Overview

On Monday 10th March 2025 Elon Musk confirmed that social media platform X (formerly known as Twitter) had been subject to a significant cyberattack but has not confirmed a Distributed Denial of Service (DDoS) attack. Elon Musk suggested that it involved a large, coordinated group or possibly a nation. The hacktivist group Dark Storm have claimed responsibility, stating they had taken the platform offline by posting a message on Telegram alongside screenshots of the attack. 

Impact

Thousands of users encountered error messages, significant service disruptions, and difficulties accessing the X mobile app and website. The suspected DDoS attack led to widespread inaccessibility throughout the day. Downdetector, showing multiple disruptions globally. The cyberattack on X had a knock-on effect on social media and technology platforms due to their vast user bases and critical role in communication, leading to increased scrutiny and pressure to enhance their cybersecurity measures. The outage may have affected organisations that use X to promote themselves or maintain newsfeeds, potentially impacting their revenue. 

Threat Group

Dark Storm is a pro-Palestinian hacktivist group formed in 2023 due to geopolitical tensions in the Middle East. They are known for launching cyberattacks against infrastructure and governments, particularly renowned for DDoS attacks against NATO countries that support Israeli objectives.  

Elon Musk was an active campaigner, using his personal wealth during the re-election of President Trump, and is involved in the Department of Government Efficiency (DOGE). President Trump and his Republican Party have proposed a controversial plan for the U.S. to take over the Gaza Strip, level it, and develop it into a resort area. This plan may be perceived as anti-Palestinian. 

According to Orange Cyberdefense, Dark Storm may have alliances with these hacktivist groups: 

• Anonymous Sudan: An affiliate of Killnet, focusing on DDoS attacks and cyber disruptions, often targeting Western entities. 

• Bluenet Russia: Likely a pro-Russian cyber group involved in various cyber operations, including DDoS attacks. 

• Channel DDoS v2: A service or tool used for conducting DDoS attacks, possibly offered by hacktivist groups. 

• Ghosts of Palestine: A hacktivist group that conducts cyberattacks, particularly DDoS attacks, in support of Palestinian causes. 

• Killnet: A pro-Russian hacktivist collective known for DDoS attacks against Western countries and entities supporting Ukraine. 

• Krypton Networks: A network or service involved in cyber operations, possibly offering DDoS-for-hire services. 

• SN_BLACKMETA: A pro-Palestinian hacktivist group known for large-scale DDoS attacks and cyber campaigns against entities supporting Israel. 

• ZeusAPI Services: Likely a service providing APIs for conducting cyber operations, including DDoS attacks. 

Attack Vectors

Dark Storm is mostly known for committing DDoS attacks, but they also offer DDoS-for-hire services. They deploy botnets during these attacks. The group exfiltrates personal data from websites, databases, and CCTV images, stealing information from countries including France, Israel, and the United States. This data is then sold on the dark web and black markets. 

The group also engages in social engineering and phishing campaigns using platforms such as Telegram to promote their services, spread propaganda, recruit new members, and orchestrate future attacks  

TTPs

T1498: Network Denial of Service 

Further Information

https://economictimes.indiatimes.com/news/international/global-trends/twitter-outage-cyberattack-cripples-x-elon-musk-blames-large-group-or-nation-pro-palestinian-hacker-group-dark-storm-claims-responsibility/articleshow/118866728.cms 
https://www.malwarebytes.com/blog/news/2025/03/x-users-report-login-troubles-as-dark-storm-claims-cyberattack