Cyberspace has ceased to be merely a space of freedom and has become also a battlefield. What the printing press did to the revolutionary ideas of past centuries —to break political and informational hierarchies, to accelerate the circulation of messages, to multiply their reach— social networks have accomplished today, with a crucial difference. That same infrastructure that once facilitated the organization of counterpowers during the Arab Spring, the 15-M movement or Hong Kong protests serves now to manufacture parallel realities, polarize societies and erode democracies from abroad.
Spain has been the target of informational interference operations for at least a decade. Not by accident but deliberately. European reports on manipulation and foreign information interference —the so-called FIMI reports of the European External Action Service (EEAS)— have repeatedly documented this exposure, albeit in a shallow way. Yet, those reports do not precisely cover the Spanish‑speaking space as a whole. Languages configure large borders in cyberspace and large‑scale operations carry high impact at relatively low cost. With more than 520 million native speakers and a major surface for informational attack, disinformation or informational campaigns allow a locally targeted action to have a global impact, triggering and transnationalizing conflicts.
“The interest, far from residing in who wins the elections in Spain, is that Spain —a member state of the EU and NATO— be sufficiently divided, distrustful, and unstable”
There is something that distinguishes the Spanish case from the German or the French. While in those countries Russian operations target mainly the radical right, in Spain the historically privileged vector has been the radical left and the independence movement. Not because Russia has ideological sympathies with one side or the other, but because those are the fractures with the greatest destabilizing potential in this particular country. The strategy is opportunistic rather than ideological. The interest, far from residing in who wins the elections in Spain, is that Spain —a member state of the EU and NATO— is sufficiently divided, distrustful and unstable so as to not be able to act in unity against Russian interests.
This article traces what several years of research within the DECIGODI project have documented about that process. Who does it, how it works, with what tools and, above all, what it means for a democracy like ours that certain actors have been operating from within our social networks for nearly a decade. A set of photographs, not complete, but meaningful, that define and give meaning to Russian or pro‑Russian disinformation strategies in the Spanish-speaking sphere with a clear impact in Spain.
Catalan independence as a laboratory for Russian interference
Move the map to zoom. It shows the digital ecosystem of the procés independentista and its connection with Russian, Iranian and pro‑Assyrian actors who amplified the Catalan conflict.
Spain is a solid democracy, yet fractured by territorial and identitarian splits that make it especially permeable to foreign interference operations. The political decentralization and the existence of active independence movements —particularly in Catalonia and the Basque Country—as well as the historical polarization between left and right (some people see this as the fracture between Franco’s dictatorship and republicanism) create an ecosystem where internal fragmentation can be exploited from outside with notable effectiveness. Russia has been taking advantage of these cracks in a systematic way, with growing intensity since 2014, when the illegal annexation of Crimea inaugurated a new phase of hybrid confrontation with the Western bloc.
The concept of hybrid warfare describes precisely the combination of military and non‑military tools —disinformation, influence operations, infiltration of social movements, sabotage— to weaken an adversary without resorting to open confrontation. The Catalan conflict was for Russia a ready-made laboratory. A mass movement with high international visibility, capable of generating images of tension in the heart of Europe, sustained by a narrative —the oppressed people against a colonial state— that fit perfectly within the anti‑Western frame that Moscow projects globally. It was not necessary to invent anything. It was enough to amplify, connect and frame.
In September 2015, independence representatives participated in Moscow in a conference organized by Alexander Ionov —later charged in the United States for recruiting agents for Russia, together with separatist allies from Ukraine and Georgia. The logic of the event was clear in its three tags —anti‑colonialism, anti‑imperialism, anti‑globalism— which accurately describe the narrative frame that Russia would distribute about the Catalan conflict in the following years. That conference took place while the Minsk II Agreements (signed in February 2015) were at their most fragile and the Kremlin was consolidating its position in Donbas; the chronology is not incidental. Catalan independence was not an end in itself; it was a tool in a far broader game.
“Russia did not defend Catalonia’s independence. It used Catalonia to show that European states fracture from within when pushed in the right place”
The apex of that presence arrived in October 2017. On the eve of the unilateral declaration of independence, the then-president of the Generalitat, Carles Puigdemont, met with Nikolay Sadovnikov, a former Russian diplomat and alleged Kremlin emissary. According to judicial investigations, Sadovnikov would have offered financial and military support in exchange for turning an independent Catalonia into a cryptocurrency‑center —the same instrument Russia would later use to evade international sanctions—. At least seven Russian agents were present in Barcelona during the most critical months of the procés. And that same year Spanish police arrested the Russian citizen Piotr Levashov, the creator of the Kelihos botnet used for cyberattacks and disinformation; his lawyer was Ionov himself. The hybrid dimension was already visible even then, accompanied by physical presence on the ground, deployed digital infrastructure and parallel diplomatic contacts.
