CyberNew CyberNew
Threat Intelligence & APT The Record 4 weeks ago

Israeli contractor BlackCore trained Angolan officials in online influence operations

CN
CyberNew Threat Research Desk
• Original Reporting: The Record
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Angolan President João Lourenço addresses parliament on October 15, 2025. Credit: parlamento.ao Israeli contractor BlackCore trained Angolan officials in online influence operations An Israeli influence-for-hire company appears to have trained Angolan government officials to run online influence operations, including creating fake social media personas and producing content designed to promote..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Angola president
Angolan President João Lourenço addresses parliament on October 15, 2025. Credit: parlamento.ao

Israeli contractor BlackCore trained Angolan officials in online influence operations

An Israeli influence-for-hire company appears to have trained Angolan government officials to run online influence operations, including creating fake social media personas and producing content designed to promote the government, according to new research.

The company, BlackCore, described itself online as “an elite influence, cyber, and technology firm built for the modern era of information warfare.” Documents obtained by researchers at the University of Toronto's Citizen Lab show BlackCore initially advertised the Angola project as an intensive four-week course covering storytelling, copywriting, traffic management and social media operations. It ultimately lasted 14 weeks and involved both training and practical operations, a final report showed.

Participants produced more than 40 pieces of content, while trainers evaluated at least 24 publications. The program also included Facebook and Instagram advertising and a TikTok campaign.

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from The Record.

Primary Advisory →