BlackCore: Israel’s Cyber Hitmen in France’s Elections

Freddie Ponton
21st Century Wire

In early May 2026, three pro‑Palestine candidates in French municipal races were hit with a coordinated smear campaign built on lies, synthetic identities and anonymous digital attacks, which French authorities and platform investigators traced back to an Israeli influence construct and the wider cyber‑operations infrastructure behind it. In Marseille, QR codes directed passers‑by to a blog accusing La France insoumise deputy and mayoral candidate Sébastien Delogu of sexual harassment. In Toulouse and Roubaix, similar websites and social media accounts pushed fabricated allegations against François Piquemal and David Guiraud, backed by fake testimonies and AI‑generated visuals. The targets were carefully chosen, and so were the methods. All three candidates are affiliated with “La France insoumise“,  the leading left‑wing, ecosocialist movement in France, founded and led by Jean-Luc Mélenchon. 

French authorities quickly moved beyond the idea that this was routine local mudslinging. Reuters reported that investigators were probing whether the Israeli firm BlackCore interfered in France’s 2026 local elections, while Meta removed coordinated inauthentic accounts it said originated in Israel and were linked to the campaign targeting French political figures. Google and TikTok separately detected parts of the same operation during their own monitoring, meaning three major platforms independently identified the same Israeli‑linked network. According to Reuters, French intelligence services are now trying to establish who commissioned BlackCore and what stood behind it, a set of facts that places the firm at the visible edge of a much more complex enterprise built to strike, disappear and leave the deeper structure intact

Public corporate records and archived infrastructure traces point toward that deeper structure. Galacticos Ltd and SNI Digital Ltd are active Israeli companies registered at the same Tel Aviv address, 103 HaHashmonaim Street, alongside Benguy Escrow Company Ltd, a trust vehicle used in cross-border transactions to hold shares and options at arm’s length. An archived login page titled “Avatar Data Generator by Galacticos AI” preserves a surviving fragment of the BlackCore toolchain, days before the cluster was scrubbed. Taken together, these traces point to a layered system: legal insulation at HaHashmonaim, modular influence tooling behind BlackCore, and a broader Israeli cybersphere where elite personnel circulate between deniable operations and regulator-facing businesses.

A smear campaign with a political target

This French case is significant because of who was targeted and why. Delogu, Piquemal and Guiraud all belong to La France insoumise, the most prominent party in France taking an openly pro-Palestine line against Israel’s war on Gaza and against the political consensus shielding it. This was, without a doubt, a political selection and not a simple random opportunism. The operation landed on a current in French politics that challenges Atlantic orthodoxy and rejects the deference expected on Israel.

The alarm in France did not begin and end with Reuters. A Reuters-derived Arabic recap states that France’s Service for monitoring and protection against foreign digital interference, also known as Viginium, first detected what it described as a “limited-range” foreign interference operation targeting a French political force in Marseille, Toulouse and Roubaix, a finding later reported by Le Monde. Le Canard Enchaîné then revealed that French authorities suspected an Israeli company, and Viginum formally warned La France insoumise that its candidates were being targeted. By the time Reuters published its account, the case already had a domestic institutional trail.

The techniques employed were tailored to municipal terrain and suggest professionalism and know-how. Anonymous blogs, QR codes in public space, fake local testimony, AI-generated content and regional media seeding gave the fabrication a neighborhood texture rather than a spectacular national footprint, which made the operation cheaper, deniable and effective at precisely the scale where municipal races can be destabilized by rumor and suspicion. Whoever designed it understood that local politics offers ideal ground for foreign interference because the threshold for contamination is low and the scrutiny often arrives too late.

This episode also sits inside a broader European pattern in which Palestine solidarity is increasingly treated as something to monitor, restrict or fold into the language of extremism. Reuters reported last year that Britain moved to ban Palestine Action under anti-terrorism laws, a measure later challenged in court and criticized by civil-liberties advocates. The French case is different in form, but it lands on the same political terrain, with pro-Palestine activism and representation finding themselves under escalating pressure.

Interestingly, the French institutions treated the affair as a national security issue, and not as a campaign sideshow. Reuters reported that the probe centered on BlackCore, while Meta said it had disrupted a network originating in Israel that primarily targeted France and linked the operation to previous activity in Africa. BlackCore’s digital presence quickly vanished as scrutiny intensified, but the takedown only confirmed the disposable role of the brand. The infrastructure and legal shell around it are what matter the most.

The BlackCore toolchain

Before it went dark, BlackCore advertised itself as an “elite influence, cyber and technology company.” It claimed the ability to run more than 1,600 avatars, generate up to one million posts a month, infiltrate Facebook groups, manipulate TikTok trends and shape positive or negative narratives for political clients. That sales pitch was unusually explicit. BlackCore was presenting information warfare as a private service.

