A Viginum investigation reveals an Israeli “Influence-As-A-Service” network that spans continents and ideologies.
In the final weeks of February 2026, a woman calling herself Sophie appeared on Facebook. Her back was to the camera, her voice digitally altered. She spoke of rape—of a prominent French politician, Sébastien Delogu, candidate for mayor of Marseille. Her testimony was posted to a Facebook page called “Le Blog de Sophie” and linked to a website, blogdesophie.com, registered just days earlier.
The story was a fabrication. The website was one of four created in a coordinated campaign to destroy the reputations of three candidates from the left-wing party La France Insoumise (LFI). The operation—codenamed “Rokh Solis” by French intelligence—involved fake news sites, hundreds of inauthentic social media accounts, artificially generated comments, and two opposing fake political movements engineered to polarize public debate.
But the most disturbing revelation lay not in the operation’s tactics, but in its origins. According to a comprehensive technical report from Viginum—France’s service for vigilance and protection against foreign digital interference—the campaign was traced to a shadowy Israeli company named Blackcore. And behind Blackcore lies a sprawling web of technology entrepreneurs, cybersecurity veterans, and former intelligence officials, all operating in a gray zone between private enterprise and state power.
Part One: The Rokh Solis Operation—A Blueprint for Digital Deception
Anatomy of a Smear Campaign
The operation, which ran from early February to March 2026, was meticulously planned. Its targets were carefully chosen: three high-profile LFI candidates in strategically important cities. Sébastien Delogu in Marseille. François Piquemal in Toulouse. David Guiraud in Roubaix.
Viginum’s report, dated June 11, 2026, describes the operation’s core architecture: four websites created between February 9 and February 19, all sharing identical technical signatures. The same IP address. The same registration date. The same WordPress template. The same AI-generated imagery from Google’s Gemini and Canva.
“Quatre des sites web en question – blogdesophie.com, delogupourpalestine.com, piquemalzero.com et lalternative2026.com – présentent des caractéristiques techniques communes (même adresse IP, date d’enregistrement, métadonnées des images, etc.)” (“Four of the websites in question—blogdesophie.com, delogupourpalestine.com, piquemalzero.com, and lalternative2026.com—share common technical characteristics (same IP address, registration date, image metadata, etc.”)
Each site was tailored to its target. For Delogu, a rape allegation and a fabricated scheme to sell nude photos for Gaza. For Piquemal, accusations of pedophilia and support for Hamas, amplified by a fake page impersonating the legitimate child protection association “Enfance et Partage.” For Guiraud, attacks on his pro-Palestinian stance.
The Polarization Strategy
But the operation went beyond simple defamation. The operators created a false political dialectic designed to inflame France’s most sensitive cultural fault lines.
The site lalternative2026.com presented itself as an initiative to help Muslim voters identify candidates who would represent their interests. It listed 108 LFI-affiliated candidates, insidiously suggesting the party supported communitarianism—the establishment of separate religious legal systems, the extension of the call to prayer, and gender-segregated facilities.
“Cette approche repose notamment sur l’accusation de communautarisme portée contre LFI, présenté comme une caractéristique centrale de la politique que le parti chercherait à promouvoir, aussi bien au niveau local que national.” (“This approach is based in particular on the accusation of communitarianism against LFI, presented as a central characteristic of the policy that the party would seek to promote, both locally and nationally.”)
To make this fake initiative credible, the operators created two opposing entities. The first was rcn-france.org, posing as a “Renaissance Catholique Nationale”—a conservative, sovereignist movement warning against the rise of radical Islam. The second was forsane-alizza.eu, mimicking a radical Islamist group that praised the “Alternative 2026” project.
“Cette dialectique narrative a probablement pour objet de susciter de l’engagement en ligne, afin de faire monter en visibilité ces deux sphères et espérer in fine polariser le débat public numérique sur la question de la place de la communauté musulmane dans la société française.” (“This narrative dialectic is probably intended to generate online engagement, in order to increase the visibility of these two spheres and ultimately hope to polarize the digital public debate on the question of the place of the Muslim community in French society.”)
It was a sophisticated strategy: create a political Rorschach test, then inject it into the public sphere.
The Amplification Machine
The websites alone would have remained invisible. To give them life, the operators deployed a network of hundreds of inauthentic accounts across Facebook, X, TikTok, and Instagram.
VIGINUM identified at least 39 inauthentic Facebook accounts participating in the scheme. The accounts shared common characteristics: AI-generated profile photos, common Francophone names, and coordinated behavior. They joined the same political groups on the same dates—September 7, 2025, for groups like “Militant de Droite” and “Combat Républicain 2027.” They posted comments at the same time, using the same phrases.
