Research Note

This note is part of broader research on the influence-for-hire industry conducted by the Citizen Lab.

Introduction

BlackCore is an Israeli influence-for-hire company, with operations in multiple countries. We examine BlackCore’s digital infrastructure, and give a detailed look into BlackCore’s modus operandi including how they construct fake profiles and amplify content, and how they market themselves and report their results to clients.

On May 13, 2026, Reuters published a report on BlackCore and its alleged campaigns targeting public audiences in France and other unspecified countries. The campaigns were apparently tied to political events, for example the French municipal elections that happened on 15 and 22 March 2026 across approximately 35,000 communes in the country. Reporting by Le Monde, Le Canard Enchaîné, and Haaretz provided additional detail about the operations.

On June 11, 2026, the French governmental watchdog on election interference, Viginum, published two reports in which it confirmed BlackCore’s targeting of the French municipal elections, adding that the company had also interfered in elections in New York, Scotland, Togo, and Angola.

This note describes how we identified one of BlackCore’s campaigns: a set of Facebook and Instagram accounts and pages created during a training program provided to government employees in Angola, which included the launch of a supervised influence operation.¹

BlackCore’s Infrastructure: Obscure But Not Hidden

BlackCore presented a public website containing a range of resources about their activities. Using exclusively open source data as well as Cyber Threat Intelligence (CTI) tools, such as proprietary WHOIS and passive DNS datasets, we comprehensively examined the company’s website to better understand their operations. We conducted the following analysis while BlackCore’s website was still publicly visible online.

We identified the domain blackcore[.]online as hosting their main public-facing website. The website presented the company as “an elite influence, cyber, and technology company built for the modern era of information warfare and digital competition”.

Figure 1

An analysis of the infrastructure linked to blackcore[.]online revealed the existence of several active subdomains, some of which hosted active and publicly visible websites.

URL	Notes
angola-plan[.]blackcore[.]online	“Angolan Government Campaign”
api[.]blackcore[.]online	Login Page
app[.]blackcore[.]online	Login Page
auth[.]blackcore[.]online	Login Page
ava[.]blackcore[.]online	Login Page
blackcore[.]online	Main website for BlackCore
demo[.]blackcore[.]online	Demo website illustrating BlackCore’s business proposition to prospective clients. Now offline.
en[.]blackcore[.]online	English version of BlackCore’s main website.
full-report[.]blackcore[.]online	Password protected
landing[.]blackcore[.]online	Login Page
photos[.]blackcore[.]online	Password protected
proposals[.]blackcore[.]online	Password protected

One subdomain of particular interest (now removed, but visible as of April 1, 2026) was demo[.]blackcore[.]online. In it, the company illustrated its services and supposed capabilities, as well as the specific tactics it could deploy while running campaigns on behalf of its clients. According to the company’s documentation shown on the website, BlackCore could offer hundreds of avatars on Facebook, TikTok, and Instagram. Its activities, as described on its website, focused on three main areas:

1. Discourse Dominance: flooding platforms with coordinated messages.
2. Organic Engagement: achieve attention and engagement from real people.
3. Counter Operations: disrupting dissenting narratives with tailored messaging.

Figure 2

Figure 3

Case in Point: Angola

One of BlackCore’s pages in particular caught our attention: angola-plan[.]blackcore[.]online, also visible at the beginning of April 2026 and now removed. The page was titled “Angolan Government Campaign,” and it described a multi-week training course for the Angolan government in communications and narrative shaping.

Figure 4

While we sought to ascertain whether the training had in fact taken place, a source provided us with additional materials that included a final report from the training, including detailed materials and spreadsheets illustrating personas and other elements of the operation. 

We took several steps to verify that the materials provided by the source were legitimate. 

• We noted that the final report document displayed the BlackCore logo at the top. Reviewing the EXIF metadata associated with the logo picture, we observed a name in Hebrew in the “Creator” field, which would correspond to development by an Israel-based company. However, we could not link the name to a BlackCore employee at the time of publication.

Figure 5

• We verified that the start date shown in the final report approximately matched the one proposed on the Angola government campaign website – February 2026 – although the campaign extended for significantly longer than the originally proposed 4 weeks.
• We matched the goals, deliverables, and results described in the final report to the ones proposed on the related, publicly visible promotional website for the “Angolan Government Campaign.”
• We confirmed that the aliases shown in screenshots, as well as in a linked dataset in the final report, corresponded to existing Facebook and Instagram accounts and pages, even when already removed.

This material appears to confirm that the training had in fact taken place, that it lasted 14 weeks in total, and that it was deemed successful by BlackCore, as described further below.

The Angola Plan: Influence Operations for Hire

BlackCore’s Angola plan began with a slide defining the “Angolan Government Campaign” timeline: 4 weeks. It described the company’s definition of success for the program: “The non-negotiable objective of this cycle was the eradication of amateur production practices and the implementation of a professional, robust, and scalable Architecture for State communications”.

