Social media platform X was reportedly hit by a massive cyberattack on Monday, causing intermittent outages. While owner Elon Musk has cited the attack as the cause, a hacking group known as Dark Storm Team has claimed responsibility.
Based on data from Downdetector, the site had been up and down throughout the morning. The first outage started around 6 a.m. ET, with more than 20,000 reports that X was down. But then reports popped up again around 9 a.m. ET and then more dramatically around 10 a.m. ET, with more than 40,000 people chiming in.
Also: How AI will transform cybersecurity in 2025 – and supercharge cybercrime
By 11 a.m. ET, the reports had dipped, indicating that this second outage may have been settled. But by 11:30 a.m. ET, the report count climbed once again, hitting almost 30,000, pointing to a third outage within the space of a few hours.
At this point, the site seems to be back up and accessible. However, according to the latest data from Downdetector, users are still experiencing intermittent outages.
In a post that appeared after the site was back up, Musk said: “There was (still is) a massive cyberattack against X. We get attacked every day, but this was done with a lot of resources. Either a large, coordinated group and/or a country is involved.”
According to Newsweek and other news outlets, that coordinated group is apparently Dark Storm Team, which has claimed responsibility for the attack via a public Telegram post.
Based on a report by security firm Orange Cyberdefense, Dark Storm Team, which first appeared around September 2023, specializes in remote access, data infiltration, ransomware, and DDoS attacks. The group is seen as heavily pro-Palestinian and targets state organizations that support Israel. So far, Dark Storm Team has focused its attacks on key business sectors, mainly in Israel and NATO member countries.
The presumption at this point is that the group has launched and may still be launching DDoS attacks against X. The true target of Dark Storm Team’s vitriol could be Musk himself, who has certainly grown into a controversial figure, politically and otherwise. For now, though, X needs to keep the site up and running while it figures out how to better defend itself from future such attacks.
“X is under relentless cyberattacks; 24/7/365 this far beyond simple DoS attempts,” Chad Cragle, CISO at cyber resilience platform Deepwatch, told ZDNET. “These are full-scale DDoS assaults, combined with sophisticated botnet activity, credential stuffing, API abuse, and targeted application-layer attacks designed to cripple operations.”
“While technical issues can occur, X’s engineers understand scalability and redundancy. This isn’t incompetence; it’s cyberwar hitting at full force. With Musk in the spotlight and political tensions at a peak, these attacks bear all the indicators of nation-state aggression. They’re throwing everything but the kitchen sink at X, and others pushing for maximum disruption, downtime, and, if possible, data exposure.”
