Russia took advantage of the disaster to fuel the rumor that Spain was a country "plunged into chaos."

The pro-Russian propaganda ecosystem took advantage of the drought that swept through the Valencian Community on October 29 of last year to launch a disinformation campaign against Spain, projecting the image of a country "plunged into chaos" in which Pedro Sánchez's government was using public funds to continue assisting Ukraine before addressing "the real need for aid" in the areas affected by the devastating cold snap. This is revealed in the latest National Security report, to which La Vanguardia has had access, which shows that the Russian Federation is the main source of hybrid threat to Spain, with an intensification of confrontational information campaigns aimed at "increasing pre-existing social and political divisions."

The report, approved by the National Security Council at its meeting on April 24, places cyber vulnerability and disinformation campaigns as the two threats to national security that rank highest on the risk map.

The highest body in matters of national security asserts that the Kremlin continues to opportunistically promote disinformation campaigns to try to manipulate public debate not only about the government's support for Ukraine, but also about Spain's membership in the European Union and NATO.

Two events exploited by pro-Kremlin activists The European Parliament elections and the floods caused by the Dana

The 304-page document, which has not yet been made public, cites electoral processes and natural disasters as key events that created the confusion that erodes democratic legitimacy. And in 2024, the year the report focuses on, two major events were exploited by pro-Kremlin activists: the European Parliament elections and the Dana floods.

In the weeks leading up to the European elections, nearly fifty instances of Russian manipulation and interference were detected, peaking between June 6 and 9, but continuing even after the elections.

The operational pattern observed, as outlined in the report, consisted of attacks on the integrity of the democratic process itself, with accusations of corruption or institutional ineffectiveness and the promotion of distrust in the electoral system. A peak of cyber interference was detected the day before voting, but the pro-Russian community also made post-election efforts to "undermine confidence" in the results.

The Department of Homeland Security also alleges that the Kremlin has carried out disinformation campaigns to try to influence, "increasingly directly," the electoral processes of other countries, both within and outside the EU, such as Moldova, Romania, and Georgia. To this end, it has used "every available tool in its hybrid arsenal" to prevent these countries from joining the EU, or from leaving it, as in the case of Romania.

In the case of the DANA, the Department of Homeland Security points out that the pro-Kremlin disinformation network, "opportunistically," amplified and adapted narratives on social media to "promote" citizen distrust in public institutions.

Although it doesn't specifically refer to specific hoaxes, social media was plagued with misinformation in those days: from the hoax claiming the government was providing €6,000 in aid that would have to be repaid within three months—which Moncloa had to come out to deny—to the decontextualized viral messages claiming aid was being allocated to Ukraine and Gaza rather than Valencia, to the unprecedented campaigns against organizations such as the Red Cross and Caritas, which were falsely accused of profiting from citizen donations.

Relevant changes in Russian disinformation New model to circumvent EU sanctions and achieve greater dissemination of narratives

The agency assisting the Presidency of the Government warns that Russian disinformation has undergone significant changes. Before the invasion of Ukraine, the planning, direction, and dissemination of narratives was carried out primarily through Russian state agencies and media outlets, but now the Kremlin has evolved this model to circumvent the impact of European Union sanctions and to seek greater penetration and dissemination of its narratives.

The campaigns have moved to unconventional channels with a more sophisticated modus operandi that is more difficult to trace back to their source. One of these is the network of pro-Russian websites known as the Kombat portal, also targeting Spanish-speaking audiences. Its objective is to spread disinformation aimed at fomenting division in Europe over support for Ukraine and, ideally, fostering rapprochement with the Russian view. A pro-Russian disinformation network, called False Facade, has also been detected. It consists of at least 23 websites, apparently not associated with the Russian government, whose fabricated content, the report warns, is exploited by the Kremlin ecosystem to target audiences in Western countries, including Spain.

The Department of Homeland Security Warning of increased Russian spying through proxies

Russia's name isn't just mentioned in the report's section on disinformation. It also plays a prominent role in the section on espionage and foreign interference, which highlights that the activity of some foreign intelligence services continues to be one of the "main threats" to Spain. Specifically, the intelligence services of the Russian Federation, which focus on "obstructing the delivery of aid to Ukraine and sowing doubts about the advisability of maintaining support for that country." This activity is allegedly carried out through "proxies," individuals outside the service who are recruited, trained, and coordinated through social media or instant messaging applications.

While the activity index of foreign intelligence services fell considerably in 2022—the year the government expelled a large number of Russian diplomats following the invasion of Ukraine—it rose again in 2024, reaching pre-war levels, according to data provided by the National Intelligence Center (CNI).

The primary targets of espionage, the report reveals, remain public bodies, but companies and public entities related to defense are of particular interest.