<

div data-component-name=”ui-article-body” data-highlight-intro=”true”>

  Elon Musk recently announced that his social media platform X was the target of a "massive cyber attack" on Monday, but who could be behind it?

Mr. Musk has mentioned that IP addresses implicated in the assault traced back to areas in Ukraine, though a cyber group named Dark Storm Team has since claimed responsibility in now-deleted Telegram communications.

“Twitter is offline due to Dark Storm Team’s actions,” the group’s Telegram post declared, including a screenshot highlighting connectivity issues in several countries.

Here, Sky News investigates the details regarding the hackers responsible for this incident.

Who are the Dark Storm Team?

The hacking group was founded in 2023, and has launched cyberattacks on governments and organizations that are known to support Israel, according to cyber security firm Check Point.

“They often target high-profile entities,” said Muhammad Yahya Patel, a lead security engineer at Check Point.

“Their main objective is to disrupt services, especially those related to government and NATO affiliations.”

The group previously targeted hospitals in Israel, US airports, government websites, and other critical infrastructures, as reported by cyber security site Security Scorecard.

Check Point stated that Dark Storm Team does not typically demand ransom post-attacks; the group openly discusses its political motivations.

“We will launch attacks on any country […] that supports the occupying entity,” the group posted on Telegram, as reported by Security Scorecard in a screenshot.

However, Dark Storm Team also markets their skills as hackers for hire.

     <div class="sdc-article-widget sdc-site-video callfn" data-account-id="6058004172001" data-amp-iframe-embed="" data-asset-id="ce00375e-46b5-46ef-a480-bd290bdb80a6" data-asset-path="" data-asset-version="" data-autoplay="false" data-auth-config="" data-caption="Ukraine, Musk, and an evicted Democrat" data-clip-type="" data-component-name="sdc-site-video" data-component-name-alias="ui-sitewide-video" data-competition="" data-copy-url-text="URL copied to clipboard" data-fn="sdc-site-video" data-id="id_ce00375e-46b5-46ef-a480-bd290bdb80a6" data-is-live-stream="false" data-lite="true" data-options="" data-originator-id="51" data-originator-handle="brightcove-news-gb" data-package-name="" data-provider="brightcove" data-player-id="yjBoKQ5XA" data-playsinline="" data-sensitive="false" data-sdc-id="6846682" data-sdc-video-id="ce00375e-46b5-46ef-a480-bd290bdb80a6" data-sport-category="" data-state="loading" data-token-state="none" data-video-ad-unit="" data-video-blacklisted-originator-ids="" data-video-id="ref:ce00375e-46b5-46ef-a480-bd290bdb80a6" data-video-type="" data-auto-pause-on-not-visible="true" tabindex="-1" data-closed-captions-position="middle-third" data-show-closed-captions="true" data-show-pip="true" data-show-live-stream-scrubber="true" data-autoload="false">
      <div class="sdc-site-video__inner">
        <div class="sdc-site-video__content" data-role="bridge-controller" style="padding-bottom: calc(100% / ());">
            <p class="sdc-site-video__accessibility-message" data-role="accessibility-message">Please use Chrome browser for a more accessible video player
          <span aria-hidden="true" data-role="poster" class="sdc-site-video__poster">
            <img loading="lazy" src="https://e3.365dm.com/25/03/768x432/skynews-us-donald-trump_6846629.jpg?20250305083251" alt="Trump's longest speech to Congress - here's what you need to know" srcset="" aria-hidden="true" class="sdc-site-video__poster-img"/>
          <span class="sdc-site-video__loader"/>
            <span class="sdc-site-video__time">0:56</span>
          </span>

          <video id="id_ce00375e-46b5-46ef-a480-bd290bdb80a6" data-embed="default" data-application-id="" class="video-js sdc-site-video__tag" controls="" playsinline="" fts-stop-on-seek="true"/>
        </div>

        <figcaption class="sdc-site-video__caption ui-media-caption">

          <span class="ui-media-caption__caption-text" data-role="caption-text">Ukraine, Musk, and an evicted Democrat</span>
        </figcaption>
      </div>
    </div>

‘We have no connection to Ukraine’

Though Mr. Musk associated the cyber attack with IP addresses “in the Ukraine area,” this claim is disputed.

A post from an account claiming ties to Dark Storm Team stated, “As per Mr. Musk’s comments regarding the cyber attack on X platform, the source is Ukraine.

“This is an unfounded claim without evidence, and we have no connection to Ukraine.”

Cybersecurity experts have also questioned this claim, noting that it is unusual for an attack to originate from a single location.

Read more:
Musk accuses US senator of being a ‘traitor’ for visiting Ukraine
Issues at Musk’s Tesla?

“IP addresses are generally distributed globally from different locations,” explained Mr. Patel.

After working with Check Point’s cyber analysts, he stated, “This incident appears to be a general DDoS attack stemming from various locations and IP addresses.”

A DDoS, or denial-of-service, attack occurs when hackers flood a system with attacks from multiple angles, aiming to disrupt services to the point of unavailability.

After researching the dark web, Mr. Patel’s team found no other group claiming responsibility for the X attack, only Dark Storm Team.

Musk, the internet, and Ukraine

Mr. Musk recently caused concern by suggesting that “Ukraine’s entire front line would collapse if I turned off Starlink.”

He made these remarks during a dispute with Poland’s foreign minister regarding the use of Musk’s satellite internet system.

Last year, Ukraine reported that around 42,000 internet terminals from Starlink were operational across military, hospitals, businesses, and aid organizations.
This is a rewritten version of the content for optimal readability and understanding.

Source: https://news.sky.com/story/x-outage-who-are-hackers-claiming-to-have-caused-massive-cyber-attack-on-elon-musks-social-media-platform-13326288