Team Jorge

Undercover reporters recorded a group of covert cyber influence specialists as they pitched their services, which involve using disinformation campaigns, false intelligence, hacks and blackmail to promote their clients’ interests. The group, which calls itself Team Jorge, claims to have worked on dozens of presidential elections around the world and charges multimillion dollar fees. Their companies are under investigation for arranging fictitious marriages, falsifying documents to smuggle babies out of Ukraine, and trading children for profit. A Spanish reputation management company’s ‘blackhat tactics’ help bad actors around the world erase their past. Across the globe, shadowy groups of cyber mercenaries have been harnessing digital technology to hack elections, employing their dark arts for anyone willing to pay a hefty fee to subvert democracy. Exposing its secret strategies to the world for the first time, one group of Israeli disinformation experts pitched its services to journalists posing as potential clients interested in disrupting an African election. Their tactics include hacking, forging blackmail material, spreading disinformation, planting false intelligence, physically disrupting elections, and deploying targeted social media campaigns. Reporters were able to verify that some of those tactics were used. Team Jorge appears to have acquired unauthorized access to Telegram and Gmail accounts of highly-placed officials, and deployed botnet social media campaigns. The evidence viewed by reporters suggests that the group meddled in at least two presidential elections. The going rate for a presidential campaign was 15 million euros, “Jorge” informed the undercover reporters, who posed as intermediaries for a prospective African client. For this short-term job – with only two months to spare – Team Jorge was willing to charge a minimum of 6 million euros. Reporters were told the money could easily be transferred through hidden means, perhaps using a French nongovernmental organization, a law firm in Dubai, or Islamic schools. The pseudonym –– a Spanish name that didn’t match his accent –– was part of an attempt to disguise his identity and location. The desktop screen of the computer he used in the presentation jumped between time zones, and showed a feed from a traffic camera in Lithuania. His contact numbers span the world: Indonesia, Ukraine, U.S. and Israel. Reporters eventually discovered that his real name is Tal Hanan, a self-described counter-terrorism expert who has been cited in the media as a cyber-security specialist. The undercover investigation led to a series of recorded meetings that allowed reporters to penetrate aspects of the disinformation-for-hire industry that are not openly advertised. In July and August 2022, the reporters posed as intermediaries, hinting at a client in Chad. The goal: delay the October election, perhaps indefinitely, to protect his economic interests. Though the election in Chad was indeed delayed for two years, it was not influenced by the undercover investigation – the journalists never contracted any services, and those conversations ceased in August. An additional in-person meeting with Team Jorge took place in Israel in December. The journalists who reported undercover are Gur Meggido (TheMarker), Frédéric Métézeau (Radio France), and Omer Benjakob (Haaretz). They were part of a collaborative investigation called Story Killers, which was coordinated by Forbidden Stories and involved more than 100 journalists from 30 media organizations including OCCRP. Forbidden Stories is an international consortium of investigative journalists that pursue the work of journalists who have been killed or work under threat. During one of the recorded Zoom presentations, Hanan displayed a screen with a Telegram account and clicked through the contacts and personal chats of Kenyan political advisor Dennis Itumbi. The live demo took place at the end of July 2022, at a critical p