DarkStorm Team: Who are they and how they may be related to X outage yesterday

Outage

X (formerly known as Twitter) faced major outages yesterday that disrupted services globally. While Elon Musk made the speculative comment on the outage, the incident was later claimed by a hacktivist group called DarkStorm Team, a pro-Palestinian hacker collective known for cyberattacks on Western institutions. The hacker group allegedly launched a Distributed Denial of Service (DDoS) attack, causing widespread connectivity issues.

The outage began at approximately 6:00 AM Eastern Time, with users from North America, Europe, the Middle East, and Asia reporting accessibility issues. Downdetector recorded over 41,000 reports of disrupted service, with many users experiencing complete login failures and service timeouts. Shortly after, DarkStorm Team took responsibility via a Telegram post, sharing a screenshot showing failed connections across global locations.

X’s CEO, Elon Musk, acknowledged the cyberattack, referring to it as a “massive and coordinated” attempt to bring down the platform. He suggested that the scale of the attack indicated possible involvement of a nation-state actor.

DarkStorm Team first came to the limelight in September 2023 and managed to position themselves as a pro-Palestinian hacktivist collective with financial and geopolitical motivations.

The group has a history of multiple cyber attacks since then and as has been linked to multiple cyberattacks, including ransomware incidents, data breaches, and targeted DDoS operations.

Their previous targets have included government institutions, financial organisations, and transportation infrastructure across Israel, the United States, and NATO-aligned countries.

Cybersecurity analysts have identified potential affiliations between the DarkStorm Team and other hacktivist groups such as Killnet, Anonymous Sudan, and Ghosts of Palestine. The group allegedly collaborates with underground networks that offer cyberattack s ervices for hire.

DarkStorm Team relies on DDoS-as-a-Service tools, ransomware campaigns, and information leaks to disrupt their targets. They use encrypted communication channels like Telegram for coordination and recruitment. Their attacks often aim to promote ideological narratives while financially benefiting from the sale of stolen data on darknet marketplaces.

While the group presents itself as a hacktivist organisation, security experts suspect potential nation-state backing, particularly from Russia, given their targeting patterns and attack sophistication.