Accounts linked to the Russian military reached more than 500,000 people with far-right messaging during the early days of the Ceuta migration crisis, according to an analysis by the counter-disinformation group 411. The finding details how a coordinated disinformation apparatus exploited one of the most acute migration shocks Europe has seen in years.

The crisis itself began on 31 July 2026, when approximately 49,000 people attempted to cross from Morocco into the Spanish enclave of Ceuta overnight. Over multiple days, an estimated 72,000 migrants entered the territory, according to The Guardian. Reuters reported that the death toll surpassed 70 by 2 August. Euronews documented that before roughly 70,000 people crossed, videos promising an easier route to Europe had spread on social media.

The disinformation barrage analyzed by 411 began on 1 August, the day after the initial mass crossing. 411 examined roughly 4.5 million social media posts and found that far-right narratives were reproduced in seven languages, reaching more than 720,000 views over six hours on that single day. The accounts framed the events as a deliberately coordinated "assault" and suggested that authorities were complicit, with some appending Islamophobic or antisemitic conspiracy theories.

One identified origin of the propaganda was Rybar, a Telegram channel linked to Russian intelligence whose parent company has faced sanctions in Europe. A network of "repeater" accounts then amplified Rybar's posts, including accounts tied to the Pravda network, an operation spreading Kremlin propaganda worldwide. The Guardian previously reported on the Pravda network's English-language websites.

Ukraine's government detected the campaign early. On 31 July, Ukrainian Foreign Minister Andrii Sybiha stated that Russia was using photos from Ceuta for a propaganda campaign across Europe, as reported by Ukrainian Pravda and Liga.net. The Atlantic published an analysis on 2 August titled "The Far Right Is Distorting Ceuta," examining how far-right narratives shaped the crisis.

The information environment operated on two distinct tracks. On the migrant side, online rumors led young Moroccans to believe the border was open. Reuters cited the case of 16-year-old Ayoub El Abyad, who saw Instagram videos showing migrants crossing. 411's analysis confirmed substantive "peer-to-peer logistics chatter" between potential migrants about how to make the crossing, mostly in comments sections beneath viral Ceuta videos. This coordination appeared organic, coming overwhelmingly from small, anonymous-looking individual accounts rather than a single identifiable "recruiter" channel.

On the amplification side, some far-right accounts called for nationalists to gather in Ceuta and "patrol" businesses and homes, some of these calls apparently in coordination.

Saman Nazari, lead researcher at Brussels-based nonprofit Alliance4Europe, said the disinformation efforts following the Ceuta crisis appeared coordinated and that groups spreading disinformation are more organized and powerful than several years ago.

The Ceuta case is instructive because it compresses several phenomena into a single event cycle. Social media rumors catalyzed migration at one end while state-linked information operations weaponized the resulting crisis at the other. The migrant coordination, while organic, created the very footage and narrative raw material that Rybar and the Pravda network then repackaged for European audiences. The seven-language reach of the far-right narratives points to an infrastructure designed for cross-border amplification, not ad hoc reaction.

The dual-track structure also raises a question that 411's data does not fully resolve: whether the initial social media rumors prompting migration were entirely organic or whether any external actors seeded or accelerated them. The analysis found the migrant-side coordination came from small, anonymous accounts, which is consistent with organic activity but does not rule out influence operations designed to mimic grassroots behavior.

The broader context here is the maturation of Russia's information-warfare apparatus. Rybar's involvement, combined with the Pravda network's amplification, indicates a layered operational model: an origin channel produces content, repeater accounts distribute it across platforms and languages, and organic social media dynamics on the ground supply the imagery and urgency that make the narratives stick. The UK government has already sanctioned elements of this ecosystem. What the Ceuta crisis reveals is how quickly that apparatus can pivot to a new migration flashpoint, producing measurable reach within hours.

For European policymakers, the Ceuta episode poses an enforcement challenge that existing regulatory frameworks are not calibrated for. The Digital Services Act imposes transparency obligations on very large platforms, but the operational tempo here, 720,000 views in six hours across seven languages, outpaces most content moderation response cycles. The calls for nationalist "patrols" in Ceuta move the threat from online narrative distortion into potential physical mobilization. Whether that escalation materialized is not addressed in the available reporting, but the coordination detected by 411 in those calls warrants attention.