Enrique Arias Gil, a Spanish professor against whom the National Court has issued an international search and arrest warrant for a crime of sabotage with terrorist purposes, is dedicated from Russia to recruiting Spanish citizens to fight as soldiers in the ranks of the Russian Army, participate in cyber attacks paid with cryptocurrencies or provide confidential information about Spanish officials. This is according to a study by Golden Owl, a startup linked to the Science Park of the University of Alicante and specialized in the analysis of open source intelligence. The report has compiled 54,737 elements and mapped 10,773 accounts from the main social networks between August 20 and last Wednesday, November 5, in addition to examining 528 documents from the dark web.
The Spanish fugitive, who manages a Telegram channel called Russian Disinformer with more than 14,500 subscribers, has made nine publications in recent weeks in which he invites people to join the Russian Army in exchange for a salary of 2,500 to 3,000 dollars per month (2,240 to 2,690 euros), in addition to a bonus of 25,000 dollars (about 22,400 euros) upon signing the contract. ―air ticket and visa included― for applicants between 18 and 50 years old, preferably with military or private security experience, with the possibility of accessing Russian citizenship. Between October 21 and November 3, he also published three messages in which he encouraged Spanish citizens and officials to collaborate with the Russian Federation, providing “confidential information and personal data of Spanish officials and businessmen”; while on October 26, he invited his followers to become “paid cyber volunteers in cryptocurrencies” and join the “best Russian hackers” to participate in the so-called “Ddosia project, cyber-attacking and cyber-sabotaging the Collective West in exchange for juicy rewards.” The three publications refer to the same address to contact the promoters.
Arias Gil, a 38-year-old from Madrid, presents himself as a political scientist, with a degree from the Complutense University, a doctor in International Security from the Gutiérrez Mellado Institute, “exiled and refugee in the Russian Federation.” In September 2025 he was included on Europol's most wanted list for his links to the Russian hacker group NoName057(16). The National Police credits him with preparing a report with the personal data of almost 2,000 police officers, civil guards, soldiers and agents of the National Intelligence Center (CNI). It is not the only dissemination of identities that members of the Armed Forces or security forces have carried out: on October 29, they published the name, photograph and history of an active non-commissioned officer of the Spanish Army. His channel is also dedicated to intimidating those who express positions contrary to the Kremlin and translating the claims of Russian cyberpirates into Spanish and publishing evidence of their attacks.
According to the report, titled The invisible arsenal: hybrid threats to the 2026 Spanish elections and national security, this professor protected by Moscow would direct the central node of a network of Telegram channels that redistribute in Spanish content from official Russian sources (the Sputnik portal, the Tass agency or the Rybar propaganda channel), but also from bloggers close to the Kremlin. According to the report, this network of pro-Russian channels - which synchronously publish their content or replicate and republish each other - has 350,000 subscriptions and 8.5 million views in 16 days.
Among other narratives, this network feeds the theory that the main threats to Spain are Israel, the United States, Morocco and NATO or that Spain is the target of attacks for arming Ukraine. Only 36 minutes after the accident in Urda (Toledo), the hoax began to spread that the catastrophe had been the result of sabotage, which spread with extraordinary rapidity thanks to the use of false railway or media accounts.
Beyond the Russian plot, Golden Owl researchers have detected the creation of a farm of Facebook pages in Spanish, managed from Vietnam, which pose as Spanish and gather together some 270,000 followers, especially people aged 65 or over. To increase their dissemination, the report warns, these pages have resorted to paying audiences, hired by citizens with Vietnamese names. As of October 27, the study warns, they stopped disseminating innocuous content and switched to electoral stories fabricated with artificial intelligence, with marked anti-government and Islamophobic bias. “The investigation reveals an organized operation, capable of creating audiences abroad that appear Spanish and redirecting them towards manipulation related to the elections,” the report warns. The so-called Vietnamese farm, with eight pages, is the most important but not the only one. There are also channels hosted in Sri Lanka, Indonesia, Pakistan or Argentina that present themselves as Spanish. A group of 25 associated accounts that published from the US, France and Germany generated 1.39 million views with identical tags or hashtags related to the Ceuta crisis.
One of the operations described in the report is the transplant to Spain of the narrative about the alleged fraud of the Brazilian elections. Launched in Latin America by far-right websites, such as La Derecho Diario or UHN Plus, linked to businessman Javier Negre, it was Spanishized in less than half an hour, with the aim of generating distrust in the electoral system with a view to 29-N. The report shows how four different accounts spread the same block of text in the same order with only nine seconds of difference, which “identifies a cell that publishes from a shared script.” The objective: to attribute any result different from a survey published by El Mundo, which gave an absolute majority to PP and Vox in the elections on the 29th, to alleged vote-by-mail fraud. This idea is reinforced with images created with artificial intelligence, such as that of a Post Office employee shredding voting ballots. “All the structures analyzed converge on a message with three variants: do not vote by mail, the census is rigged, they will steal the result,” the report states. The discourse is of national origin, he points out, but foreign networks contribute to amplifying it.
The authors of the report point out that “a disputed result on November 29 would encounter an information environment in which national and foreign sectors have prepared the rejection in advance” and have loudspeakers willing to feed and amplify it. The report also warns that more than 13 million records of Spanish citizens and 113,000 email and password combinations are for sale on the dark web, which, although they come from previous hacks, can be used to impersonate identities in disinformation campaigns.
Finally, the researchers emphasize that not all the activities included in their report are part of the same operation, but they do “demonstrate the variety of methods and actors capable of influencing the political environment in Spain.” “The immediate concern goes beyond the manipulation already documented,” they warn. “Consolidated networks and narratives are in a position to exploit the period of voting by mail, the election night and the mobilization already planned for the day after” the elections, depending on the result of the polls.
