Loading signal...
Signal
Submitted
Nov 8, 2026, 14:56 UTC
Open-source thread alleges a three-layer Russia-linked Telegram network targeting Spain, with a Moscow-run hub by Enrique Arias Gil feeding a ring of Spanish-language channels and large domestic "patriot" aggregators to rapidly shape narratives on Spanish crises, reaching an estimated 16 million views in 16 days.
Thread by analyst Sabi Soltani (@Sabi_SLTI) summarizing an 11-week analysis of a Russia-linked Spanish-language information network on Telegram targeting Spain's information space. The network is described as a three-layer system centered on a hub channel in Moscow, surrounded by a ring of distribution channels, and a landing layer of Spanish "patriot" aggregators and political channels that deliver narratives to Spanish voters across the spectrum.
Layer one ("the hub") is described as a Telegram channel run from Moscow by Enrique Arias Gil, characterized as a Spanish political scientist living under Russian protection. The channel reportedly has about 500 readers per post and is described as focused on content production rather than reach. Its functions reportedly include: translating Russian hacktivist attack claims into Spanish within an hour of publication, publishing recruitment offers for informants, hackers, and soldiers, and doxxing Spanish security personnel. The tweet states that "everything above it is Russian" and that "everything below it is built to look Spanish," implying a hierarchy of Russian-directed content feeding ostensibly domestic-facing channels.
Layer two ("the ring") is described as a set of Spanish-language Telegram channels that forward the hub's content, co-post with it, and host it. According to the analysis cited by Soltani, between 20 October and 5 November (year not explicitly stated, context suggests 2026 or the immediately preceding period), content from these channels was viewed around 16 million times within Spain's information space alone. Indicators that this is one coordinated system rather than coincidental overlap are listed as: (1) identical texts posted seconds apart across channels with no forward mark, suggesting use of a shared feed or bot-driven posting; (2) a nightly automated promotion of Russian state media at exactly 23:01 each night; (3) joint live broadcasts across the channels; and (4) a shared "news selection" digest that lists the channels together as a single editorial block. The analysis claims the detection of 35 synchronized clusters of content over 16 days, which is framed as evidence of a structured distribution system running off a shared content feed.
Layer three ("the landing end") is described as the level at which the content flow stops visibly appearing Russian. It is characterized as domestic Spanish "patriot" aggregators and political Telegram channels with six-figure audiences (i.e., at least 100,000 subscribers or regular viewers). These channels reportedly derive between 74% and 86% of their output from forwarding content, and they are said to take interpretive frames from the ring layer and deliver them to Spanish voters on both the far right and the far left. The thread emphasizes that "nothing here is covert" and that this overt amplification is central to the strategy: a single upstream source can reach hundreds of thousands of people while appearing as dozens of independent Spanish voices. The reader is described as seeing a Spanish channel talking about Spanish problems, while the actual content feed is claimed to originate in Moscow.
The thread stresses that the network does not primarily push explicit electoral messaging. Direct electoral content is described as limited to a "handful of items per channel." Instead, the main behavior is to intervene quickly in the information environment around crises in Spain, in order to frame events before Spanish newsrooms establish a factual baseline. The analysis highlights five dominant narrative "frames" that purportedly carry almost all of the network's Spain-facing output: (1) "the real foreign hand is Israel, the US and Morocco"; (2) "the train crash was sabotage"; (3) "Spain is attacked because it arms Ukraine"; (4) "Russia protects Spanish territory from Morocco"; and (5) "all parties are the same, so voting changes nothing." Soltani notes that these frames do not directly instruct Spaniards which party to vote for but instead aim to shape perceptions and trust, concluding that "none of this touches the ballot. All of it touches the voter."
The posts collectively frame this system as a coordinated Russian information operation targeting Spain, leveraging Spanish-language Telegram channels and domestic political ecosystems. A link to a fuller report is provided, but its content is not shown in the captured text.
Confidence: Medium
The thread describes a coordinated, Russia-directed information influence network targeting Spain's information space via Telegram, including translation and amplification of Russian hacktivist attack claims, recruitment messaging, and doxxing of Spanish security personnel. These are classic elements of hostile information operations and psychological pressure by a foreign state, fitting the Cyber & Information Warfare / Information Operations taxonomy. The activity is offensive and externall...
