By Celia Ramos Vera, Maldita.es
Key points:
- Since November 2024, the Russian Pravda network has been operating pages specifically targeting audiences in Spain, including versions in Catalan, Basque and Galician, which massively replicate content aligned with the Kremlin’s interests
- More than half of its publications are based on messages extracted from largely anonymous Telegram channels. Content is transferred to Pravda pages within minutes
- Maldita.es has verified that it is common practice for this network to amplify disinformative content related to both national and international events
- Its publication peaks coincide with crisis moments with high media coverage, such as the blackout that affected Spain and Portugal in April 2025, or events relevant to Russia, such as the murder of the Ukrainian politician Andriy Portnov
The visit of the ex High Representative of the European Union for Foreign Affairs, Josep Borrell, to Kyiv on 9 November 2024 triggered the first massive wave of publications on Spain News Pravda, the newly launched Spain-focused branch of the international Russian disinformation and propaganda network Pravda, which operates through more than a hundred domains targeting specific national audiences.
In the following weeks, Pravda expanded its presence in Spain by adding new pages in Catalan, Basque and Galician, co-official languages spoken in Spanish regions where political movements exist that advocate for independence from Spain. These four versions, together with the pre-existing Spanish News Pravda (active since July 2023 and aimed at the global Spanish-speaking audience), have spread more than 540,000 pieces of content since their creation up to the time of writing this article.
The Spain, Catalan, Basque and Galician versions were created in two phases, November and December 2024, as part of a broader Pravda expansion that included dozens of additional sections in other languages, countries and topics. This is documented in a joint investigation by CheckFirst and DFRLab, which tracked more than 3.7 million posts from 105 different subdomains in less than two years.
The first articles in Catalan, Basque and Galician were published simultaneously at 19:21 on 28 December 2024 and were identical translations of one another. This kind of systematic replication, often using automated translation, across the different versions of the network contributes significantly to the overall volume of publications generated by Pravda.
According to data from the CheckFirst and DFRLab dashboard, which monitors the network’s activity almost in real time, 96.7% of Pravda’s articles include in their source code the HTML tag rel=”alternate”, a signal to browsers and search engines indicating that alternative versions of the same content exist in other languages or regional contexts.
The use of co-official or minority languages is not limited to the Spanish case. The network also operates pages in Welsh, Scottish Gaelic, and versions adapted to territories such as the Republic of Srpska, one of the constituent divisions of Bosnia and Herzegovina, where a Serbian majority resides. According to Spain’s Department of National Security, such operations seek to “increase pre-existing social or political divisions in the target country, undermine its cohesion, and ideally foster an alignment with Russian positions.”
Maldita.es has found a positive correlation between the publication spikes on these pages and certain newsworthy events, both national and international. In some cases, activity increases after events directly affecting Spain, such as the April 28 2025 blackout; in others, it coincides with internationally relevant milestones, such as the February 13 meeting of EU foreign ministers on negotiations related to the war in Ukraine.
These are some of the activity peaks detected by Maldita.es on the Spain, Catalan, Basque and Galician pages from their launch on 8 November 2024 until the period following the murder of Ukrainian politician Andriy Portnov.
RT and Sputnik are the most frequently cited outlets, but nearly 60% of the content draws from Telegram channels
Portal Kombat is the name given by the French government to the 2023 investigation that revealed the scale of the Pravda ecosystem. It showed how the network acts as a transmission belt for publications from media outlets controlled or associated with the Russian state, such as RT, TASS, Sputnik, or RIA Novosti, some of which have been banned by the EU or flagged by the European External Action Service for involvement in influence and information manipulation activities.
According to an analysis by Maldita.es, conducted between November 2024 and May 2025, at least 40% of the publications by Pravda targeting the Spanish audience cite one of these outlets as a source. The most frequently referenced is RT (Russia Today), one of those blocked by the European Union in 2022. In the remaining 58.6% of cases, Pravda uses content originally posted on Telegram channels.
To understand how this network operates, Maldita.es monitored for six months the 25 Telegram channels most frequently referenced by Pravda on its Spanish-language pages. At least one third of the messages from these channels end up being reproduced in one of the Spain, Catalan, Basque or Galician versions. The average time between a Telegram post and its appearance on Pravda ranged from 5 to 10 minutes.
Among the most cited channels are NUEVO ORDEN MUNDIAL, with around 25,000 subscribers, an average of 100 messages per day, and more than 9,000 posts replicated on Pravda during the study period; and El Ojo 👁 Noticias, whose messages were reproduced in 63.8% of cases. The overall average replication rate across the 25 channels analysed is 34.9%.
