BlackCore

BlackCore
Trade name
Logo
Type	Unregistered entity (no legal entity identified)
Founded
Founder(s)
Defunct
Headquarters	Israel (reported); no address identified
Industry	Online influence operations ("influence-for-hire")
Services
Parent
Subsidiaries
Revenue
Number of employees
Homepage

BlackCore is an Israeli influence-for-hire outfit accused by France's Viginum of running covert online campaigns against left-wing candidates in the March 2026 French municipal elections, and of operations touching Scotland, New York, Angola and Togo.

BlackCore presented itself online as "an elite influence, cyber, and technology company built for the modern era of information warfare". Its name first appeared publicly in a Reuters report of 13 May 2026, which said French authorities suspected it of a smear campaign against three La France Insoumise (LFI) candidates. A joint investigation by Haaretz and Libération then traced its web infrastructure to servers shared with tools linked to two Tel Aviv companies. In June 2026 the French government's foreign digital interference service, Viginum, published a technical report naming BlackCore as the probable source of the campaign, while stating that it could not identify the operators' exact roles or anyone who commissioned the work. Its owners and executives have not been publicly identified.

What has been reported

France: the "Rokh Solis" campaign (2026 municipal elections)

Le Monde first exposed the operation on 9 March 2026, a week before the first round. A fake "Blog de Sophie" accused LFI's Marseille candidate Sébastien Delogu of rape, and a separate website attacked the Toulouse candidate François Piquemal. A fourth site, "l'Alternative 2026", claimed to guide "Muslim citizens" towards candidates supporting "the application of sharia" and listed only LFI candidates. On 12 March Viginum classified the affair as "foreign digital interference", and a week later LFI's Roubaix candidate David Guiraud was identified as another target.

Viginum's report, which calls the operating method "Rokh Solis", describes four websites (blogdesophie.com, delogupourpalestine.com, piquemalzero.com and lalternative2026.com). The report says the sites shared technical characteristics and were relayed by inauthentic accounts on TikTok, Instagram, X and Facebook. It also identifies "markers of foreign origin": Hebrew characters in one site's metadata, a TikTok account located in Israel, and the sharing of hashtags and posts associated with the pro-Israel organisation ELNET. The report found the sites had only "low visibility" online despite repeated attempts at artificial amplification, but concluded that it met the criteria of foreign digital interference.

France 3 reported that the targeted candidates had filed complaints, and that after the 22 March second round Piquemal had asked the administrative court to overturn the Toulouse result. According to Middle East Eye, Paris prosecutors opened a probe in late May 2026.

BlackCore's own materials

Before it was taken offline, BlackCore's website described a political campaign model of 1,600 social media avatars, up to a million posts a month, infiltration of Facebook groups and manipulation of TikTok trends, along with "positive narratives" for a client and "counter-narratives" against opponents. Citizen Lab, which examined the site while it was still online, reported that a demo subdomain described three lines of business: "Discourse Dominance", "Organic Engagement" and "Counter Operations". Viginum reported that the domain blackcore.online was registered on 22 August 2025 and that the website and LinkedIn page were deleted after the May 2026 press reports. According to The Guardian, Reuters reported that BlackCore scrubbed its website after Reuters contacted it and did not respond to requests for comment.

Other countries

At a press conference with Prime Minister Sébastien Lecornu on 11 June 2026, Viginum's Marc-Antoine Brillant said the same modus operandi "also appears to have been used to carry out foreign digital interference operations in other countries or regions, such as Angola, Togo, the elections in Scotland, and the 2025 municipal election in New York". He added: "Our investigations did not make it possible to identify the sponsor or sponsors, if indeed they exist".

