Sabi Soltani

CTO & Co-Founder @GoldenOwl_AI | OSINT Researcher | Data & Intelligence Lead |

[Sabi Soltani @Sabi_SLTI]

Spain votes on Nov 29. Russia is already inside the conversation.

An 11-week OSINT investigation collected 54,737 posts across X, Telegram, Facebook, Instagram, TikTok and YouTube, mapped 10,773 accounts and 3,284 network links.

The headline isn't "disinformation." It's recruitment. A Spaniard in Moscow is openly hiring his own countrymen as informants, hackers and soldiers. In Spanish. During the campaign.

Around him, a ring of pro-Russian channels with ~500K subscriptions feeds ready-made narratives to ordinary Spaniards, deciding how every crisis gets explained before the facts arrive.

This is a national security problem dressed up as a media problem.

Full report:

[Golden Owl @GoldenOwl_AI]

We began investigating influence on Spain’s 29N election. We uncovered threats extending into national security.

From Russian recruitment of Spaniards to Vietnamese page farms; from Latin America to Pakistan and Sri Lanka.

Different weapons, different vulnerabilities, from cyber infrastructure to the human mind.

Where vulnerabilities exist, exploitation should come as no surprise.
https://t.co/QNziNIeG96

[Ana B. @AnaBeik_GO]

If Russia can recruit openly inside one EU country, what stops the same system from running in the others?

Not bots. People. Paid to fight for Russia, to run cyber operations, or to hand over information on their own officials.

In Spain, @GoldenOwl_AI documented it: Enrique Arias Gil, a Spaniard wanted by Europol, operating from Moscow, used a Telegram channel to post nine Russian army recruitment ads (up to $3,000/month), crypto-paid cyber-operation pitches, and calls for confidential information on Spanish officials, all weeks before Spain votes on 29 November, while doxing active security personnel.

An election is not only a vote. It is also the officials, police and systems that protect it.

A post can be removed in hours, but a recruited insider can't.

[Sabi Soltani @Sabi_SLTI]

In our OSINT investigation of Spain's information space ahead of the Nov 29 election, we found a Vietnamese page farm riding the campaign. It is the largest foreign structure in the country's pre-election information space.

12 Facebook pages posing as Spanish news and community outlets, every manager located in Vietnam. Together: about 270,000 followers, built in eleven weeks this summer. Since Oct 27 they publish fabricated election stories dated to the campaign calendar.

We traced the pages, the ads that bought their audience, the company behind the links, and the operator's own desk, captured by malware.

This is how a Spanish audience is manufactured abroad.

[Sabi Soltani @Sabi_SLTI]

@RoyceJacob16 Yes, El Faro Diario is managed from Vietnam.

[Sabi Soltani @Sabi_SLTI]

In our OSINT investigation of Spain's information space ahead of the Nov 29 election, we found a Vietnamese page farm riding the campaign. It is the largest foreign structure in the country's pre-election information space.

12 Facebook pages posing as Spanish news and community outlets, every manager located in Vietnam. Together: about 270,000 followers, built in eleven weeks this summer. Since Oct 27 they publish fabricated election stories dated to the campaign calendar.

We traced the pages, the ads that bought their audience, the company behind the links, and the operator's own desk, captured by malware.

This is how a Spanish audience is manufactured abroad.

[Sabi Soltani @Sabi_SLTI]

Full report:
https://t.co/y9DKQCNDKA

[Sabi Soltani @Sabi_SLTI]

The farm has no dark-web presence. Its workshop does.

On a Russian-language stealer-log market, for $10: the saved logins of an infected computer in northern Vietnam. Side by side in that browser: the Blogbio dashboard, Facebook Business Manager, a traffic dashboard, a shop selling aged US Facebook accounts, AI voice and image generators, a proxy provider. In the same layer, Vietnamese Telegram sellers offer aged Facebook accounts from Europe and fan pages with members renamed in one second.

The same markets carry the raw material for mass messaging to Spanish voters: 13 million+ Spanish identity records with DNI data re-listed Nov 2, a 113,000-line Spanish email:password list on Nov 4. Nothing targets the electoral institutions. The ballot is not the target. The voter is.