Additionally, it defined the program’s scope as being “positive government campaigns”. Per the documentation that was visible on the subdomain demo[.]blackcore[.]online as shown in Figure 2 above, this appears to only include the inorganic, coordinated dissemination of specific narratives via social media and other platforms; and not the artificial countering of dissenting opinions. Areas to be included in the training were: Storytelling, Copywriting, Traffic Management, and Social Media Operations.

Finally, the website made it clear that the training did include the creation, maintenance and assessment of a “Meta Ads campaign” and a “TikTok campaign” on Week 3.

Figure 6

A closer look at the description of that week showed four days of demographic research, technical setup, and optimization for the campaigns, capped by a “Practical Workshop” on day 5, when the trainees would launch their campaign and start producing reports on it.

Figure 7

While these descriptions could theoretically be associated with both a regular marketing and communications campaign and a covert influence operation, BlackCore’s unique value proposition and market positioning through their websites strongly suggest that it was the latter. Indeed, BlackCore’s final report summarizing the program confirms their services were utilized for influence operations.

The Final Report

The final report document revealed several pieces of information that are critically important to our understanding of how the training was conducted, and the results it achieved.

First, it defined the program’s timeline:

• Initiated on January 19, 2026.
• Run for “more than 14 uninterrupted weeks of training and practical operation”, ending at an unspecified date in April 2026.

Figure 8

Second, it defined its objectives:

Figure 9

According to the report, the training program produced more than 40 distinct pieces of content, several of which are detailed in a separate document. The trainers – whom we could not identify – evaluated at least 24 publications produced by the trainees, and reported high proficiency levels for aspects such as “content strategy and organizational ideation”, “strategic writing and visual structuring”, and “advanced audiovisual production and AI usage”.

Figure 10

However, according to the report BlackCore found the deployed Meta Ads campaign to be underperforming, though it attributed that result to “the inherent complexity of the Meta Ads tool.”

The Assets

Several snapshots included in the final report from the produced campaigns allow us to identify assets produced or co-opted for it.

At the centre of the operation appears to be a Facebook page for a made-up news outlet called “Agita News”. It posted its own original content, as well as links to articles posted on an external site, the identity of which we cannot currently confirm. Both Facebook page and website are now offline.

Figure 11

A critical portion of the BlackCore final report was an embedded Google Sheet file designed to map the extent of the Angola campaign, named “FB Activity”. The file, the link to which is no longer working, originally listed: 

• The date of posting of a given piece of content. 
• The page or profile it was posted from, and the Facebook Groups – public or private communities of users – it was reposted to.
• The link to the original post.
• A set of names associated with each post – which we assess to be the artificial personas utilized to manage the pages and post the content. We will detail this further below in the note.

Figure 12

Overall, the inorganic campaign run by BlackCore and its trainees appears to have followed a common playbook for covert influence operations conducted online: 

1. Seeding of original content through deceptive online identities. 
2. Backstopping via an external website: for example, the Facebook page for “Agita News” linked to agitanews[.]net, which is now offline, and for which there is no available archived version.
3. Artificial amplification of the content via reposting to online communities.
4. Measurement of visualizations, website traffic, and organic engagement.
5. Recalibration of the campaign.

Identifying the Actors

We could not conclusively determine the identities of the Angolan personnel trained by BlackCore or those of BlackCore’s own trainers; nor could we independently confirm that the training actually took place. However, given the existence of multiple online assets corroborating the contents of BlackCore’s program final report, we assess it as highly likely that the program happened as described by the company.

Despite multiple operational security lapses made by BlackCore, identifying the actual individuals involved in the Angola training program on either side remains a challenge.

Of the five names shown in the Google Sheet file (Dorivaldo, Gancho, Mário, Carla, and Mariana), we could confirm with high confidence two online identities. Both appeared to be fake personas, and to have been removed by Facebook, the platform where they were utilized. Both likely made use of AI-generated imagery for their profile pictures.

Dorivaldo Kiala

• Name mentioned in full in the spreadsheet, and shown in pictures attached to BlackCore’s final report. Posed as an Angolan political activist.

Figure 14

Gancho Atalaia

• Mentioned as “GANCHO” in the spreadsheet, but with its name shown in full in admin panel screenshots from BlackCore’s final report.

Figure 15

BlackCore did not name the Angola trainees anywhere in the documentation that we analyzed.

On the side of BlackCore’s trainers’ identities, we located some clues – such as, for example, an email address and a first name for the owner of the Google Sheet file. However, at the time of publication we have no conclusive evidence that they represent real individuals. 

Only one first name was shown in BlackCore’s final report: Ronaldo, Technical Lead. That name, paired with the language settings on Facebook as visible in screenshots and the Portuguese filenames for several pictures in the report (i.e. “Captura de ecrã”), lead us to the conclusion that BlackCore likely employed local staff to deliver their training.

August 2026: Meta’s H2 Adversarial Threat Report

On August 27, 2026, Meta published the company’s second-half Adversarial Threat Report. Among the network disruptions the company described was “a Coordinated Inauthentic Behavior network originating in Israel and targeting audiences in France, the United Kingdom, Australia, Iran, Togo, Gabon, Angola, and the United States.” Meta assessed this as “an influence-for-hire operation, likely run on behalf of a number of distinct clients”.