The French operation followed that logic closely. It did not require a dramatic hack or a sprawling troll farm. It required fake local credibility, synthetic content, targeted insertion and enough amplification to keep the allegations moving through regional networks. Investigative reporting by Libération and Haaretz traced BlackCore-linked infrastructure to a London-hosted server cluster active from roughly March 2025 until 13 May 2026, when the system was scrubbed within hours of press contact. That kind of cleanup points to an operation accustomed to burning evidence fast.

BlackCore had already been selling the same machinery abroad. Documents reviewed by Reuters show the company claiming responsibility for a social-media operation run for an African government starting in January and lasting around 14 weeks. After Reuters asked Meta about that African campaign, the company said the same network was behind the French disinformation push. The continuity between overseas influence work and French electoral sabotage was identified by the platforms themselves.

The exposed subdomains, cited in France 3’s recent report on the topic, are unusually revealing. Among the names publicly identified were avatar-data-generator, agentforge, fb-search and socialtrigger. The names read like a wiring diagram: a persona-generation layer, an orchestration layer, a Facebook targeting component and a narrative deployment trigger. This strongly suggests a modular production line for synthetic identities, targeted insertion and coordinated manipulation. Nothing about it suggests freelance improvisation.

One surviving artifact cuts through the fog. An archived login page captured shortly before the purge carries the label “Login – Avatar Data Generator by Galacticos AI.” That page links a concrete BlackCore-adjacent tool to the Galacticos’ name in plain sight. A single archived interface does not reveal the full backend or every operator involved, but it does tie the exposed influence stack to real entities beyond the burned BlackCore label. Once that bridge appears, the story moves from allegation to structure.

The French case exposes more than a smear campaign against three candidates. It exposes a reusable machine built to manufacture false identities, penetrate digital communities and inject pre-fabricated narratives into democratic life. BlackCore was the storefront. The surviving traces point toward the companies and legal framework that kept the backend insulated from the fallout.

The HaHashmonaim hub

Israeli corporate records show that Galacticos Ltd and SNI Digital Ltd are active private companies registered at 103 HaHashmonaim Street, Tel Aviv–Jaffa, with incorporation dates in 2022 and 2021 and recent annual filings on record. Corporate registry tools such as KYC Israel and CheckID place Galacticos, SNI Digital and Benguy Escrow at the same address with active status data, which undercuts any claim that these were purely notional shells. BlackCore itself leaves almost no durable corporate footprint. Galacticos and SNI do. They sit at the same node as Doron Afik’s law office, and a trust vehicle called Benguy Escrow Company Ltd, a structure Afik uses as trustee in cross‑border tech deals, including in U.S. SEC filings where Benguy holds founder and executive shares at 103 HaHashmonaim Street.

Benguy Escrow is not a decorative registry footnote. Public U.S. securities filings show B.E.N.G.U.Y Escrow Company Ltd. (reg. 513905034) being used in cross‑border tech transactions as a lock‑up or escrow agent from the same HaHashmonaim address. In one SMX lock‑up agreement, “BENGUY ESCROW CO LTD A/C” appears as the holder, while Doron Afik signs as trustee for Benguy and as attorney for the company, with notices routed through Afik & Co. at 103 HaHashmonaim Street. In SMX’s amended F‑1 filing, the same escrow structure is described in relation to founder and executive shareholdings, with Benguy identified as the vehicle through which their equity is held under trustee arrangements. These filings show a repeat‑use instrument for separating operators and beneficiaries from immediate visibility

That detail matters because it places Galacticos and SNI inside a standing legal architecture rather than an improvised shell game. The HaHashmonaim cluster includes:

• Afik & Co., a law firm specializing in international transactions and capital markets.
• Galacticos Ltd.
• SNI Digital Ltd.
• Benguy Escrow, the trustee vehicle repeatedly used to hold shares and options at arm’s length.

It is hard not to notice that the pattern is consistent. A law office handling cross-border corporate work sits alongside private companies tied to the BlackCore toolchain and a trust mechanism designed to insert distance between activity and ownership. This evidently suggests that a legal firewall was already in place before BlackCore became a public scandal. When the exposed infrastructure leads back toward Galacticos and SNI, it does not land on an anonymous dead end, but lands on a functioning node built for controlled opacity.

Afik & Co.’s broader profile reinforces that reading. The firm publicly markets cross-border advisory work linking Israel, Latin America and Spain, alongside capital markets, tech transactions and crypto-related practice areas. It presents itself as a bridge for international business and corporate listings. At that same address, companies linked by infrastructure and registry overlap to a French interference probe were operating under legal cover sturdy enough to survive the burning of a front brand.

