X Outage Linked to Dark Storm Hacker Group as Elon Musk Confirms 'Massive Cyberattack'

Elon Musk’s social network X was hit by at least three distributed denial of service attacks Monday that took the site down intermittently worldwide.

“There was (still is) a massive cyberattack against X,” Musk posted. “We get attacked every day, but this was done with a lot of resources. Either a large, coordinated group and/or a country is involved.”

Musk said the attack was linked to IP addresses in Ukraine during an interview with Fox Business on Monday afternoon.

“We’re not sure exactly what happened but there was a massive cyberattack to try to bring down the X system, with IP addresses originating in the Ukraine area,” Musk said.

While Musk appeared certain of his claim, it is worth mentioning that the attackers could have used a virtual private network or VPN to mask their true location.

A Distributed Denial-of-Service (DDoS) attack is a cyberattack in which multiple compromised systems flood a target, such as a website or server, with excessive traffic, overwhelming its resources and making it inaccessible to legitimate users. 

“The motivations behind these attacks are shifting,” Head of Cybersecurity at email validation service ZeroBounce Vlad Cristescu told Decrypt. “Ransom-driven extortion is on the rise, but so are hacktivist campaigns tied to political and social agendas, as well as competition-fueled assaults. No industry is off-limits, DDoS attacks are constantly evolving.”

According to a recent report by internet infrastructure company Zayo, DDoS attacks increased 81.7% since 2023.

Internet sleuths pointed to the notorious hacking group Dark Storm. The so-called hacktivists have been behind numerous cyber attacks and threats, among other things, targeting Israel and its allies following the start of its war with Hamas.

“How are you Elon Musk? I hope you like our visit,” a message on the Dark Storm Team Telegram channel reads.

The Dark Storm Team apparently offers cyberattack services for hire, such as DDoS-as-a-Service and database breaches.

According to the internet monitoring website Downdetector, the DDoS attacks against Twitter began at 6:00 a.m. EST on Monday. By 10:00 a.m. EST, the site had collected over 39,000 outage reports. Some 57% of the X users affected were on the X mobile app, Downdetector reported, with 32% on the X.com website.

"It's one of the bigger attacks I've seen from the group lately,” internet sleuth SypoSecure told Decrypt. “The website should have better security to prevent an attack like that from happening."