“Sur 338 commentaires au total, 138 utilisateurs uniques ont été identifiés. Parmi eux, trois comptes commentent les trois pages Facebook, tandis que 48 d’entre eux commentent au moins deux des trois pages du dispositif.” (“Out of 338 comments in total, 138 unique users were identified. Among them, three accounts comment on the three Facebook pages, while 48 of them comment on at least two of the three pages in the device.”)
This was a factory of artificial engagement, designed to manufacture consensus and credibility through sheer volume.
Yet despite this elaborate machinery, the campaign failed to gain traction. The report notes with clinical detachment that the operation achieved only “low visibility” in the lead-up to the elections. The manufactured outrage did not go viral. The fabricated allegations did not sway voters.
“Malgré la variété d’actifs numériques, de nombreuses tentatives d’amplification artificielle et la latéralisation des opérations d’ingérences numériques étrangères sur plusieurs plateformes, les opérations du MOI Rokh Solis n’ont bénéficié que d’une faible visibilité en ligne en amont des élections municipales 2026.” (“Despite the variety of digital assets, numerous attempts at artificial amplification, and the lateralization of foreign digital interference operations across multiple platforms, the Rokh Solis operations only benefited from low online visibility in the lead-up to the 2026 municipal elections.”)
The operation was a failure in terms of impact. But the digital fingerprints it left behind were a treasure trove for French intelligence.
Part Two: The Blackcore Connection
Breadcrumbs in the Code
VIGINUM’s investigators began finding traces of foreign involvement in the technical infrastructure of the operation. The metadata of images on lalternative2026.com contained Hebrew characters. The TikTok account @renaissancecatholiquefr was geolocated in Israel. The same inauthentic accounts that amplified the Rokh Solis content had previously been used to promote the pro-Israeli organization ELNET.
But the most significant lead pointed to a company called Blackcore.
“Plusieurs éléments techniques ont orienté les investigations de Viginum vers une entité privée israélienne nommée Blackcore, dont les stratégies d’influence numérique s’apparentent à celles observées dans le cadre des campagnes informationnelles conduites au moyen du MOI Rokh Solis.”) (“Several technical elements directed VIGINUM’s investigations towards an Israeli private entity named Blackcore, whose digital influence strategies are similar to those observed in the information campaigns conducted using the Rokh Solis operation.”)
Blackcore is not a legitimate company in the conventional sense. It has no registration with the Israeli company register. It has no office, no employees listed on LinkedIn, no public-facing presence beyond a few hastily constructed websites.
“La pseudo-société Blackcore ne produit que très peu de données en source ouverte, ce qui ne permet pas à VIGINUM de vérifier les statuts légaux de cette entité, a priori, non inscrite au registre des entreprises israéliennes.”) (“The pseudo-company Blackcore produces very little open-source data, which does not allow VIGINUM to verify the legal status of this entity, which is apparently not registered with the Israeli company register.”)
Yet Blackcore’s digital footprint tells a remarkable story.
The Infrastructure of Influence
The domain blackcore.online was registered on August 22, 2025. This date coincides with the “activation of certain digital assets” of the Rokh Solis operation—specifically, the renaming of dozens of inauthentic amplification accounts on X.
The site itself functions as a marketing brochure, describing Blackcore as a provider of “influence, security, and technology solutions for governments.” A demonstration sub-domain, demo.blackcore.online, goes further. It claims Blackcore controls a network of 1,600 inauthentic “avatars” across Facebook, Instagram, and TikTok. It boasts of capabilities in mass private messaging and community infiltration—precisely the tactics observed in the Rokh Solis campaign.
But the most revealing discovery was the interconnected web of domains and companies behind Blackcore.
The domain blackcore.online is hosted on the IP address 94.237.57[.]56. Also hosted on this server are electric-marinade.com and omrisystems.com. These domains function as internal interfaces for the influence operation.
One sub-domain, fb-search.omrisystems.com, provides a tool that uses a large language model to find keywords and then automatically search for relevant Facebook groups to infiltrate. Another, avatar-data-generator.electric-marinated.com, is described as an “Avatar Data Generator by Galacticos AI.”
The Web of Entities
This is where the investigation deepens. Galacticos AI is a real company. Its domain, galacticos.ai, was registered by Guy GEYOR via a company called SNI, both of which are domiciled at 103 Hachashmonaim Street in Tel Aviv.
The same address houses Afik & Co., a law firm specializing in international affairs. The firm’s founder, Doron AFIK, is listed as a director of Galacticos LTD. Photos on the firm’s website show Afik with Guy Geyor and with another individual: Nir Dobicky.
Nir Dobicky is a Swedish-registered entrepreneur of Israeli origin. He is the director of several companies in the UK and Sweden, including Rocketpod Technologies LTD and Blade Marketing (also known as Social Worx LTD), all specializing in online influence and automation. He also appears to be linked to a fake charity campaign called “Sadaqah Palestine,” which targeted pro-Palestinian audiences.