The report went on to describe the influence operation as follows: “The operation then deployed clusters of fake, automated accounts that used AI to mass-produce contextually relevant comments designed to artificially boost engagement on the network’s primary assets, a tactic to boost reach that the network’s own operators referred to as ‘Mother-Child’. Ahead of France’s 2026 municipal elections, the network created brands to criticize political candidates and spread narratives about the “Islamization” of France. Network operators disseminated varied messaging tailored to different regions, including partisan content in Togo and Gabon, anti-government messaging in Iran and Angola, and anti-immigrant and anti-Muslim campaigns in France, the United Kingdom, and Australia. The network also aimed a small cluster of these bots at the NYC mayoral campaign.”

We do note that Meta cites “anti-government messaging […] in Angola”. It is not clear whether Meta was mistaken in their analysis, or BlackCore was servicing both sides of the political spectrum. In spite of the inconsistency, given what has been previously publicly reported about BlackCore’s campaigns, including their targeting of the New York City mayoral campaign and of audiences in Scotland, Togo, and Angola, we assess that the firm Meta is describing is likely BlackCore.

Conclusions

It is usually difficult to prove that an influence operation had an impact on the intended audience, and was therefore successful. BlackCore went to great lengths in its final report to demonstrate precisely that. Screenshots of Facebook’s posts engagement metrics attached to the company’s final report on their Angola training program showed that engagement with some of its deceptive posts was in the range of 20,000 “likes”, and those still visible online are now close to 50,000: substantial amounts in a country with an estimated six million active Facebook users.

Moreover, the full BlackCore service offering displayed by the company on one of their promotional websites (demo[.]blackcore[.]online) showed that the firm did not shy away from selling targeted attacks and “narrative disruptions,” making it even clearer that they did not offer simple marketing campaigns, but rather deceptive, harmful influence operations with the goal of manipulating audiences on behalf of powerful clients. Even more: in its Angola plan, the company promised to deliver “a professional, robust, and scalable Architecture for State communications”, signaling how governments can now easily access off-the-shelve influence operation infrastructure and capabilities.

BlackCore is a glaring example of the damage the influence-for-hire industry can do to an online ecosystem that is already facing significant struggles. With the well-documented global reduction on Trust & Safety focus on social media platforms, and the lack of consistent frameworks and enforcement levels to address information operations across them, private firms offering influence-for-hire services can arguably evade detection much more easily than governments. In doing so, they can pollute the online sphere almost unseen – unless a slip-up happens, as in the case we analyze in this note.

Appendix

Domains/Subdomains

BlackCore’s Official Assets

Domain or Subdomain
angola-plan.blackcore[.]online
api.blackcore[.]online
app.blackcore[.]online
auth.blackcore[.]online
ava.blackcore[.]online
blackcore[.]online
demo.blackcore[.]online
en.blackcore[.]online
full-report.blackcore[.]online
landing.blackcore[.]online
photos.blackcore[.]online
proposals.blackcore[.]online

Social Media Assets

The following is a brief list of confirmed assets that we identified by reviewing BlackCore’s documentation. It is worth noting that on its own promotional website, BlackCore claims to control several thousands of social media sockpuppet accounts.

URL or Handle	Platform	Notes
https://www.facebook.com/people/Gancho-Atalaia/61586701523100/	Facebook	Confirmed seeder of content from the Angola training.
https://www.facebook.com/people/Dorivaldo-Kiala/61586504372500/	Facebook	Confirmed seeder of content from the Angola training.
“Agita News”	Facebook	URL unknown, page possibly now removed. Several Facebook pages with the same name currently online cannot be confirmed as linked to BlackCore.
https://www.facebook.com/a24hangola	Facebook	Admin panel and campaign-related posts made by a BlackCore avatar are shown in BlackCore’s report. Currently active.
marcos.moves	Instagram	Shown in pictures attached to BlackCore’s report.
carlos.mendz1	Instagram	Shown in pictures attached to BlackCore’s report.
joanamarques0na	Instagram	Shown in pictures attached to BlackCore’s report.
andre_alfredo_87	Instagram	Shown in pictures attached to BlackCore’s report.
intelligence_unit_ao	TikTok	Shown in pictures attached to BlackCore’s report.
stira.poltica.e.s	TikTok	Shown in pictures attached to BlackCore’s report.

Other Indicators

Indicator	Notes
hjack5632@gmail[.]com	Email address used to create the Google Sheet file linked to BlackCore’s Angola report.

Acknowledgements

We would like to thank Sarah McKune, Luis Fernando Garcia, and Siena Anstis for their reviews. Thanks to Anna Mackay and Claire Posno for comms support and to Adam Senft for review and operational support.

Research for this project was supervised by Ronald Deibert.

1. We were unable to find a recent contact point at BlackCore in order to seek comment from the company on these research findings. Their public facing websites and social media presence have been removed. ↩︎