A recent, in-depth analysis of online conversations surrounding Operation Epic Fury revealed a startling truth: much of the immediate backlash and anti-Israel sentiment wasn't homegrown. Instead, a significant portion originated from accounts operating outside the United States, skillfully disguised as American voices.
The research pinpointed recurring narratives deliberately pushed by these foreign-based accounts. These included claims that the operation represented a “betrayal of MAGA” supporters, was “highly unpopular” with the American public, and was undertaken “on behalf of Israel.” The messaging was designed to sow discord and misrepresent public opinion.
A staggering sixty percent of the most widely shared posts on X mentioning “Iran” during the operation’s first week came from accounts located outside the U.S. These accounts, despite their foreign origins, expertly mimicked American political discourse, making detection incredibly difficult for the average user.
The analysis focused on 100 highly viral posts – each exceeding 10,000 shares – between February 28th and March 7th. The sheer volume of activity was immense: 98 million posts, 696.4 million interactions, and an estimated 1.5 trillion potential views, marking it as one of the largest online information events ever recorded.
Foreign accounts alone generated 155.6 million views, significantly outpacing the 93.4 million views from U.S.-based accounts – a difference of over 60 million views within the analyzed sample. This disparity highlights the scale of the foreign influence campaign.
The data revealed a stark contrast in sentiment. Every single post originating from a foreign-based account expressed negativity towards the operation, while all supportive content came exclusively from users within the United States. This pattern strongly suggests a coordinated effort to undermine the operation’s perception.
Cyber threat experts note that a substantial portion of this activity is specifically targeted at Israel, combining disruptive tactics with carefully crafted messaging. This includes doxing campaigns and the proliferation of AI-generated videos designed to manipulate the information landscape.
Distinguishing genuine cyber incidents from exaggerated claims made by hacktivist groups seeking attention presents a significant challenge. Many online assertions lack verifiable evidence and are intended to amplify the perception of disruption.
Researchers emphasize that the scale, consistency, and geographic distribution of the messaging point to a deliberate, coordinated campaign rather than spontaneous global debate. The operation appears to be a calculated attempt to influence public opinion.
This online narrative campaign is unfolding alongside broader activity from pro-Iranian and aligned groups across the digital sphere. A prominent group, Handala, linked to Iran, has claimed responsibility for attacks targeting both U.S. and Israeli entities.
Seven of the top ten most influential accounts driving engagement were based outside the United States, with connections to Russia, the United Arab Emirates, the United Kingdom, and South Asia. This demonstrates the widespread international involvement in the campaign.
U.S. authorities and cybersecurity firms have directly linked Handala to Iran’s Ministry of Intelligence and Security, identifying it as part of a larger strategy that integrates cyberattacks with psychological and information warfare.
Handala is part of a wider network of Iran-aligned and pro-Russian hacktivist groups that have mobilized since the start of the conflict, seamlessly blending disruptive cyber activity with online narrative manipulation. The groups work in concert to achieve their objectives.