These 25 channels are themselves fed by more than 1,200 additional pro-Russian Telegram channels, forming a multi-layered network structure with several redistribution levels. Some channels act as aggregators, sharing content from hundreds of other channels—such as Irina 🇷🇺, ROKOT | TORMENTA, or InfoDefenseESPAÑOL. Others, like Herqles, Guerras y Geopolítica or NUEVO ORDEN MUNDIAL, focus primarily on original content.
This internal feedback loop is also reflected in message forwards: 18.2% of all mentions and posts within this group of 25 channels come from others within the same cluster. The result is a system that artificially multiplies the visibility of certain messages and reinforces their circulation without relying on external sources. Notably, there is a strong connection between Irina 🇷🇺 and El Ojo 👁 Noticias, with more than 1,500 messages shared between them. In fact, 41.4% of all content published by Irina 🇷🇺 originated from El Ojo 👁 Noticias. There is also frequent cross-posting among Los Sombreros Blancos [Z], Ucraniando, and La Trinchera Del Che.
The relationships between some of these channels had already been exposed. In March 2023, DFRLab published an investigation about Telegram disinformation networks that highlighted key clusters formed by channels like Surf Noise (whose Spanish version is ROKOT | TORMENTA) and Info Defense in various languages. Both have Spanish versions and are among the 25 most referenced by Pravda’s Spanish network.
Who’s Who? 13 of the 25 analysed channels operate anonymously
According to the European External Action Service, Telegram channels play a key role in Foreign Information Manipulation and Interference (FIMI) operations. Their limited traceability allows these networks to function as an initial link in the disinformation distribution chain, enabling certain campaigns to spread without a clear or attributable origin. This anonymity acts as a form of laundering that precedes subsequent amplification by more visible or state-linked outlets such as Sputnik or RT.
Many of these channels operate anonymously. Only 12 of the 25 analysed have identified administrators; the rest remain anonymous. In Spain’s case, two channels with a strong presence on Pravda are managed from within the country. Eureka News, administered by Santiago Martínez, presents itself as a geopolitical analysis channel based in Vigo (Galicia). Martínez also participates in DMP Geopolítica, where he frequently collaborates with Juan Antonio Aguilar, a Spanish adviser to the so-called Global Fact-Checking Network (GFCN), a Russian initiative to “bring together fact-checking journalists who share their ‘views and values’” that began operating in April 2025, and director of the site Geoestrategia.eu. The other channel, Herqles, was founded by César Pintado, creator of the group Revuelta, which has participated in Vox events such as “Europa Viva 24” convention.
Other channels are Spanish-language versions of larger projects in multiple languages. One example is Info Defense, the parent of Info Defense ESP, a volunteer network run by Yury Podolskaya, a blogger close to the Kremlin. Rybar ES is the Spanish version of the original Russian channel with over one million followers, run by Mikhail Zvinchuk, who is accused by the US of election interference. Also present is UKR Leaks, a project headed by Ukrainian defector Vasily Prozorov, whom DFRLab profiled in 2023. DD Geopolitics is another multilingual project reportedly run by Sarah Bils, a former US Navy member accused of leaking Pentagon documents.
Several Russian channels produce content in Spanish or directly share material from the Ukrainian front. Russian reporter Ana Prokófieva, who died in combat in March 2025, contributed to A Toda Potencia. Ucraniando is run by Spanish-speaking Russian journalist Lisa Vuković, and Los Sombreros Blancos [Z] is run by a group of soldiers who regularly post in Spanish.
From PayPal to crypto: nine of the 25 channels ask for donations
Nine of the 25 Telegram channels most referenced by Pravda seek funding from their audiences through payment platforms such as PayPal, Stripe, Buy Me a Coffee, or Patreon. Others use less traceable methods, such as cryptocurrencies or Telegram’s own built-in payment systems, like Tribute or the “stars” virtual currency. Albatrops and A Toda Potencia operate this way. RybarESP, includes QR codes for payments through Russia’s NSPK (National Payment Card System), which has been sanctioned by the U.S. government. Meanwhile, La Trinchera del Che allows cryptocurrencies donations, which are harder to trace.
Flooding the Internet to deceive AI: the “LLM grooming” strategy
By flooding search engines and web crawlers with automated disinformation content, Pravda managed to insert false claims and pro-Russian propaganda into the results produced by various AI chatbots, according to an audit by NewsGuard, a service that evaluates the reliability of news sources.
These operations aim to manipulate the data that feed artificial intelligence models such as ChatGPT or Gemini, increasing the likelihood that they will reproduce narratives aligned with Kremlin interests. The technique, known as “LLM grooming” (from Large Language Model and grooming, the practice of conditioning someone for a particular purpose, as in child grooming), consists of flooding the internet with tokens loaded with disinformation so that this material becomes integrated into the online datasets used to train AI chatbots.
