Elon Musk says ‘massive cyberattack’ on X had Ukrainian links

Elon Musk has claimed Monday’s X outage, which left the site unavailable to thousands of users, had Ukrainian links.

Mr Musk said the social media platform was being targeted in a “massive cyberattack.”

“We get attacked every day, but this was done with a lot of resources,” he said in a post. “Either a large, co-ordinated group and/or a country is involved. Tracing …”

Later on Monday, he told Fox Business Network that the attackers had “IP addresses originating in the Ukraine area” without going into further detail.

Cybersecurity experts quickly pointed out that this does not necessarily mean that an attack originated in Ukraine.

Allan Liska of the cybersecurity firm Recorded Future pointed out that even if “every IP address that hit Twitter today originated from Ukraine (doubtful), they were most likely compromised machines controlled by a botnet run by a third party that could be located anywhere in the world.”

Complaints about outages spiked around 11am UK time on and again four hours later with more than 40,000 users reporting no access to the platform, according to the tracking website Downdetector.com.

By afternoon, the reports had dropped to the low thousands.

A sustained outage that lasted at least an hour saw the heaviest disruptions occurring along the US coasts.

Downdetector.com said 56% of problems were reported for the X app, while 33% were reported for the website.

It is not possible to definitively verify Mr Musk’s claims without seeing technical data from X and the likelihood of them releasing that is “pretty low,” said Nicholas Reese, an adjunct instructor at the Centre for Global Affairs in New York University’s School of Professional Studies and expert in cyber operations.

Mr Reese said the likelihood that a state actor is behind the outages “doesn’t make a lot of sense” given their short duration — unless it was a warning for something larger to come.

“There are kind of two types of cyber attacks — there are ones that are designed to be very loud and there are ones that are designed to be very quiet,” he said. “And the ones that are usually the most valuable are the ones that are very quiet. Something like this was designed to be discovered. So to me that almost certainly eliminates state actors. And the value that they would have gained from it is pretty low.”

“It’s only really a statement if there is some kind of follow on action, which I would not rule out at this point,” he said.

In March 2023 the social media platform then known as Twitter experienced a bevy of glitches for over an hour as links stopped working, some users were unable to log in and images were not loading for others.

“X outage” was trending on rival social media platform BlueSky, with some posts welcoming users to the site and urging them to stick around.

Mr Musk bought the former Twitter in 2022 and also serves as the CEO of Tesla.

Later on Tuesday it emerged that US officials have not determined who was behind an apparent cyber attack, according to a Trump administration official familiar with the ongoing investigation into the matter.

The official added that the Republican administration takes all cyber attacks against American companies seriously but underscored that the US government had not gleaned any specific intelligence about who might have been behind such an attack.