Sabi Soltani

CTO & Co-Founder @GoldenOwl_AI | OSINT Researcher | Data & Intelligence Lead |

[Sabi Soltani @sabber_dev]

@idkwhoiamidccc 😂

[Sabi Soltani @sabber_dev]

ولی هوانگ از سال ۲۰۲۴ اخلاقش عوض شده بود.

[Sabi Soltani @sabber_dev]

هوانگ، مدیر عامل Nvidia اخلاقش عوض نشده؟

قبلا خبر‌های کمی از زندگیش میومد بیرون، یادمه یه بار عکسش موقع میوه خریدن تو همه‌ی رسانه ها پخش شد!

الان هر جا میری هوانگ می‌بینی
هوانگ روی بدن طرفدارهاش امضا می‌کنه
هوانگ از زندگی می‌گه، آینده‌ی AI و...

احساس می‌کنم تغییر کرده و جالبه

[Sabi Soltani @sabber_dev]

@CallmeGraphist 😁

[Sabi Soltani @Sabi_SLTI]

Three weeks before Spain's general election, Facebook pages presenting themselves as Spanish opinion outlets are being run from Sri Lanka.

The pages list street addresses in central Madrid and are filed as news and media websites. Every one of their managers is located in Sri Lanka.

The pages were created in September 2026. In ten weeks they reached 126,000 followers, and their videos have been played 25.9 million times. One page alone has collected more than 828,000 reactions, comments and shares.

Their content is about the Nov 29 election. Several times a day they ask Spaniards which party and which candidate they will vote for.

[Ana B. @AnaBeik_GO]

If Russia can recruit openly inside one EU country, what stops the same system from running in the others?

Not bots. People. Paid to fight for Russia, to run cyber operations, or to hand over information on their own officials.

In Spain, @GoldenOwl_AI documented it: Enrique Arias Gil, a Spaniard wanted by Europol, operating from Moscow, used a Telegram channel to post nine Russian army recruitment ads (up to $3,000/month), crypto-paid cyber-operation pitches, and calls for confidential information on Spanish officials, all weeks before Spain votes on 29 November, while doxing active security personnel.

An election is not only a vote. It is also the officials, police and systems that protect it.

A post can be removed in hours, but a recruited insider can't.

[Sabi Soltani @Sabi_SLTI]

In our OSINT investigation of Spain's information space ahead of the Nov 29 election, we found a Vietnamese page farm riding the campaign. It is the largest foreign structure in the country's pre-election information space.

12 Facebook pages posing as Spanish news and community outlets, every manager located in Vietnam. Together: about 270,000 followers, built in eleven weeks this summer. Since Oct 27 they publish fabricated election stories dated to the campaign calendar.

We traced the pages, the ads that bought their audience, the company behind the links, and the operator's own desk, captured by malware.

This is how a Spanish audience is manufactured abroad.

[Sabi Soltani @sabber_dev]

روسیه چطور بین اسپانیایی ها نفوذ می‌کنه؟
از استخدام جاسوس تا پخش کردن روایت‌های همسو با خودش و دیده شدن محتوا در سطح میلیونی، پرداخت پول با کریپتو و جزئیات بیشتر رو اینجا توضیح دادم👇

این الگو مهمه چون همین ها رو به جمهوری اسلامی برای نفوذ به کشورهای دیگه آموزش میده.

[Sabi Soltani @Sabi_SLTI]

How is Russia's network inside Spain organised, and how does it push content?

Our 11-week analysis of Spain's information space shows three layers.

Layer one: the hub. A Telegram channel run from Moscow by Enrique Arias Gil, a Spanish political scientist living under Russian protection. It is small, about 500 readers per post. Its job is not reach. Its job is production: translating Russian hacktivist attack claims into Spanish within the hour, publishing recruitment offers for informants, hackers and soldiers, and doxxing Spanish security personnel.

Everything above it is Russian. Everything below it is built to look Spanish.

[Sabi Soltani @Sabi_SLTI]

How is Russia's network inside Spain organised, and how does it push content?

