Executive Summary

The actor monitored as Desinformador Ruso announced the launch of #OpDominó, a pressure campaign against Spain structured around opposition to Spanish support for Ukraine, rejection of NATO, anti-Atlanticist narratives and a discourse of direct confrontation against the Spanish government.

The sequence began with a public 72-hour ultimatum addressed to the government of Spain. After the deadline expired, the actor announced the start of Operation Dominó and released a set of political demands, including an end to Spanish intervention in Ukraine, Spain’s withdrawal from the European Union, a break with Atlanticist structures and the questioning of Spain’s political regime.

Shortly afterward, a publication attributed to APT Desi presented a first action under the #OpDominó banner: the alleged release of faces and personal data of more than 1,000 police officers and Civil Guard members. Later, NoName057(16) published a message from its official account supporting Desinformador Ruso and indicating that it would soon join the operation. From that point onward, publications began to appear linked to alleged access to CCTV systems at official Loterías y Apuestas del Estado ticket offices and to home automation management systems in Spanish territory. Shadow ClawZ 404 also joined the campaign, presenting its adhesion through the publication of material associated with cameras in Spain.

Key Judgments

• #OpDominó is registered as a political-cyber pressure campaign against Spain, with a strong propagandistic load and pro-Russian orientation.
• Desinformador Ruso appears as the convening actor and narrative articulator of the operation, while APT Desi, NoName057(16), DDoSia and Shadow ClawZ 404 contribute different degrees of participation.
• The campaign combines maximalist political demands, anti-NATO signaling, narratives against Spanish support for Ukraine and messages aimed at eroding the institutional legitimacy of the Spanish state.
• The alleged leak of data belonging to police officers and Civil Guard members introduces a doxing and personal-pressure dimension against security forces, with potential reputational, psychological and individual security impact if the material proves authentic.
• Subsequent publications on CCTV, home automation and cameras suggest a strategy of visual exposure and public humiliation.
• The adhesion of NoName057(16) increases the campaign’s visibility and connects #OpDominó with the broader pro-Russian hacktivist ecosystem, especially through #OpSpain, #FuckEastwood and #TimeOfRetribution.

What Happened

On July 22, Desinformador Ruso published a notice addressed to the government of Spain on behalf of its “information and hacker army”. In that message, the actor gave Spain 72 hours to stop financing the government of Ukraine, under threat of consequences.

On July 25, the same actor stated that the deadline had expired and announced that Operation Dominó would begin the following week. The message introduced the hashtag #OpDominó and linked it to hashtags such as #StopNeoNazis, #FuckCecilios and #SoloElPuebloSalvaAlPueblo.

In a continuation of the same context, Desinformador Ruso published a political manifesto associated with #OpDominó. In it, the actor demanded an end to Spanish intervention in Ukraine, Spain’s withdrawal from the European Union, the removal of foreign or Atlanticist agents from Spanish territory, the end of the “Regime of 1978”, and the return of money that, according to its narrative, had been used for wars and foreign business interests.

On July 26, the actor announced that Operation Dominó would officially begin on Monday, July 27, 2026. The message reinforced the accusation against the Spanish state for financing Ukraine and linked the campaign to a narrative of internal social crisis, wildfires, housing, cost of living, the arms industry and alleged subordination to NATO interests.

Minutes later, a publication attributed to APT Desi presented what would be the first action under the #OpDominó banner: the alleged release of faces and personal data of more than 1,000 police officers and Civil Guard members. The communication used a punishment narrative against security forces, military personnel and state structures, and claimed to make a leaked database available.

On July 27, NoName057(16) published from its official account that its “friend” Desinformador Ruso had something interesting underway and that they would soon join. The message included the tags #OpDominó, #FuckEastwood, #TimeOfRetribution and #OpSpain, connecting the campaign with the narrative framework already used by NoName057(16) in operations against European targets.

After that message, publications associated with alleged access to systems in Spain began to appear. One of them claimed full access to the CCTV system of official Loterías y Apuestas del Estado ticket offices, with references to cameras, shifts, monitors and forms. Another publication, associated with volunteers of the DDoSia Project, claimed access to a home management system in Spanish territory, including blinds, lights, heating and a water heater.

