Dark Storm Team claimed it was behind the attack and has previously targeted Israeli hospitals and US airports, according to cyber security experts.
Elon Musk said his social media platform X was hit by a “massive cyber attack” on Monday – but who was behind it?
Musk said IP addresses involved in the attack were traced to locations “in the Ukraine area” but a hacking group called Dark Storm Team claimed it was responsible, in now-deleted Telegram posts.
“Twitter has been taken offline by Dark Storm Team,” a post read on the group’s account, with a screenshot showing connection problems in a long list of countries.
Elon Musk claimed IP addresses in Ukraine were linked to the cyber attack on X. Pic: Reuters
Who is Dark Storm Team?
The hacking group was founded in 2023 and has orchestrated cyber attacks against governments and organisations known to support Israel, according to cyber security firm Check Point.
“They tend to go after those high-profile attacks,” said Muhammad Yahya Patel, a lead security engineer at Check Point.
“Their main mantra is to disrupt services, largely related to government and NATO connections.”
The group has previously targeted Israeli hospitals, US airports, government websites and other critical infrastructure services, according to cyber security site SecurityScorecard.
It added that Dark Storm Team does not tend to demand ransoms after attacks and the group is vocal about its political motivations.
“We will attack any country that supports the occupying entity,” the group posted on Telegram last year, in screenshots shared by SecurityScorecard.
However, Dark Storm Team is not completely motivated by political beliefs – it also advertises itself as hackers-for-hire.
‘We have no relationship with Ukraine’
While Musk linked the cyber attack to IP addresses “in the Ukraine area”, this is disputed.
A post from an X account claiming to be connected to Dark Storm Team read: “According to what Elon Musk said about the cyber attack on the X platform, its source is Ukraine.
“It is an accusation without any evidence, and we have no relationship with Ukraine.”
Cybersecurity experts also questioned the claim, saying it would be unusual for an attack like this to come out of one location.
