Elon Musk said his social media platform X was hit by a “massive cyber attack” on Monday – but who was behind it?
Musk said IP addresses involved in the attack were traced to locations “in the Ukraine area” but a hacking group called Dark Storm Team claimed it was responsible, in now-deleted Telegram posts.
“Twitter has been taken offline by Dark Storm Team,” a post read on the group’s account, with a screenshot showing connection problems in a long list of countries.
Here, Sky News looks at what we know about the hackers claiming responsibility for the attack.
Who is Dark Storm Team?
The hacking group was founded in 2023 and has orchestrated cyber attacks against governments and organisations known to support Israel, according to cyber security firm Check Point.
“They tend to go after those high-profile attacks,” said Muhammad Yahya Patel, a lead security engineer at Check Point.
“Their main mantra is to cause disruption of services, largely related to government and NATO connections.”
The group has previously targeted Israeli hospitals, US airports, government websites and other critical infrastructure services, according to cyber security site Security Scorecard.
It added that Dark Storm Team does not tend to demand ransoms after attacks and the group is vocal about its political motivations.
“We will attack any country […] that supports the occupying entity,” the group posted on Telegram last year, in screenshots shared by Security Scorecard.
However, Dark Storm Team is not completely motivated by political beliefs – it also advertises itself as hackers-for-hire.
Please use Chrome browser for a more accessible video player
Ukraine, Musk, and an evicted Democrat
‘We have no relationship with Ukraine’
While Musk linked the cyber attack to IP addresses “in the Ukraine area”, this is disputed.
A post from an X account claiming to be connected to Dark Storm Team read: “According to what Elon Musk said about the cyber attack on the X platform, its source is Ukraine.
“It is an accusation without any evidence, and we have no relationship with Ukraine.”
Cybersecurity experts also questioned the claim, saying it would be unusual for an attack like this to come out of one location.
Read more:
Musk calls US senator ‘a traitor’ for visiting Ukraine
What’s gone wrong at Musk’s Tesla?
“The IP addresses are [usually] distributed globally from different locations,” said Mr Patel.
After checking with Check Point’s team of cyber analysts, he added: “It looks like a general DDoS attack coming from different locations, different IP addresses.”
A DDoS, or denial-of-service, attack is when hackers flood a system with attacks from all angles, targeting web servers, internal networks, or anything else they can access. The idea is to disrupt services enough that they become unavailable.
After scouring the dark web, Mr Patel’s team also found no one else claiming responsibility for the attack on X, only Dark Storm Team.
Musk, the internet and Ukraine
Musk caused alarm on Sunday when he claimed Ukraine’s “entire front line would collapse if I turned it [Starlink] off”.
He made the remarks during a row with Poland’s foreign minister over the use of Musk’s satellite internet system.
Last year, Ukraine said around 42,000 of the internet terminals were in operation across its military, hospitals, businesses and aid organisations.
Musk later said he would “never turn off [Starlink’s] terminals”.
US negotiators pressing Kyiv for access to Ukraine’s critical minerals have raised the possibility of cutting Ukraine’s access to the service, sources told Reuters in February.
