A major social platform, identified as X, faced unexpected challenges when it became the target of distributed denial-of-service (DDoS) attacks, causing intermittent outages. The owner of X, Elon Musk, attributed the outages to the DDoS attacks and expressed surprise at the level of resources involved in the attack, suggesting the involvement of a large coordinated group or even a country. However, security experts dismissed the claim of the attack originating from Ukraine as baseless and labeled it as a complete fabrication.
Ciaran Martin, a former head of Britain’s National Cyber Security Centre, pointed out that such unsophisticated attacks are often carried out by hijacking infrastructure globally, making it difficult to pinpoint the exact source. He expressed astonishment that a global brand as prominent as X could be disrupted by DDoS attacks in 2025. Additionally, cybersecurity researcher Milivoj Rajić noted that the IP addresses used in the attack were geographically dispersed, with significant traffic originating from countries like the U.S., Mexico, Spain, Italy, and Brazil.
The attack was linked to the Eleven11bot botnet, discovered by Nokia, which comprised nearly 90,000 infected devices primarily located in the U.S., U.K., Mexico, Canada, and Australia. Marcus Hutchins, another cybersecurity researcher, emphasized that DDoS attacks typically stem from compromised devices and cautioned against attributing attacks to specific countries based solely on IP addresses. He refuted Musk’s implication of Ukraine’s involvement in the attack and highlighted the prevalence of insecure devices in developing nations being exploited by botnets.
The responsibility for the DDoS attacks on X was claimed by a hacktivist group named Dark Storm Team, known for its pro-Palestinian stance and history of targeting entities perceived to support Israel. The group denied any connection to Ukraine and reiterated its focus on Western entities, including the U.S., Ukraine, UAE, and Israel. Researchers noted the group’s past involvement in attacks on critical infrastructure like airports and government entities.
The disruption caused by the DDoS attacks highlighted the potential impact of such incidents on prominent organizations and the ability of hacktivist groups to gain attention rapidly through such actions. Security experts cautioned about the increasing threats posed by such groups and emphasized the importance of robust cybersecurity measures to defend against DDoS attacks. The incident served as a reminder of the ongoing cybersecurity challenges faced by organizations in an age of escalating cyber threats.