Polish prosecutors and the Internal Security Agency (ABW) are investigating an alleged plan to burn down a drone factory in Gliwice. The target, Flytronic, makes military systems including FlyEye reconnaissance complexes for Ukraine, making the case a test of how far hostile activity can reach into the industrial base behind military support.
The reported offer was blunt: $30,000 for the destruction of the plant. It was allegedly made on Telegram by a recruiter using the pseudonym “Joker”, whose account was linked to a telephone number in Russia’s Saratov region.
Those details are being examined by investigators, but they do not by themselves prove who controlled the account or establish that Russian intelligence services directed the plot. The case remains under investigation, and the available reporting describes an alleged attempt to arrange an arson attack rather than a fire that was carried out.
A target chosen for what it produces
Flytronic is not simply another industrial site. Its work sits within Poland’s defence manufacturing network and includes the FlyEye reconnaissance system, equipment used in support of Ukraine. That gives the factory a dual significance: it contributes to Poland’s own military capacity while also forming part of the supply chain assisting Kyiv.
A successful fire would not have needed to destroy the entire plant to cause trouble. Damage to machinery, workshops, components or stored equipment could have interrupted production and complicated delivery schedules. There is no established damage or documented delay to Ukrainian supplies in this case, because the reported plan was uncovered before an attack took place.
The significance of the alleged target lies in that potential disruption. Modern defence production depends on specialised firms that may look like ordinary commercial businesses from outside, even when their output is important to national security. Their vulnerability is therefore not confined to the gates, fences and security systems around a factory.
The problem begins away from the perimeter
The reported approach was uncovered by the Polish outlet Vot Tak. Rather than relying on a known operative or an employee inside the company, the alleged recruiter appears to have sought someone willing to carry out a single paid act.
That method can separate the person arranging an operation from the person expected to commit it. A prospective arsonist may have no obvious connection to a foreign state and may be motivated primarily by money. The organiser, meanwhile, can remain outside Poland and communicate through an online account.
For investigators, that creates a chain with several links: the recruitment message, the identity of the account holder, any intermediaries, the promised payment and the process by which Flytronic was selected. Finding a possible local perpetrator would not necessarily reveal who financed the plan or ordered it.
The case was also reported by TVP World. The $30,000 figure and the apparent Russian telephone connection are important leads, but neither is conclusive evidence of the complete chain of responsibility.
From one factory to a wider concern
The Flytronic investigation follows a fire at another company linked to Poland’s WB Group at the end of August 2026. WB Group is active in defence technology and unmanned systems. The proximity between the incidents has heightened concern that Polish production sites connected to military assistance could be facing a new form of pressure.
It is not yet established that the two cases were coordinated or directed by the same organisation. Nor do the available details show the scale of any disruption caused by the earlier fire. But together they have shifted attention towards a part of the security picture that is easy to overlook: factories and suppliers that make defence deliveries possible.
For a hostile organiser, industrial sites offer several possible advantages. A limited attack could halt a production line without requiring access to a military base, while a recruited outsider may be harder to connect to the person behind the order. Financial incentives also allow an operation to be broken into stages, with separate people handling contact, payment and execution.
That does not make every suspicious approach evidence of a coordinated campaign. It does mean that Poland’s response cannot stop at guarding individual facilities or arresting anyone who attempts an attack. Investigators must also trace the channels used to find potential recruits, the routes proposed for payment and the intelligence used to select a target.
The central question now is whether the Telegram offer was an isolated attempt or part of a repeatable method aimed at Poland’s defence industry and the production supporting Ukraine. The answer will depend on whether the investigation can move beyond the visible message and identify the network, if any, that stood behind it.