Dobicky’s X account, @niroknox, was amplified by the same network of inauthentic accounts that supported the Rokh Solis operation. When investigators traced the account’s activity, they found it had also been used to target political figures in Scotland—John Swinney and the Scottish National Party—with coordinated comment campaigns.
The Former General
At the center of this web stands Yigal Unna. His curriculum vitae reads like a who’s who of Israeli security: former Director-General of the Israel National Cyber Directorate (INCD). Veteran of the IDF’s elite Unit 8200. Former Shin Bet official.
Unna now heads Cygun LTD, a cybersecurity incubator that provides consulting and investment to Israeli startups. One of its portfolio companies is Galacticos AI. Cygun’s website prominently features Unna’s biography and the logos of its partners, including the Israeli investment fund Iron Nation.
“Yigal UNNA apparaît alors comme une figure centrale de cet écosystème, d’une part en tant qu’ancien directeur général de l’Israel National Cyber Directorate (INCD) et d’autre part du fait de ses différentes expériences passées au sein de l’Unité 8200 de Tsahal et du Shin Bet.” (“Yigal Unna thus appears as a central figure of this ecosystem, on the one hand as former Director-General of the Israel National Cyber Directorate (INCD) and on the other hand due to his various past experiences within the IDF’s Unit 8200 and the Shin Bet.”
Uunna’s role is that of a bridge. He connects the world of Israeli state intelligence to the private sector, providing legitimacy, capital, and connections to companies like Galacticos AI. In turn, these companies—operating in a legal gray zone—provide services that blur the line between legitimate influence and foreign interference.
Part Three: A Global Influence Machine
The Angola Connection
The Blackcore infrastructure is not a one-off operation. It is a reusable platform for global influence campaigns.
Viginum identified a separate cluster of inauthentic accounts in Portuguese, targeting audiences in Angola. The accounts amplified content favorable to the Angolan government and the ruling MPLA party. The technical link to Blackcore is explicit: a sub-domain called angola-plan.blackcore.online refers to training given to the Angolan government in February 2026.
“angola-plan.blackcore.online fait notamment référence à une formation donnée au gouvernement d’Angola en février 2026, laissant supposer que l’entreprise israélienne a directement traité avec ce gouvernement.” (“angola-plan.blackcore.online notably refers to training given to the Angolan government in February 2026, suggesting that the Israeli company directly dealt with this government.”)
The inauthentic accounts identified in the Angola campaign share the same characteristics as those used in France: AI-generated photos, coordinated behavior, and infiltration of relevant groups. Some of these accounts had previously been used in the France campaign, with names changed from French to Portuguese.
The Pro-Palestinian Front
Perhaps the most revealing aspect of the investigation is the ideological flexibility of the operation. The same infrastructure used to attack LFI candidates for their alleged pro-Palestinian sympathies was also used to operate a fake pro-Palestinian charity.
The domain sadaqahpalestine.com (now inactive) was hosted on the same mail server as electric-marinated.com—one of the core domains in the Blackcore infrastructure. The site promoted a pseudo-charity for the Palestinian population. Its X account was amplified by inauthentic accounts displaying identical behavior to those used in the Rokh Solis campaign.
This is not a case of inconsistent principles. It is a case of consistent commerce. The operators of this influence machine are mercenaries, willing to sell their services to anyone, for any cause. The ideological content is irrelevant; the only principle is payment.
The Reach of the Network
Viginum’s investigation also revealed that the network of inauthentic accounts had been used in other political campaigns. The same accounts that infiltrated French political groups in February 2026 had previously targeted the 2025 New York City mayoral election, amplifying content for Democratic candidate Andrew Cuomo.
“Probablement dans le cadre de cette dynamique, les comptes ‘Julie Simon’ et ‘Théo Blanc’ ont relayé les 6 et 7 octobre 2025, des publications issues de la page Facebook d’Andrew CUOMO, candidat démocrate aux élections municipales de New York.” (“Probably as part of this dynamic, the accounts ‘Julie Simon’ and ‘Théo Blanc’ relayed on October 6 and 7, 2025, publications from the Facebook page of Andrew CUOMO, Democratic candidate for the New York municipal elections.”)
The same accounts also targeted audiences in Ireland, the UK, and Scotland with anti-Muslim content and pro-Israeli advocacy. The TikTok account @renaissancecatholiquefr, used in the Rokh Solis campaign, had previously been named @IrelandRealNews and targeted Irish audiences with content using hashtags like #TheWestIsNext and #TheWestIsNow.