Source URL
https://x.com/Sabi_SLTI/status/2119397773372002321
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "c2a5d896-440c-4a94-83ed-fd3cfd0b74b4",
"url": "https://x.com/Sabi_SLTI/status/2119397773372002321",
"source": "extension",
"status": "processed",
"category": "Cyber & Information Warfare",
"subcategory": "Information Operations",
"incident_type": "Propaganda & disinformation campaigns",
"country": "Spain",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"Russia",
"Spain",
"Telegram",
"Information operations",
"Disinformation",
"Propaganda",
"Election influence",
"Narrative framing",
"Hacktivist claims",
"Doxxing",
"Recruitment",
"Russian state media",
"Far-right audiences",
"Far-left audiences",
"Coordinated posting",
"View metrics",
"Spanish security services"
],
"nodes": [],
"countries": [],
"where_text": "Cyberspace",
"headline": null,
"description": "Thread by analyst Sabi Soltani (@Sabi_SLTI) summarizing an 11-week analysis of a Russia-linked Spanish-language information network on Telegram targeting Spain's information space. The network is described as a three-layer system centered on a hub channel in Moscow, surrounded by a ring of distribution channels, and a landing layer of Spanish \"patriot\" aggregators and political channels that deliver narratives to Spanish voters across the spectrum.\n\nLayer one (\"the hub\") is described as a Telegram channel run from Moscow by Enrique Arias Gil, characterized as a Spanish political scientist living under Russian protection. The channel reportedly has about 500 readers per post and is described as focused on content production rather than reach. Its functions reportedly include: translating Russian hacktivist attack claims into Spanish within an hour of publication, publishing recruitment offers for informants, hackers, and soldiers, and doxxing Spanish security personnel. The tweet states that \"everything above it is Russian\" and that \"everything below it is built to look Spanish,\" implying a hierarchy of Russian-directed content feeding ostensibly domestic-facing channels.\n\nLayer two (\"the ring\") is described as a set of Spanish-language Telegram channels that forward the hub's content, co-post with it, and host it. According to the analysis cited by Soltani, between 20 October and 5 November (year not explicitly stated, context suggests 2026 or the immediately preceding period), content from these channels was viewed around 16 million times within Spain's information space alone. Indicators that this is one coordinated system rather than coincidental overlap are listed as: (1) identical texts posted seconds apart across channels with no forward mark, suggesting use of a shared feed or bot-driven posting; (2) a nightly automated promotion of Russian state media at exactly 23:01 each night; (3) joint live broadcasts across the channels; and (4) a shared \"news selection\" digest that lists the channels together as a single editorial block. The analysis claims the detection of 35 synchronized clusters of content over 16 days, which is framed as evidence of a structured distribution system running off a shared content feed.\n\nLayer three (\"the landing end\") is described as the level at which the content flow stops visibly appearing Russian. It is characterized as domestic Spanish \"patriot\" aggregators and political Telegram channels with six-figure audiences (i.e., at least 100,000 subscribers or regular viewers). These channels reportedly derive between 74% and 86% of their output from forwarding content, and they are said to take interpretive frames from the ring layer and deliver them to Spanish voters on both the far right and the far left. The thread emphasizes that \"nothing here is covert\" and that this overt amplification is central to the strategy: a single upstream source can reach hundreds of thousands of people while appearing as dozens of independent Spanish voices. The reader is described as seeing a Spanish channel talking about Spanish problems, while the actual content feed is claimed to originate in Moscow.\n\nThe thread stresses that the network does not primarily push explicit electoral messaging. Direct electoral content is described as limited to a \"handful of items per channel.\" Instead, the main behavior is to intervene quickly in the information environment around crises in Spain, in order to frame events before Spanish newsrooms establish a factual baseline. The analysis highlights five dominant narrative \"frames\" that purportedly carry almost all of the network's Spain-facing output: (1) \"the real foreign hand is Israel, the US and Morocco\"; (2) \"the train crash was sabotage\"; (3) \"Spain is attacked because it arms Ukraine\"; (4) \"Russia protects Spanish territory from Morocco\"; and (5) \"all parties are the same, so voting changes nothing.\" Soltani notes that these frames do not directly instruct Spaniards which party to vote for but instead aim to shape perceptions and trust, concluding that \"none of this touches the ballot. All of it touches the voter.\"\n\nThe posts collectively frame this system as a coordinated Russian information operation targeting Spain, leveraging Spanish-language Telegram channels and domestic political ecosystems. A link to a fuller report is provided, but its content is not shown in the captured text.",