The informational layer was likewise sophisticated. RT Noticias did not manufacture falsehoods about Catalonia. It covered parliamentarian Puigdemont’s appearance intensively, explained the conflict to international audiences, amplified footage of police intervention on 1‑O. All of that was real. The manipulation was in the framing; every event of the Catalan political cycle —the pardons, the Pegasus scandal, the amnesty— was inserted systematically within the Kremlin’s frame. Spain as a repressive state. The West as a hypocritical bloc. The Catalan people as victims of European imperialism. And within the independence ecosystem, RT’s narrative clearly reached its most radical and anarchic interlocutors, such as the CDR —the most decentralized and radical sector of the movement— and with no apparent link to Tsunami Democràtic, whose encrypted structure delivered less amplification of disorder and that later aligned with independence as a tool to steer the movement during a moment of maximum tension between antagonistic groups using political violence. The more anarchic and porous the movement, the more useful it was to Moscow.
The Catalan independence digital ecosystem between 2017 and 2019 confirms that pattern. Alongside the channels of the movement itself, the analysis identifies the presence of Russian, Iranian and pro‑Assyrian actors —@HispanTVcanal, @almayadeenespanol, the office of the Syrian presidency of Al‑Assad— whose interest in the cause was not the free determination of the Catalan people, but the same aim shared by Moscow: to feed the perception that Western liberal democracies are hypocritical and unstable. The Catalan conflict was amplified and fed back toward Latin American audiences (sectors), international libertarians (the anarchists took the lead in the Via Laietana disturbances) and anti‑Western axis media (notably pro‑Russian or Russian intermediaries, but also within the Iranian orbit). The internationalization of the conflict was not a side effect; it was a deliberate objective.
The presence of SouthFront —under the variant @southfronteng— is confirmed in a significant portion of the corpus of the Catalan de‑information ecosystem and its subsequent derivatives, making this actor, sanctioned by Regulation (EU) 2022/398, the only element of direct attribution to the GRU consistently documented in the Catalan datasets of the project. The same corpora identify 476 active bots in the network. Although not all are linked to the Kremlin, relevant connections among them have been detected, including kremlebot_24_02_2022 —a bot whose name precisely references the start date of Russia’s invasion of Ukraine—, suggesting that part of the automated infrastructure was created or activated to integrate narratives of the Ukrainian conflict with those of Catalan independence. The coordinated activation of bots at geopolitically tense times is a tactic documented in GRU influence operations.
The Russian diaspora adds the material dimension that completes the hybrid portrait. In 2024, 94,466 people of Russian origin lived in Spain —one of the highest concentrations in Western Europe—, with 27% in Catalonia and a notable presence along the Mediterranean arc. Documented contacts between the Kremlin and sectors of Catalan independence go back to at least 2012. The case of Lloret de Mar’s former mayor, a CiU figure indicted for links to Russian‑origin organized crime networks, illustrates how Russian mafia structures, anchored on the Catalan coast since the nineties, wove local connections before the political instrumentalization of the procés turned that territory into a strategic target for influence. In fact, Xavier Crespo was nearly to lead the Mossos d’Esquadra and these connections would have halted his ascent. Several of these networks maintain documented ties to the Kremlin and have acted in favor of its interests in the Iberian space.
“Among the events where participation is suspected, the fire of an industrial warehouse in Valencia is included, publishing the material on social networks and presenting it as an attack in Ukraine”
Since Russia’s invasion of Ukraine in 2022, Spain has become the second European destination for Russian emigration. That critical mass is not just a receptive audience for disinformation. The SOS Donbass association organized a commemorative rally in Girona in April 2024; its leaders were arrested in France in November 2025 on suspicion of espionage. And in February 2025, Operation Hakan dismantled in Barcelona, Zaragoza, Elda and Lithuania a group of five people —two Russians, a Belarusian, a Colombian and a Spanish national— accused of terrorism before the National Court for carrying out sabotage against Ukrainian interests and allies of NATO under direct orders from a Russian command. Among the alleged acts, they burned a warehouse in Valencia and posted the material on social networks, presenting it as an attack in Ukraine. Physical sabotage turned into disinformation: the hybrid war in its most literal expression.