Spain's electoral infrastructure is not compromised. Spain's information space is for sale.

[Sabi Soltani @Sabi_SLTI]

Russia's network in Spain has a specific use for Ukraine: it turns Spain's support for Kyiv into a case against Spain's own government.

The sequence, Oct 20 to Nov 4, all in Spanish, all on Telegram:

Oct 20: Ukrainian weapons are flooding Spain's black market.

Oct 28: Spain sends Leopard tanks to Russia's border and Renfe signs rail deals with Ukraine "while the Peninsula burns."

Oct 29: Russian state media names Spanish defence firms building weapons for Ukraine "while Spaniards live in tents."

Oct 30: a munitions factory accident in Granada becomes "a factory that supplies weapons to Ukraine." 12,600 views, the network's most-viewed Spain post of the campaign.

Nov 4: Spain joins a Multinational Force for Ukraine exercise. 15,900 views in one afternoon.

The message to Spanish voters is consistent: your money, your factories and your soldiers go to Ukraine, and what you get back is risk.

That is the frame Russia wants in place before Nov 29.

[Sabi Soltani @Sabi_SLTI]

How is Russia's network inside Spain organised, and how does it push content?

Our 11-week analysis of Spain's information space shows three layers.

Layer one: the hub. A Telegram channel run from Moscow by Enrique Arias Gil, a Spanish political scientist living under Russian protection. It is small, about 500 readers per post. Its job is not reach. Its job is production: translating Russian hacktivist attack claims into Spanish within the hour, publishing recruitment offers for informants, hackers and soldiers, and doxxing Spanish security personnel.

Everything above it is Russian. Everything below it is built to look Spanish.

[David Colon @Colon_David]

A LIRE DE TOUTE URGENCE, le rapport riche d’enseignements Golden Owl sur l’organisation du réseau d’ingérences informationnelles russes en Espagne en amont des élections législatives du 29 novembre.
L’analyse, menée sur 11 semaines met en évidence trois niveaux :
1. La plaque tournante est une modeste chaîne Telegram gérée depuis Moscou par Enrique Arias Gil, un politologue espagnol vivant sous la protection de la Russie. Il a pour mission la traduction rapide de contenus russes en espagnol, le recrutement de hackers, d’informateurs et d’agents, et la divulgation d’informations personnelles des agents de sécurité espagnols.
2. Le deuxième niveau est « le cercle », un ensemble de chaînes en langue espagnole qui relaient le flux produit par la chaîne Telegram de Gil, publient des contenus en parallèle avec elle et les hébergent. Le cercle publie des textes identiques à quelques secondes d’intervalle et promeut automatiquement les médias d’État russes. Entre le 20 octobre et le 5 novembre, leurs contenus ont été consultés environ 16 millions de fois rien que dans l’espace d’information espagnol.
3. Troisième niveau : Des agrégateurs « patriotiques » espagnols et des chaînes politiques dont l’audience se compte en centaines de milliers blanchissent le contenu. Leur production est composée à 74 à 86 % de partages. Ils récupèrent les images provenant de Moscou et les diffusent aussi bien aux électeurs espagnols d’extrême droite qu’à ceux d’extrême gauche.
En résumé, une seule source touche des centaines de milliers d’Espagnols tout en se présentant comme des dizaines de voix indépendantes. Le lecteur voit une chaîne espagnole qui traite de problèmes espagnols. Or, le flux d’informations qui la sous-tend provient directement de Moscou.
Or, à chaque crise en Espagne, ce réseau s’empresse d’imposer l’interprétation du Kremlin comme l’interprétation dominante avant même que les rédactions espagnoles n’aient pu relater les faits. Cinq thèses constituent la quasi-totalité de sa production destinée à l’Espagne : les véritables acteurs étrangers sont Israël, les États-Unis et le Maroc ; l’accident de train était un sabotage ; l’Espagne est attaquée parce qu’elle arme l’Ukraine ; la Russie protège le territoire espagnol contre le Maroc ; tous les partis sont identiques, donc voter ne change rien. https://t.co/Zd77W6bhir

[Sabi Soltani @Sabi_SLTI]

Read the full report here:
https://t.co/y9DKQCNDKA

[Sabi Soltani @Sabi_SLTI]

How is Russia's network inside Spain organised, and how does it push content?

