A recent analysis by the counter-disinformation group 411 has revealed that Russia-linked social media accounts actively stoked far-right tensions during the recent migration crisis in the Spanish enclave of Ceuta. The study, which examined approximately 4.5 million social media posts, suggests a highly coordinated effort to influence public perception by framing the mass border crossings as an intentional “assault” rather than a humanitarian event.
The disinformation campaign operated with remarkable speed and reach, successfully garnering over 720,000 views within the first six hours of the activity on August 1. By leveraging networks in seven different languages, the actors behind these accounts were able to amplify inflammatory rhetoric, including harmful Islamophobic and antisemitic conspiracy theories, to a massive global audience in a very short window of time.
Researchers identified specific nodes within this influence operation, most notably the Telegram channel Rybar, which is widely recognized for its ties to Russian intelligence services. Following the initial dissemination of narratives through such channels, the content was systematically amplified through broader networks, including accounts associated with the Pravda network, creating what lead researcher Ned Mendez described as a “highly specific and organised information superhighway.”
Beyond promoting far-right agendas, the investigation also uncovered that social media played a direct, facilitating role for the migrants themselves. The report noted that online discussions were frequently used to provide practical advice and logistical support for those attempting the crossing. However, researchers noted that this specific aspect of the online activity appeared largely organic, originating from small, individual, anonymous accounts rather than being directed by a single identifiable “recruiter.”
The dual nature of this social media activity—combining organic, decentralized advice for migrants with a centralized, sophisticated push for political disinformation—highlights the complex landscape of modern hybrid threats. By simultaneously stoking internal societal divisions in the West and managing the flow of migration-related information, the actors involved were able to maximize the impact of the crisis for their own strategic purposes.
In light of these findings, the report serves as a stark warning regarding the vulnerability of the digital information ecosystem during geopolitical flashpoints. As state-linked entities continue to refine their methods for spreading disinformation, the ability to rapidly identify and isolate such “information superhighways” remains a critical challenge for security analysts and social media platforms alike.