.png){kind=logo}
Elon Musk has claimed that a large-scale cyberattack, which disrupted his social media platform X (formerly Twitter), originated from Ukraine. During an interview , Musk stated, “We’re not sure exactly what happened, but there was a massive cyberattack to try to bring down the X system with IP addresses originating in the Ukraine area.”
The attack began early Monday and led to widespread outages across Asia, Europe, and North America. Users reported difficulties accessing the platform, with Downdetector, a service that tracks online disruptions, recording a peak of over 40,000 outage reports. The incident caused access issues throughout the day, further raising concerns about cybersecurity threats against major social media platforms.
Musk’s claims about Ukraine’s involvement have sparked debate among cybersecurity experts. He suggested that the attack required “tremendous resources” and could be the work of a nation-state or a highly coordinated group. However, experts caution against attributing cyberattacks based solely on IP addresses, as attackers can easily mask their locations through proxy servers or compromised systems.
Adding to the complexity, a pro-Palestinian hacker group known as Dark Storm Team later claimed responsibility for the attack via a public Telegram channel. The group is known for targeting countries and organizations that support Israel’s military operations in Gaza. This claim raises questions about whether the attack had any direct link to Ukraine or if Musk’s statement is tentative.
X users worldwide faced significant disruptions, with services repeatedly going offline and then restoring throughout the day. Downdetector reported that in the U.S. alone, outages peaked at 39,021 affected users by 10 a.m. Eastern Time. The number of reported issues gradually declined to around 1,500 by late afternoon.
A source within the internet infrastructure sector, speaking anonymously, revealed that X was hit by multiple waves of distributed denial-of-service (DDoS) attacks, starting at 9:45 UTC. DDoS attacks involve overwhelming a website with artificial traffic, rendering it temporarily inaccessible. While disruptive, such attacks are not necessarily sophisticated, and both small groups and large state-sponsored actors have executed them.
This is not the first time Musk has attributed service disruptions on X to cyberattacks. Last year, he claimed that a similar outage coincided with a planned live-streamed interview with U.S. President Donald Trump. Critics argue that these statements, lacking concrete evidence, may serve to deflect from internal technical challenges faced by X.
Since Musk’s $44 billion acquisition of Twitter in 2022, the company has undergone major changes, including significant staff layoffs. Technical issues have become more frequent, leading some analysts to question whether the latest outage was the result of a cyberattack or simply an internal failure.
Musk’s remarks on the cyberattack come amid growing tensions regarding his stance on Ukraine. Recently, he criticized Ukraine’s war efforts against Russia, claiming that without his Starlink satellite system, Ukraine’s front line “would collapse.” While he assured them that Starlink access would not be revoked, his statements have drawn backlash from Ukrainian officials and supporters.
He further defended his position on X, responding to criticism for focusing on Ukrainian President Volodymyr Zelenskyy instead of Russian President Vladimir Putin. “I literally challenged Putin to one-on-one combat over Ukraine, and my Starlink system is the backbone of the Ukrainian army,” Musk posted. “What I am sickened by is years of slaughter in a stalemate that Ukraine will inevitably lose.”
The latest cyberattack on X has renewed concerns about digital security and misinformation. With conflicting claims about who was behind the attack, cybersecurity analysts stress the importance of a thorough forensic investigation before drawing conclusions. For now, X appears to have stabilized, but the debate surrounding the attack’s origins and Musk’s assertions continues. Whether this was a genuine state-sponsored assault or another instance of opportunistic cyber disruption remains an open question.
