Full Report
Days after the United States launched Operation Epic Fury, Chairman of the Joint Chiefs of Staff General Dan Caine described how U.S. Cyber Command had been “layering” cyber effects with space and other non-kinetic capabilities to disrupt Iranian communications and sensors. The remarks came weeks after President Donald Trump implied that U.S. forces used cyber effects to “turn out the lights” in support of the raid…
Analysis Summary
# Incident Report: Operation Epic Fury & U.S. Cyber-Kinetic Integration
## Executive Summary
U.S. Cyber Command conducted a series of offensive cyber operations in early 2026, most notably "Operation Epic Fury" against Iranian targets and a support mission in Venezuela. These operations utilized "layered" cyber effects integrated with space and non-kinetic capabilities to disrupt adversary communications, sensors, and power grids. While successful against mid-tier adversaries, the incidents highlight a critical need for deeper integration of cyber effects into standard joint military doctrine.
## Incident Details
- **Discovery Date:** Publicly acknowledged March 2026 (via Gen. Dan Caine)
- **Incident Date:** January – March 2026
- **Affected Organization:** Iranian Defense/Communications Infrastructure; Venezuelan Government (Maduro Administration)
- **Sector:** Government / Defense / Energy
- **Geography:** Iran and Venezuela
## Timeline of Events
### Initial Access
- **Date/Time:** Circa January 2026 (Venezuela) / March 2026 (Iran)
- **Vector:** Not explicitly disclosed; implied remote exploitation of critical infrastructure and communication nodes.
- **Details:** U.S. forces targeted Iranian sensors and communications systems simultaneously with space-based assets.
### Lateral Movement
- **Details:** The report indicates "layering" effects, suggesting movement across integrated military communication networks and industrial control systems (ICS) to achieve broad disruptive goals.
### Data Exfiltration/Impact
- **Impact:** In Venezuela, cyber effects were used to "turn out the lights" (power grid disruption) to facilitate a physical raid. In Iran, the primary impact was the disruption of tactical communications and early-warning sensors.
### Detection & Response
- **Discovery:** Publicly signaled by U.S. leadership (General Dan Caine and the Executive Branch) as a demonstration of capability.
- **Response Actions:** Adversaries attempted to maintain operational continuity, while the U.S. analyzed the "qualified success" to identify planning deficiencies.
## Attack Methodology
- **Initial Access:** Multi-vector (non-kinetic and cyber).
- **Persistence:** Postured for "persistent engagement" below the level of armed conflict.
- **Defense Evasion:** Layered effects combined with space capabilities to mask the specific origin and nature of the cyber strikes.
- **Impact:** Denial of Service (communications), disruption of critical infrastructure (grid), and degradation of sensor arrays.
## Impact Assessment
- **Financial:** Not disclosed; focus was on military/tactical advantage.
- **Data Breach:** Primary focus was disruption rather than theft; volume of data exfiltration is unknown.
- **Operational:** Significant disruption to Iranian military command and control; total blackout in localized Venezuelan sectors.
- **Reputational:** High public impact; transitioned cyber operations from "classified espionage" to "standard combat enablers."
## Indicators of Compromise
- **Network indicators:** None disclosed in public report.
- **File indicators:** None disclosed.
- **Behavioral indicators:** Unexpected synchronization of space-based signal interference and localized power grid failure; degradation of encrypted communication channels.
## Response Actions
- **Containment:** U.S. Cyber Command utilized NSPM-13 authorities for rapid deployment.
- **Eradication:** N/A (Offensive operation).
- **Recovery:** Adversary recovery of sensors and power grids post-raid.
## Lessons Learned
- **Success against mid-tier threats:** The operations were successful because they were conducted against less capable adversaries with ample time for rehearsal.
- **Integration Gap:** Cyber effects are still difficult to fit into the "joint warfight" compared to kinetic fires.
- **Peer Competitor Risk:** Current force generation and planning models may be insufficient for high-intensity conflict against a peer competitor like China.
## Recommendations
- **Doctrine Revision:** Transition cyber forces from a standalone "elite unit" model to one that is integrated into every level of joint military planning.
- **Resource Allocation:** Increase resources for "combat enabler" cyber roles rather than just standalone disruption missions.
- **Red Teaming:** Conduct exercises (e.g., Exercise Wolverine) to stress-test the ability to call for cyber effects as readily as kinetic fire support.