG reported.
According to Google, this disinformation wave demonstrates how Russia-aligned influence ecosystems rapidly activate after geopolitical events to shape narratives aligned with Moscow’s strategic objectives.
GTIG analysts identified four main influence objectives emerging after the drone incident:
- Promoting a Positive Russian Image: Amplifying claims that Russia was not responsible for the airspace violation.
- Blaming NATO and the West: Reframing the event as a provocation engineered by Poland or NATO.
- Undermining Domestic Confidence in the Polish Government: Spreading the idea that Warsaw’s response to the incident destabilizes its own citizens.
- Weakening International Support for Ukraine: Suggesting that aiding Ukraine harms Poland’s economic and national security interests.
“Messaging designed to negatively influence Polish domestic support for its own government… insinuated that its actions related to both the event itself and the broader conflict in Ukraine are detrimental to Poland’s domestic stability,” the report notes.
GTIG highlighted that Poland remains one of the highest-priority targets for Russia’s disinformation apparatus due to its role as a NATO front-line state and staunch supporter of Ukraine.
The actor Portal Kombat—also known as the “Pravda Network”—has operated since at least 2024 as a network of fake media sites that amplify Russian state propaganda across multiple regions.
“These domains share near identical characteristics while each targeting different geographic regions… and have developed new infrastructure to expand targeting of the West and other countries around the world,” GTIG stated.
In the wake of the drone incursion, Portal Kombat outlets published several misleading articles:
- One claimed the drones couldn’t possibly have come from Russia, arguing they lacked the range to reach Polish airspace.
- Another accused Polish and Baltic officials of politicizing the incident to “derail possible Russia–U.S. negotiations.”
- A third article pushed the idea that Europe’s defense focus would shift inward, implying the incident was meant to reduce aid to Ukraine.
These narratives mirror earlier Russian influence playbooks that seek to create confusion, erode trust, and deflect accountability.
Another key player, the Doppelganger operation, uses inauthentic media brands to spread disinformation tailored to specific national audiences.
“The Doppelganger pro-Russia IO actor has created a network of inauthentic custom media brands that it leverages to target Europe, the U.S., and elsewhere,” the report explains.
Two examples from the incident include:
- Polski Kompas (Polish-language site): Claimed that Poles oppose their government’s Ukraine policy, alleging it strains national security and finances.
- Deutsche Intelligenz (German-language site): Framed Europe’s response as “hyperinflated” and accused NATO of fabricating a threat to justify militarization.
These posts aim to sow division both within the EU and between European citizens and their governments.
The NDP network, a long-standing Polish-language influence operation, continues to pose as an “independent political journal.” In reality, it has been one of the most prolific amplifiers of anti-NATO disinformation in Poland.
“NDP has historically leveraged a number of suspected inauthentic personas as editors or contributing authors… characterized as a prolific purveyor of primarily anti-NATO disinformation,” GTIG noted.
Following the drone event, NDP articles described Poland’s defensive response as “war hysteria” and accused its leaders of fabricating the crisis to distract from domestic issues.
Its associated social media accounts also posted false claims that Poland was “pre-warned about the drones” and that “most Poles blame NATO or the government.”
GTIG concludes that Russia’s information operations are highly adaptive, using established propaganda channels to exploit emerging geopolitical crises within hours.
“The mobilization of covert assets within Russia’s propaganda and disinformation ecosystem… demonstrates how established influence infrastructure can be flexibly leveraged to respond to high-profile, emerging geopolitical stressors,” Google’s researchers wrote.
The report stresses that such campaigns “undermine society’s ability to establish a fact-based understanding of potential threats in real-time” by flooding the information space with noise and confusion.
Donate