There is an office in Modiin, on the outskirts of Tel Aviv, that has no name on the door, and the man who runs it once told journalists posing as clients that this was exactly what they were, nothing. That man is Tal Hanan, and for two decades he operated under the alias Jorge, selling to governments, campaigns and private companies the ability to manufacture entire realities on social media. In 2023 a consortium of thirty outlets coordinated by Forbidden Stories exposed him. Three years later, the same industry he helped found no longer needs to hide behind an alias, it hides behind registered companies, business lawyers and servers spread across four countries. The craft trade became disposable infrastructure, and that changes entirely what it means to suspect an election.
The original factory
Before he was Jorge, Hanan already worked at the margins of private financial espionage. In 2006, while on assignment for a Panamanian bank, he alerted Martin Rodil, then a data analyst at the International Monetary Fund, to transfers from PDVSA to Iran that violated US sanctions. Rodil left the IMF to partner with him. A year later both travelled to Israel and spent two days answering questions from the secret service at the intelligence offices of Glilot Junction. Out of that meeting came Global Resources Solutions, a financial intelligence firm that connected them to Roger Noriega, a former deputy secretary of state under George W. Bush and one of the most consistent voices of American interventionism against the continent’s left-wing governments. Noriega acknowledged knowing Hanan when the Forbidden Stories consortium contacted him, while insisting he had had no serious business with him in years.
That origin matters because it explains the kind of client Hanan already knew how to serve long before he became Jorge.
The corporate vehicle behind much of that work is called Demoman International, a security company registered since 1999 on the Israeli Ministry of Defence’s site promoting military exports. Around Hanan worked a small circle of former intelligence officers, his brother Zohar as the company’s chief executive, Mashi Meidan, an Israeli government employee until 2006, and Shuki Friedman, a former officer of the domestic intelligence service who, according to one repeated legend in the trade, once recruited the son of a Hamas leader as an informant. Meidan’s lawyers later denied, when the journalistic consortium asked, that their client had ever been a partner in an entity called Team Jorge, while acknowledging his presence at the meetings where the services were presented.
By the time Hanan finally set up Team Jorge, the product had matured. His software, Advanced Impact Media Solutions, could generate a complete fake profile in seconds, nationality, gender, photograph, email history, and multiply it up to thirty thousand times. During the meeting filmed in Modiin in December 2022, Hanan calmly explained how credibility is built before manipulation, first you create trust, then you manipulate. He demonstrated live access to a Kenyan election official’s Gmail account and the ability to post messages from the Telegram account of an aide close to William Ruto. None of this stayed at the level of a sales pitch, all of it was filmed.
Hanan told the undercover journalists he had intervened in thirty-three presidential campaigns worldwide, twenty-seven of them with a successful outcome for whoever paid. The figure comes solely from his own statement and has never been fully verified by an independent source.
The scale of the business did not rest on Hanan’s word alone. Days after the journalistic consortium shared a sample of the fake accounts generated by Advanced Impact Media Solutions with Meta, the company that owns Facebook and Instagram took down the batch and linked it to another set of accounts tied, since 2019, to a different Israeli firm already banned from the platform for identical practices. The overlap suggested something wider than a lone operator, a technique shared across several companies within the same Israeli professional milieu, where former intelligence officers rotate between commercial influence projects with no public record of who works for whom at any given time.
The craft becomes an industry
What distinguishes Team Jorge from what came after is not ambition but artisanal scale. Hanan negotiated in person, charged between six and fifteen million euros per campaign by his own admission, and left witnesses, colleagues present at meetings, physical offices, a face that ended up photographed. It was a private reputation business within a closed circle of clients who knew each other, some linked to Cambridge Analytica as early as 2014, when Alexander Nix asked in an internal email what the surname was of that mysterious Jorge from the Israeli black-ops firm. Brittany Kaiser, the whistleblower who later exposed the wider Cambridge Analytica scandal, answered the next day, Tal Hanan is CEO of Demoman International. That single reply was the thread investigators eventually pulled to unravel two decades of careful anonymity.
Hanan also leaned on tools he did not build himself. During live demonstrations for the undercover reporters he showed products from TA9, a subsidiary of the Israeli firm Rayzone, though he had erased its logo from the screen before presenting it as his own. Contacted afterwards, TA9 denied ever doing business with Hanan or his associates, and noted that the same product screenshots were already public on its own marketing pages. The borrowing mattered less as fraud than as habit, a business built on presenting other people’s capabilities as a seamless part of one unified, faceless service.
The method of denial, however, had already been rehearsed before BlackCore existed. OCCRP investigators found evidence suggesting Hanan was behind forged bank documents implicating Serbian opposition figure Dragan Đilas in an alleged hidden fortune in Mauritius and Switzerland, a report whose December 2020 metadata matched almost exactly a service Hanan himself called, in his meetings with the undercover journalists, a global bank scan. Đilas had suspected the origin of those accusations for years without being able to prove it, and his lawsuit against the journalists who published them was dismissed by Serbian courts. No one ever claimed responsibility for fabricating those documents, and that absence of a claim, that deliberate void where a signature should be, is precisely what Hanan’s business later turned into architecture.
