Welcome to SOCRadar’s Operation Epic Fury First Month Cyber Threat Assessment Report!

The first month of Operation Epic Fury revealed how quickly cyber operations can scale into a sustained, multi-layered campaign alongside kinetic conflict. What began as an immediate wave of disruption rapidly evolved into coordinated, cross-border activity involving hacktivist coalitions, state-aligned actors, ransomware operators, and reconnaissance-driven targeting. Over the course of a single month, the cyber dimension expanded across regions, sectors, and attack types, reflecting a shift from short-term disruption to structured and persistent operations.

Download the full report today to gain a comprehensive view of the cyber risks emerging from Operation Epic Fury and understand how the threat landscape evolved over its first month.

Key Insights from Operation Epic Fury Month 1 Cyber Activity

• Cyber Activity Scaled Rapidly and Persisted: 1,357 verified incidents were recorded over 32 days, averaging more than 40 incidents per day.
• DDoS Dominated the Threat Landscape: 82.9% of all activity consisted of DDoS attacks, confirming their role as the primary disruption method.
• Israel Was the Central Target: 516 incidents, representing 38% of total activity, were directed at Israel, far exceeding any other country.
• Regional Spillover Was Immediate and Sustained: Kuwait (133), Bahrain (76), UAE (58), Jordan (46), and Qatar (41) were heavily targeted due to their regional alignment.
• Geographic Expansion Extended Globally: By Week 4, the conflict reached five continents, introducing new targets including Uganda, Denmark, Italy, and Indonesia.
• Government and Critical Sectors Faced Highest Risk: Government (426 incidents), Defense (116), Financial Services (115), and Energy sectors were among the most targeted.
• Hacktivist Coalitions Drove Most Activity: Over 40 attack groups participated, with more than 70 pro-Iran aligned groups forming coordinated operations.
• Reconnaissance Emerged as a New Phase: 63 reconnaissance incidents appeared mostly in Weeks 3 and 4, signaling a shift toward structured targeting and pre-attack intelligence gathering.
• OT/ICS Targeting Signaled Escalation: 20 intrusion claims were recorded, including confirmed attempts against critical infrastructure systems.
• Destructive and Advanced Attacks Appeared: Wiper attacks and APT-linked operations demonstrated a move beyond disruption toward long-term impact.

Why This Report Matters

The first month of Operation Epic Fury highlights how cyber conflict evolves from immediate disruption into coordinated, persistent operations involving multiple actor types and attack methods. The combination of large-scale DDoS activity, reconnaissance targeting, infrastructure-focused attacks, and global geographic expansion shows that cyber campaigns are no longer confined to the initial conflict zone.

Organizations must prepare for sustained activity rather than short-lived spikes, with risks extending beyond service disruption to include data exposure, infrastructure targeting, and coordinated multi-vector campaigns.

Take Action Now

• Monitor Conflict-Driven Threat Activity: Track hacktivist groups, APT actors, and evolving coalitions
• Strengthen DDoS Resilience: Protect public-facing services and critical infrastructure
• Expand Visibility Across Regions: Prepare for spillover effects beyond immediate conflict zones
• Prioritize Critical Sector Defense: Focus on government, energy, financial, and transportation systems
• Detect Early-Stage Reconnaissance: Identify targeting activity before attacks escalate
• Prepare for Multi-Vector Campaigns: Align defenses against combined disruption, intrusion, and influence operations