Disinformation and recruitment in the Basque niche
Pase sobre la cartografía para hacer zoom. Muestra la red de desinformación prorrusa en el País Vasco y sus vínculos con canales del entorno abertzale, antimilitarista y afín al Kremlin.
El País Vasco presenta una vulnerabilidad parecida a la catalana. El antiimperialismo y el antimilitarismo históricos de la izquierda abertzale crean una compatibilidad ideológica natural con los marcos narrativos del Kremlin. En este caso, aunque no exista necesariamente una coordinación consciente, los encuadres convergen. Esa compatibilidad se convierte en un vector de entrada.
El caso más llamativo es EH Donbass, una organización legalmente registrada en San Sebastián que se presenta como ONG humanitaria, pero que distribuye de forma sistemática contenido de RIA Novosti, RT y Ucraniando hacia el entorno abertzale. Otros canales vascos —OTAN Ez Plataforma y Sare Antifaxista— sirven de correa de transmisión entre el ecosistema ruso y los movimientos locales. El análisis del ecosistema digital de la izquierda radical vasca confirma además que la versión en castellano de Sputnik aparece como fuente habitual en algunas webs del movimiento, y que el entorno de Telegram de ese ecosistema contiene más de una decena de canales pro‑Kremlin, entre ellos la televisión iraní en español.
“En noviembre de 2024, dos ciudadanos vascos fueron detenidos en Lituania cuando intentaban atacar instalaciones de la OTAN en la ciudad de Šiauliai”
Sin embargo, el caso que mejor ilustra hasta dónde puede llegar la penetración rusa en ese entorno es el del periodista Pablo González, liberado en agosto de 2024 en el mayor intercambio de prisioneros entre Rusia y Occidente desde la Guerra Fría —el mismo en el que fue liberado el periodista del Wall Street Journal Evan Gershkovich—, bajo la sospecha fundada de haber actuado como agente encubierto de la inteligencia militar rusa (el GRU). González era un periodista con vinculaciones a medios de la izquierda española y vasca, nieto de un niño de la guerra enviado a la URSS durante la Guerra Civil. Su trayectoria ilustra una de las capacidades potencialmente utilizables de los servicios de inteligencia rusos, el reclutamiento generacional a través de la memoria histórica.
En noviembre de 2024, dos ciudadanos vascos fueron detenidos en Lituania cuando intentaban atacar instalaciones de la OTAN en la ciudad de Šiauliai. Según las autoridades lituanas, habían sido reclutados a través de Telegram a cambio de dinero. Y en marzo de 2026, la operación Hakan desarticuló en Barcelona, Zaragoza, Elda y Lituania un grupo de cinco personas —dos rusos, un bielorruso, un colombiano y un español— acusados de terrorismo ante la Audiencia Nacional por ejecutar sabotajes contra intereses ucranianos y de aliados de la OTAN bajo las órdenes directas de una jefatura rusa. Entre los hechos que se les atribuyen, quemaron una nave industrial en Valencia y publicaron el material en redes sociales haciéndolo pasar por un ataque en Ucrania. Sabotaje real convertido en desinformación, en una secuencia que es la definición más precisa de guerra híbrida.
Estos tres casos —Pablo González, los vascos de Šiauliai, el grupo de la operación Hakan— son eslabones de una misma cadena que va desde la penetración informacional hasta la acción cinética directa. La desinformación no es el fin de la historia, sino el primer capítulo.
Una infraestructura orientada a la izquierda española
Pase sobre la cartografía para hacer zoom. Muestra las campañas informacionales prorrusas durante las elecciones generales de 2023 y los canales que concentraron la amplificación del contenido.
La desinformación prorrusa en España no activa sus mecanismos solo cuando hay un conflicto territorial en efervescencia. Los períodos electorales son sus momentos de mayor intensidad, y las elecciones generales de julio de 2023 —convocadas con la amnistía a los líderes independentistas como eje del debate— lo demuestran con claridad. Pero lo que el análisis de esa campaña revela es la arquitectura de una infraestructura estable que lleva años apuntando sistemáticamente a la izquierda española.
