After widespread outages on Monday left thousands unable to access X, Elon Musk stated the platform was under a “massive cyberattack.” “We face attacks daily, but this one used significant resources,” Musk shared in a post. “Either a large group or possibly a nation was involved. Tracing …”
Later, Musk told Fox Business Network’s Kudlow that the IP addresses linked to the attack originated from the Ukraine region, though he didn’t clarify what that implied.
Cybersecurity experts quickly pointed out this may not mean the attack started in Ukraine. Researcher Kevin Beaumont explained on Bluesky that the claim overlooked key details: “The IPs were global, not just from Ukraine.”
Beaumont said the attack involved a Mirai botnet, which uses hacked devices like cameras, and joked it seemed like the work of “advanced persistent teenagers.”
Allan Liska from cybersecurity firm Recorded Future added that even if all IPs were from Ukraine (which he doubted), it doesn’t necessarily mean the attack originated there. He explained such IPs are often from compromised devices controlled by botnets, which could be operated from anywhere.
Reports of outages spiked around 6 a.m. and again at 10 a.m. Eastern on Monday, with over 40,000 users impacted, according to Downdetector.com. By the afternoon, the number of complaints dropped, though another outage lasting about an hour began at noon, hitting users along the U.S. coasts hardest.
Downdetector.com noted that 56% of the problems were with the X app, while 33% were related to the platform’s website.
Nicholas Reese, a cyber operations expert and adjunct professor at NYU, said Musk’s claims are tough to verify without technical data from X, which is unlikely to be shared. Reese also cast doubt on the idea of a state actor behind the attack, especially given its short duration.
“If this was a warning for something bigger, maybe. But typically, state-sponsored attacks are quieter and more valuable when undetected,” Reese noted. He suggested the attack was likely designed to draw attention, which makes state involvement less probable. “A brief outage like this doesn’t send much of a message unless there’s a follow-up,” he added.
This isn’t X’s first technical issue since Musk acquired it. In March 2023, the platform (then Twitter) faced an hour-long disruption, during which links broke, users couldn’t log in, and images failed to load.
Meanwhile, “X outage” trended on rival platform BlueSky, with users encouraging newcomers to stick around.
Musk, who took over Twitter in 2022 and leads Tesla, continues to run X while holding access to U.S. government systems. He’s often seen wearing a shirt reading “tech support.”
