The hybrid war that Europe faces with Russia also has a Spanish front. A citizen who is being sought by the Audiencia Nacional and who is allegedly linked to one of the main networks of pro-Russian cyberattacks would be using his activity on Telegram to recruit Spaniards willing to fight in the ranks of the Russian Army, take part in paid computer operations, or provide confidential information about officials and businesspeople. The activity has been documented in a report by Golden Owl, a company specialized in open-source intelligence linked to the Parque Científico of the University of Alicante.
The protagonist of this investigation is Enrique Arias Gil, the Spaniard who operates under the alias of "Desinformador Ruso" and for whom an international order for search and capture issued by the Audiencia Nacional is in effect. The report, titled "The invisible arsenal: hybrid threats to the Spanish elections of 2026 and to national security," places his activity within an ecosystem of recruitment, propaganda, and dissemination of information that goes beyond conventional cyberattacks.
The researchers compiled 54,737 digital elements, mapped 10,773 accounts from the main platforms, and examined 528 documents from the dark web during the period between August 20 and November 5. The analysis reconstructs connections between profiles, distribution channels, and digital communities that, according to the study, may contribute to amplifying influence operations against Spain.
Arias Gil’s activity stands out for the diversity of the profiles he tries to recruit. Through his Telegram channel, which exceeds 14,500 subscribers according to the report, he has disseminated offers to join the Russian Army, collaborate with computer operators linked to Russia, or provide personal data of Spanish citizens with public responsibilities.
Soldiers, informants, and paid cyber volunteers
One of the recruitment lines identified by Golden Owl is aimed at Spanish citizens who are willing to join the Russian Armed Forces. The report counts nine recent publications in which economic conditions are offered to those who accept fighting in Ukraine alongside Moscow’s troops.
The offers provide for monthly remuneration of between 2,500 and 3,000 dollars, in addition to a recruitment bonus of 25,000 dollars. They also include, according to the messages analyzed, travel and visa expenses, as well as the possibility of obtaining Russian citizenship. The ads are aimed at people between 18 and 50 years old, with preference for those who have military experience or experience in private security companies.
The second recruitment route focuses on obtaining sensitive information. Between October 21 and November 3, Arias Gil published three messages in which he urged Spanish citizens and officials to collaborate with Russia by handing over "confidential information and personal data of Spanish officials and businessmen."
The third front targets the digital sphere. On October 26, the channel invited its followers to become "paid cybervolunteers in cryptocurrencies" and to take part in the so-called Ddosia project, an initiative which, according to the message disseminated, would allow them to collaborate with Russian hackers in denial-of-service attacks and computer sabotage against Western targets. The three recruitment methods point to the same contact address, an element that investigators incorporate into their reconstruction of the activity. The report documents an offer that combines financial incentives, information-sharing collaboration, and participation in cyber operations.
The importance of the case is not limited to these calls. Arias Gil has been on Europol’s list of the most wanted since September 2025 for his alleged involvement with NoName057(16), an organization of pro-Russian hackers that has carried out campaigns against European institutions and companies. The National Police attributes to him having facilitated information about targets to prepare cyberattacks and having participated in the dissemination of personal data of members of the Fuerzas y Cuerpos de Seguridad del Estado. Among the episodes investigated is the publication of information on nearly 2,000 police officers, Civil Guards, military personnel, and agents of the Centro Nacional de Inteligencia (CNI). On October 29 as well, the channel disseminated the name, photograph, and professional record of an active non-commissioned officer in the Spanish Army, as reported by the study.
The trajectory of the investigated person had already been the subject of journalistic and police investigations. Cadena SER reported in September 2025 on the international arrest order and on suspicions of his involvement with the pro-Russian network, while Newtral reconstructed his inclusion on the Europol list and his activity as a channel administrator.
A propaganda network in Spanish with hundreds of thousands of followers
Beyond direct recruitment, Golden Owl identifies an infrastructure of Telegram channels that distributes content favorable to Moscow among Spanish-speaking audiences. The study places Arias Gil at the core of a network that translates, reproduces and amplifies materials coming from Russian state media, military information platforms and commentators close to the Kremlin.
Among the sources that appear in this circulation are Sputnik, the Tass agency and Rybar, along with other channels and content creators that disseminate analysis on the war in Ukraine and international politics from positions aligned with Russian interests.
The identified network accumulates approximately 350,000 subscriptions and 8.5 million views in 16 days, according to data collected by the researchers. Its capacity to spread does not depend only on the individual size of each channel, but on coordination in the publication and redistribution of content. Messages are replicated across different accounts, sometimes with identical texts and small time differences.
