History of the expansion of the Russian Pravda network in Spain: Over 150,000 posts reaching their peak during events like the Spain’s blackout or the assassination of Portnov

Josep Borrell, former High Representative of the EU for Foreign Affairs, visited Kyiv (Ukraine) on November 9, 2024, in one of his last official acts in the position. The event triggered the first massive reaction of publications from the newly launched page dedicated to Spain, 'Spain News Pravda', which belongs to the Russian propaganda and disinformation network Pravda, encompassing more than 100 domains focused on different countries around the world.

Weeks later, new pages appeared in Catalan, Basque, and Galician. Together with ‘Spanish News Pravda’ these sites have generated over 150,000 articles in just six months. They amplified coverage on events like the April 28 blackout or the May 21 shooting of Ukrainian figure Andriy Portnov in Madrid and boosted Spanish-language Telegram channels, some with under 3,000 followers.

The Pravda pages directed at Spain and its co-official languages recorded the highest number of publications on the day of the blackout (April 28)

The blackout was the day when the Pravda pages targeting Spanish territory reached their publication peak. The 'Spain,' 'Catalan,' 'Basque,' and 'Galician' pages recorded nearly 1,200 publications between April 28 and 30, the highest since they began operating in late 2024. They shared the first hoax detected after the blackout: a supposed statement by Ursula Von der Leyen attributing the incident to a Russian cyberattack, which began circulating 23 minutes after the power outage.

The first content on the blackout by Pravda's Spain network was a short alert at 12:53 p.m. stating "BREAKING NEWS | Large-scale national blackout." It redirected to a Telegram channel called 'TSA Noticias', which had published the identical text at 12:52 p.m., one minute earlier. It is the fifth most referenced channel by all the Pravda pages dedicated to Spain and in the Spanish language.

The mass publication of content came shortly after. The pace started to increase at 1:00 p.m., half an hour after the blackout, and reached its highest frequency at 2:40 p.m. During that time frame, they were already talking about a possible cyberattack or claiming that the blackout affected countries that were not impacted, such as Belgium or France.

During and after the blackout, they spread the hoax that a supposed "rare atmospheric phenomenon" had caused the power outage. They also disseminated satellite images that showed the Iberian Peninsula in darkness, although many of them were false, as they displayed areas in darkness that had not actually experienced power cuts, such as the Balearic Islands.

The Pravda network once again used a national issue to generate thousands of posts, many of them disinformation. We had seen this before during the DANA (cold drop) on October 29, 2024, when Pravda repeatedly shared the hoax of King Felipe VI's fake entourage, among other disinformative content.

The 2024 annual report of the Spanish National Security Department [p. 99] directly names Pravda and outlines a strategy. It defines it as a "pro-Kremlin propaganda and disinformation ecosystem" that opportunistically takes advantage of crisis situations to sow "public distrust in institutions," "project an image of a country in chaos," and has attempted to delegitimize aid to Ukraine under the pretext that it prevents assistance from reaching areas affected by the DANA.

The 'peaks' are associated with specific political events: from Borrell's visit to Ukraine to the death of Ukrainian Portnov

Data analysis shows how the network's publication peaks usually correspond to specific events. In some cases, they involve Spain, such as the blackout, but in many others, they relate to international news, such as the February 13 meeting of EU foreign ministers on Ukraine negotiations.

These are the peaks we have detected on the 'Spain,' 'Catalan,' 'Basque,' and 'Galician' pages from their inception on November 8, 2024, up to the aftermath of the death of Ukrainian Portnov.

Andriy Portnov, a former Ukrainian political adviser and pro-Russian figure investigated for embezzlement in Ukraine and sanctioned by the EU and the United States, was shot dead outside the American School in Pozuelo de Alarcón (Madrid) on May 21. This event has been one of the most widely shared by the Spanish Pravda network since its launch in November 2024.

On the 'Spain' page alone, this event triggered the second-largest publication peak. Of the 335 publications on May 21, 167 contained Portnov's name.

The 'Spain', 'Catalan', 'Basque', and 'Galician' pages were created in late 2024 during a period of network expansion

The 'Spain', 'Catalan', 'Basque', and 'Galician' pages were created in late 2024 in two phases of expansion of the Pravda network in November and December, which also saw the addition of dozens of sections dedicated to other countries, languages, or themes, according to a large-scale joint investigation on the Pravda network by CheckFirst and DFRLab, published in April 2025. Their data shows over 3.7 million publications by 105 different subdomains in nearly two years.

The first articles from 'Catalan', 'Basque', and 'Galician' are exact translations published at 7:21 p.m. on December 28, 2024. The replication of publications across the different pages of the network—often the result of translations—is one of the keys to the high volume of posts on the Pravda network.

The report by CheckFirst and DFRLab states that 38% of the posts across the network, that is, from the more than 100 domains that comprise it, include a reference in their source code (rel="alternate"), indicating that a page has alternate versions in different languages.

