Welcome to SOCRadar’s Operation Epic Fury Week 3 Cyber Threat Assessment Report!

The third week of Operation Epic Fury marked a shift from sustained disruption toward more complex and coordinated cyber activity. While high-volume DDoS campaigns remained active, Week 3 introduced a broader mix of attack types, increased coordination among hacktivist groups, and more persistent claims targeting critical infrastructure. The pace of operations showed no signs of slowing, with threat actors refining their tactics and expanding their geographic and sectoral focus.

Download the full report today to gain deeper insight into evolving cyber tactics, active threat actors, and the expanding risk landscape shaped by Operation Epic Fury.

Key Insights from Operation Epic Fury Week 3 Cyber Activity

• Attack Volume Remained Consistent: Week 3 recorded over 480 cyber incidents, indicating continued operational intensity despite slight stabilization compared to previous weeks.
• DDoS Still Led, but Diversification Increased: While DDoS accounted for around 60–65% of attacks, defacement campaigns, data leak claims, and access disclosures became more visible.
• Israel Continued as Primary Target: Israel remained the most targeted country, though its share slightly decreased as attacks spread more evenly across the region.
• Regional Targeting Broadened: Increased activity targeted Saudi Arabia, UAE, Jordan, and Egypt, showing wider regional engagement beyond initial hotspots.
• Critical Infrastructure Targeting Persisted: Energy, transportation, and public service sectors continued to face both disruption attempts and claimed intrusions.
• Hacktivist Coordination Became More Structured: Groups showed improved synchronization, including shared target lists, coordinated timing, and cross-platform amplification.
• International Participation Continued: Russian-aligned and other foreign hacktivist actors remained active, reinforcing the global dimension of the campaign.
• Data Leak and Access Claims Increased: More groups claimed unauthorized access to systems or data, though verification levels varied across incidents.
• Psychological and Information Operations Expanded: Messaging campaigns, propaganda, and influence operations became more prominent alongside technical attacks.

Why This Report Matters

Week 3 highlights how cyber campaigns mature over time. What began as high-volume disruption evolved into more layered operations combining DDoS, defacement, access claims, and coordinated messaging. This shift increases uncertainty for defenders, as organizations must now prepare not only for service outages but also for potential data exposure, reputational risks, and targeted intrusion attempts.

Take Action Now

• Expand Threat Visibility: Monitor both disruption campaigns and emerging intrusion-related indicators.
• Prioritize Critical Services: Ensure resilience for systems tied to energy, transportation, and public services.
• Track Actor Coordination: Follow evolving alliances and shared infrastructure used by hacktivist groups.
• Strengthen Detection Capabilities: Look beyond DDoS to identify early signs of unauthorized access or data staging.
• Prepare for Multi-Vector Attacks: Align defenses against combined campaigns involving disruption, data leaks, and information operations.