Security1 publisher2 min readPublished
Citizen Lab documents a 14-week fake-persona curriculum delivered to Angolan officials
Files obtained by the researchers show BlackCore grading more than 40 pieces of content produced by its trainees. The contractor's final report to the client claims deceptive Facebook posts approaching 50,000 likes in a country with six million active Facebook users.
The Watch · Security desk
What happened
- Citizen Lab obtained documents indicating that BlackCore, an Israeli influence-for-hire company, trained Angolan government officials to create fake social media personas and content promoting the government.
- At the center of the operation was a Facebook page for a fictitious media outlet called Agita News, which published its own material and linked to an external website; both are now offline.
- BlackCore's marketing offered clients hundreds of fake personas it called avatars across Facebook, Instagram and TikTok, along with coordinated message flooding and countering unwanted narratives.
- Citizen Lab could not independently confirm the training happened or identify which officials took part, but called it highly likely that the program ran as BlackCore's documents described.
- France's Viginum said in June that an operation against the France Unbowed party during municipal elections had technical links to Israeli actors including BlackCore.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability The assignments were graded, so officials who produced more than 40 pieces of content under trainer review can keep writing and posting once the trainer is gone.
- constraint Platform enforcement that clusters on a single contractor's infrastructure and origin country gets harder when the operators are government staff working from their own accounts.
- contradiction Citizen Lab presents the case as a government acquiring ready-made capability, while Meta's and Viginum's findings describe BlackCore running influence networks itself.
- precedent A pitch selling a "professional, robust, and scalable" government communications system can be sold again to the next client.
The pitch was an intensive four-week course in storytelling, copywriting, traffic management and social media operations [3]. What the final report describes is 14 weeks of training with practical operations attached [4], three and a half times the advertised length [1]. Participants turned out more than 40 pieces of content and trainers evaluated at least 24 publications [5], roughly three pieces a week [2]. Facebook and Instagram advertising and a TikTok campaign ran alongside the coursework [6].
BlackCore described itself online as "an elite influence, cyber, and technology firm built for the modern era of information warfare" [2]. Its Angola proposal promised what it called a "professional, robust, and scalable" system for government communications [21]. Citizen Lab senior researcher Alberto Fittarelli said the intention was to promote what BlackCore called "positive government campaigns". That included narratives intended to portray the Angolan government "in a positive light," rather than merely attacking government opponents [7].
The engagement figures come from the contractor's own final report. Screenshots showed some deceptive Facebook posts receiving roughly 20,000 likes [10]. Citizen Lab said some posts that remained accessible later approached 50,000, "substantial amounts in a country with an estimated six million active Facebook users" [11]. Fifty thousand likes is about 0.8 percent of that estimated user base [3], and likes are not unique accounts. The researchers said measuring whether an influence operation actually changed public opinion is difficult, and that BlackCore appeared eager to show its Angola work was generating attention [22].
Meta said in an August threat report that it had disrupted a coordinated network originating in Israel that targeted audiences in Angola and several other countries. Citizen Lab said the network was highly likely operated by BlackCore [19]. Viginum has also said BlackCore is suspected of interference activity aimed at elections or political audiences in New York, Scotland, Angola and Togo [18]. On the French case, authorities said they could not determine who commissioned the operation [17]. Citizen Lab said the Angola case shows how governments can increasingly acquire ready-made infrastructure and expertise for covert online influence campaigns from private contractors [20].
Citizen Lab's researchers told Recorded Future News they found no evidence detailing how BlackCore was hired, whether the Angolan government paid the company directly, or how much it cost [13]. The trainings likely began in February, and the company's websites and social media accounts have since been taken offline [14]. Citizen Lab was unable to find a recent contact point for the company, and the Angolan government did not respond to Recorded Future News [15].
What to watch
- Whether Meta or TikTok attributes any Angolan accounts active since February to a government actor.
- Any procurement record, invoice or contract naming who paid BlackCore for the Angola program and what it cost.
- Viginum follow-up on the suspected BlackCore activity aimed at New York, Scotland and Togo.