"summary_short": "Open-source thread alleges a three-layer Russia-linked Telegram network targeting Spain, with a Moscow-run hub by Enrique Arias Gil feeding a ring of Spanish-language channels and large domestic \"patriot\" aggregators to rapidly shape narratives on Spanish crises, reaching an estimated 16 million views in 16 days.",
"summary_extended": null,
"actor_primary": null,
"target_primary": null,
"location_text": "Spain (online information space)",
"location_region": null,
"location_coordinates_lat": 40.463667,
"location_coordinates_lon": -3.74922,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "Medium",
"classification_rationale": "The thread describes a coordinated, Russia-directed information influence network targeting Spain's information space via Telegram, including translation and amplification of Russian hacktivist attack claims, recruitment messaging, and doxxing of Spanish security personnel. These are classic elements of hostile information operations and psychological pressure by a foreign state, fitting the Cyber & Information Warfare / Information Operations taxonomy. The activity is offensive and externall...",
"event_time_utc": "2026-11-08T11:53:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm24h",
"created_at": "2026-11-08T14:56:00.544Z",
"updated_at": "2026-11-09T06:58:21.434Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_24h",
"severity_band": "moderate",
"attribution_basis": "single_source"
}Source reliability
B
Info credibility
3
Event time
Nov 8, 2026, 11:53 UTC
Event time confidence
pm24h
Location
Spain (online information space)
Country
Spain
Tags
Russia, Spain, Telegram, Information operations, Disinformation, Propaganda, Election influence, Narrative framing, Hacktivist claims, Doxxing, Recruitment, Russian state media, Far-right audiences, Far-left audiences, Coordinated posting, View metrics, Spanish security services
Signal
Submitted
Nov 8, 2026, 14:56 UTC
Open-source thread alleges a three-layer Russia-linked Telegram network targeting Spain, with a Moscow-run hub by Enrique Arias Gil feeding a ring of Spanish-language channels and large domestic "patriot" aggregators to rapidly shape narratives on Spanish crises, reaching an estimated 16 million views in 16 days.
Thread by analyst Sabi Soltani (@Sabi_SLTI) summarizing an 11-week analysis of a Russia-linked Spanish-language information network on Telegram targeting Spain's information space. The network is described as a three-layer system centered on a hub channel in Moscow, surrounded by a ring of distribution channels, and a landing layer of Spanish "patriot" aggregators and political channels that deliver narratives to Spanish voters across the spectrum.
Layer one ("the hub") is described as a Telegram channel run from Moscow by Enrique Arias Gil, characterized as a Spanish political scientist living under Russian protection. The channel reportedly has about 500 readers per post and is described as focused on content production rather than reach. Its functions reportedly include: translating Russian hacktivist attack claims into Spanish within an hour of publication, publishing recruitment offers for informants, hackers, and soldiers, and doxxing Spanish security personnel. The tweet states that "everything above it is Russian" and that "everything below it is built to look Spanish," implying a hierarchy of Russian-directed content feeding ostensibly domestic-facing channels.
Layer two ("the ring") is described as a set of Spanish-language Telegram channels that forward the hub's content, co-post with it, and host it. According to the analysis cited by Soltani, between 20 October and 5 November (year not explicitly stated, context suggests 2026 or the immediately preceding period), content from these channels was viewed around 16 million times within Spain's information space alone. Indicators that this is one coordinated system rather than coincidental overlap are listed as: (1) identical texts posted seconds apart across channels with no forward mark, suggesting use of a shared feed or bot-driven posting; (2) a nightly automated promotion of Russian state media at exactly 23:01 each night; (3) joint live broadcasts across the channels; and (4) a shared "news selection" digest that lists the channels together as a single editorial block. The analysis claims the detection of 35 synchronized clusters of content over 16 days, which is framed as evidence of a structured distribution system running off a shared content feed.
