Spanish intelligence services expect Ceuta and Melilla to face a surge in covert hostile actions in the coming months, focused on the so-called 'grey zone', a strategic space between peace and open conflict. Reports seen by EL PAÍS say a direct military move by Morocco is considered highly unlikely in the short or medium term, while the risk of hybrid tactics is rising, from cyberattacks and disinformation to sabotage and orchestrated migration flows.
In recent years, the 'grey zone' concept has gained prominence in geostrategic analysis. This ambiguous space complicates attribution of attacks and delays military responses. Examples include mass crossings at the Morocco-Ceuta border in 2021 and 2026, along with similar incidents on the Poland-Belarus frontier. Such actions, often carried out by state-backed proxies or non-state actors, aim to destabilize adversaries and achieve political objectives without triggering open warfare.
During the latest crisis, thousands crossed into Ceuta as social media campaigns called for cyberattacks on Spain’s Ministry of Foreign Affairs and sabotage of Ceuta’s electricity grid. These hybrid threats echo tactics used elsewhere, including Russia’s annexation of Crimea in 2014. They are now embedded in the strategic doctrines of NATO and the EU, as well as Spain’s. There is still no unified approach to countering them, despite the availability of political and diplomatic tools, along with economic measures, provided the aggressor can be clearly identified.
Intelligence assessments rule out the possibility that the Majzén, Morocco’s royal power circle, orchestrated the mass entry of 72,000 people into Ceuta, of whom 5,000 reportedly remain in the city. Unlike during the 2021 incident, when Moroccan officials did not deny involvement, Rabat has avoided public statements this time. Analysts nevertheless believe Morocco has used the crisis to reinforce its sovereignty claims over Ceuta and Melilla.
Spanish intelligence does not link the July events to Prime Minister Pedro Sánchez’s recent visit to Algeria, contrary to some media interpretations. Instead, it points to the new UK-EU agreement on Gibraltar, which places border control under Spanish authority and has sparked debate in Moroccan media about the status of Ceuta and Melilla. Intelligence sources have also highlighted the passive stance of Moroccan security forces during the peak of the Ceuta border breach. Footage shows Moroccan gendarmes allowing vehicles carrying migrants to approach the frontier.
Spanish intelligence considers the images credible, and they suggest involvement by higher authorities in Morocco. Yet Moroccan forces reportedly cooperated with Spanish authorities before and after the July 30 incident, particularly as most migrants voluntarily returned in the days following the mass entry.
Investigators have identified individuals managing Instagram and WhatsApp* (принадлежит Metа, которая признана экстремистской организацией и запрещена в РФ)* (принадлежит Metа, которая признана экстремистской организацией и запрещена в РФ) groups that spread false interpretations of a Supreme Court ruling and provided practical information on crossing the border. But, no conclusive evidence links the groups to any foreign intelligence service.
In late July, authorities detected a gathering of 1,000 to 2,000 people on the Moroccan side, preparing to swim to Ceuta. Initially seen as a seasonal migration flow, it was amplified by misinformation, while Moroccan border forces were less vigilant during the Throne Day celebrations and King Mohamed VI’s presence in Tetouan. On July 29, the CNI warned Ceuta’s government delegation about a social media campaign urging a mass entry; some groups had as many as 180,000 followers.
Despite the warnings, tens of thousands joined the crossing spontaneously, spurred by viral TikTok videos showing successful entries. The situation quickly descended into chaos. Afterward, Moroccan security forces changed tactics and prevented a new attempt on August 15, reflecting the international reputational risks Morocco faces despite its political gains.
Intelligence reports put the chance of military action against Ceuta and Melilla at less than 10%, but estimate the probability of increased hostile activity in the 'grey zone' at up to 60%. Spain has deployed more than 3,000 soldiers for patrols, while experts stress that the response must also involve diplomacy and coordination at the European level.
Spain’s government previously allocated €165 million to Ceuta to address the strain migration pressures have placed on local services, as reported in a related analysis by russpain.com. Ceuta and Melilla’s status as Spanish enclaves in North Africa continues to make them focal points for regional tension and hybrid threats, requiring Spanish authorities to maintain vigilance and adapt their strategies.
