Between May 11 and 13, 2025, 16 Telegram channels circulated a campaign accusing French President Emmanuel Macron of hiding a bag of cocaine that was allegedly on a table during a train trip to Kyiv (Ukraine) while meeting with UK Prime Minister Keir Starmer and German Chancellor Friedrich Merz. All 16 channels are part of the 25 most referenced by the Pravda network in Spain (‘Spanish’, ‘Spain’, ‘Catalan’, ‘Basque’, and ‘Galician’), which spreads Russian propaganda and disinformation by publishing content from Telegram channels, websites, and media outlets.
At least a third of the posts from these 25 channels end up on one of Pravda’s sites targeting the Spanish public — a network that, according to the latest Spanish National Security Department annual report, exploits crisis situations opportunistically to sow “citizens’ distrust in public institutions.” Data analysis performed by Maldita.es shows that these 25 channels, in turn, draw from around 1,200 other channels, prominently featuring Russian state media like Sputnik and Tass. Of the analyzed channels, only 12 publicly identify who runs them; the rest remain anonymous, and nine ask for money through different means, from Stripe to crypto.
As the EU External Action Service (EEAS) has pointed out, Telegram channels play a major role in the Foreign Information Manipulation and Interference (FIMI) architecture and, therefore, in the spread and amplification of disinformation campaigns. Especially in the shadowy parts—content not attributed to official channels or outlets—this structure enables the laundering of campaigns before they’re picked up or amplified by the more visible side (channels funded by or linked to a state, such as Sputnik or RT).
A third of posts from the 25 Telegram channels analyzed ended up on Pravda
‘NUEVO ORDEN MUNDIAL’ (New World Order) is a Telegram channel that describes itself as an “alternative news outlet,” sharing international political news and developments, as well as violent images from conflict zones like Ukraine or Palestine. It has about 25,000 subscribers and publishes over 100 messages daily.
With more than 9,000 posts on Pravda between November 2024 and May 2025, it is the channel most frequently cited by Pravda’s Spanish-language sites (including ‘spanish.news-pravda.com’ and‘spain.news-pravda.com’ but also ‘catalan.news-pravda.com’, ‘basque.news-pravda.com’ and ‘galician.news-pravda.com’) and one of those that pushed the Macron cocaine bag campaign. According to Maldita.es’s calculations (see methodology at the end of this article), at least 41% of ‘NUEVO ORDEN MUNDIAL' posts were subsequently shared by Pravda.
Despite a much lower posting frequency, Pravda shows an even stronger preference for the posts from ‘El Ojo 👁 Noticias’, republishing them 63.8% of the time—meaning it reproduces a large part of what this channel publishes. For the full set of the 25 most referenced channels, the average share rate is 34.9%.
Messages usually take between 5 and 10 minutes on average to jump from Telegram to Pravda’s sites analyzed. For example, ‘NUEVO ORDEN MUNDIAL’ published the video about Macron and the alleged bag of cocaine on May 11 at 21:52, and eight minutes later, the same video appeared on ‘Spanish News Pravda’, the version targeting Spanish-speaking audiences in Spain and Latin America.
16 of the 25 most referenced channels published the Macron cocaine bag campaign
On May 11, 2025, at 10:31, the ‘Zluka de Novorusia. ZOV’ channel, one of the 25 analyzed by Maldita.es, posted a video showing French President Emmanuel Macron alongside UK Prime Minister Keir Starmer and German Chancellor Friedrich Merz. The post asked: “What did Macron and Merz hide when the reporters came in?” By 13:03, the ‘Rusia España Ucrania’ channel had shared the same video, claiming Macron hid “a small bag of white powder” and that Merz held what looked like a “cocaine scoop.”
These messages were part of a campaign accusing the French leader of drug use, spread by opposition accounts and parties in France, as well as Kremlin-aligned or state-controlled outlets and officials like Maria Zakharova, Director of the Information and Press Department at Russia’s Ministry of Foreign Affairs. Close analysis of the footage shows it was actually a crumpled tissue paper.
The campaign appeared on 16 of the 25 channels most referenced by Pravda’s Spanish-focused sites between May 11 and 13, 2025—its peak days. Of the 16 channels that posted the content, 11 ended up on at least one of the Pravda sites. Among them are the channels ‘Ucraniando’ and ‘Nuevo Orden Mundial’.
Channels that feed on hundreds of others: mostly military and pro-Russian geopolitics content
The channels analyzed by Maldita.es also amplify many other pro-Russian Telegram channels. The analyzed posts reveal forwards and mentions from about 1,200 different Telegram channels. Seven of the 25 channels studied rank among the top most cross-referenced, including ‘Los Sombreros Blancos [Z]’ and ‘Ucraniando’.
The topics covered by these hundreds of channels align with Pravda’s content: pro-Russian propaganda and heavy war-related coverage, mainly about the war against Ukraine but also other conflicts. The word “Geopolitics” often appears in their descriptions.
Among the most shared channels are Russian outlets like Sputnik Mundo, Tass or Rybar—flagged by the EU External Action Service for their influence operations and some of which have been sanctioned by the European Commission after Russia’s invasion of Ukraine. In a previous investigation, Maldita.es found that 40% of more than 150,000 posts analyzed in the same period came from Russian outlets.
