BlackCore: Inside an Israeli foreign influence operation

An Israeli influence operation run by a private intelligence firm branded two left wing French mayoral candidates as “pro-Palestinian”, “pro-Muslim” and “rapists”.

A joint investigation by liberal-leaning Israeli newspaper Haaretz and French outlet Liberacion exposed details of BlackCore, a shadowy disinformation operation. This is just the latest so-called ‘psy-op‘ to be exposed.

The targets were current Marseille and Toulouse mayoral candidates, Sébastien Delogu and François Piquemal.

Haaretz explained on Monday:

The French operation was first exposed by Le Monde on March 9, a week before the country’s local elections. The target was France Unbowed, the party of left-wing presidential candidate Jean-Luc Mélenchon.

The outlet said:

The first to be hit was Sébastien Delogu, the party’s mayoral candidate in Marseille; “Sophie,” a woman calling herself a blogger, accused him of rape and violence.

Adding:

A separate site published phony AI-generated photos that purported to be nude pictures of Delogu, presented as part of an alleged Gaza fundraising campaign.

A third website went after Toulouse mayoral candidate François Piquemal, while another “claimed to ‘help Muslim voters choose well’ and steered them toward Mélenchon’s hard-left slate”.

The whole package was amplified by a small army of fake accounts on social media.

BlackCore’s influencer operation

Haaretz said that once discovered, whoever was running the operation tried “to scrub their tracks, deleting avatars and websites, but digital traces remained online”.

French state security even stepped in.

A special investigative team from France’s General Secretariat for Defense and National Security, the Interior Ministry, the election commission and Viginum, the agency tasked with detecting foreign manipulation and disinformation on social media, picked up the trail and identified BlackCore as the main suspect. BlackCore’s name was first reported this weekend by Reuters.

The Haaretz/Liberacion expose revealed even more details about BlackCore.

Haaretz and Libération conducted an extensive analysis of BlackCore’s online digital footprint, including its website and other sites that seem to be part of the wider effort. For example, there is the company’s marketing website – a mini-site in Hebrew and English showcasing BlackCore’s alleged flagship product, “political campaign management.”

Adding:

It is built around the deployment of 1,600 avatars and fake social media accounts for the purposes of “infiltrating Facebook groups, manipulating trends, and skewing polls on TikTok and Instagram.”

Israeli business and intelligence links

A deeper look trawled up strange details and substantial inconsistencies about BlackCore.

The investigation could find no legal entity called BlackCore registered in any country. Its website contained no identifying details about owners or executives, or a physical address.

The domain blackcore.online was registered in an Icelandic registrar that allows owners to remain anonymous. The address was purchased only last August – by a company that presents itself as long-established.

Additionally, investigators identified “eight subdomains tied to BlackCore”.

One was active on a London-based server run by a Finnish cloud provider that hosted only a small handful of other websites that all had shared characteristics.

That server, which was “active until a few weeks ago” had “hosted a collection of different systems that required a username and password to log in to, tools through which an influence campaign could be conducted”.

For example, one login page was called “Galacticos AI Avatar Generator Login Page.”

A source told Haaretz that Galacticos “had developed a product that generates avatars that can be deployed both for influence operations and the monitoring of social media – as both require active accounts”.

Galacticos incorporated as a firm “in Tel Aviv in April 2022 under the name Pagecorn Ltd”.

 A year later it changed its name to Mycelium Intelligence Networks, and then to Galacticos in 2024.

The investigators discovered connections to two Israeli businessmen. One, Guy Geyor, is a “tech entrepreneur and former contestant on the Israeli versions of Survivor and The Bachelor“.

The other is lawyer Doron Afik. Both claimed when questioned to have no knowledge of BlackCore and denied “political activity in France”.

Less than two hours after they were asked for comment, the remaining digital infrastructure of both BlackCore and Galacticos was pulled offline.

Haaretz and Liberacion traced the various firms involved and found links to Israeli intelligence unit 8200 and to Yigal Unna, the former head of Israel’s National Cyber Directorate. Unna also denied any link to the operation.

It is rare — though not unknown — to get a glimpse inside a state influence operation. What is also remarkable is how quickly this one was shut down and traces of it scrubbed once it was exposed.

It is not exactly a secret that the settler-colonial state seeks to influence democratic outcomes in foreign states. But it is still fascinating when details of subterfuge and deception emerge.

Featured image via La Dépêche/ Adrien Nowak