Only a few hours after the events in the Syrian coast, the hashtag "#الجولاني_سفاح_سوريا" (Julani Syria’s Butcher) swept across X, garnering millions of views and interactions.

The campaign was digital, fast, and remarkably coordinated. In this report, we uncover the hidden networks behind the "Julani, Syria’s Butcher” campaign.

The rapid surge in the spread of the hashtag "#الجولاني_سفاح_سوريا" (Julani, Syria’s Butcher) was neither ordinary nor spontaneous. From the very first moments, it was clear that coordinated efforts were at play behind the scenes. Between March 6 and 9, 2025, the digital campaign tied to this hashtag witnessed an exceptional spike in posts and views on X.

At the same time, the word “Assad” (referring to former Syrian president Bashar al-Assad) emerged as one of the most frequently mentioned terms within the hashtag’s content. His name was often featured in posts expressing apologies to him, contrasted with harsh criticism of the new Syrian government.

The hashtag also became a vehicle for spreading messages aimed at inciting sectarian strife between Sunnis and Shiites.

According to documentation by the Syrian Observatory for Human Rights, 1,093 civilians were killed during the events in Syria’s coastal region—most of them from the Alawite sect, along with several Christians and 25 Sunnis, who were reportedly killed by loyalists of the former regime.

The numbers reveal a significant spike in activity around the hashtag "#الجولاني_سفاح_سوريا" (Julani Syria’s Butcher). In a short period, the total number of posts using the hashtag reached approximately 75.9K—a 138% increase compared to the previous period, which recorded only 31.9K posts.

This surge was also reflected in the daily posting average, which rose to around 2.53K posts per day, up from approximately 1.06K posts per day during the earlier timeframe.

The activity wasn't limited to posting —it extended to a massive boost in visibility and engagement. During the peak of the events, the total reach of posts using the hashtag "#الجولاني_سفاح_سوريا" (Julani Syria’s Butcher) soared to 147 million views, marking a 239% increase compared to the previous period.

The average daily reach also jumped significantly, climbing to approximately 4.88 million views per day, up from a previous average of just 1.44 million.

A closer look at the types of posts driving this surge reveals that the majority of digital activity came from reposts, which totaled around 41,337—accounting for more than half of the campaign's content. This was followed by replies, with approximately 26,674 posts, and quote posts, totaling around 4,103. Original posts made up the smallest portion, with just 3,895 posts.

These figures indicate that the spread of the hashtag was not driven by original content as much as it relied on the amplification and recycling of specific posts to achieve maximum reach—a hallmark of coordinated online campaigns and organized propaganda efforts.

These exceptional numbers were accompanied by clear indicators of an abnormal surge in the number of posts during the days of intense ground clashes. On March 6—the first day of the fighting—around 1,418 posts were published. This number suddenly rose to 4,621 the following day, then doubled again on March 8, reaching 8,233 posts. The campaign peaked on March 9, recording over 11,000 posts in a single day.

It was also notable that the campaign wasn’t confined to Syria. Large numbers of posts were observed from several countries and cities, most notably Iraq, Yemen, Lebanon, the United States, Saudi Arabia, Egypt, Germany, the United Kingdom, and other European countries. There was also a noticeable use of location-masking technologies (VPN), especially from unusual locations in such campaigns—like Paradise City, Vatican City.

The interaction with the hashtag was accompanied by a large, coordinated flow of unified negative messages that deliberately used specific keywords such as “genocide,” “jihadist regime,” and “political Alawism.”

Silent Network 

Through the use of network analysis tools, we were able to uncover the identity of the "beating heart" of this campaign—a small group of influential accounts that led the wave of dissemination in a highly coordinated and precise manner.

These accounts were not necessarily the most famous or followed, but they were the most active and engaged. In a short period, they became the true driving force steering and amplifying the conversation, and they flooded the digital platform with their messages. Among the thousands of accounts that participated in the campaign, ten accounts stood out clearly, forming the central network for managing and directing the discussion. At the top of these accounts is @Property_Assets, which, despite having only a few posts since its creation in 2012, suddenly turned into one of the key movers of the campaign through intensive and coordinated reposting activities.

At the same time, another intriguing account appeared, named @alsisioffice, featuring a picture of Egyptian President Abdel Fattah El Sisi and describing itself as "The Mighty Warrior." What’s unusual about this account is that it also has a limited number of posts, all of which are violent and targeted, without any genuine reference to the owner’s identity or any human interaction.

The network also includes recently created accounts, such as @AsdMekal13595, which became notably active during the peak of the campaign, as well as @KingAlhaj, which played a clear role in stirring discussion and engaging directly with other users.

In the same network, two other accounts appear: @x8469 and @bubg717208, which seem automated or, at the very least, have limited direct interaction, reinforcing the hypothesis that automated techniques were used to amplify the campaign. Additionally, the account @ASADALBAHRI played a notable role in the repeated and intense posting of negative content. In addition, accounts such as @marina_lovi, @OsmanXece, and @mohamedghazy152 all exhibited clear and coordinated activity in spreading messages that aligned with the core narrative of the campaign, particularly through reposting, replies, and engagement.

Content Lamenting the Assad Era

Through content analysis, we found attempts to link the new Syrian administration to terrorism. Prominent accounts—such as @fatema_imm, who identifies as "Bint Al Mamlaka" (Daughter of the Kingdom)—shared targeted posts aiming to associate the image of "Julani" with that of Abu Bakr Al Baghdadi, the former leader of the ISIS terrorist organization.

Notably, the account @alkindy2073, operating from Iraq, played a significant role by publishing posts that drew parallels between the events in the Syrian coastal region and the tragedy of " Al Hussein and his household in Ashura." These posts used sectarian language, with some reaching as many as 56,000 views.

One of the most revealing pieces of content that highlighted the campaign's objectives and direction came from a post by an account named Razan Ahmed @razin340. It featured a short message: "An official apology to President Bashar Al Assad #الجولاني _ سفاح _سوريا (Julani, Syria’s Butcher)," accompanied by a video in which the account owner personally apologizes to Assad. The post received considerable engagement, with 934 direct interactions.

One of the most widely circulated posts came from the account of Ali Fahim (@alkindy2073), which compared the events in the Syrian coastal region to the killing of Al Hussein in Karbala’—an attempt to invoke religious symbolism and stir sectarian emotions.

Meanwhile, other posts drew parallels between the new administration and historical Umayyad figures, accompanied by curses directed at the "Umayyads."

Connections Between Active Accounts

Through network analysis, we detected repeated interaction between sectarian-fueling accounts like @alkindy2073 and those promoting messages of apology and rehabilitation for former Syrian president Bashar Al Assad—most notably, the account @razin340, which published a video on the subject. Additionally, another account, @ahmedalmoaiad, stood out for its notable activity, as it was clearly connected to several accounts in the network and played a role in amplifying and spreading this content.