Layer three ("the landing end") is described as the level at which the content flow stops visibly appearing Russian. It is characterized as domestic Spanish "patriot" aggregators and political Telegram channels with six-figure audiences (i.e., at least 100,000 subscribers or regular viewers). These channels reportedly derive between 74% and 86% of their output from forwarding content, and they are said to take interpretive frames from the ring layer and deliver them to Spanish voters on both the far right and the far left. The thread emphasizes that "nothing here is covert" and that this overt amplification is central to the strategy: a single upstream source can reach hundreds of thousands of people while appearing as dozens of independent Spanish voices. The reader is described as seeing a Spanish channel talking about Spanish problems, while the actual content feed is claimed to originate in Moscow.
The thread stresses that the network does not primarily push explicit electoral messaging. Direct electoral content is described as limited to a "handful of items per channel." Instead, the main behavior is to intervene quickly in the information environment around crises in Spain, in order to frame events before Spanish newsrooms establish a factual baseline. The analysis highlights five dominant narrative "frames" that purportedly carry almost all of the network's Spain-facing output: (1) "the real foreign hand is Israel, the US and Morocco"; (2) "the train crash was sabotage"; (3) "Spain is attacked because it arms Ukraine"; (4) "Russia protects Spanish territory from Morocco"; and (5) "all parties are the same, so voting changes nothing." Soltani notes that these frames do not directly instruct Spaniards which party to vote for but instead aim to shape perceptions and trust, concluding that "none of this touches the ballot. All of it touches the voter."
The posts collectively frame this system as a coordinated Russian information operation targeting Spain, leveraging Spanish-language Telegram channels and domestic political ecosystems. A link to a fuller report is provided, but its content is not shown in the captured text.
Confidence: Medium
The thread describes a coordinated, Russia-directed information influence network targeting Spain's information space via Telegram, including translation and amplification of Russian hacktivist attack claims, recruitment messaging, and doxxing of Spanish security personnel. These are classic elements of hostile information operations and psychological pressure by a foreign state, fitting the Cyber & Information Warfare / Information Operations taxonomy. The activity is offensive and externall...
Source URL
https://x.com/Sabi_SLTI/status/2119397773372002321
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "c2a5d896-440c-4a94-83ed-fd3cfd0b74b4",
"url": "https://x.com/Sabi_SLTI/status/2119397773372002321",
"source": "extension",
"status": "processed",
"category": "Cyber & Information Warfare",
"subcategory": "Information Operations",
"incident_type": "Propaganda & disinformation campaigns",
"country": "Spain",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"Russia",
"Spain",
"Telegram",
"Information operations",
"Disinformation",
"Propaganda",
"Election influence",
"Narrative framing",
"Hacktivist claims",
"Doxxing",
"Recruitment",
"Russian state media",
"Far-right audiences",
"Far-left audiences",
"Coordinated posting",
"View metrics",
"Spanish security services"
],
"nodes": [],
"countries": [],
"where_text": "Cyberspace",
"headline": null,
"description": "Thread by analyst Sabi Soltani (@Sabi_SLTI) summarizing an 11-week analysis of a Russia-linked Spanish-language information network on Telegram targeting Spain's information space. The network is described as a three-layer system centered on a hub channel in Moscow, surrounded by a ring of distribution channels, and a landing layer of Spanish \"patriot\" aggregators and political channels that deliver narratives to Spanish voters across the spectrum.\n\nLayer one (\"the hub\") is described as a Telegram channel run from Moscow by Enrique Arias Gil, characterized as a Spanish political scientist living under Russian protection. The channel reportedly has about 500 readers per post and is described as focused on content production rather than reach. Its functions reportedly include: translating Russian hacktivist attack claims into Spanish within an hour of publication, publishing recruitment offers for informants, hackers, and soldiers, and doxxing Spanish security personnel. The tweet states that \"everything above it is Russian\" and that \"everything below it is built to look Spanish,\" implying a hierarchy of Russian-directed content feeding ostensibly domestic-facing channels.