Our 11-week analysis of Spain's information space shows three layers.

Layer one: the hub. A Telegram channel run from Moscow by Enrique Arias Gil, a Spanish political scientist living under Russian protection. It is small, about 500 readers per post. Its job is not reach. Its job is production: translating Russian hacktivist attack claims into Spanish within the hour, publishing recruitment offers for informants, hackers and soldiers, and doxxing Spanish security personnel.

Everything above it is Russian. Everything below it is built to look Spanish.

[Sabi Soltani @sabber_dev]

توی تحقیقات OSINT مربوط به اروپا، معمولا پشت هر شری که به امنیت مربوطه به اسم روسیه میرسیم.

این بار برای انتخابات اسپانیا تو گزارش جدید نشون دادیم که چطور روسیه وارد گفت‌وگوهای سیاسی شده، از درست کردن شایعه گرفته، تا استخدام اسپانیایی‌ها برای خراب کاری.

اطلاعات اشخاصی که پشت این حساب‌ها هستند، شبکه‌ها و جزئیات بیشتر رو میتونید داخل وبسایت بخونید:

[Golden Owl @GoldenOwl_AI]

We began investigating influence on Spain’s 29N election. We uncovered threats extending into national security.

From Russian recruitment of Spaniards to Vietnamese page farms; from Latin America to Pakistan and Sri Lanka.

Different weapons, different vulnerabilities, from cyber infrastructure to the human mind.

Where vulnerabilities exist, exploitation should come as no surprise.
https://t.co/QNziNIeG96

[Sabi Soltani @Sabi_SLTI]

Spain votes on Nov 29. Russia is already inside the conversation.

An 11-week OSINT investigation collected 54,737 posts across X, Telegram, Facebook, Instagram, TikTok and YouTube, mapped 10,773 accounts and 3,284 network links.

The headline isn't "disinformation." It's recruitment. A Spaniard in Moscow is openly hiring his own countrymen as informants, hackers and soldiers. In Spanish. During the campaign.

Around him, a ring of pro-Russian channels with ~500K subscriptions feeds ready-made narratives to ordinary Spaniards, deciding how every crisis gets explained before the facts arrive.

This is a national security problem dressed up as a media problem.

Full report:

[Sabi Soltani @sabber_dev]

وقتی توی توییتر فارسی اسکرول می‌کنید اولین فکت اینه که باید به همه چی شک کرد، چون واقعیت اینه جمهوری اسلامی سرمایه گذاری بزرگی روی سوشال مدیا برای دستکاری افکار عمومی کرده.

حساب‌هایی فیکی که به ظاهر عادی هستند، کسشر پست می‌کنند اما به وقتش بازگو کننده‌ی روایت های ج.ا هستند.

کافیه تو شبکه‌ای که دارند آمپلیفای می‌کنند چند تا از کیوردهای مورد علاقه‌ی ج.ا رو سرچ کنید.

[Saeed Ghasseminejad @SGhasseminejad]

A coordinated mass-reporting campaign backed by the Islamist regime in Iran has been targeting Iran-based, anti-regime, pro-Pahlavi accounts on X, leading to their suspension.

Many of these accounts are eventually restored, sometimes after days or even months, because the reports against them are baseless. But the damage is already done. Suspensions, especially repeated ones, can completely derail an account’s growth, reach, and ability to communicate.

This is a deliberate, coordinated attempt by the regime to manipulate and control the Iran narrative on X.

It is essential that @X and @Support investigate this abuse and take action against accounts engaged in systematic, meritless mass reporting of dissidents.

This is particularly urgent for dissidents inside Iran. They are risking their lives to tell the world what is happening in their country. They should not also have to fight coordinated efforts by the regime to silence them on X.

[Apranik 2 🇮🇷🇮🇱 @PatriotApranik]

اکانت اصلی منو باند این فرد ساسپند کرد.

