Dark Storm Claims Responsibility for Attack on Elon Musk’s X

Elon Musk has blamed a ‘massive cyberattack’ for widespread X outages experienced by tens of thousands of users globally. 

Posting on the platform, Musk said: “There was (still is) a massive cyberattack against X. We get attacked every day, but this was done with a lot of resources. Either a large, coordinated group and/or country is involved.”

Users first reported problems with X on the morning of Monday 10 March, with the platform experiencing several outages during the day.

While Musk suggested in an interview with Fox News Monday that the attack originated ‘in the Ukraine area’, there is yet no evidence to support this claim. The hacking collective Dark Storm has since said it is responsible for the attack.

Anatomy of the X attack

The first sign of problems with X began at around 6am EST on Monday 10 March, with users reporting difficulties accessing the platform. 

According to Downdetector, a service that provides real-time information about the status of online services, these reports peaked at 10am EST, with over 40,000 incidents logged. Issues encountered include error messages when posting and buffering. 

Services were briefly resolved but X experienced several more outages during the day. At around noon EST a sustained outage affected users along the US coasts. 

Data from Downdetector revealed that 56% of reported problems related to X’s app, while 33% were related to website issues. 

Musk updates X users

Musk posted about the attack on X, suggesting a large group or nation was responsible. 

Later, during an interview with Fox Business Live he reiterated his claim, saying “we’re not sure exactly what happened, but there was a massive cyberattack to try to bring down the ecosystem with IP addresses originating in the Ukraine area.”

Ciaran Martin, Professor at Oxford University’s Blavatnik School of Government told the BBC that the explanation was “wholly unconvincing” and “pretty much garbage”. 

The BBC reported that Martin, former head of the UK’s National Cyber Security Centre, said X could have experienced a distributed denial of service (DDoS) attack, adding that “I can’t think of a company of the size and standing international of X that’s fallen over to a DDoS attack for a very long time”. 

Martin told the BBC X’s incident “doesn’t reflect well on their cybersecurity”.

Toby Lewis, Head of Threat Analysis at Darktrace supports the theory of X facing a DDoS attack: “This appears to be a fairly standard DDoS attack on X - essentially an overwhelming amount of traffic designed to disrupt the service. Like all DDoS attacks, the effect is temporary.

“Importantly, these sorts of attacks are almost always delivered by botnets,” he says, “globally distributed networks of computers that have been unknowingly recruited to take part in the attack – typically through some form of compromise or the use of malware. These sort of botnets are unfortunately incredibly commonplace, making up the so-called ‘background noise of the internet’, and often available for hire for whoever is willing to pay.”

Dark Storm claims responsibility

Hacktivist group Dark Storm has subsequently said it is responsible for the disruption at X. Writing on cloud-based social media and messaging platform Telegram in a now-deleted post, it said "Twitter has been taken offline by Dark Storm Team”. 

The post included a screenshot showing connection problems in a list of countries.

Dark Storm was formed in 2023 and has attacked NATO countries, Israel and the US with large-scale DDoS campaigns as well as ransomware attacks. 

It is known to use tactics similar to a Russia-linked group called KillNet which also had a history of attacking western targets and Ukraine-supporting organisations, before becoming a more mainstream attackers-for-hire service.

X has yet to confirm whether Dark Storm was behind the attack.

Musk has faced disruption in recent weeks after growing unease over his influence on the US government.

Tesla facilities across the US have faced vandalism and protests, including a 'Tesla Takedown' campaign at showrooms in the US and other countries.

In New York, demonstrations at a Tesla dealership in Manhattan resulted in arrests while activist groups projected images and slogans onto the company's gigafactory in Berlin. 

Explore the latest edition of Cyber Magazine and be part of the conversation at our global conference series, Tech & AI LIVE and Cyber LIVE.

Discover all our upcoming events and secure your tickets today.

Cyber Magazine is a BizClik brand