Elon Musk alleges cyberattack after users report outages on X
Musk says attackers had IPs 'originating in the Ukraine area'; experts say that doesn't mean much
Hours after a series of outages on Monday left X unavailable to thousands of users, Elon Musk claimed that the social media platform was being targeted in a "massive cyberattack."
"We get attacked every day, but this was done with a lot of resources," Musk claimed in a post. "Either a large, co-ordinated group and/or a country is involved."
Later on Monday, Musk said on the Fox Business Network's show Kudlow that the attackers had "IP addresses originating in the Ukraine area" without going into detail about what this might mean.
Cybersecurity experts quickly pointed out, however, that this doesn't necessarily mean that an attack originated in Ukraine.
Security researcher Kevin Beaumont said on the social media platform Bluesky that Musk's claim is "missing a key fact — it was actually IPs from worldwide, not just Ukraine."
According to The Associated Press, Beaumont said it was a Mirai variant botnet, which is made of compromised cameras.
Allan Liska of the cybersecurity firm Recorded Future pointed out on Bluesky that even if "every IP address that hit Twitter today originated from Ukraine (doubtful), they were most likely compromised machines controlled by a botnet run by a third party that could be located anywhere in the world."
Complaints about outages spiked around 6 a.m. ET Monday and again at 10 a.m ET, with more than 40,000 users reporting no access to the platform, according to the tracking website Downdetector.com.
Outage reports then spiked again around noon ET, and the latest appears to be ongoing. The outages appeared to be heaviest on the U.S. coasts.
Downdetector.com said that 56 per cent of problems were reported for the X app, while 33 per cent were reported for the website.
State actor theory 'doesn't make a lot of sense': expert
It's not possible to definitively verify Musk's claims without seeing technical data from X, and the likelihood of that information being released is "pretty low," said Nicholas Reese, an expert in cyber operations and an adjunct instructor at the Center for Global Affairs in New York University's School of Professional Studies.
Reese said the likelihood that a state actor is behind the outages "doesn't make a lot of sense" given their short duration — unless it was a warning of something larger to come.
He noted that there are typically two types of cyber attacks: Those that are designed to be very loud and those that designed to be very quiet.
"The ones that are usually the most valuable are the ones that are very quiet," he said. "Something like this was designed to be discovered. So to me, that almost certainly eliminates state actors. And the value that they would have gained from it is pretty low."
Reese says it's possible that a group was trying to make a statement by causing X outages but noted that such a temporary outage isn't much of a statement.
"It's only really a statement if there is some kind of follow on action, which I would not rule out at this point," he said.
In March 2023, the social media platform then known as Twitter experienced a bevy of glitches for more than an hour as links stopped working, some users were unable to log in and images were not loading for others.
Musk, who is also the CEO of Tesla and SpaceX, bought the site in 2022. He has also been acting as an adviser to the Trump administration with the Department of Government Efficiency, where he has access to U.S. government data systems. He's often seen wearing a T-shirt that says "tech support."