Social media platform X was hit by a series of outages yesterday in what its owner Elon Musk has called a “massive cyberattack” stemming from Ukraine. Analysts believe the disruption was caused by botnets — but finding the culprits will be a tall order.  

The outages began at around 14:00 CET and lasted for most of the afternoon, trailing off at around 18:00, according to Down Detector. While the outages appeared to have flatlined overnight, there was an uptick in reports of downtime starting from 08:00AM today up until the time of writing.

“We’re not sure exactly what happened,” Musk said during a Fox Business interview. “But there was a massive cyberattack to try to bring down the X system, with IP addresses originating in the Ukraine area.” 

In a separate post on X, Musk said: “We get attacked every day, but this was done with a lot of resources. Either a large, coordinated group and/or a country is involved.” The multi-billionaire has not provided any evidence to back up his claims. 

Toby Lewis, head of threat analysis at UK-based cybersecurity firm Darktrace, said the X outage appears to be a “fairly standard DDoS attack”, which involves many devices flooding a server or network with traffic to overwhelm and shut it down.

“These sorts of attacks are almost always delivered by botnets — globally distributed networks of computers that have been unknowingly recruited to take part in the attack, typically through some form of compromise or the use of malware,” said Lewis.

With botnets, hackers can control devices in a country without actually being there. So even if the IP addresses did originate Ukraine, as Musk claimed, that doesn’t necessarily mean the attack has any link to the country or its government. 

Jake Moore, global cybersecurity advisor at Slovakian firm ESET, highlighted the method’s ability to conceal the culprits’ identities. 

“DDoS attacks are a clever way of targeting a website without having to hack into the mainframe and therefore the perpetrators can remain largely anonymous and difficult to point a finger at,” he said.

X adds to mounting problems for Musk

Musk bought Twitter in October 2022 in a deal worth $44bn. Within a year, he had changed the platform’s name to X, laid off around 80% of the company’s staff and made sweeping changes to its content moderation policies. 

Since Musk took over, there have been a series of glitches on the platform. X’s last major outage was in August last year, when hundreds of thousands of listeners were unable to access his interview with the then former US president Donald Trump. Musk later blamed the incident on a “massive” DDoS attack.   

Whether yesterday’s attack had political or ideological motivations will be virtually impossible to ascertain. However, it comes amid a swathe of backlash against Musk, whose role in the US government and open support of far-right politicians is causing controversy and anger. 

Tesla stock fell to a five-year low on Monday amid protests and arson attacks against the EV brand, which many see as symbolic of Musk, the company’s CEO and founder. A report last week found that Tesla sales in Germany fell 70% in February, off the back of a 60% sales slump in January. 

Analysts have linked Tesla’s fallout to Musk’s increasingly incendiary behaviour. In Europe, Musk has openly endorsed Germany’s far-right AfD, even hosting an interview on X where he heaped praise on the party’s leader Alice Weidel. At the Trump inauguration on January 20, Musk made a controversial hand gesture, which many likened to a Nazi salute. 

“There is no doubt that ‘the Musk factor’ has influenced Tesla’s sales in the same way as his reputation impacted Twitter when he bought it and rebranded it as X,” Andrew Fellows, an automotive industry expert at Star, a tech consultancy firm, previously told TNW.

Musk’s antics have put Starlink, a subsidiary of his firm SpaceX, in hot water too. Officials in Europe are considering replacing the satellite internet service with a homegrown alternative amid mounting concerns about putting the continent’s security in the hands of a single, private network whose owner has direct ties to the US government.