Knockout of X Tied to Pro-Palestinian Hacktivists’ Botnet

One of the world’s biggest social networks continued to face intermittent outages Tuesday, apparently due to unsophisticated, distributed denial-of-service attacks.

See Also: 2024 CISO Insights: Navigating the Cybersecurity Maelstrom

The owner of X, formerly known as Twitter, ascribed the outages to DDoS attacks. “We get attacked every day, but this was done with a lot of resources,” said Elon Musk on Monday in a sporadically available tweet. “Either a large, coordinated group and/or a country is involved.” He later claimed in an interview with Fox Business that the attack originated from Ukraine, without providing any supporting evidence.

Multiple security experts have labeled that assertion a complete fabrication.

“The supposed Ukraine link is nonsense,” Ciaran Martin, former head of Britain’s National Cyber Security Centre, which is part of intelligence agency GCHQ, said in a Tuesday post to Bluesky.

He said such relatively “unsophisticated” attacks are predicated on hijacking infrastructure around the world and that “IP addresses tell you nothing about the source.” Martin also said he’s “surprised that in 2025 a global brand of this stature was knocked over by DDoS.”

Had the attack originated from one country, X could have easily stopped it. “If the attack were purely Ukrainian, they could have blocked the IP range,” cybersecurity researcher Milivoj Rajić told Information Security Media Group.

In fact, the IP addresses of devices used to disrupt X were “very geographically distributed,” with the most traffic coming from the U.S., Mexico, Spain, Italy and Brazil, said Jérôme Meyer, a security researcher at Nokia Deepfield, in a post to social platform Mastodon.

Such activity reflects that many DDoS attacks get launched by malware-infected PCs or internet of things devices, which get remotely controlled by a botnet. In this attack, “most of the source IPs intersect with #Eleven11bot as we started seeing them on Feb. 26,” Meyer said.

Discovered by Nokia, the Eleven11bot botnet is one of the largest recorded since 2022 and apparently comprised of nearly 90,000 infected devices, largely based in the United States, United Kingdom, Mexico, Canada and Australia.

“DDoS attacks almost always originate from hacked devices,” cybersecurity researcher Marcus Hutchins said in a post to Mastodon. “The country/countries that the traffic originates from have never been an indicator of who’s behind the attack. Musk’s implication that Ukraine was responsible for the Twitter DDoS attack based on seeing some traffic originating from Ukrainian IPs is just dangerous speculation.”

Hutchins said the IP addresses seen in DDoS attacks typically reflect how “nations with larger populations tend to have more devices, but developing nations tend to have a higher percentage of older, less secure devices, which are more likely to be hacked and recruited into botnets.”

Further bolstering that Ukraine or Ukrainians have nothing to do with X’s troubles, when the disruptions began Monday, a hacktivist group called Dark Storm Team quickly claimed responsibility via a Telegram post. After Musk’s attempt to blame the attacks on Kyiv, the hacktivists outright dismissed that assertion. “We have no relationship with Ukraine,” the group posted to Telegram.

DDoS attacks are widely used by hacktivist groups that want to make a political statement. Self-proclaimed Russian hacktivist groups in recent weeks claimed to increase their targeting of the United Kingdom, France and Spain, among other NATO members, after those countries’ governments pledged to increase their support for Ukraine following the Trump administration’s decision to pare back aid. Researchers said those groups may be funded or directly run by Russian security and intel services.

Security experts said Dark Storm Team is well-known for its pro-Palestinian stance and history of attacking anything they see as supporting Israel, including everything from governments to critical infrastructure to organizations. The group also has a history of renting out its botnet to others.

Following its Telegram channel being blocked, the group recently reappeared with a new Telegram channel. “Their primary targets are Western entities, including organizations in the United States, Ukraine, the UAE and Israel,” said Check Point Research. “Over the past month, they have launched successful attacks on critical infrastructure, including airports – such as LAX in the U.S. – Haifa Port in Israel and the UAE’s Ministry of Defense.”

Now add X to the group’s latest targets. As the successful disruption highlights, “DDoS groups can gain significant publicity in a relatively short period,” Rajić said.