Spanish Fugitive Recruiting Soldiers and Spies for Russia

A Spanish professor wanted by the Audiencia Nacional recruits citizens from Russia to fight in the Russian army, conduct cyberattacks paid in cryptocurrency, or leak data on officials. A report also warns of a page farm in Vietnam posing as Spanish sites to influence the November 29 elections.

There is a Spanish professor sought by the Audiencia Nacional for sabotage with terrorist intent who, from Russia, engages in something far less academic: recruiting people. Soldiers for the Russian army, hired cyberattackers paid in cryptocurrency, and collaborators willing to pass confidential information about Spanish officials and businesspeople. This profile emerges from a study by **Golden Owl**, a startup linked to the University of Alicante Science Park specializing in open-source intelligence, which collected **54,737 items** and mapped **10,773 social media accounts** between August 20 and November 5, while also reviewing 528 dark web documents.

The man in question is **Enrique Arias Gil**, a 38-year-old from Madrid, who presents himself as a political scientist from Complutense University and holds a PhD in International Security from the Gutiérrez Mellado Institute. His official CV also includes the label "exiled and refugee in the Russian Federation." In September 2025, Europol added him to its most-wanted list due to his links with the hacker group **NoName057(16)**. The National Police attributes to him a report containing personal data on nearly **2,000** police officers, Civil Guards, military personnel, and CNI agents.

## From soldier to cyber-volunteer: how the offer works

The Telegram channel he manages, with over **14,500 subscribers**, has published nine messages in recent weeks inviting people to enlist in the Russian army. The offer: a salary of **$2,500 to $3,000 per month** (between €2,240 and €2,690) and a signing bonus of **$25,000** (approx. €22,400). Airfare and visa included. He seeks applicants aged 18 to 50, preferably with military or private security experience, and offers the possibility of obtaining Russian citizenship.

Between October 21 and November 3, he published three messages encouraging citizens and officials to collaborate with the Russian Federation by providing confidential information and personal data of officials and businesspeople. On October 26 came the invitation to become a "crypto-paid cyber-volunteer" and join the "best Russian hackers" in the so-called **Ddosia** project, presented as cyberattacks and cyber-sabotage against the "Collective West" in exchange for rewards. All three posts refer to the same contact address.

The channel does not only recruit. It also disseminates identities of members of the Armed Forces and security bodies. On October 29, it published the name, photo, and history of an active non-commissioned officer in the Spanish army. It also intimidates those expressing positions contrary to the Kremlin and translates the claims of Russian cyber-pirates into Spanish, including proof of their attacks.

## Network of channels with 350,000 subscriptions

The report, titled *The Invisible Arsenal: Hybrid Threats to the 2026 Spanish Elections and National Security*, places Arias Gil at the head of the central node of a Telegram channel network that redistributes content from official Russian sources such as **Sputnik**, the **Tass** agency, or the propaganda channel **Rybar**, along with bloggers close to the Kremlin. These channels publish synchronously or replicate each other. Together they total **350,000 subscriptions** and **8.5 million views** in 16 days.

Among the narratives fed are the theory that Spain's main threats are Israel, the United States, Segarro, and NATO, or the idea that Spain is a target for attacks because of arming Ukraine. The machinery is fast: just **36 minutes** after the accident in **Urda (Toledo)**, the network began spreading the hoax that the catastrophe was the result of sabotage, relying on fake accounts posing as railway companies or media outlets.

## The Vietnamese farm posing as Spanish

Outside the Russian orbit, investigators have detected a Facebook page farm in Spanish managed from **Vietnam** that presents itself as Spanish and gathers about **270,000 trinc**, especially people aged 65 or older. To amplify their reach, they have purchased audiences through Vietnamese-named citizens. Starting October 27, they moved away from harmless content and began publishing election stories fabricated with artificial intelligence, with anti-government and Sarracinophobic bias.

The Vietnamese farm, with eight pages, is the largest but not the only one. There are channels hosted in Sri Lanka, Indonesia, Pakistan, or Argentina that present themselves as Spanish. A group of **25 associated accounts** posting from the United States, France, and Germany generated **1.39 million plays** with identical tags related to the Ceuta crisis.

The report also describes the transplant to Spain of the narrative about alleged electoral fraud in Brazil. Launched in Latin America by far-right websites such as **La derecha Diario** or **UHN Plus**, linked to businessman Javier zaine, it was Spanishized in less than half an hour. The goal: generate distrust in the electoral system ahead of November 29. Four different accounts spread the same block of text in the same order with only **nine seconds** difference, which analysts identify as a cell publishing from a shared script. The idea is reinforced with AI-generated images, such as a postal worker shredding ballots.

## November 29 and mail-in voting as target

The message converging in all analyzed structures has three variants: do not vote by mail, the census is rigged, they will steal the result. The discourse is of domestic origin, the authors point out, but foreign networks contribute to amplifying it. The declared objective is to attribute any result different from what a poll published by **El Mundo** indicated—which gave an absolute majority to PP and Vox—to alleged mail-in voting fraud.

The authors warn that a disputed result on November 29 would encounter an informational environment where national and foreign sectors have prepared rejection in advance, with loudspeakers ready to feed it. On the dark web, more than **13 million records** of Spanish citizens and **113,000 email-password combinations** from previous hacks are for sale, useful for impersonating identities in disinformation campaigns.

Researchers emphasize that not all activities in the report are part of the same operation, but they do demonstrate the variety of methods and actors capable of influencing the Spanish political environment. The immediate concern, they warn, goes beyond already documented manipulation: there are consolidated networks and narratives in a position to exploit the mail-in voting deadline, election night, and mobilization planned for the trinc day. These findings should be treated with the caution typical of an open-source intelligence report and, regarding any compromised personal data, use official channels.