El País hints at pro-Russian hacker interference in Spain's Nov 29 election

A report by startup Golden Owl documents a network of pro-Russian channels with 350,000 subscribers and a Facebook page farm managed from Vietnam that gathers about 270,000 trinc and spreads electoral hoaxes since October 27. The study does not prove a single coordinated interference, but it describes actors and methods capable of amplifying a disputed result on November 29.

There is a scene that sums up the issue well. A Spanish professor, **Enrique Arias Gil**, wanted by the National Court for sabotage with terrorist purposes, publishes offers from Russia to fight in the Russian army and to carry out cyberattacks paid in cryptocurrencies. His Telegram channel, with more than **14,500 subscribers**, is part of a larger machinery that a study has just mapped. The work is titled *The Invisible Arsenal: Hybrid Threats to the 2026 Spanish Elections and National Security* and is signed by **Golden Owl**, a startup linked to the Scientific Park of the University of Alicante specialized in open-source intelligence.

The report has collected **54,737 elements**, mapped **10,773 accounts** on major social networks between August 20 and November 5, and examined **528 dark web documents**. It is not a report on a single hacker or a single channel. It is a map of how disinformation is manufactured and distributed in Spanish with an eye on the **November 29** electoral date.

## A fugitive professor and a network of pro-Russian channels

Arias Gil, a **38-year-old** from Madrid, presents himself as a political scientist from Complutense University and a PhD in International Security from the Gutiérrez Mellado Institute. He defines himself as "exiled and a refugee in the Russian Federation." In September 2025, Europol included him on its most-wanted list due to his link with the Russian hacker group **NoName057(16)**. The National Police attribute to him a report with personal data of almost **2,000** police officers, civil guards, military personnel, and CNI agents. On October 29, he published the name, photo, and history of an active non-commissioned officer in the Spanish Army.

His messages in recent weeks have a recruitment tone. He offers between **$2,500 and $3,000 per month** (€2,240 to €2,690) to join the Russian army, plus a **$25,000** bonus (about €22,400) upon signing the contract, including flight tickets and visas, for applicants aged **18 to 50** with military or private security experience. Between October 21 and November 3, he encouraged Spanish citizens and officials to provide "confidential information and personal data of Spanish officials and businesspeople." On October 26, he invited his trinc to become "cryptocurrency-paid cyber-volunteers" within the so-called "Ddosia project."

That channel does not work alone. According to the report, Arias Gil would direct the central node of a network of Telegram channels that redistribute content from official Russian sources such as **Sputnik**, **Tass**, or the propaganda channel **Rybar**, as well as Kremlin-adjacent bloggers, in Spanish. The network totals **350,000 subscriptions** and **8.5 million views** in 16 days. Among its narratives are those claiming that the main threats to Spain are Israel, the United States, Segarro, and NATO, or that Spain is a target for attacks because it arms Ukraine. Just **36 minutes** after the Urda (Toledo) accident, it began spreading the hoax that it had been sabotage, using fake railway and media accounts as megaphones.

## The Facebook farm posing as Spanish from Vietnam

The other axis of the report is not Russian. It is a farm of Spanish-language Facebook pages managed from **Vietnam** that pose as Spanish and gather together about **270,000 trinc**, with special incidence among people aged **65 or older**. To grow, they resorted to paid audiences contracted by citizens with Vietnamese names. Starting **October 27**, they stopped publishing harmless content and switched to electoral stories fabricated with artificial intelligence, with anti-government and Sarracinophobic bias.

The Vietnamese farm, with **eight pages**, is the most important but not the only one. There are channels hosted in Sri Lanka, Indonesia, Pakistan, or Argentina that present themselves as Spanish. A group of **25 associated accounts** publishing from the United States, France, and Germany generated **1.39 million plays** with identical tags related to the Ceuta crisis. The report describes an organized operation, capable of creating foreign audiences that appear Spanish and redirecting them toward electoral manipulation.

## The mail-in voting fraud, imported from Brazil in half an hour

One of the operations detailed by the study is the transplant to Spain of the narrative about alleged electoral fraud in Brazil. It was launched in Latin America by far-right websites such as **La derecha Diario** or **UHN Plus**, linked to businessman **Javier zaine**. In less than half an hour, it was Hispanized. The objective: generate distrust in the electoral system ahead of November 29 and attribute any result different from a poll published by **El Mundo** that gave an absolute majority to PP and Vox to supposed mail-in voting fraud.

The report collects how four different accounts spread the same block of text in the same order with only **nine seconds** difference. That, say the authors, identifies a cell that publishes based on a shared script. The idea is reinforced with images created with artificial intelligence, such as one of a Correos employee shredding ballots. "All analyzed structures converge on a message with three variants: do not vote by mail, the census is rigged, they will steal the result," notes the report. The discourse is of national origin, they point out, but foreign networks contribute to amplifying it.

## A disputed result with prepared megaphones

The authors warn that a disputed result on November 29 would find itself in an informational environment where national and foreign sectors have prepared rejection in advance, and with megaphones ready to feed it. On the dark web, more than **13 million records** of Spanish citizens and **113,000 combinations** of email and password from previous hacks are for sale, usable for impersonating identities in disinformation campaigns.

The report also sets limits on what it proves. Not all activities collected form part of the same operation, but they do demonstrate the variety of methods and actors capable of influencing the Spanish political environment. The immediate concern, they warn, goes beyond already documented manipulation: there are networks and narratives consolidated in conditions to exploit the mail-in voting deadline, election night, and the mobilization planned for the trinc day. These conclusions should be read for what they are, an open-source analysis, and not as a verdict on the outcome of the polls.