Social media accounts reportedly linked to Russian military and intelligence networks amplified far-right narratives following the recent migration crisis in Spain's Ceuta enclave, according to an analysis by counter-disinformation group 411.

The analysis found that the posts reached hundreds of thousands of users online and portrayed the mass movement of migrants from Morocco into Ceuta as a deliberately coordinated "assault".

Researchers said the activity highlighted how existing online networks can quickly exploit migration and border crises to spread polarising political narratives across Europe.

Disinformation Surge After Crisis

The analysis examined around 4.5 million social media posts and found that some narratives linked to the Ceuta crisis generated more than 720,000 views within six hours on August 1, according to 411.

The group said the activity began around the time tens of thousands of people attempted to enter Ceuta from Morocco.

Around 72,000 migrants were estimated to have reached the Spanish territory, although the majority were subsequently returned to Morocco.

Researchers said Russia-linked accounts and other far-right networks used the incident to promote claims that the migration movement was a coordinated attack on Spain.

Some posts also accused Spanish authorities of being complicit in the episode and relied on Islamophobic and antisemitic conspiracy theories to support their claims.

Narratives Spread Across Europe

According to the analysis, the messaging was reproduced in seven languages, allowing the narratives to reach audiences beyond Spain.

Saman Nazari, lead researcher at Brussels-based nonprofit Alliance4Europe, said the pattern appeared to be part of a broader phenomenon seen during migration-related crises across Europe.

"We keep seeing this across Europe, and we find it very interesting. It seems like there is some type of machinery in place, or structure," Nazari said.

He added that the repeated appearance of similar narratives following crises made it difficult to dismiss the phenomenon as simple online bandwagoning.

The analysis suggested that the networks involved were more organised than similar operations observed several years ago.

Calls for Far-Right Mobilisation

The report also identified far-right accounts encouraging nationalists to travel to Ceuta and "patrol" businesses and residential areas.

Researchers said some accounts appeared to coordinate their messaging and amplify the same narratives across different platforms.

The development comes amid growing concerns over the role of social media in migration crises.

Online rumours had reportedly contributed to the initial movement of people towards Ceuta, with some young Moroccans allegedly believing that the border had been opened. Social media posts also circulated information about possible routes to the Spanish territory.

According to the analysis, however, the online coordination among migrants appeared largely organic. Much of the activity originated from small and anonymous-looking individual accounts rather than a single identifiable recruitment channel.

Rybar Network Examined

The 411 analysis identified Rybar, a Telegram channel with reported links to Russian intelligence structures, as one source associated with the propaganda campaign.

Rybar's parent company has faced sanctions in Europe.

The analysis said a network of "repeater" accounts subsequently amplified Rybar content. These included accounts associated with the Pravda network, which researchers have described as a system for distributing Kremlin-aligned narratives internationally.

The findings suggest that the importance of such networks may extend beyond any single migration crisis.

Researchers Warn of Repeat Pattern

The researchers said the infrastructure used to amplify narratives during the Ceuta crisis could potentially be activated during future incidents elsewhere in Europe.

The concern is not limited to the specific messages circulated after the migration surge. Instead, analysts are focusing on the existence of established networks capable of rapidly picking up an event, reframing it along ideological lines and distributing the narrative to large audiences.

The 411 analysis said this "machinery" could become particularly significant during future border incidents in the Mediterranean.

Social Media’s Growing Role

The Ceuta crisis has demonstrated how quickly events at physical borders can spill into the digital information space.

Migration, national security and border control are already highly polarising issues across Europe. False or misleading claims can therefore spread rapidly, particularly when they are packaged around emotionally charged events.

While the 411 findings point to alleged coordination by Russia-linked networks, the analysis also indicates that multiple independent actors participated in spreading narratives around the crisis.

For European authorities and social media platforms, the episode highlights the continuing challenge of distinguishing organic public reaction from coordinated influence operations during fast-moving crises.

The findings also underline how existing online networks can remain active long after an individual crisis has ended, potentially ready to amplify similar narratives when another migration or border incident occurs.