• Scotland: Viginum reported that the accounts of First Minister John Swinney, the Scottish National Party and the Scottish government appear to have been targeted four times between 6 January and 8 May 2026. At least 256 accounts posted about 1,400 coordinated comments.
• New York: Viginum reported that some of the inauthentic accounts used in France had joined New York community groups in October 2025 and relayed posts by mayoral candidate Andrew Cuomo.
• Angola: a BlackCore subdomain referred to training given to the Angolan government in February 2026. Citizen Lab obtained what it describes as BlackCore's final report on a "Digital Training Program 2026" for the Angolan government's communications team. According to that report, the programme began on 19 January 2026, ran for "more than 14 uninterrupted weeks", and included live covert campaigns built around a fake outlet, "Agita News", and fake personas. Citizen Lab assessed it as "highly likely" that the programme took place as described, but could not confirm it independently or identify the participants or trainers.
• Togo and Gabon: a phone number on the "Sadaqah Palestine" website (below) led Viginum to a TikTok account located in Israel that promoted the opening of an Israeli hospital in Togo. Viginum also found Fiverr reviews, left by a profile linked to the same network, ordering AI-generated videos for Togolese or Gabonese audiences.
• "Sadaqah Palestine": Viginum found that sadaqahpalestine.com shared a mail server with electric-marinade.com, a domain hosted alongside BlackCore's infrastructure. The now-inactive site promoted a purported Palestinian charity. Posts from the related X account were amplified by accounts behaving identically to those that commented on the Facebook pages targeting the LFI candidates.
• Meta: on 27 August 2026 Meta reported disrupting "a Coordinated Inauthentic Behavior network originating in Israel" that targeted audiences in France, the UK, Australia, Iran, Togo, Gabon, Angola and the US. Citizen Lab assesses that this network is likely BlackCore.

Related firms and investigations

Viginum describes BlackCore as a "pseudo-company" ("pseudo-société") with no legal status. It says BlackCore appears to sit within an ecosystem of numerous Israeli cyber-sector companies, which prevents it, for now, from determining "with a sufficient level of confidence" the identity and scope of the private company behind the campaign.

• Shared infrastructure: according to Libération and Haaretz, as summarised by France 3, a London server hosted a BlackCore subdomain between March 2025 and May 2026. The same server hosted about twenty subdomains of omrisystems.com and electric-marinade.com, with names such as "avatar-data-generator", "agentforge", "fb-search" and "socialtrigger". Viginum reports the same servers and says the electric-marinade.com, omrisystems.com and BlackCore entities appear to have no legal existence.
• Galacticos Ltd: the source code of the "avatar data generator" referred to "Galacticos AI". This leads to Galacticos Ltd, registered in Israel since April 2022 at HaHashmonaim Street, Tel Aviv. Israeli registry data list Galacticos Ltd (גלקטיקוס בע"מ) as an active private company, no. 516599818, registered at 103 HaHashmonaim Street (c/o Afik & Co.), Tel Aviv-Yafo 6713319, the address of Doron Afik's law firm. Viginum's public report says Guy Geyor and Doron Afik "ont fondé et/ou dirigé" (founded and/or ran) the company. Its domain, galacticos.ai, was registered on 17 April 2024; the current registrant is listed as "Tech GLC" at 103 Hahachmonaim, Tel Aviv, with the telephone number +972-3-6093609, the number Afik & Co. lists for its lawyers. Viginum says the domain was registered by Geyor through SNI. A source told Haaretz that Galacticos "had developed a product that generates avatars that can be deployed both for influence operations and the monitoring of social media". The Canary, citing Haaretz, reports that the company was incorporated as Pagecorn Ltd, renamed Mycelium Intelligence Networks and then Galacticos in 2024.
• SNI Digital: a second Tel Aviv company at the same address. France 3 reports that Galacticos' director, the lawyer Doron Afik, also heads SNI Digital, and that the two companies share shareholders, including Guy Geyor, described by France 3 as an influencer turned tech entrepreneur and co-founder of SNI Cyber, and by The Canary (citing Haaretz) as a former contestant on the Israeli versions of Survivor and The Bachelor. Agence France-Presse, via Le Parisien, also reports that Afik is director of both companies. Registry data list SNI Digital Ltd (אס אן איי דיגיטל בע"מ) as an active private company, no. 516320363, at 103 HaHashmonaim Street, Tel Aviv-Yafo 6713319. On the server that hosted a BlackCore subdomain, Viginum found an API configuration that pointed to a database named "sni-staging" at pg.electric-marinade.com. Viginum says this links electric-marinade.com and omrisystems.com, and "éventuellement" (possibly) sni.ai. sni.ai was registered on 30 December 2021 behind a privacy service. Internet Archive captures show that the front-end code of sni.ai (2024) and galacticos.ai (2025) carried the same marketing text for a brand and social-media monitoring service.
• Electric Marinade and Omri Systems: neither appears to be a registered company. Viginum found no legal existence for them, and UK Companies House searches return no company of either name. The domain electric-marinade.com was registered with GoDaddy on 19 February 2025, and omrisystems.com was registered with GoDaddy on 12 February 2026. Certificate Transparency logs list omrisystems.com subdomains including "agentforge", "avatar-data-generator", "fb-search", "socialtrigger", "flowise", "vnc" and "vpn". An "fb.aoa" subdomain appears on all three of omrisystems.com, electric-marinade.com and modules.galacticos.ai. Archived captures show password login pages there titled "AOA System" (galacticos.ai, February 2025) and "AOA Generator" (electric-marinade.com, April 2025). What "AOA" stands for has not been reported.
• Iron Mind AB: Viginum also traced the avatar tool to a development subdomain of iron-mind.ai. That domain belongs to Iron Mind AB, apparently a software developer, registered in Sweden on 30 October 2025 (company no. 559551-9181, Kopparvägen 44, 187 45 Täby).
• Denials: Afik told the newspapers that "Galacticos has no affiliation, partnership or knowledge of any entity named BlackCore". Geyor told Haaretz he had "no activity in France, and certainly no political activity". According to The Canary, citing Haaretz, the remaining infrastructure of BlackCore and Galacticos went offline less than two hours after the two were asked for comment. Middle East Eye likewise reports that executives of both companies deny any connection to BlackCore.
• Official investigations: Viginum's investigation, with its report published on 11 June 2026, and a Paris prosecutors' probe opened in late May 2026. Haaretz reported in June that France's domestic intelligence agency was separately investigating who may have commissioned the campaign. A source quoted by AFP described BlackCore as only "la porte d'entrée d'une entreprise beaucoup plus complexe" (the entry point to a much more complex enterprise), and said the campaign came from Israel but that it had not been established whether the state was involved. According to The Guardian, the Israeli government said it was waiting for the French report before deciding whether to investigate, and denied any interest in interfering in other countries' elections.

