By CIVIL Hybrid Threats Monitoring

The investigation into the deadly 7 November shooting in Kraków continues amid questions about extremist influences and possible foreign involvement. Poland’s Independence Day celebrations unfolded under heightened security, while disinformation surrounding the attack exposed a wider European vulnerability: Mass violence can be exploited by hostile actors regardless of who perpetrates it. The challenge extends beyond counterterrorism to democratic resilience, public trust, and the role of civil society in European security.

Investigation continues after gunman’s death

Polish prosecutors have confirmed that 24-year-old Michał Oksiński, who killed six people and wounded 15 in Kraków’s historic Main Market Square, died in hospital on 9 November after being shot during a police intervention.

Investigators believe he had earlier murdered his parents and 21-year-old sister at their home in Ostrowiec Świętokrzyski, bringing the total death toll to nine, including the three family members.

According to the National Prosecutor’s Office, investigators recovered 11 firearms, including two AR-15 rifles, and hundreds of rounds of ammunition. Four mobile phones are undergoing forensic examination.

Oksiński obtained a firearms licence in January 2026. His death has prevented prosecutors from questioning him, making digital evidence, personal contacts and possible ideological influences particularly important.

The investigation is formally classified as terrorism-related. However, the motive remains unconfirmed.

Russian involvement among investigative possibilities

Polish prosecutors are examining possible extremist inspiration and whether other individuals encouraged or assisted the perpetrator.

Justice Minister Waldemar Żurek acknowledged that a possible Russian hybrid operation could not be excluded. Prosecutor Eryk Stasielak similarly confirmed that investigators would examine every lead, including a Russian connection.

Independence Day under heightened security

The Kraków tragedy cast a shadow over Poland’s 11 November Independence Day celebrations. Authorities deployed additional police and protective barriers around Warsaw’s Independence March. Temporary bans on carrying firearms and using pyrotechnics had already been introduced before the attack.

The march, organised by nationalist groups, attracted up to 250,000 participants, according to city authorities, while organisers claimed at least half a million.

President Karol Nawrocki joined the nationalist-led march in Warsaw, while Prime Minister Donald Tusk attended separate celebrations in Szczecin, where he called for national unity following the Kraków tragedy.

“May no Pole ever raise a hand against another Pole. May there never be bloodshed in Poland,” Tusk declared, urging restraint and reconciliation across political divisions.

He also invited President Nawrocki and his family to his home in Sopot for a meeting before Christmas, appealing for dialogue and solidarity.

The Warsaw march proceeded without violent incidents, although police reported 59 arrests during Independence Day events across the capital. Officers confiscated more than 450 pyrotechnic devices and intervened in several incidents, including an attack on a policewoman with a flare.

Across Poland, the existing BRAVO and BRAVO-CRP security alert levels remained in force, alongside a higher CHARLIE alert covering designated railway infrastructure. These measures, introduced before the Kraków attack, reflect Poland’s broader concerns about terrorism, sabotage, cyber threats and hostile hybrid operations.

A second attack: Disinformation

The physical violence was followed by an extensive information assault. Poland’s cybersecurity institute NASK reported referring 4,795 pieces of disinformation-related content to social media platforms for moderation between 7 and 10 November, according to its spokesperson, Paulina Zywar.

False narratives blamed Ukrainians, accused the Polish government and European Union of orchestrating the attack, and circulated AI-generated images and videos.

Some material was amplified by Russian-language accounts and automated networks, although identifying Russian involvement in disinformation does not establish responsibility for the shooting itself. Disinformation campaigns aim to intensify ethnic hostility, discredit institutions, and undermine public confidence in emergency communication systems and security measures designed to protect Poland and Europe.

European security implications

Kraków demonstrates how domestic extremism, firearms accessibility and digital manipulation can converge into a broader security crisis. For Poland, the immediate challenge is strengthening preventive intelligence, reassessing firearms licensing and identifying potentially radicalised individuals without undermining civil liberties.For Europe, the implications are equally serious. Whether mass violence is instigated, inspired, or organised by hostile states (or has no connection to them whatsoever), such incidents can create a window of opportunity for hostile information and influence operations. Hostile actors do not need to orchestrate an attack to weaponise its consequences.

That is why CIVIL has repeatedly stressed that European security cooperation must strengthen intelligence sharing, counterterrorism, cybersecurity, and independent verification. Equally important, it must actively engage citizens and experienced civil society organisations across Europe, both within and beyond the EU.

In other words, preventing the next attack requires more than armed police and protective barriers. It demands stronger institutions, an engaged and connected civil society across Europe, and informed citizens working together to identify emerging threats, counter manipulation, and defend public trust. Learning from one another, sharing information, strengthening resilience, and safeguarding democracy and human rights are essential to building a safer, stronger, and more democratic Europe.

The Shadow War Briefing – Special Edition is part of CIVIL’s strategic intelligence reporting on hybrid threats, disinformation, foreign influence and democratic resilience in Europe.

CIVIL. 27 years defending democracy and human rights.
Now we need your support to continue.

SUPPORT CIVIL — MAKE A CONTRIBUTION