Moreover, the use of languages such as Catalan, Basque, or Galician on these pages does not appear to be an isolated case. There are other pages targeting languages such as Welsh or Scottish Gaelic, or territories like the Republic of Srpska, one of the divisions making up Bosnia and Herzegovina, inhabited by a Serbian majority. These are areas where nationalist or separatist movements exist. One of the aims of such operations, according to National Security, is to "increase preexisting social or political divisions in the target country, undermine its cohesion and, ideally, promote alignment with Russian positions."

92.6% of the publications on the 'Spain News Pravda' page have also been published on 'Spanish News Pravda'

Before the creation of these Spain-focused pages, the only one in Spanish was 'Spanish News Pravda’, created in July 2023. It has a significantly higher volume of publications than those focused solely on Spain and is more targeted at the Spanish-speaking community in both Spain and Latin America.

According to the analysis by Maldita.es, 92.6% of the 'Spain' publications are identical to those of 'Spanish': they have the same text and are based on the same source. In fact, a third of these matches were published at exactly the same time on both pages.

The CheckFirst and DFRLab investigation reveals the existence of sub-networks of Pravda pages that amplify content among themselves to target specific audiences. A robust Francophone network stands out, which not only includes the 'Français' page (counterpart of 'Spanish' for the French language), but also 'France' (counterpart of 'Spain') and other regions like 'Senegal' or 'Burkina Faso'. The most used languages across the entire Pravda network are English, French, German, and Spanish.

RT and Sputnik are the most cited agencies, but nearly 60% of the content uses Telegram channels as sources

'Portal Kombat' is the name given by the French government to the investigation that revealed the scale of the Pravda ecosystem in 2023. It showed how the network is routinely used as a conveyor belt for publications from media controlled or associated with the Russian state such as RT, Tass, Sputnik, or RIA Novosti, some of which are banned by the EU or flagged by the European External Action Service for conducting influence and information manipulation activities.

At least 40% of all publications analyzed by Maldita.es cite one of them as a source. The most referenced is RT (Russia Today), one of those blocked by the European Union in 2022.

In the rest of the cases (58.6%), Pravda uses content published by channels on the Russian platform Telegram. Among the most cited on the pages dedicated to Spain ('Spain', 'Catalan', 'Basque', and 'Galician') are Spanish-language channels. The most used is 'Baleares-WWG1WGA 🇪🇸', a channel with fewer than 3,000 followers. It is followed by 'Herqles' (around 50,000) and 'TSA Noticias 🇪🇸' (slightly more than 60,000 followers). These three channels existed before Pravda and the beginning of the Russian invasion of Ukraine in February 2022.

'Herqles', which defines itself as "the voice of countercultural youth who do not recognize themselves in a decadent society," is also one of the channels that promoted a protest against the "bellicist drift" in Ukraine along with others that have spread pro-Russian disinformation. Its founder also created the group Revuelta, which emerged during the protests against the amnesty law in 2023. 'TSA Noticias 🇪🇸' is one of the channels investigated by Maldita.es for spreading COVID-19 denialist disinformation, which later shifted to content about the war in Ukraine.

If the 'Spanish' section is included, whose publication volume is much higher, the ranking of most cited changes. The most significant in numbers are 'Nuevo Orden Mundial', 'Ucraniando', and 'Los Sombreros Blancos [Z],' three Spanish-language channels with similar content: war themes in favor of Russia and geopolitical current events affecting other countries as well.

Examples of posts from Telegram channels most referenced on the Pravda network in Spanish:

Russia and Ukraine are the most prominent topics in Spanish, but numerous international issues are addressed with a geopolitical approach

Maldita.es conducted a text analysis using a natural language processing model to extract names, places, and entities present in the texts of Spanish-language publications. We detected five major themes that stand out: Russia, Ukraine, United States, European Union, and Spain.

The most recurring topics on the 'Spanish' and 'Spain' pages—that is, not including the co-official language pages—are Russia and Ukraine, present in 21.4% and 20.2% of the content, respectively. While most publications generally address war and international politics, this categorization helps highlight when certain topics are more prevalent than others.

The topic of the United States has sometimes overtaken Russia or Ukraine, and in fact, the volume of posts on this topic also increased after Donald Trump returned to the presidency, compared to late 2024. In the week following January 6, 2025, Pravda amplified events such as Trump's threat over Greenland or the historic wildfires that ravaged Los Angeles. The president's name is the most repeated in publications on this topic.

Posts related to the European Union have also increased their presence in the network at other times, more intensely in February 2025 when Ukraine once again expressed its intention to join the EU or when an increase in European military aid to Ukraine was debated.

The peak for these five topics was Russia-related, around Victory Day (May 9, 2025)—a major display of military strength by the Russian government used to strengthen its foreign relations and attended by the presidents of Cuba, Venezuela, China, and Serbia, among others.