Alleged links

Unit 8200

According to France 3's summary of the Libération/Haaretz findings, one shareholder of Galacticos and SNI Digital says he spent ten years in Unit 8200. That shareholder did not respond to requests for comment. The Canary writes that the investigation "found links to Israeli intelligence unit 8200". No source identifies a Unit 8200 veteran as a founder or executive of BlackCore itself.

Yigal Unna

Yigal Unna, first director-general of the Israel National Cyber Directorate (2018–2022 per France 3), is described by Viginum as a "central figure" in the ecosystem around BlackCore. Viginum cites his former roles at the INCD and his past experience in Unit 8200 and the Shin Bet. Viginum reports that:

• photos from a September 2025 event at the Tel Aviv law firm that shares an address with Galacticos show Unna, apparently as a representative of Galacticos AI;
• Unna's start-up incubator, Cygun Ltd, lists Galacticos AI among the start-ups it supports.

France 3 reports that Unna's name is associated with Galacticos on the website of the law firm that hosts it. The law firm's account of the 8 September 2025 event lists "Mr. Yigal Unna of Galacticos.AI" among the guests. Cygun Ltd (סיגאון בע"מ) is a registered Israeli private company, no. 516559317, based in Givatayim. Cygun's website describes Unna's career as beginning "in Unit 8200, Israel’s elite signal-intelligence corps", followed by "23 years in the Israel Security Agency (Shin Bet), where he rose to head the Cyber & Signal Intelligence Division", before he became Director General of the National Cyber Directorate. The startups page on Cygun's current site (viewed October 2026) names no portfolio companies.

Denial: Unna says he "distanced himself" from Galacticos at the end of 2024 after seeing a "form of improvisation" at the start-up (France 3). The Canary reports that he "denied any link to the operation". No source accuses Unna of involvement in BlackCore's campaigns.

What remains unknown

• Legal identity: no legal entity named BlackCore has been found in Israel or elsewhere.
• Ownership and management: BlackCore's owners, executives and staff have not been publicly identified. Citizen Lab could not identify the individuals behind it and was "unable to find a recent contact point" to seek comment.
• Who commissioned the work: Viginum says nothing allows it to establish the identity or origin of any clients, and its chief said the sponsors, "if indeed they exist", could not be identified.
• Relationship to Galacticos and SNI: Viginum calls the relationship between BlackCore and these companies part of a wider ecosystem whose exact roles it cannot yet establish, and the companies' executives deny any link.
• Payment for the Angola programme: Citizen Lab told The Record it found no evidence of how BlackCore was hired, whether the Angolan government paid it directly, or how much the programme cost.
• State involvement: no official source has attributed the campaign to the Israeli state, which denies any interest in interfering in other countries' elections.