Accounts linked to the Russian military reached more than 500,000 people with far-right messaging during the early days of the Ceuta migration crisis, according to an analysis by the counter-disinformation group 411. The finding details how a coordinated disinformation apparatus — a network of accounts working together to spread misleading information — exploited one of the most severe migration shocks Europe has seen in years.

The crisis began on 31 July 2026, when roughly 49,000 people attempted to cross from Morocco into the Spanish enclave of Ceuta overnight. Ceuta is a small Spanish territory on the North African coast, bordered by Morocco — a geopolitical oddity that makes it a focal point for migration pressures. Over multiple days, an estimated 72,000 migrants entered the territory, according to The Guardian. Reuters reported that the death toll surpassed 70 by 2 August. Euronews documented that before roughly 70,000 people crossed, videos promising an easier route to Europe had already spread on social media.

How the Disinformation Campaign Worked

The disinformation barrage analyzed by 411 began on 1 August, the day after the initial mass crossing. The group examined roughly 4.5 million social media posts and found that far-right narratives were reproduced in seven languages, reaching more than 720,000 views over six hours on that single day. The accounts framed the events as a deliberately coordinated "assault" and suggested that authorities were complicit, with some appending Islamophobic or antisemitic conspiracy theories.

Think of the operation as a broadcast system with three layers. One identified origin of the propaganda was Rybar, a Telegram channel linked to Russian intelligence whose parent company has faced sanctions in Europe. A network of "repeater" accounts then amplified Rybar's posts, copying and redistributing them across platforms — including accounts tied to the Pravda network, an operation spreading Kremlin propaganda worldwide. The Guardian previously reported on the Pravda network's English-language websites. At the third layer, organic social media activity by migrants and far-right sympathizers supplied the imagery and urgency that made the narratives stick.

Ukraine's government detected the campaign early. On 31 July, Ukrainian Foreign Minister Andrii Sybiha stated that Russia was using photos from Ceuta for a propaganda campaign across Europe, as reported by Ukrainian Pravda and Liga.net. The Atlantic published an analysis on 2 August titled "The Far Right Is Distorting Ceuta," examining how far-right narratives shaped the crisis.

Two Tracks: Migration Rumors and Amplification

The information environment operated on two distinct tracks. On the migrant side, online rumors led young Moroccans to believe the border was open. Reuters cited the case of 16-year-old Ayoub El Abyad, who saw Instagram videos showing migrants crossing. 411's analysis confirmed substantive "peer-to-peer logistics chatter" — everyday people trading tips about how to make the crossing — between potential migrants, mostly in comments sections beneath viral Ceuta videos. This coordination appeared organic, coming overwhelmingly from small, anonymous-looking individual accounts rather than a single identifiable "recruiter" channel.

On the amplification side, some far-right accounts called for nationalists to gather in Ceuta and "patrol" businesses and homes, some of these calls apparently in coordination.

Saman Nazari, lead researcher at Brussels-based nonprofit Alliance4Europe, said the disinformation efforts following the Ceuta crisis appeared coordinated and that groups spreading disinformation are more organized and powerful than several years ago.

Why the Ceuta Case Matters

The Ceuta case compresses several phenomena into a single event cycle. Social media rumors catalyzed migration at one end while state-linked information operations weaponized the resulting crisis at the other. The migrant coordination, while organic, created the very footage and narrative raw material that Rybar and the Pravda network then repackaged for European audiences. The seven-language reach of the far-right narratives points to an infrastructure designed for cross-border amplification, not a hastily assembled response.

The dual-track structure also raises a question that 411's data does not fully resolve: whether the initial social media rumors prompting migration were entirely organic or whether any external actors seeded or accelerated them. The analysis found the migrant-side coordination came from small, anonymous accounts, which is consistent with organic activity but does not rule out influence operations designed to mimic grassroots behavior.

The broader context here is the maturation of Russia's information-warfare apparatus. Rybar's involvement, combined with the Pravda network's amplification, indicates a layered operational model: an origin channel produces content, repeater accounts distribute it across platforms and languages, and organic social media dynamics on the ground supply the imagery and urgency that make the narratives compelling. The UK government has already sanctioned elements of this ecosystem. What the Ceuta crisis reveals is how quickly that apparatus can pivot to a new migration flashpoint, producing measurable reach within hours.

For European policymakers, the Ceuta episode poses an enforcement challenge that existing regulatory frameworks are not calibrated for. The Digital Services Act — the EU's law requiring large online platforms to be transparent about how they handle content — imposes transparency obligations on very large platforms, but the operational tempo here, 720,000 views in six hours across seven languages, outpaces most content moderation response cycles. The calls for nationalist "patrols" in Ceuta move the threat from online narrative distortion into potential physical mobilization. Whether that escalation materialized is not addressed in the available reporting, but the coordination detected by 411 in those calls warrants attention.