Russia grants asylum to Spanish professor wanted for alleged pro-Moscow cyber operations

Russia has granted political asylum to a Spanish national accused in his home country of “cyberterrorism and espionage” in support of Moscow, according to Russian state media.

Enrique Arias Gil, a former university professor in Spain, said in an interview with the TASS news agency that he requested asylum in Russia in February 2025 and has since been granted political refugee status. He is currently completing paperwork to obtain citizenship, according to the report.

Arias Gil traveled to Russia in August 2024 under a grant from Russian House, a Moscow-funded cultural institute operating abroad. In September 2025, Europol placed him on its most wanted list, while a Spanish court issued an international arrest warrant, though police sources told local media that Moscow was unlikely to cooperate.

Authorities suspect Arias Gil of gathering information on Spain’s critical infrastructure and members of its security forces to facilitate cyberattacks. He is also accused of threatening journalists and business leaders who supported Ukraine.

Arias Gil, who previously lectured on political science and is the author of books on extremism, is wanted on charges including computer damage for terrorist purposes, membership in a criminal organization and glorifying terrorism.

Arias Gil was reportedly behind a Spanish-language Telegram channel called Desinformador Ruso (“Russian Disinformer”), set up in March 2024, which has posted messages about cyberattacks claimed by NoName057(16) and another pro-Russian group, Z-Pentest. 

Two days after being declared wanted, Arias Gil posted a defiant message on his Telegram channel, demanding that Spanish law enforcement drop the case within 10 hours or face the release of alleged kompromat on senior officials. 

NoName057(16) emerged in early 2022 following Russia’s full-scale invasion of Ukraine. The group has primarily focused on disruptive but relatively unsophisticated cyber operations, relying on volunteer participants and botnets to overwhelm targeted websites across Europe and North America.

Supporters of NoName057(16) previously described the case against Arias Gil as politically motivated, saying he only reposted content related to their cyber operations.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

SolarWinds Web Help Desk Exploited for RCE in Multi-Stage Attacks on Exposed Servers

Next Post

Payment tech provider for Texas, Florida governments working with FBI to resolve ransomware attack

Related Posts

Nigeria Arrests RaccoonO365 Phishing Developer Linked to Microsoft 365 Attacks

Authorities in Nigeria have announced the arrest of three "high-profile internet fraud suspects" who are alleged to have been involved in phishing attacks targeting major corporations, including the main developer behind the RaccoonO365 phishing-as-a-service (PhaaS) scheme. The Nigeria Police Force National Cybercrime Centre (NPF–NCCC) said investigations conducted in collaboration with
Read More

ShadyPanda Turns Popular Browser Extensions with 4.3 Million Installs Into Spyware

A threat actor known as ShadyPanda has been linked to a seven-year-long browser extension campaign that has amassed over 4.3 million installations over time. Five of these extensions started off as legitimate programs before malicious changes were introduced in mid-2024, according to a report from Koi Security, attracting 300,000 installs. These extensions have since been taken down. "These
Read More

eScan Antivirus Update Servers Compromised to Deliver Multi-Stage Malware

The update infrastructure for eScan antivirus, a security solution developed by Indian cybersecurity company MicroWorld Technologies, has been compromised by unknown attackers to deliver a persistent downloader to enterprise and consumer systems. "Malicious updates were distributed through eScan's legitimate update infrastructure, resulting in the deployment of multi-stage malware to enterprise
Read More