This event led to violent clashes in multiple areas of Tripoli, including Ain Zara, Salah al-Din, and Abu Salim, where heavy weapons were used. The fighting resulted in deaths and injuries, as well as the escape of several inmates from Al-Jadid prison. The Government of National Unity later announced it had regained control of the Abu Salim area, with Prime Minister Abdul Hamid Dbeibeh stating that the operation aimed to reassert state authority and end the presence of irregular armed groups.
Amid these developments, the hashtag #الفيلق_الأوروبي (European Corps) resurfaced strongly on X (formerly Twitter), as multiple accounts used it to circulate narratives alleging European involvement in the events, thereby amplifying the digital discourse around foreign intervention in Libya.
In the first part of this report, we provide an in-depth analysis of more than 400 posts under the hashtag, along with indicators that suggest it is part of a coordinated campaign. In the second part, we examine who is behind the hashtag and the digital narratives it promotes about the "European Corps."
Sudden Rise
In May 2025, amid escalating armed clashes in the Libyan capital, Tripoli—following the killing of Abdel Ghani al-Kikli and the outbreak of fighting between rival armed factions, most notably the 444 Brigade—the hashtag #الفيلق_الأوروبي (European Corps) resurfaced prominently on X.
The hashtag began spreading with narratives claiming the presence of European military forces in Libya, accompanied by photos and videos allegedly showing the “Corps” participating in ground operations or hinting at European intelligence ties to targeted assassinations.
Posts under this hashtag propagated narratives suggesting that NATO is seeking to take control of Libya’s oil and gas resources through the so-called “European Corps,” which is said to consist of the United Kingdom, France, Italy, and the United States.
2025 data
This precise timing—coinciding with the security collapse in Tripoli and the exchange of accusations between rival factions—contributed to amplifying the narrative linking foreign intervention to internal escalation.
2024 data
The hashtag #الفيلق_الأوروبي (European Corps) first emerged on June 17, 2024, and activity on it resurfaced on July 23, August 22, and October 27, 2024 before reaching its peak in May 2025.
These dates all coincided with sensitive political and military milestones in Libya—such as high-level European visits to Tripoli, shifts in the rhetoric of the interim government, or significant military movements in western Libya.
The hashtag spiked dramatically on October 3, 2024, with more than 170,000 posts, coinciding with the leak of a draft "security memorandum of understanding" between the Dbeibeh government and the Italian energy company Eni. The document included provisions for the establishment of a “joint unit to protect oil fields and gas pipelines” in western Libya.
The leak—initially published by small local websites and later picked up by the account “المعتصم الفيتوري” (Al Moutassim Al Fitouri)—was portrayed as conclusive evidence of Italy's intent to deploy military forces under the guise of the “European Corps.”
The campaign on the hashtag was launched by only three accounts within a single hour. Our analysis reveals that these accounts are connected to networks of reposting, involving dozens of smaller accounts that amplify and redistribute the original content.
Network analysis shows that the accounts @NEFWEW7vyIiR9IA ("Crimes of the Militias") and @h5PITEOcChu9esY ("Under the Table of the National Oil Corporation") functioned as hubs for a network that immediately reposted content to dozens of smaller accounts. These smaller accounts followed a highly synchronized posting pattern in both text and timing, strongly suggesting they are managed using scheduling tools or automated software.
The original post came from the account @al_mutasem_al_f (Al Moutassim Al Fitouri), who has a real follower base of around 10,000 users and is known for his nationalist rhetoric opposing any foreign presence in Libya.
2024 data
By comparing digital activity patterns over the past year and a half, a consistent feature of the campaign emerges: a clear disparity between the number of posts and the scale of audience reach. In May 2025, for instance, only 25 posts were published, yet they reached over 52,000 accounts and appeared more than 85,000 times on users' timelines.
These figures cannot be explained without the presence of a centralized distribution mechanism—either through amplification by high-reach accounts or organized automation techniques.
2025 data
Publishing Tactics: How the Campaign WasDesigned to Amplify Itself
After understanding the timeline and volume of activity around the hashtag "#الفيلق_الأوروبي" (European Corps), our analysis shifted toward examining the quality of the content that shaped this digital campaign and how it engaged with the audience.
Data extracted from the Meltwater platform reveals that more than half (55.6%) of the posts using the hashtag were retweets, while original content accounted for less than a quarter of the total engagement. This suggests a possible amplification campaign driven by retweeting, rather than organic content creation.
2024 data
2024 data
In addition to analyzing the timing of the campaigns and content dissemination tactics, a deep textual analysis of posts using the hashtag "#الفيلق_الأوروبي" (European Corps) during 2024 and 2025 reveals further clarity about the narrative and political objectives of the campaign, as well as how its content evolved in terms of themes, targets, and tone.
A keyword analysis shows that in 2024, discourse around the hashtag heavily focused on delegitimizing Prime Minister Abdulhamid Dbeibeh, repeatedly referring to him as "expired" (used 25 times). This indicates a deliberate attempt to shape public opinion toward the idea that his term was over—effectively laying the groundwork for a political transition or potential foreign intervention.
2024 data
Starting in early 2025, the discourse surrounding this hashtag markedly shifted towards more open and aggressive escalation. This was reflected in the frequent use of sharper, more provocative phrases such as “القادم سيطال” ("what’s coming will reach [you]"), which appeared 16 times, and “الأعلى لثوار” ("supreme for the revolutionaries"), mentioned 7 times.