\n\nLayer two (\"the ring\") is described as a set of Spanish-language Telegram channels that forward the hub's content, co-post with it, and host it. According to the analysis cited by Soltani, between 20 October and 5 November (year not explicitly stated, context suggests 2026 or the immediately preceding period), content from these channels was viewed around 16 million times within Spain's information space alone. Indicators that this is one coordinated system rather than coincidental overlap are listed as: (1) identical texts posted seconds apart across channels with no forward mark, suggesting use of a shared feed or bot-driven posting; (2) a nightly automated promotion of Russian state media at exactly 23:01 each night; (3) joint live broadcasts across the channels; and (4) a shared \"news selection\" digest that lists the channels together as a single editorial block. The analysis claims the detection of 35 synchronized clusters of content over 16 days, which is framed as evidence of a structured distribution system running off a shared content feed.\n\nLayer three (\"the landing end\") is described as the level at which the content flow stops visibly appearing Russian. It is characterized as domestic Spanish \"patriot\" aggregators and political Telegram channels with six-figure audiences (i.e., at least 100,000 subscribers or regular viewers). These channels reportedly derive between 74% and 86% of their output from forwarding content, and they are said to take interpretive frames from the ring layer and deliver them to Spanish voters on both the far right and the far left. The thread emphasizes that \"nothing here is covert\" and that this overt amplification is central to the strategy: a single upstream source can reach hundreds of thousands of people while appearing as dozens of independent Spanish voices. The reader is described as seeing a Spanish channel talking about Spanish problems, while the actual content feed is claimed to originate in Moscow.\n\nThe thread stresses that the network does not primarily push explicit electoral messaging. Direct electoral content is described as limited to a \"handful of items per channel.\" Instead, the main behavior is to intervene quickly in the information environment around crises in Spain, in order to frame events before Spanish newsrooms establish a factual baseline. The analysis highlights five dominant narrative \"frames\" that purportedly carry almost all of the network's Spain-facing output: (1) \"the real foreign hand is Israel, the US and Morocco\"; (2) \"the train crash was sabotage\"; (3) \"Spain is attacked because it arms Ukraine\"; (4) \"Russia protects Spanish territory from Morocco\"; and (5) \"all parties are the same, so voting changes nothing.\" Soltani notes that these frames do not directly instruct Spaniards which party to vote for but instead aim to shape perceptions and trust, concluding that \"none of this touches the ballot. All of it touches the voter.\"\n\nThe posts collectively frame this system as a coordinated Russian information operation targeting Spain, leveraging Spanish-language Telegram channels and domestic political ecosystems. A link to a fuller report is provided, but its content is not shown in the captured text.",
"summary_short": "Open-source thread alleges a three-layer Russia-linked Telegram network targeting Spain, with a Moscow-run hub by Enrique Arias Gil feeding a ring of Spanish-language channels and large domestic \"patriot\" aggregators to rapidly shape narratives on Spanish crises, reaching an estimated 16 million views in 16 days.",
"summary_extended": null,
"actor_primary": null,
"target_primary": null,
"location_text": "Spain (online information space)",
"location_region": null,
"location_coordinates_lat": 40.463667,
"location_coordinates_lon": -3.74922,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "Medium",
"classification_rationale": "The thread describes a coordinated, Russia-directed information influence network targeting Spain's information space via Telegram, including translation and amplification of Russian hacktivist attack claims, recruitment messaging, and doxxing of Spanish security personnel. These are classic elements of hostile information operations and psychological pressure by a foreign state, fitting the Cyber & Information Warfare / Information Operations taxonomy. The activity is offensive and externall...",
"event_time_utc": "2026-11-08T11:53:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm24h",
"created_at": "2026-11-08T14:56:00.544Z",
"updated_at": "2026-11-09T06:58:21.434Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_24h",
"severity_band": "moderate",
"attribution_basis": "single_source"
}Source reliability
B
Info credibility
3
Event time
Nov 8, 2026, 11:53 UTC
Event time confidence
pm24h
Location
Spain (online information space)
Country
Spain
Tags
Russia, Spain, Telegram, Information operations, Disinformation, Propaganda, Election influence, Narrative framing, Hacktivist claims, Doxxing, Recruitment, Russian state media, Far-right audiences, Far-left audiences, Coordinated posting, View metrics, Spanish security services