In parallel, Desinformador Ruso issued a message calling on followers to publicly harass President Pedro Sánchez during visits associated with advanced command posts in wildfire-affected areas. This element shows that #OpDominó is not limited to a cyber dimension, but also attempts to transfer pressure into the socio-political sphere.

Finally, Shadow ClawZ 404 announced its adhesion to #OpDominó and published material related to cameras in Spain, presenting it as support for collaborators and as evidence of low-quality or poorly maintained surveillance systems.

Operational Assessment

The central component is narrative. Desinformador Ruso uses Spanish support for Ukraine, NATO, the European Union, the cost of living, housing, wildfires and the arms industry as mobilization axes. The campaign attempts to connect internal social grievances with a pro-Russian geopolitical narrative, presenting the Spanish state as subordinated to foreign interests.

The second component is hacktivist aggregation. The #OpDominó tag allows publications from different actors to be gathered under the same banner. APT Desi appears as a possible executing actor associated with a first doxing action. NoName057(16) provides visibility and validation within the pro-Russian ecosystem. DDoSia appears as a mobilizable community or resource. Shadow ClawZ 404 joins as an adherent actor with supporting publications.

The third component is exposure and psychological pressure. The publications about CCTV, home automation and cameras do not necessarily demonstrate compromise of critical infrastructure, but they do aim to create a sense of vulnerability. The apparent selection of targets — ticket offices, cameras, smart homes and security forces — allows the message to shift from the state level toward spaces recognizable to the population.

The alleged leak of data belonging to more than 1,000 police officers and Civil Guard members is the potentially most sensitive element. If the material were authentic and current, it could enable harassment, social engineering, personal exposure or pressure against security officials. Without validation, it must be treated as an actor statement, but its publication alone already has propagandistic impact and may increase the perception of risk.

The adhesion of NoName057(16) is also relevant because it connects #OpDominó with previous pro-Russian campaigns against European countries. The use of tags such as #FuckEastwood and #TimeOfRetribution suggests continuity with a retaliation narrative against police and judicial operations targeting the pro-Russian hacktivist ecosystem.

Taken together, the campaign combines declared operations, mobilization propaganda, doxing, visual exposure of systems, ridicule of Spanish security and calls for social pressure under a single banner. The technical effectiveness of each publication must be validated case by case, but the campaign already functions as an instrument of narrative coordination.

Intelligence Significance

#OpDominó is relevant because it shows how a Spanish-speaking actor aligned with pro-Russian narratives can operate as a bridge between local propaganda, internal Spanish grievances and international hacktivist networks.

Desinformador Ruso is not acting merely as an ideological content emitter. In this sequence, the actor functions as a convener, symbolic organizer and articulator of a campaign that attracts other actors. The incorporation of APT Desi reinforces the hypothesis of a close relationship between both actors — iQBlack assesses them to be the same actor — at least in narrative and operational terms. The public adhesion of NoName057(16) adds a layer of external legitimization and expands the reach of the operation within the pro-Russian ecosystem.

The use of #OpDominó as an operational tag makes it possible to observe a flexible campaign logic. Under that umbrella, data leaks, camera publications, access to minor systems, political propaganda, harassment calls and actions by allied groups can coexist. That elasticity is useful for the actor because it allows the campaign to continue even if some actions are technically weak, recycled or unverified.

For intelligence, the case also shows a convergence between information operations and low- or medium-level cyber activity. The exposure of a camera, a domestic interface or an unvalidated database can have propagandistic value if inserted into a narrative of punishment against the state, institutional humiliation or generalized vulnerability, as is the case here.

The doxing and harassment dimension deserves particular attention. When the campaign moves from criticizing the government to publishing personal data or calling for direct pressure against political figures and security forces, the risk of individual harm, coordinated harassment and radicalization of sympathizers increases.

Analytical Closing

#OpDominó represents a pressure campaign against Spain articulated by Desinformador Ruso and projected by actors from the pro-Russian hacktivist ecosystem. Its value does not lie solely in the declared accesses or leaks, but in the ability to bring together political propaganda, doxing, visual exposure of systems and adhesion by allied groups under a single operation.

iQBlack assesses the technical actions published under #OpDominó as declared activity and exposure material pending corroboration. However, the campaign is already a relevant signal due to its orientation against Spain, its anti-NATO framing, its connection to Spanish support for Ukraine, the public participation of NoName057(16) and the incorporation of actors such as APT Desi and Shadow ClawZ 404.