Our 11-week analysis of Spain's information space shows three layers.

Layer one: the hub. A Telegram channel run from Moscow by Enrique Arias Gil, a Spanish political scientist living under Russian protection. It is small, about 500 readers per post. Its job is not reach. Its job is production: translating Russian hacktivist attack claims into Spanish within the hour, publishing recruitment offers for informants, hackers and soldiers, and doxxing Spanish security personnel.

Everything above it is Russian. Everything below it is built to look Spanish.

[Sabi Soltani @Sabi_SLTI]

Spain votes on Nov 29. Russia is already inside the conversation.

An 11-week OSINT investigation collected 54,737 posts across X, Telegram, Facebook, Instagram, TikTok and YouTube, mapped 10,773 accounts and 3,284 network links.

The headline isn't "disinformation." It's recruitment. A Spaniard in Moscow is openly hiring his own countrymen as informants, hackers and soldiers. In Spanish. During the campaign.

Around him, a ring of pro-Russian channels with ~500K subscriptions feeds ready-made narratives to ordinary Spaniards, deciding how every crisis gets explained before the facts arrive.

This is a national security problem dressed up as a media problem.

Full report:

[Sabi Soltani @Sabi_SLTI]

Here is what matters most. This network does not tell Spaniards who to vote for.

Direct electoral content is a handful of items per channel. Instead, for every crisis in Spain, it moves to set the dominant interpretation faster than Spanish newsrooms can report the facts.

Five frames carry almost all of its Spain-facing output: the real foreign hand is Israel, the US and Morocco; the train crash was sabotage; Spain is attacked because it arms Ukraine; Russia protects Spanish territory from Morocco; all parties are the same, so voting changes nothing.

None of this touches the ballot. All of it touches the voter.

[miguel gonzalez @mgonzalezelpais]

Un profesor buscado por la Audiencia Nacional recluta soldados y espías españoles para Rusia. Un estudio advierte de la creación en Vietnam de una granja de cuentas de Internet para influir en la campaña electoral del 29-N. @GoldenOwl_AI Vía @el_pais
https://t.co/KbqQKtmEyb

[Sabi Soltani @Sabi_SLTI]

@adria_blanch It seems you haven't actually read the report. We've published the data, documented the networks and backed our findings with evidence.

[Sabi Soltani @Sabi_SLTI]

Spain votes on Nov 29. Russia is already inside the conversation.

An 11-week OSINT investigation collected 54,737 posts across X, Telegram, Facebook, Instagram, TikTok and YouTube, mapped 10,773 accounts and 3,284 network links.

The headline isn't "disinformation." It's recruitment. A Spaniard in Moscow is openly hiring his own countrymen as informants, hackers and soldiers. In Spanish. During the campaign.

Around him, a ring of pro-Russian channels with ~500K subscriptions feeds ready-made narratives to ordinary Spaniards, deciding how every crisis gets explained before the facts arrive.

This is a national security problem dressed up as a media problem.

Full report:

[Golden Owl @GoldenOwl_AI]

We began investigating influence on Spain’s 29N election. We uncovered threats extending into national security.

From Russian recruitment of Spaniards to Vietnamese page farms; from Latin America to Pakistan and Sri Lanka.

Different weapons, different vulnerabilities, from cyber infrastructure to the human mind.

Where vulnerabilities exist, exploitation should come as no surprise.
https://t.co/QNziNIeG96

[Sabi Soltani @Sabi_SLTI]

I agree that political dissent shouldn't be confused with foreign interference.

But that's not what our report does. We documented a Spaniard operating from Moscow, openly recruiting informants, paid cyber operatives and soldiers for Russia. And that's only part of it. The report also examines disinformation campaigns, influence networks and other operations advancing Russian interests in Spain. This isn't about labeling political opponents as Putin supporters. I'd encourage you to read the full report.

[Tal Hagin @talhagin]

What does an attack on an election look like in 2026? Not just disinformation.

Our investigation into Spain's 29N election found a Spaniard in Moscow recruiting for the Russian Army, "Spanish" news pages run from Vietnam, and 13 million identity records on sale.

@GoldenOwl_AI 🧵