[Sabi Soltani @sabber_dev]

بیش از ۹۵ درصد از حساب‌های مرتبط با شبکه‌ی نفوذ جمهوری اسلامی به قصد دستکاری افکار عمومی انتخابات اسرائیل که Golden Owl شناسایی و منتشر کرد از دسترس خارج شدند.

سازمان امنیت داخلی اسرائیل (Shin Bet) این موضوع رو تایید و اطلاع رسانی کرد.

https://t.co/6mIgSY53de

[Golden Owl @GoldenOwl_AI]

95% of the X accounts identified in Golden Owl®’s research as posing as Israelis while operating under foreign influence are no longer active on the platform, as confirmed by our latest re-check.

Days before Israel’s election, Shin Bet (Israel’s domestic security agency) had also confirmed that numerous profiles accused of attempting to influence the election had been removed.

[Ana B. @AnaBeik_GO]

What stands out is the speed of adaptation once the network realized it was being watched.

The date was brought forward, a separate vetted group was proposed to evade police visibility, transport between Madrid and Barcelona was coordinated, and luxury targets such as Rolex, Louis Vuitton, Balenciaga and Hermès were explicitly named.

And this is no longer only Barcelona: the network has been traced across 18 locations in 11 autonomous communities.

[Reza Pahlavi Communications @PahlaviComms]

شاهزاده رضا پهلوی در پیام ویدیویی تازه‌ای، از همه ایرانیان، نه فقط نیروهای نظامی و دولتی، دعوت کرد به کارزار همکاری ملی برای نجات ایران بپیوندند.
او با تأکید بر اینکه جمهوری اسلامی ضعیف‌تر از هر زمان دیگری است، اعلام کرد برای سرنگونی رژیم و اداره ایران پس از آن برنامه‌ای روشن وجود دارد، برنامه‌ای برای حفظ امنیت و ثبات در دوران گذار، تضمین آزادی‌های اساسی و تأمین نیازهای ضروری مردم.
شاهزاده همچنین از نیروهای نظامی، انتظامی و امنیتی خواست به ملت بپیوندند و در روز آزادی ایران در کنار مردم بایستند تا امان‌نامه دریافت کنند.

برای ارتباط مستقیم با تیم شاهزاده رضا پهلوی و پیوستن به کارزار همکاری ملی برای نجات ایران، از طریق نشانی زیر در تلگرام اقدام کنید:
BarkhizIranBot

[Saeed Ghasseminejad @SGhasseminejad]

“باور دارم که همه ما، در کنار یکدیگر و با رهبری شاهزاده رضا پهلوی، می‌توانیم مأموریت خود برای ایران، یعنی بازپس‌گیری و بازسازی میهن، را با موفقیت به سرانجام برسانیم.”

[Sabi Soltani @sabber_dev]

خرابکاری‌هایی که از فرانسه شروع شد به اسپانیا هم رسیده.
گزارش جدید جغد نشون می‌ده شبکه‌ای به اسم «Blocus» که مردم رو به خشونت و خرابکاری تشویق می‌کنه، داره فعالیتش رو به شهرهای مختلف اسپانیا گسترش می‌ده.
تو گروه‌های تلگرامی این شبکه، درباره غارت فروشگاه‌ها، آتش زدن و حمله به پلیس صحبت شده.
این شبکه برای ۳۱ اکتبر در بارسلونا و مادرید فراخوان داده و برای شهرهای دیگه اسپانیا هم برنامه‌هایی اعلام کرده.

[Golden Owl @GoldenOwl_AI]

New Golden Owl® research maps the expansion of "Blocus" beyond Barcelona.

→ mobilisation spreading to multiple Spanish cities
→ anonymous TikTok accounts feeding users into Telegram and WhatsApp groups
→ minors and very young participants forming a significant part of the mobilisation base
→ explicit instructions on concealment, meeting points and disruptive actions
→ new calls for coordinated activity on 31 October

The key intelligence question is no longer what happened in Barcelona, but how quickly the same mobilisation architecture can be replicated elsewhere.

Full research:
https://t.co/N7tK61ImC8