The Alicante technology company Golden Owl has warned this Friday of the existence of "a diverse arsenal of hybrid threats against the electoral integrity and national security of Spain" in view of the proximity of the general elections on November 29. "These are different operations, with different actors, objectives and degrees of attribution, but their capabilities can reinforce each other," indicates the start-up, specialized in strategic intelligence, data analysis and detection of cyber threats, which became known after the migratory assault on the Ceuta border by revealing a previous mobilization campaign on social networks as a catalyst for that episode.
In a report released this Friday, it fundamentally warns of the spread in Spain of fake news, distortion of news, replicating information or even magnifying tragedies such as the Urda train accident through the internet using bots or false identities to influence Spanish public opinion. "The investigation exposes coordinated amplification, synthetic media, deceptive online identities and clandestine digital infrastructure. These are not necessarily components of the same operation, but rather different activities that demonstrate the variety of methods and actors capable of influencing Spain's political environment," he emphasizes.
Specifically, Golden Owl reveals "a chain of Telegram repeater channels" that reproduces information from Russian media such as Sputnik, TASS or Rybar in Spanish. "Following that chain to the end led to the most serious finding of the entire investigation. At the center of the pro-Kremlin Spanish-language ecosystem is a channel managed from Moscow by a Spanish citizen, under the protection of the Russian State."
This is Enrique Arias Gil, a Madrid political scientist considered a cyberterrorist by the National Police and who is among the most wanted fugitives by Europol. The report highlights that their activities include "recruiting other Spaniards as cyber volunteers paid in cryptocurrencies, as informants against their own officials and as contracted soldiers for the Russian Army."
"Around it, a ring of Spanish-language channels with half a million subscriptions brings the Kremlin's narrative of Spain's crises to both the Spanish far-right and far-left," the report says.
He assures that this tangle of channels "is active now, in Spanish and around Spanish events, with a network of half a million subscribers and Spanish political channels with six-digit figures that spread their narrative frameworks," which include a defense of Russian interests and that attribute harmful events "to Israel, the United States or Morocco."
The report also detects "page farms" in Vietnam that contribute to disinformation. It cites, for example, eight pages that published political content in Spanish in October 2026, whose administrators were in that Southeast Asian country: Gentle Echo, Atlas Wire, Horizonte Político, El Faro Diario, Ecos Perdidos, Global Horizons, Solstice Harbor and CosmoWire. "The pattern is coherent and deliberate. The eight were created within a period of eleven weeks. They are classified into categories that, like news, do not arouse suspicion (a restaurant, a fast food establishment, a music band, a children's clothing store) and use Spanish addresses that seem real: Alcalá, Serrano, Avenida de la Constitución in Seville or Calle de Mallorca in Barcelona."
Another example outlined in the report refers to the Urda train accident. Here he points to the "He repeated the same words under the accounts of Adif, Europa Press, El País and elDiario.es in less than ten minutes" and later "raised the accusation to 'terrorist attack by Israel and the USA in the middle of the electoral campaign'." He notes that half an hour after the accident, "Zionist sabotage" or "Israeli-Moroccan hybrid war" was already circulating on that social network, with tens of thousands of views.