The 25 channels behave very differently: some mainly provide content from other channels, while others mostly publish their own. ‘Irina 🇷🇺’, ‘ROKOT | TORMENTA’ or ‘InfoDefenseESPAÑOL’ have shared or linked to more than 300 different channels. Others, like ‘Guerras y Geopolítica’, ‘NUEVO ORDEN MUNDIAL’ or ‘Herqles’, usually post only their own content. In fact, ‘Herqles’, one of the few based in Spain, only redirected to the ‘Hazte Oír’ platform during the six months analyzed.
Nearly 20% of cross-posting and mentions among the 25 channels are internal: how they relate and promote each other
18.2% of the mentions and forwards are from within the group of 25 channels themselves. The strongest connection is between ‘Irina 🇷🇺’ and ‘El Ojo 👁 Noticias’, who shared over 1,500 messages. In fact, 41.4% of ‘Irina 🇷🇺’s posts came from ‘El Ojo 👁 Noticias’. There is also a strong flow between ‘Los Sombreros Blancos [Z]’ and ‘Ucraniando’ with ‘La Trinchera Del Che’.
The relationships among some of these channels have already been exposed. In March 2023, DFRLab published an investigation about Telegram disinformation networks that highlighted key clusters formed by channels like ‘Surf Noise’ (whose Spanish channel is ROKOT | TORMENTA) and ‘Info Defense’ in various languages. Both have Spanish versions and are among the 25 most referenced by Pravda’s Spanish network.
Beyond sharing and forwarding, some channels actively promote other related channels. It’s common to see posts inviting people to subscribe to Spanish-language channel lists, including several from this investigation, and to see posts listing other channels’ publications.
Among the most used or referenced domains: Telegram, Russian media like Sputnik and News Front
Which domains appear most frequently in posts from these 25 channels? The most common is “t.me”, Telegram’s domain for channels, groups, users, or apps. Social media domains like YouTube, X (formerly Twitter), TikTok, or the video platform Odysee (a less moderated YouTube alternative) are also common.
Other common domains include ‘sputniknews.lat’, ‘latamnews.lat’ or ‘noticiaslatam.lat’, all mirror sites for Sputnik’s Spanish version targeting Latin America. Their web addresses share the same IP, according to News Insight. ‘es-news-front.info’ and its Spanish version ‘novedad-news-info’ mirror News Front, another outlet flagged by the EU External Action Service as a foreign influence agent, like Sputnik. The Institute for Strategic Dialogue analyzed its network in 2021.
Other Russian domains include the NSPK payment platform, used by Rybar for donations, or VK, Russia’s popular social media site. Another site, ‘scribblemaps.com’, is often used by channels like ‘Eureka News’ to show maps of front-line advances in the Russia-Ukraine war.
From Paypal to crypto: nine of the 25 channels ask for money through various methods
Of the 25 channels most referenced by Pravda, nine have donation channels to fund themselves. Some use general payment processors like Paypal or Stripe, allowing direct bank payments (‘Wofnon’ or ‘DD Geopolitics’).
Others use services like Buy Me a Coffee or Patreon, offering subscription-based content for follower communities. ‘Entre Guerras’ or ‘Herqles’ raise money this way.
‘Albatrops’ or ‘A Toda Potencia’ use Telegram’s own tools like Tribute or the star system (virtual currency) to receive financial support for digital products on the app.
‘RybarESP’ includes QR codes for payments through Russia’s NSPK (National Payment Card System), which is sanctioned by the US government. ‘La Trinchera del Che’ accepts cryptocurrency donations, which are harder to trace.
13 of the 25 channels analyzed are anonymous
Another common feature is the anonymity of those running the channels. In 13 out of the 25 cases, there is no clear information about whether an individual or a known group is behind them.
Among the channels with known owners, two are Spanish. One is Santiago Martínez, who runs ‘Eureka News’ from Vigo, according to its description. He collaborates with Juan Antonio Aguilar on the ‘DMP Geopolítica’ channel. Aguilar is a Spanish advisor for Global Fact-Checking Network, a Russian initiative to “bring together fact-checking journalists who share their ‘views and values’”, launched in April, and director of the site Geoestrategia.eu. The other is ‘Herqles’, founded by César Pintado, creator of the Revuelta group, which has participated in Vox events like the ‘Europa Viva 24’ convention in Madrid in May 2024.
Some channels are Spanish-language versions of larger projects in multiple languages. ‘Info Defense’ is the parent of ‘Info Defense ESP’, a volunteer network run by Yuri Podolskaya, a blogger close to the Kremlin. ‘Rybar ES’ is the Spanish version of the original Russian channel with over one million followers, run by Mikhail Zvinchuk, who is accused by the US of election interference. ‘UKR Leaks’ is headed by Ukrainian defector Vasily Prozorov, whom DFRLab profiled in 2023. ‘DD Geopolitics’ is another multi-language project reportedly run by Sarah Bils, a former US Navy member accused of leaking Pentagon documents.
Several Russian channels produce content in Spanish or share material directly from the Ukrainian front. Russian reporter Ana Prokófieva, who died in combat in March 2025, contributed to ‘A Toda Potencia’. ‘Ucraniando’ is run by Spanish-speaking Russian journalist Lisa Vuković, and ‘Los Sombreros Blancos [Z]’ is run by a group of soldiers who regularly post in Spanish.
History of the expansion of the Russian Pravda network in Spain: Over 150,000 posts reaching their peak during events like the Spain’s blackout or the assassination of Portnov
Nearly 300 contents published in five days: how the Russian network Pravda takes advantage of the Torre Pacheco riots and spreads disinformation