That business no longer exists in its original form of a visible man and an identifiable office. What came after has no face, and no colleagues willing to pose for a camera.
Three years after that exposure, the same kind of service resurfaced in France under an entirely different architecture. There is an entity called BlackCore that never appeared in the Israeli commercial registry, whose domain was created in August 2025, just months before the municipal campaigns began, and which presented itself, on a site now gone, as an elite company specialising in influence, cyber and technology for the modern era of information warfare.
The trail they failed to erase in time
In March 2026, three La France Insoumise candidates in Marseille, Toulouse and Roubaix were targeted by a digital smear campaign. Sébastien Delogu was accused of rape by a supposed blogger named Sophie, whose identity never existed outside the accounts that sustained her. AI-generated nude photographs circulated. Viginum, the French agency that monitors foreign digital interference, traced the technical footprint to a London server shared between March 2025 and May 2026 by subdomains of BlackCore and two other entities, Omrisystems and Electric Marinade.
Before targeting the three French candidates, the same infrastructure had operated under a different disguise. A site called Sadaqah Palestine presented itself as a non-political humanitarian organisation collecting donations for displaced Palestinians, with an active payment form and accounts on Instagram, Facebook and X showing engagement patterns investigators later recognised as artificial, the same avatars, the same posting style, the same operators behind the humanitarian mask who would later be used to destroy political reputations. Elsewhere on that same infrastructure appeared a Portuguese-language subdomain called angola-plan, advertising a training programme for an Angolan government campaign dated February 2026, complete with a three-month editorial calendar and Meta and TikTok ad spend, evidence that the same toolkit was being offered both to sink opposition candidates and to prop up sitting governments.
A joint investigation by Libération and Haaretz traced that server to two companies registered at the same Tel Aviv address on HaHashmonaim Street, Galacticos Ltd and SNI Digital. Both are directed by Doron Afik, a business lawyer. Within the technical orbit sit Guy Geyor, a former reality television contestant turned tech entrepreneur, and Nir Benita, a former officer in Unit 8200, the Israeli army’s signals intelligence branch. All denied knowing BlackCore when the two papers contacted them on 13 May. Less than two hours after those calls, the entire digital infrastructure linked to Galacticos and BlackCore went offline, the website, the LinkedIn profile, the subdomains, all vanished in the same motion, as if an emergency protocol had already been written before the question arrived.
Viginum later confirmed the same operating pattern was not limited to the French municipals. The French agency said it suspected similar operations in Angola, in Togo, in the Scottish elections and in the 2025 New York City municipal election. No government, not even Israel’s, has yet managed to establish who commissioned and paid for the campaign against the French candidates.
According to its own marketing material, recovered by Haaretz and Libération before the site vanished, BlackCore offered the deployment of sixteen hundred avatars capable of infiltrating Facebook groups, shifting trends on TikTok and skewing polls on Instagram, as part of a political campaign management package.
What this market sells today is the suspicion itself
Team Jorge had a face because in 2022 it was still profitable to have one, the seller’s credibility was part of the product. BlackCore built exactly the opposite, an architecture of instant denial built into the design of the service itself, active before the accusation even exists. When the defence mechanism precedes the attack, the question of whether a specific operation took place in a specific country stops being the most useful one.
The useful question is what this market does with the mere rumour of its own existence. Any close election anywhere in the world is now, by definition, a scenario where an accusation of foreign interference becomes instantly credible, whether or not a real intervention took place. That does not free whoever loses from the burden of proving what they allege, nor does it turn every suspicion into truth. But it does mean the industry Hanan founded achieved something more lasting than any of its contracts, it made it structurally plausible that no contested election can, strictly speaking, be declared clean with absolute certainty. That is the final product, not the isolated, verifiable manipulation of a specific result, but the lasting, almost permanent impossibility of ever fully ruling it out…
G.S.
Sources
- “Team Jorge”: In the heart of a global disinformation machine, Forbidden Stories
- Exposé unmasks Israel-led disinformation team, Times of Israel
- Israeli Disinformation Expert Linked to Faked Bank Accounts in Serbian Smear Campaign, OCCRP
- Why Witnesses to Venezuela’s Catastrophic Corruption Keep Turning Up in the U.S., Bloomberg Businessweek
- Israeli firm BlackCore meddled in US and Scottish elections, French watchdog says, Middle East Eye
- Israeli Firm BlackCore Suspected of Meddling in NYC, Scotland Elections, Haaretz
- Ingérence lors des municipales, de BlackCore à Tel-Aviv, France 3 Occitanie
- Candidats LFI dénigrés lors des municipales, Yahoo Actualités France
- Wired for war, the Israeli spy-tech machine strikes again, RT World News