A fragmented cyber ecosystem

The public face of this world does not look like BlackCore. That is part of its durability. While the BlackCore label vanished, the cyber-intelligence talent around that market remains distributed across firms, advisory roles and verticals that present themselves as legitimate and institutionally useful.

One example is Lionsgate Intelligence Network, a Tel Aviv firm whose public business centers on blockchain forensics and crypto-asset recovery. Its materials describe work with law enforcement and regulatory bodies and focus on stolen funds, fraud and illicit-finance tracing rather than social-media operations. Lionsgate’s public story is built around NemesisAI and headline cases involving the tracing of alleged Hamas-linked or “terror” funds, a branding posture that makes the firm a comfortable partner for regulators, while the wider ecosystem around it supplies private influence capacity. The company operates from a different address than the HaHashmonaim hub used by Galacticos, SNI Digital, Afik & Co. and Benguy Escrow.

That contrast sharpens the political question. One side of the same ecosystem presents itself as a guardian against illicit finance and extremism, while another is tied by infrastructure and corporate records to an operation targeting pro-Palestine politicians in France. The split between clean-facing intelligence services and deniable influence work is one of the most important facts exposed by this case.

The personnel are just as telling. Lionsgate’s advisory and executive orbit includes figures from Israel’s security and cyber establishment, including former National Cyber Directorate chief Yigal Unna, who publicly distanced himself from Galacticos by late 2024. There is no public evidence that Lionsgate ran the BlackCore operation, and its declared business is distinct. The separation works like a shield, where the disposable brand takes the fall, while the operators keep their contracts and their invitations from regulators.

That fragmentation should not be mistaken for innocence. One branch sells blockchain forensics and “digital asset intelligence” to regulators, police agencies and compliance actors. Another builds avatar farms, targeting tools and narrative-trigger systems, while a legal hub manages the corporate and trust architecture. As for former intelligence and cyber officials, they clearly circulate through the broader market. To simplify, the visible scandal burns at the edge while the rest of the ecosystem keeps its reputation, clients and access intact.

Another interference case in France

What happened in France was more than a municipal dirty trick. All point to a foreign interference operation aimed at a pro-Palestine current in French politics and executed through a private Israeli-linked ecosystem built for deniability. In this case, the political logic is difficult to miss because the targets belonged to the force in mainstream French politics most openly hostile to Israel’s war on Gaza and most resistant to the Atlantic discipline that now governs nearly every official discussion of Palestine.

Israel’s Foreign Ministry told Reuters it was unaware of BlackCore and did not say whether Paris had raised the case. That answer was narrowly framed around formal awareness of one burned label rather than the wider private ecosystem surrounding it. By the time that line was delivered, Meta had already tied the relevant network to Israel, three major platforms had detected parts of the operation, and French authorities were investigating the matter as foreign interference.

The BlackCore brand’s disappearance should reassure no one. Disposable fronts are meant to vanish once journalists, platform investigators or intelligence services begin closing in. What remains are the active companies, the legal node, the trust mechanisms, the archived toolchain and the wider professional environment that can absorb exposure without collapsing. That is why the French case matters beyond France. It shows how a privatized interference industry can be hired, shielded and deployed against democratic actors while preserving plausible deniability for those behind it.

French political and security elites have spent years treating Israeli cyber expertise as something to import, trust and integrate. This case shows the risk of such a posture. A private Israeli-linked influence apparatus is now at the center of a French interference probe involving attacks on domestic opposition figures.

France has stumbled into a market that European elites still prefer to treat as hypothetical. Municipal races are ideal terrain for these operations because they are cheaper to target, easier to contaminate and less intensively scrutinized than presidential contests. If such methods are already being used against local pro-Palestine candidates, there is no serious reason to assume the industry will stop there. The machinery exposed in this case was built for reuse.

The scandal is not a vanished website or a bad actor with a clever domain name. It is a private architecture of political sabotage. The French probe has exposed one working edge of that architecture, starting with shell companies at 103 HaHashmonaim Street, followed by a legal and escrow framework capable of shielding ownership, and a modular AI-driven stack for building fake people and pushing lies into electoral space. BlackCore burned because it was designed to burn. The real work now is to go after the system behind it, the one that was built not to vanish, but to survive.

21st Century Wire is an alternative news agency designed to enlighten, inform and educate readers about world events which are not always covered in the mainstream media.

Source: https://21stcenturywire.com/2026/05/15/blackcore-israels-cyber-hitmen-in-frances-elections/