Skip to main content

Someone Paid for This

Manipulation Breakdowns · 8 min read · By D0

The Report

On June 11, 2026, VIGINUM — France’s technical and operational service for detecting foreign digital interference — published findings on a suspected influence operation it had been tracking across multiple countries.

In Scotland, the agency identified the mobilization of at least 256 accounts that generated approximately 1,400 comments, targeted primarily at three accounts: @JohnSwinney, the Scottish First Minister; @theSNP, the Scottish National Party’s official account; and @ScotGovFM, the Scottish Government. The comments were overwhelmingly negative. The accounts showed signs of being AI-generated bots. The activity was concentrated in the period before Scotland’s May 2026 parliamentary elections.

The operation was not limited to Scotland. VIGINUM linked the same infrastructure to interference in France’s local elections in March 2026, influence activity around the 2025 New York City municipal election, and operations in Angola and Togo.

The firm behind the infrastructure was identified as BlackCore.

The Firm That Isn’t

BlackCore described itself, on its website, as “an elite influence, cyber, and technology company built for the modern era of information warfare” that provided governments and political campaigns with “cutting-edge strategies, advanced tools, and robust security to shape narratives.”

This is a reasonably precise description of what it appears to have done.

What BlackCore does not have is a legal existence. Investigators found no company named BlackCore registered in any jurisdiction. What they found instead is that BlackCore’s web infrastructure is shared with two Israeli firms — Galacticos and SNI — owned by tech entrepreneur Guy Geyor and lawyer Doron Afik. At least one Galacticos employee served in Unit 8200, the Israeli military’s signals intelligence directorate. Neither firm has responded to press inquiries.

Two investigations are now open in France: one by Paris prosecutors, one by the domestic intelligence agency. BlackCore itself cannot be charged because it does not exist as a legal person. There is no entity to summon to court, no assets to freeze, no officer of record to depose.

The name is a marketing surface. The legal accountability surface is empty.

The Most Important Detail

VIGINUM’s report identified the operator. It did not identify the sponsor.

In Scotland, in France, in New York, in Angola, in Togo — the same infrastructure, the same operational signature, the same absence of a named client. The investigation geolocated the firm. The firm’s connections to other companies were traced. The accounts were counted, the comments were tallied, the targets were documented.

Nobody knows who paid for it.

This is presented in coverage as a limitation of the investigation. It is more accurate to describe it as a feature of the product. Commercial influence operations are structured so that the buying event cannot be traced even when the operational event can. The firm absorbs attribution risk. The client buys deniability as part of the service.

Think about what this means in practice. A government, a political party, a wealthy individual, a foreign intelligence service — any of them could have commissioned operations across five countries, had those operations caught and publicly attributed, and remained entirely outside the public record. The investigation succeeded in the sense that it named the contractor. It failed in the only sense that would produce accountability: naming the person who gave the instruction.

Why Swinney

John Swinney has made pro-Palestinian statements. He is the leader of the Scottish National Party, which has been broadly sympathetic to Palestinian civilian casualties in Gaza. His accounts were the primary target: 652 of the 1,400 documented comments were directed at his personal profile.

VIGINUM’s report explicitly notes that Swinney’s pro-Palestinian position appears to be the reason for his targeting.

This detail is worth sitting with. Someone — unknown, anonymous, unidentified — decided that a politician’s public expression of a foreign policy view warranted an influence operation to suppress or discredit him ahead of an election. The speech triggered the commission. The commission triggered the operation. The operation targeted him with AI-generated accounts before his voters went to the polls.

The political position was the offense. The election was the venue. The operation was the response.

We know this because VIGINUM traced the targeting logic. We do not know why anyone felt strongly enough about Swinney’s position to pay for 256 accounts and 1,400 comments. The “why” of the targeting is partially visible — what speech was suppressed, and against whose interest. The “who” of the commission is not.

Influence as a Service

BlackCore is not unique. It is the current visible instance of a model that has been developing for over a decade.

The model works as follows. A firm with operational expertise in influence campaigns — account creation, content generation, amplification, targeting — builds infrastructure that can be deployed against any target in any jurisdiction. The firm sells access to this infrastructure to clients who want specific outcomes: a politician discredited, a narrative seeded, an election shifted at the margins. The client communicates requirements. The firm handles execution. The firm is the only visible entity in the transaction.

The commercial logic is efficient. The firm acquires expertise at scale across multiple operations and amortizes that expertise across paying clients. The clients receive operational capability they could not easily build themselves, with built-in deniability because their fingerprints are nowhere in the execution chain. The firm handles the risk that comes with operating in hostile jurisdictions or being identified by foreign intelligence services.

When BlackCore was caught, it was caught doing what it advertised it did. “Shape narratives” and “information warfare” are the firm’s own description of its services. The investigation confirmed the services were real. The investigation could not reach the clients who purchased them.

This separation — of operational attribution from sponsorship attribution — is increasingly the defining feature of how influence operations are structured. The era of the state-directly-operated influence campaign, where the trail leads back to a government ministry, is giving way to a market model in which sovereign actors, political operatives, and private interests all shop at the same infrastructure providers. The provider is the only address the investigation can find.

The Unit 8200 Detail

The connection to Israeli military intelligence is worth noting precisely because it is incomplete.

Unit 8200 is one of the most technically sophisticated intelligence organizations in the world. A substantial number of Israel’s technology sector executives and founders did their mandatory military service in signals intelligence, cyber operations, or related units. The fact that a Galacticos employee served in Unit 8200 establishes a connection to that background — it does not establish that BlackCore’s operations were state-directed.

Israel is also currently under international pressure over Gaza. Operations that targeted a politician for his pro-Palestinian statements, in multiple countries, during the period of that pressure — the circumstantial pattern is obvious. But circumstantial patterns are not evidence, and VIGINUM’s report makes no such claim.

What the Unit 8200 detail actually reveals is the talent pipeline that commercial influence operations draw from. The technical expertise required to run a coordinated inauthentic behavior campaign across five countries’ social media infrastructure is the same expertise that military intelligence services develop and then discharge into the private sector. The firms that hire it operate commercially. Whether they also retain government relationships is an open question in every case.

The client list, if it exists, is not public.

What Gets Caught and What Doesn’t

The BlackCore case demonstrates both the reach and the limit of current attribution capabilities.

VIGINUM succeeded in identifying the firm, tracing the infrastructure, connecting the accounts, and documenting the operations across multiple jurisdictions. This is technically sophisticated work. The agency published its findings publicly, named the firm, and triggered criminal investigations.

What did not get identified: the client. What cannot be charged: the entity that gave the instruction, because the entity is a legal fiction. What remains unknown: whether the five countries were commissioned by one client with broad interests or five separate clients with local ones.

The accountability surface is the infrastructure layer. Everything above it — the decision, the commission, the instruction — is invisible.

This creates a structural incentive. If you want to run an influence operation and you can pay a commercial firm to do it, the cost of getting caught is borne by the firm. The firm loses a contract. The firm’s name appears in a French intelligence report. No named individual pays a legal consequence. No government acknowledges a policy. The politician who was targeted still ran against the headwind of 652 AI-generated attacks on his personal account before his voters went to the polls.

Swinney’s SNP lost seats in the May elections. Whether the operation contributed to that result is unknowable. That question will also never be answered, because the client who might have cared about the answer has no public name.

Someone paid for this. We know what they bought. We know it was delivered. We do not know who they are.

That is the design.

This article is part of Decipon’s Manipulation Breakdowns series, examining specific influence operations through the Influence Tactics Protocol.

Sources: