Israeli Intelligence Agents in Slovenia

On Monday, December 22, 2025, an Israeli private Hawker 800XP aircraft with registration number 4X-CNZ landed at the VIP terminal of Ljubljana’s Jože Pučnik Airport. The Hawker 800 is a midsize business jet with a range of 4,700 kilometers and seating for up to nine passengers. The aircraft that landed at Brnik in December is operated by Arrow Aviation Ltd. of Tel Aviv, one of Israel’s leading private jet operators for VIP transport, diplomatic missions, and special operations for government and private clients.

This aircraft regularly flies between Tel Aviv and European cities. This is an aircraft that transports influential people, with an average charter cost exceeding 20,000 euros per flight. However, in recent months, the Slovenian capital has been one of this aircraft’s regular destinations. Between last November and this February, for example, it landed in Paris only once, but in Ljubljana as many as three times. The first time was on November 24, 2025, then on December 22, 2025, and most recently last month, on February 17.

It is not known who arrived on this aircraft in November and February, but we were able to determine who came to Slovenia on December 22 of last year. According to data from the Flightradar24 tracker, which tracks flights worldwide, the aircraft in question took off from Tel Aviv on December 22 of last year and landed in Ljubljana around 10:30 a.m. However, it did not depart again but remained parked at the airport. According to our information, there were four passengers from Israel on the plane, who then went to Ljubljana. More specifically, to 8 Trstenjakova Street, where the SDS party is headquartered.

The visitors stayed in Ljubljana for about two hours. Around 1:20 p.m., the plane had already departed for Rome. However, only three of the four passengers flew with it; one remained in Ljubljana. Based on flight data, testimonies from sources who must remain anonymous, and publicly available information, we were able to identify two of the four passengers.

The first, with whom, according to this information, Janša met on the morning of December 22, 2025, at the SDS headquarters, was Dan Zorella, co-founder and CEO of one of the largest private intelligence agencies; this is the Israeli company Black Cube. The second was retired Major General Giora Eiland, former head of Israel’s National Security Council and a long-time advisor to this private intelligence agency.

Who are these two men, and what were they doing in Ljubljana? Zorella founded Black Cube in 2010 together with Avi Yanus; both founders were previously officers in the Israeli Defense Forces. Black Cube has offices in Tel Aviv, London, and Madrid and, according to its own statements, operates in more than 75 countries. While it presents itself as an organization that gathers evidence for international legal disputes, it has in fact—as documented—carried out some of the most controversial intelligence operations to date. One of its most controversial campaigns was for film producer Harvey Weinstein, during which operatives, using false identities, followed women who had accused him of sexual harassment and filmed them in order to discredit them as witnesses in criminal proceedings; They also followed journalists and representatives of the women who had been harassed.

Their operations in Hungary are significant for Slovenia. From December 2017 to March 2018, Black Cube operatives, using false identities, established contacts with leading representatives of Hungarian non-governmental organizations, lured them to meetings under the pretext of business opportunities, and secretly recorded them. The recordings, which appeared in the media three weeks before the election, became a central element of Orbán’s 2017 campaign. Black Cube has denied any involvement. However, it carried out a similar operation ahead of the Hungarian elections in April 2022. At that time, using a network of fake LinkedIn profiles and job offers via video calls, it lured at least 12 journalists and activists who had criticized Orbán, and the recordings subsequently appeared in pro-Orbán media ahead of the election.

In this case, Black Cube was also exposed: LinkedIn confirmed in November 2022 that the company was responsible for the operation; consequently, it removed all fake profiles and the company’s corporate page from the platform. According to Hungarian journalists, similar attempts were reportedly made in Hungary even before these elections, but the public there is already resistant to such methods.

Black Cube carried out a similar operation ahead of the Hungarian elections in April 2022. At that time, it lured at least 12 journalists and activists with a network of fake LinkedIn profiles and job offers via video calls.

Over the past decade, Black Cube has carried out several more such operations, all following a similar pattern: they use fake companies, typically based in the UK or Western Europe. Websites, LinkedIn profiles, and phone numbers disappear once the operation is complete. When direct access to the primary target is not possible, agents make contact with family members or other associates. In all documented political operations, recordings or compromising material are published two to three weeks before a critical date—a court ruling or an election. All material is distributed anonymously: the material reaches the media via anonymous websites or ownerless domains, typically in English. Black Cube also never reveals who the client is.

Black Cube presents itself as a private intelligence agency with no ties to the Israeli government, but the collaboration between Zorello and Eiland is what raises legitimate doubts. Both men, who arrived in Ljubljana in December, reportedly attended a meeting in July 2024 with Israeli Minister of Diaspora Affairs Amihai Chikli, where they discussed covert operations abroad. More specifically: they are said to have discussed carrying out an intelligence operation—one that could not be attributed to the State of Israel—against the organization Students for Justice in Palestine (SJP). This is an American organization that organized protests against Israel’s genocidal policies at American universities.

Over the past decade, Black Cube has carried out several such operations, all following a similar pattern: it uses shell companies, typically based in the UK or Western Europe.

We are now seeing the same pattern of operations carried out by Black Cube in these cases in Slovenia as well. Ten days before the elections, covertly recorded videos of prominent individuals appeared online here. They were published on the website anti-corruption2026.com, which lists no owners, editor, or contact information. The site is in English, not Slovenian. It features recordings secretly made during business meetings.

The first of the victims, former Minister of Justice Dominika Švarc Pipan, explained the circumstances surrounding the creation of the recordings: she was contacted by the alleged British investment fund Stockard Capital, which claimed it wanted to invest in data centers in

the region and was interested in GEN-I. She met with its representatives twice: in February and on March 5, 2026, in Vienna. The company covered her airfare and accommodation costs. After the meeting, during which she was secretly recorded, all publicly available information about the fund disappeared.

The operation, through which Harvey Weinstein sought to discredit the women who had accused him of sexual harassment, reportedly cost up to $1.3 million under the contract. Black Cube’s operation against Laura Codruța Kövesi, head of Romania’s anti-corruption office, in 2016 cost 900,000 British pounds, while the smear campaign against a Canadian judge in 2017 is said to have been worth as much as 11 million US dollars.

***

What is Black Cube?
A company some call the Private Mossad

In 2010, former Israeli military officers Dan Zorella and Avi Yanus founded a company in Tel Aviv that became publicly known as Black Cube. Their business model was simple: leverage intelligence skills linked to the Israeli intelligence community and offer them commercially to corporations, wealthy clients in legal disputes, and other clients seeking an edge in high-stakes disputes. Publicly available sources describe Black Cube as a group of veterans from elite Israeli intelligence units specializing in complex business and legal matters. According to its own statements, the company has operated in more than 75 countries and handled hundreds of cases.

From the very beginning, Black Cube’s public positioning has largely been based on the reputation of the Israeli security apparatus.

Its advisory board included former Mossad directors and other high-ranking Israeli and international security officials. Meir Dagan, who led the Mossad from 2002 to 2011, served as chairman of Black Cube until his death in 2016. Efraim Halevy, another former director of the Mossad, also served on the board of directors. The list of current public advisors includes former Israeli Police Commissioner Yohanan Danino and Major General Giora Eiland, the former head of Israel’s National Security Council and a central figure in Israeli national security planning.

Link to the Israeli government

Although Black Cube publicly presents itself as a private intelligence firm providing services to commercial clients, reports have documented direct links to the Israeli state. In 2019, Haaretz reported that the Israeli Ministry of Defense had entered into a contract with Black Cube between 2012 and 2014, and that its employees worked full-time at an intelligence base of the Israeli Defense Forces (IDF) during that period. A spokesperson for the IDF and a spokesperson for the Ministry of Defense confirmed this arrangement but declined to disclose the nature of the work or the amount paid for it.

In the same report, published in the newspaper Haaretz, Black Cube also appeared in a separate domestic political context: Israeli tycoon Idan Ofer reportedly hired the firm to gather intelligence on Israeli politicians and senior officials. This reporting is significant because it places the company not only in the context of cross-border business and legal work, but also in the sensitive realm of Israeli politics and government (The Times of Israel). A recent report in the daily TheMarker suggests that the company’s significance to Israeli official circles extends beyond its former ties to the Ministry of Defense. In 2024, Minister Amichai Chikli reportedly discussed with Black Cube the possibility of an intelligence operation targeting the organizationStudents for Justice in Palestinein the United States. According to the report, the operation was never carried out, and the parties made conflicting statements regarding whether the idea originated from the ministry or from Black Cube. The report also notes that Giora Eiland attended the meeting.

The composition of the company’s advisory board confirms how heavily Black Cube relied on the legitimacy of former state security services. This in itself does not prove that the company is state-directed. However, it does indicate that it consistently promoted itself based on the credibility, reputation, and networks of former high-ranking officials from the intelligence services, police, and national security.

How Black Cube Operates

Cases in which the company has been involved show that its operatives approach targets using false identities, front companies, plausible excuses, and covert recordings. Depending on the case, agents have posed as filmmakers, journalists, businesspeople, HR staff, activists, or intermediaries. The goal is usually not merely to gather information, but to shape a legal or political outcome for a client.

It appears that some operations required extensive preparation, including the use of fake digital identities, corporate cover stories, and persistent efforts to gain trust before establishing contact. At least in some documented contracts, fees were tied to results—including the suppression of damaging stories or the improvement of a client’s legal position in a lawsuit. Black Cube claims to operate in accordance with legal advice in the relevant jurisdictions, but several courts and public authorities have found that some operations were inappropriate or illegal.

***

FALSE IDENTITIES, FICTITIOUS COMPANIES, COVERT RECORDING, AND PUBLICATION JUST BEFORE THE ELECTIONS.
BELOW: OPERATIONS BY THE ISRAELI PRIVATE INTELLIGENCE AGENCY BLACK CUBE DOCUMENTED TO DATE
2015 – NIGERIA: ELECTION INTERFERENCE

In 2015, a tense presidential race took place in Nigeria between then-President Goodluck Jonathan and opposition candidate Muhammadu Buhari. Jonathan’s campaign was led by Cambridge Analytica, which reportedly also hired Black Cube for election purposes.

According to whistleblower Christopher Wylie—one of the key internal sources at Cambridge Analytica—Black Cube hacked into Buhari’s medical and financial records.

The aim was to gather compromising material on the opposition candidate that could be used to discredit him during the campaign. Wylie revealed this to British lawmakers, though Black Cube denied the allegations. Buhari nevertheless won the election, and Jonathan experienced one of the rare peaceful transfers of power in Nigeria’s history. This case is significant for two reasons: first, it marks the first time Black Cube has been linked to illegal activities, such as the misuse of personal data. And second, it suggests that the agency is not only involved in activities related to corporate and legal disputes, but was also willing to interfere in democratic electoral processes.

2016 – Romania: Attack on an Anti-Corruption Prosecutor

In Romania, Black Cube was hired to target Laura Codruța Kövesi, who at the time headed Romania’s National Anti-Corruption Directorate (DNA) and oversaw investigations into influential politicians. The client was Daniel Dragomir, a former officer of the Romanian intelligence service SRI. Agents harassed her with threatening calls and attempted to hack into Kövesi’s email account via phishing. Two employees were later arrested in Bucharest. During questioning by Israeli investigators, Zorella admitted that he had personally ordered the employees to hack into the email account to find compromising material. Zorella and the others later agreed to a 35-month suspended sentence. The court convicted them of forming a criminal organization, illegal access to a computer system, unauthorized data transfer, computer forgery, and violation of the secrecy of correspondence. Laura Codruța Kövesi is currently the head of the European Public Prosecutor’s Office (EPPO).

2016–2017 – Harvey Weinstein: Surveillance of Plaintiffs and Journalists

In July 2016, Harvey Weinstein signed a $1.3 million contract with Black Cube, in which he explicitly stated that he wanted to prevent allegations of his sexual harassment of multiple women from becoming public. Over the course of a year, agents gathered data for personal profiles on dozens of individuals, including details about their sexual histories. Key agent Stella Penn Pechanac introduced herself to actress Rose McGowan as a women’s rights advocate at the London-based investment firm Reuben Capital Partners.

The company did not exist; its headquarters were located at the address of an office space rental firm. Upon the revelation, The New Yorker published a report titled “Harvey’s Army of Spies.” Black Cube subsequently issued an apology. The case became the basis for Ronan Farrow’s book *Catch and Kill*.

2017 – Canada: Attempt to Discredit a Judge

Black Cube agents, using false identities, made contact with a judge in Canada and attempted to provoke him into making anti-Semitic statements, which they would secretly record. The aim was to discredit the judge and influence the course of the legal proceedings. An Ontario court documented and condemned the operation—this is one of the rare instances where a court explicitly criticized Black Cube’s methodology.

2017–2018 – Iran Nuclear Deal: Attacks on the Families of Former U.S. Officials

Following President Trump’s visit to Israel in 2017, Black Cube agents reportedly contacted relatives of former Obama administration officials Ben Rhodes and Colin Kahl, posing as documentary filmmakers. The New Yorker reported that detailed dossiers had been compiled on the officials and their relatives. The client behind the operation was never publicly disclosed. Black Cube denied acting on behalf of the Trump administration or in connection with the Iran nuclear deal, but this episode demonstrated the company’s willingness to operate in the politically explosive realm of U.S. national security.

2018 – Hungary: Attacks on Civil Society Ahead of the Elections

This is Black Cube’s best-documented political operation; moreover, it is nearly identical to the operation that is apparently underway in Slovenia right now. Black Cube denied involvement, but it was clear from the course of the operation that it had organized it. From December 2017 to March 2018, agents using false identities secretly recorded NGO officials—whom their clients had identified as Soros allies—during meetings in hotels and restaurants in Budapest, Vienna, Amsterdam, London, and New York. The companies represented by the agents did not exist. LinkedIn profiles and websites were deleted immediately after the meetings. Most phone numbers were disconnected in the weeks following the meetings. The recordings began appearing in the media three weeks before the election, in the Israeli daily Jerusalem Post and the Hungarian government-affiliated daily Magyar Idők. Prime Minister Orbán, of course, immediately used them in his campaign.

BETWEEN 2020–2022, Hungary – A Repeat Before the 2022 Elections, a Network on LinkedIn

Ahead of the April 2022 elections, Black Cube repeated the pattern from 2018. This time, using a network of fake LinkedIn profiles and job offers, it lured at least 12 journalists and activists who had criticized Orbán into video calls. The recordings appeared in pro-Orbán media ahead of the election. Microsoft, or rather LinkedIn, confirmed in November 2022 that Black Cube was responsible for the operation. LinkedIn subsequently removed all the fake profiles and the company’s entire corporate page. The pattern of fake companies was identical to what we are now seeing in Slovenia: Wilson Energy Consultants had a functioning website that became inaccessible after the operation ended, and its English phone number was redirected to the customer service line of the Sky television channel.