Hackers Claim Responsibility for X Cyberattack – But Can We Trust Them?

The recent cyberattack that disrupted X (formerly Twitter) has sparked controversy, speculation, and conflicting reports. As details emerge, it's clear that the attack was a large-scale distributed denial-of-service (DDoS) assault. However, determining the true culprit is proving to be a challenge.

What Happened?

On Monday, users worldwide experienced outages on X, with tens of thousands reporting issues accessing the platform. According to DownDetector, the disruptions likely stemmed from waves of DDoS attacks—an assault method designed to overwhelm a target’s servers with excessive traffic.

Elon Musk quickly confirmed the attack, stating that while X faces cyberattacks daily, this one was particularly severe. He speculated that either a well-coordinated hacker group or even a nation-state might be responsible.

Later, in an interview with Fox Business, Musk suggested that the attack’s originating IP addresses were traced to the Ukraine region. However, this claim was met with skepticism. A source within the internet infrastructure industry told Reuters that traffic from Ukraine was insignificant, and most attack traffic actually came from the U.S., Vietnam, and Brazil.

A Closer Look at DDoS Attacks

DDoS attacks are notoriously difficult to attribute. They often leverage botnets—networks of compromised devices spread across the globe—to generate overwhelming traffic. Because these attacks use hijacked devices from different locations, the IP addresses involved don’t necessarily reveal the attackers’ true origins.

Cybercriminals are also refining their DDoS techniques. Some of the most powerful recent attacks have been launched with relatively few botnets. For example, in late 2024, Cloudflare reported a record-breaking 5.6 Tbps attack that involved only 13,000 unique IPs—showing how devastating modern DDoS methods can be.

Dark Storm Team Takes Credit – But Should We Believe Them?

Shortly after the attack, a group called Dark Storm Team claimed responsibility. This hacker collective presents itself as a pro-Palestine hacktivist group, with possible links to Russian cyber operations.

Dark Storm Team has been active since September 2023, conducting various cyberattacks, including ransomware, data breaches, and DDoS campaigns. Their operations appear to be a mix of financially motivated crimes and ideological attacks.

However, other hacktivist groups—including factions tied to the Anonymous movement—have also claimed responsibility for the X attack. This raises the question: who is really behind it?

False Claims and Cyber Deception

It’s not uncommon for hacker groups to falsely take credit for high-profile cyberattacks. Hacktivists, cybercriminals, and even state-sponsored threat actors often use deception to manipulate public perception, instill fear, or boost their reputations.

Increasingly, cyberwarfare is blurring the lines between hacktivism, cybercrime, and state-sponsored operations. Governments and intelligence agencies sometimes work with or even disguise themselves as hacktivist groups to carry out attacks while maintaining plausible deniability.

X: A Frequent Target

This isn’t the first time X has faced a major cyberattack. In the past, the platform was also targeted by Anonymous Sudan, another notorious hacktivist group. Some of its alleged members were recently charged in the U.S. for offering DDoS attack services, further highlighting how these groups operate within the larger cybercriminal ecosystem.

The Investigation Continues

While Dark Storm Team and others claim responsibility, X’s cyberattack remains under investigation. Given the murky nature of cyber attribution, it may be a while before clear answers emerge—if they ever do.

What is certain, however, is that social media platforms remain prime targets for cyberattacks, whether motivated by ideology, political agendas, or financial gain. Users and organizations alike should remain vigilant, as cyber threats continue to evolve in complexity and scale.

Stay Informed and Stay Secure

As more details unfold, it’s essential to approach reports of cyberattacks with skepticism and caution. Hackers thrive on misinformation and fear, and in the world of cybersecurity, things are rarely what they seem at first glance.