This linguistic escalation indicates a transition from delegitimization to incitement, signaling a possible intent to mobilize or justify action under revolutionary or confrontational framing.
2025 data
At the individual level, posts using the hashtag in 2024 frequently mentioned Field Marshal Khalifa Haftar as the primary military adversary of Tripoli. Meanwhile, Nicola Orlando—then Italy’s special envoy to Libya—was invoked as evidence of Italy’s direct role in engineering what was referred to as the “European Corps”: a joint force led by Rome with logistical backing from European allies, allegedly created to protect ENI’s investments and gas pipelines.
In 2025, the focus shifted to include key figures aligned with the Government of National Unity (GNU), such as Mu’ammar Al Dhawi, commander of the 55th Infantry Battalion, and Abdulsalam Al-Zoubi, deputy minister of defense. GNU figures, along with others linked to the Petroleum Facilities Guard (PFG), were negatively portrayed in the campaign, which accused them of collaborating with the so-called “European Corps.”
Who's Driving the Wave?
Through Meltwater, we identified the leading accounts involved in promoting the narrative of a European invasion of Libya. At the forefront is the account of Al Moutassim Al Fitouri, whose posts ranked highest among those using the hashtag in 2024.
Al Fitouri’s rhetoric focuses on attacking the government of Abdul Hamid Dbeibeh, accusing it of using public funds to buy loyalty and openly distributing bribes to coerce employees and citizens into staging pro-government demonstrations.
By 2025, the accounts “Militia Crimes” (@NEFWEW7vyIiR9IA) and “Under the Table of the National Oil Corporation” (@h5PITEOcChu9esY) topped the list of most engaged users on the hashtag. They provided vivid narratives of the clashes, alleged on-the-ground photos and videos, and lists of names of the dead and wounded. This content drove engagement to its peak, with one post in May 2025 receiving over 340 interactions.
In 2024, engagement on the hashtag peaked when it was claimed that the European Legion had taken control of the Naval Academy in Janzour. Although the event was not confirmed on the ground, the mere possibility of a “military facility being occupied” was enough to capture public attention and drive high engagement.
Engagement in 2025 was concentrated around three clear peaks. The first occurred on May 12, following the assassination of Abdel Ghani al-Kikli (Ghnewa) and the emergence of accusations alleging the involvement of European experts. The second spike took place on May 14, with the withdrawal of the 444 Brigade militia from key positions in Tripoli. The third surge in interaction followed reports of a so-called “Desert Maneuver,” which was claimed to simulate an assault on Libya’s oil fields.
These findings are supported by a network analysis, through which we mapped the precise spread of the narrative on X. This map reveals the hidden lines of communication that transmit posts from the original source to thousands of followers. The network analysis of accounts engaging with the hashtag “European Corps” indicates that interaction with the hashtag is not from organic or spontaneous user engagement. Instead, it is driven by closed circles of accounts—some real, others appearing to be automated or systematically coordinated.
At the heart of this digital network, the accounts “Crimes of the Militias” and “Under the Table of the National Oil Corporation” stood out. Their influence did not merely stem from their relatively large follower base, but from their ability to steer the conversation. When either account posts about clashes, assassinations, or accusations of foreign interference, the message is quickly picked up by medium- or small-sized accounts, which re-share the content dozens of times within minutes.
A network analysis also revealed the presence of lesser-known “intermediary nodes” that, while not as prominent as the two main accounts, play a key role in amplifying the messages and pushing them into broader circles.
Among the most prominent of these accounts are: @hosseinmosa, with over 170,000 followers, as well as @fawaselmedia, @knowwhathappend, @Ibnwatanlibya, and @salmaliby. These accounts do not post frequently, but X’s algorithms treat them as trusted sources due to their longevity or large followings. As a result, any retweet or mention from them gives a significant boost to visibility, feeding the spread across smaller accounts.
The presence of these intermediary layers provides campaign organizers with ready-made bridges between the core of the operation and the amplification base. This setup explains how the same posts can be recycled hundreds of times within minutes—without appearing artificially coordinated to the average user.
In addition, Betweenness Centrality analysis revealed that a limited number of accounts were responsible for the majority of content dissemination. These central accounts acted as digital "brokers"—without them, the narrative would fragment and lose much of its reach. In essence, these accounts functioned as critical bridges, enabling the narrative to travel from its origin point to broader, more dispersed parts of the network. Their role was essential in ensuring that the campaign's messaging reached a wider audience efficiently and consistently.
The network analysis also revealed distinct clusters of accounts that echoed the same messages in near-identical wording and operated in synchronized timeframes. This phenomenon, known as "coordinated networks," is one of the clearest indicators of artificial influence campaigns. These clusters became particularly visible during critical flashpoints, such as the May 2025 clashes and the events surrounding the oil fields in October and November 2024.
The most important takeaway from this network analysis is that activity around the hashtag “European Corps” was not random or organic. Instead, it was driven by a digital infrastructure controlled by a small number of influential core accounts, supported by organized intermediary nodes that transmitted the narrative to the edges of the network. These peripheral nodes served to amplify the message and shape perceptions among social media audiences.