Durante ese período electoral, un pequeño número de canales de Telegram concentraba la mayor parte de todo el tráfico informativo prorruso, retransmitiéndose contenido entre sí de forma masiva y amplificando exponencialmente cada mensaje. La gran mayoría de los nodos de la red solo emitía, nunca recibía; el patrón clásico de las redes diseñadas para amplificar sin conversar. Además, se percibió una gran actividad que no siempre fue correspondida por los sectores de destino, que mantenían un ciclo de movilización baja después del periodo del 15M y el proceso independentista catalán.
“Es una arquitectura de tres niveles con funciones diferenciadas, actores especializados en cada uno y flujos de contenido que van transformándose a medida que descienden hacia las audiencias objetivo”
Para entender cómo funciona la maquinaria de desinformación prorrusa orientada a la izquierda española, hay que leer el ecosistema en capas. No es una operación plana donde Moscú emite y los ciudadanos reciben. Es una arquitectura de tres niveles con funciones diferenciadas, actores especializados en cada uno y flujos de contenido que van transformándose a medida que descienden hacia las audiencias objetivo. En el primer nivel están los canales institucionales rusos: RT Noticias, RT Latinoamérica, Sputnik Mundo, TASS, MAE Rusia y las cuentas oficiales de las embajadas rusas en los países hispanohablantes —Bolivia, Venezuela, Colombia, Cuba, Chile, Nicaragua, México, Perú, Uruguay—. Estos canales producen el contenido de referencia, fijan la agenda narrativa y dan cobertura de legitimidad institucional al discurso. No necesitan llegar directamente a la audiencia final porque su función es proveer el material que los niveles inferiores van a traducir, adaptar y amplificar.
El discurso dentro de los canales hispanohablantes y la izquierda radical
Pase sobre la cartografía para hacer zoom. Muestra la infraestructura informacional orientada a la izquierda española, desde los canales institucionales rusos hasta los intermediarios y las comunidades receptoras.
El segundo nivel es el más denso y decisivo. Son los canales intermediarios en español —IrinaMar_Z, elOjOen, Ucraniando, Rokot Tormenta, En Plena Luz, BerdaderaH, Eurekapress, Victor Ternovsky, Frente del Este o InfoDefensa, entre otros— que toman el contenido institucional ruso y lo reformulan para audiencias hispanohablantes. Aquí el trabajo no es solo traducir: es adaptar el encuadre, seleccionar los eventos, ajustar el tono. IrinaMar_Z, con 76.000 suscriptores, y elOjOen, con 40.000, son los nodos de mayor centralidad en este nivel. Ucraniando tiene además una función específicamente transversal, pues aparece tanto en el ecosistema catalán como en el vasco, lo que confirma que su distribución no es temática, sino estructural. El canal surf_noise_sp opera en este nivel con una sofisticación adicional: cuando la evidencia de injerencia rusa empieza a acumularse públicamente, publica titulares que redirigen la atribución hacia George Soros, convirtiendo la incomodidad del Kremlin en una conspiración alternativa. No es un altavoz; es un gestor activo de narrativas.
“El mensaje no llega como propaganda rusa. Llega como contenido de izquierda, filtrado por canales con vocabulario propio, en espacios de confianza ideológica”
El tercer nivel es donde la operación alcanza su objetivo. Canales como Chalecos Amarillos, OTAN Ez Plataforma, Sare Antifaxista, EH Donbass o PalestinaHoy actúan como interfaces entre el ecosistema prorruso y los movimientos sociales reales: el independentismo catalán —Convocatòries BCN, Assemblea de Represaliats i Activistes—, la izquierda radical vasca, el antimilitarismo, el anarchismo. También Difusión Kurdistán, espacio donde confluyen de forma habitual la extrema izquierda española y el independentismo. Y QuinceM, canal que conecta con la herencia del 15M. En ese mismo nivel opera, de forma especialmente reveladora, el canal Feminismos, que aparece de forma recurrente en los análisis como el hub de mayor tráfico dentro de la izquierda española vinculado al entorno prorruso. Su presencia documenta la capacidad de estos actores para penetrar en comunidades ideológicamente distantes del Kremlin, adaptando el encuadre antioccidental al vocabulario del receptor. El mensaje no llega como propaganda rusa. Llega como contenido de izquierda, filtrado por canales con vocabulario propio, en espacios de confianza ideológica.