The result is a chain of amplification that allows introducing the same narrative into different communities and increasing its reach without all the channels having to respond to a single address management structure.
Among the accounts that appear repeatedly is the presentation of Israel, the United States, Morocco and NATO as the main threats to Spain, as well as the idea that the country has become a target of attacks due to its military support for Ukraine. The strategy, according to the report, consists of linking national events with the geopolitical confrontation and offering interpretations that erode confidence in Spanish institutions and their international alliances. One of the examples collected is the spread of false information after the railway accident in Urda, in Toledo. A mere 36 minutes after the accident, messages began to circulate that attributed the tragedy to alleged sabotage, a hypothesis that spread through accounts that imitated railway profiles and media outlets.
The speed of the spread illustrates one of the risks pointed out by Golden Owl: the ability to exploit events with a great impact on society before the authorities have been able to clarify their causes. The use of fake accounts, synchronized posts and manipulated content makes it possible to introduce alternative explanations and turn a national crisis into an instrument of polarization.
Fake pages from Vietnam and narratives prepared for 29-N
The report also identifies a network of Facebook pages managed from Vietnam that are presented to users as Spanish information spaces. The main network brings together eight pages and around 270,000 followers, with a particularly prominent presence among users aged 65 or older.
Researchers find that these pages would have resorted to paid audiences to increase their reach and build communities that appear to have a nationwide presence. Starting on 27 October, the content would have undergone a change in direction: from initially innocuous posts to political stories fabricated using artificial intelligence, with a marked anti-government and Islamophobic bias. The investigation warns that Vietnam is not the only source of these operations. Pages and channels also appear that simulate being Spanish from Sri Lanka, Indonesia, Pakistan or Argentina. In parallel, a set of 25 associated accounts, with activity from the United States, France and Germany, would have accumulated 1.39 million views through posts with identical tags related to the Ceuta crisis.
The electoral calendar adds another dimension to these operations. Golden Owl alerts to the adaptation to the Spanish context of narratives previously used in Latin America to question the legitimacy of election results, especially those related to alleged fraud in mail-in voting. The study identifies a sequence of publications that are practically identical, circulated by four accounts with barely nine seconds of difference. The researchers consider that this pattern points to a cell operating based on a shared script, with messages intended to present as fraudulent any result that does not match certain polling-based projections.
Among the materials disseminated are images generated using artificial intelligence that depict a supposed Correos employee destroying election ballots. The aim of this narrative would be to anticipate suspicions about the count and question in advance the legitimacy of the results of November 29.
The report summarizes this strategy in three recurring messages: not to vote by mail, to denounce that the census is manipulated, and to claim that an electoral theft will take place. Golden Owl specifies, however, that the discourse also has a national origin and that the participation of foreign networks consists of contributing to its dissemination and amplification. It does not attribute all detected activities to a single coordinated operation run out of Russia.
Millions of personal data exposed on the dark web
The investigation incorporates a final front related to the availability of personal information of Spanish citizens in clandestine markets. After examining 528 documents from the dark web, Golden Owl has identified ads offering more than 13 million records of Spanish citizens and 113,000 combinations of email address and password. The data comes from previous leaks, so their presence in these spaces does not necessarily mean that all credentials remain active or that the information is updated. However, its availability can facilitate identity impersonation campaigns, social engineering, and targeted disinformation operations aimed at specific groups.
The researchers’ concern focuses on the possible use of these databases to build more accurate campaigns, identify targets, and lend credibility to fraudulent messages. The combination of personal information, fake accounts, and content generated through artificial intelligence expands the possibilities for manipulating the public debate.
The report’s conclusion is that Spain faces the upcoming elections in an information environment in which networks, audiences, and narratives already exist that can exploit political or social events to erode institutional trust. The authors warn that an election night with a disputed result could become the setting for a new wave of fraud accusations, amplified by national and foreign digital structures.
The study insists, however, that not all documented activities are part of the same operation and do not necessarily respond to a single command center. Its relevance lies in the convergence of methods and capabilities: from recruiting citizens and disseminating sensitive information to propaganda, audience manipulation, and the exploitation of personal data.
The underlying warning goes beyond the electoral campaign. The digital infrastructure described by Golden Owl could remain operational after 29-N and take advantage of any crisis to intensify polarization, question institutional decisions, or weaken citizens’ trust in the democratic system.