QuoIntelligence analyzed an information operation campaign aiming to discourage Russian speaking citizens from voting in the latest Spanish elections. The association of Russian citizens in Spain reported the campaign, but no technical analysis or analysis of the influence campaign has been published to date. 

The campaign utilized Telegram messages for reach and cloned website of local Madrid government to spread rumors of alleged coming terrorist attack.

Our analysis of the infrastructure used in the operation indicates that the adversary used a popular Russian bulletproof hosting provider associated with multiple malicious campaigns. 

The notable aspect of the campaign is its focus on a specific demographic and attempts at direct outreach targets.  Compared to other campaigns based on using copied or fake news sites, it used limited delivery mechanisms beyond that with lack of massive social media campaigns. 

Targeting Russian-speaking population in Spain almost certainly had very limited effect on election turnout. The activities are likely representation of reaching specific demographics for increasing effectiveness of narratives.