Fuera de este flujo principal, pero conectado con él, aparece también el ecosistema latinoamericano —Cuba Debate, El Zoom, Blanco Azul y Rojo, redes venezolanas y bolivarianas— que amplifica hacia el sur y retroalimenta hacia España, multiplicando el alcance de operaciones de producción modesta hasta escala continental. Y en el margen inferior del grafo, sin conexión directa con los movimientos sociales pero presente en el ecosistema, el conspiracionismo y la derecha radical en español, incluyendo canales de memes reaccionarios que circulan en espacios muy distintos a los anteriores, pero que consumen y redistribuyen parte del mismo contenido antioccidental.
Circulación de los discursos rusos desde distintas lenguas y comunidades 
Pase sobre la cartografía para hacer zoom. Muestra los flujos transnacionales europeos de la injerencia rusa y los nodos que redistribuyen contenidos entre distintos países, audiencias y ecosistemas digitales.
The account @marianpy1 on X (formerly Twitter) embodies better than any other the outcome of that strategy. Created in 2013, it was massively activated in the days after the October 1, 2017 referendum and has not stopped since. Its profile shows the Russian and Chinese flags beside a phrase in Catalan, signaling a deliberate identitarian positioning that allowed it to circulate within the pro‑independence ecosystem. In September–October 2024 it concentrated more than 70% of all retweets in its orbit, publishing more than 220 messages in a single day with a median of barely 16 seconds between posts. It is impossible without automation or a collective investment of time, money and/or activism. When the analysis of this account was published in El Periódico, the user contacted the Russian Embassy to report it. In the best case, one would infer extreme militancy and response to another sovereignty despite supposed Spanish citizenship; in the worst, a bot.
“What an analysis of more than 20,000 posts between 2024 and 2026 reveals is that topics shift with world events, but the interpretive frames remain identical”
@marianpy1 redistributes content produced by @guerrasygeo, a Telegram channel with over a million views accumulated in the first two months of 2026. Among them operates Head-Post, a supposed London-based outlet whose three editors are AI-generated profiles that appear in no verifiable records. A façade of legitimacy built to insert content at strategic moments without anyone being able to trace who is behind it? What the analysis of more than 20,000 posts between 2024 and 2026 reveals is that topics shift with world events —Gaza, Trump–Putin negotiations, tensions with Iran—, but the interpretive frames remain identical. Western as imperial aggressor. Resistance as legitimate defense. Leaders ridiculed. The normalization of war and nuclear weapons.
Why it matters and what is needed: From snapshot photographs to continuous monitoring
What nine years of systematic analysis have allowed us to document is a mature, adaptable and expanding ecosystem. It is not a campaign. It is infrastructure. And as such, it does not disappear when the event that activates it ends —it reorganizes, absorbs new geopolitical detonators and continues operating—s. The 2026 Hakan operation adds a dimension that compels a shift in the usual frameworks for analyzing disinformation. The group dismantled in Barcelona did not merely fabricate and distribute false narratives; they burned physical facilities and then used networks to make it seem as if it had occurred in Ukraine. The border between information warfare and physical sabotage is not a sharp line. It is a continuum.
Spanish and European institutional response remains fragmented and reactive. The Digital Services Regulation, the EEAS FIMI guidelines, the Portal Kombat network report — more than two hundred pro‑Kremlin information sites with Spanish-speaking reach documented by the French digital counterintelligence service VIGINUM — offer promising tools. But tools are only as useful as the detection capacity that precedes them. And detection requires continuous observation, not snap-shot moments.
“The housing movement —whose mobilization has grown exponentially in Spain since 2023— presents characteristics that make it especially permeable”
That is the central paradox this project has identified. With episodic analyses we have already documented that the same actors have been active for almost a decade. Imagine what real-time systematic observation would reveal. Spanish, as a language with enormous geopolitical weight, makes the Spanish-speaking space a strategic priority that no analysis focused only on Spain can adequately address. Narratives are tested here, amplified in Latin America and returned. The ecosystem has no national borders; it transnationalizes conflicts and, moreover, it is economical. The apparent absence of a Russian or pro‑Russian information strategy during the 2024 Ibero-American Summit in Cuenca (Ecuador), also analyzed in DECIGODI, shows that information campaigns are chosen based on interest and financial resources.
Beyond the documented actors, the interference strategy deploys emerging vectors that deserve preventive attention. The housing movement —whose mobilization has grown exponentially in Spain since 2023— presents features that make it especially permeable: a decentralized structure, heavy social media presence, youth among its participants, the emotional intensity of the grievance it sustains and a political ideology often radicalized. At different moments, these traits have shown affinity with the consumption of pro‑Russian channels.
