New details are emerging about the cyberattack that caused widespread outages on X this Monday. A hacker group known as Dark Storm has claimed responsibility for the attack, but the incident remains under investigation.

Who Is Dark Storm?

Dark Storm Team is a cyber threat group that describes itself as a pro-Palestine hacktivist organization with alleged links to Russia. 

According to cybersecurity firm Orange Cyberdefense, the group has been active since September 2023. They are engaging in various cyberattacks, including ransomware, data breaches, and distributed denial-of-service (DDoS) attacks. These actions appear to serve both financial and ideological motives.

Other hacktivist groups, including factions associated with the Anonymous movement, have also claimed responsibility for the attack on X.

However, attributing such cyberattacks remains challenging, as it is common for hacktivists—or those posing as them—to falsely take credit for major disruptions.

https://usaherald.com/portal-combat-russian-disinformation-campaign-manipulates-ai-chatbots/

X Targeted by DDoS Attack

Reports from DownDetector indicated that multiple attack waves affected tens of thousands of X users. The attack has been identified as a distributed denial-of-service (DDoS) attack, a method used to overwhelm servers by flooding them with traffic.

Elon Musk commented on the severity of the attack, stating, "We get attacked every day, but this was done with a lot of resources. Either a large, coordinated group and/or a country is involved."

During an interview with Fox Business, Musk mentioned that the attack was still under investigation but noted that the IP addresses involved originated from the Ukraine region. However, Reuters reported, based on information from an unnamed internet infrastructure industry source, that the attack traffic came from IP addresses in Ukraine, as well as the U.S., Vietnam, and Brazil.

The Complexity of DDoS Attacks

DDoS attacks typically leverage compromised devices worldwide, instructing them to send massive amounts of traffic to a targeted system, depleting its resources and causing downtime. The geographical origin of attack traffic does not necessarily reveal the attacker’s actual location.

Cybercriminals continue to develop more sophisticated DDoS techniques. In some cases, attackers no longer need vast networks of bots to launch devastating attacks. For example, in late 2024, Cloudflare reported a record-breaking DDoS attack peaking at 5.6 Tbps, executed using only 13,000 unique IP addresses.

The lines between state-sponsored cyber warfare, criminal hacking operations, and hacktivism are becoming increasingly blurred. Government-backed cyber actors and organized cybercriminals frequently use hacktivist narratives to mask their true objectives.

X Previously Targeted by Hackers

X has faced similar disruptions in the past. One of the most notable incidents involved Anonymous Sudan, a threat group accused of launching a disruptive DDoS attack on the platform. Several of its members were later charged in the U.S. for offering DDoS-for-hire services.

As investigations into the latest attack continue, cybersecurity experts warn that such incidents highlight the persistent vulnerabilities in major online platforms and the evolving tactics of cyber threat groups.