The more articles a network publishes with this objective, the greater the chance that a chatbot will pick up one of its texts and cite it in its responses, thereby transmitting disinformation to users who ask about related topics. According to NewsGuard, the technique proved effective: one in three chatbots tested reproduced pro-Russian falsehoods in their answers. For example, when asked whether Ukrainian president Volodymyr Zelensky had blocked Donald Trump’s social network Truth Social in Ukraine, one chatbot cited three articles from Pravda’s network that contained this false claim (there is no evidence that the platform was ever available in the country, according to Ukrainian authorities and the Center for Countering Disinformation).
According to Viginum, Pravda also employed search engine optimization (SEO) strategies that boosted the visibility of its content in search results. “As a result, AI chatbots—which often rely on publicly indexed content, tend to draw from these websites,” NewsGuard concluded.
Pravda’s Spain-focused pages reached their publication peak on the day of the blackout (April 28)
On April 28, 2025, when a power outage left large areas of Spain and Portugal without electricity, the Spain, Catalan, Basque and Galician Pravda pages reached their highest volume of publications since launch. Between April 28 and 30, they produced nearly 1,200 posts, many of them linked to disinformative narratives.
Activity began just minutes after the outage. At 12:53 p.m., Pravda Spain published an initial alert that redirected readers to the Telegram channel TSA Noticias, the fifth most frequently cited channel by the analysed Pravda pages, where the same message had appeared just one minute earlier.
Half an hour after the blackout, publication frequency spiked, peaking at 2:40 p.m. During that period, posts already mentioned a possible cyberattack or falsely claimed that the blackout extended to unaffected countries such as Belgium or France.
Among the most widespread hoaxes was a supposed statement by Ursula von der Leyen attributing the incident to a Russian cyberattack. The claim first appeared in Portuguese 23 minutes after the blackout and circulated in several languages before being debunked. Alternative theories also spread, including that a “rare atmospheric phenomenon” or “induced atmospheric vibration” caused the failure, both falsely attributed to the Portuguese operator REN.
Pravda amplified these narratives both on its Spanish-language pages and on other regional versions, such as the one targeting Belgium. For example, it shared alleged satellite images showing the Iberian Peninsula completely dark, even though many of these images were outdated or included unaffected areas such as the Balearic Islands. The same content had appeared hours earlier on the Russian social network Pikabu, reinforcing the pattern of recycling material from social media before publication on Pravda.
The blackout episode also served as a testing ground for content linked to Operation Matryoshka, a campaign attributed to Russian networks that impersonates media outlets to spread disinformation with a veneer of legitimacy. Content blaming EU sanctions on Russia for the blackout, falsely attributed to The Independent and France24, first circulated on Telegram and was later picked up by Pravda’s English and Spanish pages.
Pravda once again used a domestic event to generate thousands of posts, many of them false. The same approach had already been applied during the DANA (cold drop) floods of October, 2024, when Pravda repeatedly shared the hoax of King Felipe VI’s fake entourage that actually showed Madrid’s municipal police. The pattern reappeared after the Torre Pacheco riots (Murcia) in July 2025: during the five days following the assault that triggered the unrest, Pravda published around 300 posts on the case, most sourced from Telegram channels such as Herqles, Viejos Tercios or TSA Noticias. The first post, shared just hours after the events, featured a decontextualized video of an assault in Almería falsely presented as having occurred in Torre Pacheco. The post was replicated on Spain News Pravda and Spanish News Pravda only thirteen minutes after its appearance on Telegram, following the same dissemination pattern observed in earlier incidents.
The same has occurred internationally. The murder in Madrid of Andriy Portnov, a pro-Russian Ukrainian politician sanctioned by both the EU and the United States, generated one of the largest publication spikes since Pravda’s Spain-focused pages were launched: on Spain News Pravda alone, out of 335 posts published on May 21, 167 contained Portnov’s name. A few days earlier, on May 8, the network spread a video in several languages claiming that that President Zelensky had purchased a $20 million mansion in Florida, a baseless piece of disinformation that forms part of a recurring narrative accusing the Ukrainian president and his entourage of enriching themselves with Western funds destined for the war in Ukraine.
In the same month, Pravda’s pages replicated images of a meeting between Emmanuel Macron, Keir Starmer and Friedrich Merz on a train bound for Kyiv, accompanied by messages in English, German, French and Spanish falsely suggesting that the leaders were using cocaine during the trip. The same images, shared by Russian officials such as Maria Zakharova, Director of the Information and Press Department at Russia’s Ministry of Foreign Affairs, were debunked by the French government, which clarified that the object in question was a paper tissue. Whether concerning the war in Ukraine, European institutions or Western political leaders, these contents follow a consistent pattern: they appear rapidly after real-world events, rely on sources that are difficult to trace, and are simultaneously disseminated across multiple regional versions of the network, maximizing their reach and persistence in search engines.
.
Posted by: Nayara Güércio (Trilateral Research)