Part Four: The Question of Attribution
A Private Actor, not a State
Viginum’s report is careful in its attribution. While the evidence strongly points to Israeli actors, the service does not claim this is state-sponsored activity. The involvement is “at least indirect” of a foreign actor, and the specific operators remain unidentified.
“Aucun élément ne permet par ailleurs à VIGINUM d’établir l’identité et l’origine des commanditaires ayant pu recourir aux services de cette société.” (“Furthermore, no element allows VIGINUM to establish the identity and origin of the sponsors who may have used the services of this company.”)
This distinction is crucial. The Blackcore network represents a new form of digital interference: privatized, deniable, and commercially motivated. It is not a government operation, but it operates with the complicity and involvement of individuals with deep ties to government intelligence. The blurring of lines between public and private is not accidental; it is the point.
The Ecosystem of Impunity
The investigation reveals a broader ecosystem of Israeli cyber companies operating in a legal gray zone. Viginum identifies Galacticos AI, Iron Mind AB, Rocketpod Technologies LTD, Blade Marketing, and others as part of this ecosystem. These companies share infrastructure, clients, and personnel. They are connected through a network of investors, lawyers, and former intelligence officials.
What makes this ecosystem difficult to regulate or prosecute is its structure. It is not a single company with a clear chain of command. It is a constellation of entities, each providing a piece of the puzzle: technology, infrastructure, legal cover, investment, and operational expertise. The whole is greater than the sum of its parts, but each part is plausibly deniable.
“À ce stade, l’étendue de cet environnement ne permet pas l’identification précise et la qualification du rôle exact des opérateurs à l’origine du MOI Rokh Solis.” (“At this stage, the extent of this environment does not allow the precise identification and qualification of the exact role of the operators behind the Rokh Solis operation.”)*
Part Five: The Implications
The Weaponization of the Digital Public Sphere
The Rokh Solis operation is a case study in the weaponization of the digital public sphere. It combined traditional disinformation—fabricated allegations, fake news sites—with advanced computational propaganda: AI-generated content, automated amplification, and algorithmic manipulation of social media platforms.
But it also added a new dimension: the creation of opposing fake political movements to manufacture polarization. This is not simply a matter of spreading false information. It is about shaping the very terms of political debate, creating a false reality in which the target is caught in a crossfire of manufactured outrage.
The Failure of Impact
For all its sophistication, the Rokh Solis operation failed. Its content did not go viral. Its fabricated allegations did not become news. Its fake political movements did not gain traction. The report’s observation of “low visibility” is a reminder that even the most advanced influence operations can fail to achieve their objectives.
This failure may be more significant than any success. It suggests that the platforms’ content moderation efforts, while imperfect, can disrupt even well-resourced operations. It also suggests that the French public, at least in this instance, was not easily manipulated. The accusations were too extreme, the accounts too obviously inauthentic, the narrative too contrived.
The Need for International Cooperation
The Rokh Solis investigation highlights the need for international cooperation in countering foreign digital interference. The operation targeted French elections, but its infrastructure spanned multiple countries: domains registered in Sweden, hosting in multiple jurisdictions, and operational activity in Israel, the UK, the US, and Angola.
Viginum’s ability to trace the operation to its source is a testament to the capabilities of French intelligence. But one country alone cannot dismantle a global network of influence mercenaries. International cooperation, shared intelligence, and coordinated action are essential.
The Challenge of Privatized Interference
The most troubling aspect of the Rokh Solis operation is its commercial nature. This was not a state-sponsored campaign with clear political objectives. It was a paid service, offered by private companies to unknown clients. The operators had no ideological commitment to the content they were spreading. They were selling a product: influence.
This privatization of digital interference presents a new challenge for democracies. Traditional attribution models—identifying the state actor behind an operation—are insufficient when the operator is a private company. The client may be a state, a political party, a corporation, or an individual. The motive may be political, financial, or personal.
The Blackcore ecosystem represents a new form of political warfare, one that is deniable, commercial, and global. It is a threat that democracies are only beginning to understand.
Conclusion: The Ghosts in the Machine
The Rokh Solis operation, and the Blackcore ecosystem that enabled it, reveal a troubling new reality. The digital public sphere, once seen as a democratizing force, has become a battlefield. And on this battlefield, mercenaries—former intelligence officials, cyber entrepreneurs, and shadowy companies—sell their services to the highest bidder.
The French investigation was a success. The operation was detected, analyzed, and exposed. The perpetrators, or at least their infrastructure, were identified. The public was not deceived. But the investigation also revealed the scale of the challenge. This was not a one-off attack. It was a test run, a demonstration of capabilities that will be refined and repeated.
As Yigal Unna and his network move on to their next project—Angola, Scotland, or somewhere else entirely—the lesson for democracies is clear. The ghosts in the machine are real, and they are not going away. The only defense is vigilance, cooperation, and a commitment to the tru
