Key Points

It seems likely that X was targeted by an APT cyber attack due to its content moderation policies on the Israel-Palestine conflict, particularly perceived censorship of pro-Palestinian content.
The hacking group Dark Storm Team, with a pro-Palestinian agenda, claimed responsibility, suggesting political motivation.
Research suggests the attack aimed to disrupt service, aligning with Dark Storm Team’s history of targeting entities they view as unsupportive of Palestine.

Background and Context

X, owned by Elon Musk, experienced a significant outage on March 10, 2025, which Musk described as a „massive cyber attack“ involving substantial resources, possibly from a coordinated group or country. This attack was identified as a Distributed Denial of Service (DDoS) attack, where the platform was flooded with traffic to make it inaccessible.

The hacking group Dark Storm Team claimed responsibility via a public Telegram post, and their motives appear tied to X’s handling of content related to the Israel-Palestine conflict. Dark Storm Team, established in 2023, is known for its pro-Palestinian stance and has previously threatened cyberattacks against NATO countries, Israel, and nations supporting Israel, often using DDoS tactics.

Perceived Censorship and Motivation

Reports and accusations have highlighted that X, along with other platforms, has been censoring or over-moderating pro-Palestinian content, while some pro-Israeli content, including potentially discriminatory posts, has been allowed. For instance, an X post by Israel’s Prime Minister on October 16, 2023, used dehumanizing language, and there have been concerns about unequal content moderation affecting Palestinian voices Amnesty International report. This perceived bias likely motivated Dark Storm Team to target X, aiming to disrupt its service as a form of protest.

Unexpected Detail: Broader Implications

An unexpected aspect is the potential involvement of a nation-state, as Musk speculated, which could escalate the attack into a geopolitical issue, given Dark Storm Team’s history of targeting high-profile entities and their global reach in cyber operations.

Survey Note: Comprehensive Analysis of X’s APT Cyber Attack on March 10, 2025

On March 10, 2025, at 07:54 PM CET, X, the social media platform formerly known as Twitter and owned by Elon Musk, experienced multiple outages, which Musk described as a „massive cyber attack“ in an X post (Elon Musk’s statement). This attack was later identified as a Distributed Denial of Service (DDoS) attack, a type of cyber assault that floods a target with excessive traffic to render it inaccessible. The hacking group Dark Storm Team claimed responsibility for this attack via a public Telegram post, as reported by multiple news outlets Newsweek article. This survey note provides a detailed background analysis of why X became the victim of this Advanced Persistent Threat (APT) cyber attack, exploring the motivations, context, and implications.

Attack Details and Confirmation

The attack began early on March 10, 2025, with the platform experiencing at least three outages, affecting users globally, including in the US, UK, India, Australia, and Canada Hindustan Times report. Downdetector recorded over 40,000 outage reports during the peak, with users unable to access the site, receiving error messages, and facing login failures Deadline article. Musk’s X post confirmed the attack, stating, „There was (still is) a massive cyber attack against X. We get attacked every day, but this was done with a lot of resources. Either a large, coordinated group and/or a country is involved,“ suggesting significant resources and possibly state involvement.

Attacker Profile: Dark Storm Team

Dark Storm Team, a hacking collective established in 2023, claimed responsibility for the DDoS attack, as evidenced by their Telegram post, which included images purportedly showing real-time attack data The Desk report. This group is recognized for advanced cyber warfare tactics and has a pro-Palestinian agenda, as reported by Orange Cyberdefense Times Now article. Their previous activities include threatening cyberattacks on NATO countries, Israel, and nations supporting Israel, often linked to the ongoing Israel-Hamas conflict, with a notable escalation following the October 2023 terrorist attack in Israel The Cyber Express article. Their operations also extend to targeting US airports and other critical infrastructure, citing grievances against US policies supporting Israel Privacy Affairs report.

Motivation: Content Moderation and Political Agenda

The primary motivation for Dark Storm Team’s attack on X appears to be tied to X’s content moderation policies regarding the Israel-Palestine conflict. Multiple reports and studies have accused X, along with other platforms, of censoring or over-moderating pro-Palestinian content. For example, Amnesty International documented concerning reports of over-broad censorship of Palestinian accounts and advocates, limiting their ability to exercise freedom of expression Amnesty International report. Human Rights Watch’s report, „Meta’s Broken Promises: Systemic Censorship of Palestine Content on Instagram and Facebook,“ highlighted similar issues, noting undue removal and suppression of protected speech in support of Palestine, which could extend to X given shared moderation challenges HRW report.

Specific instances include an X post by Israel’s Prime Minister on October 16, 2023, using dehumanizing language („children of light and children of darkness“), which raised concerns about unequal moderation Amnesty International report. The Palestinian Observatory of Digital Rights Violations recorded over 1,350 instances of online censorship on X through July 1, 2024, including suspensions and content takedowns, interpreted as aggressive over-moderation Euronews article. This perceived bias likely incited Dark Storm Team, aligning with their pro-Palestinian agenda to disrupt platforms they view as unsupportive.

Historical Context and Vulnerability

X has a history of being targeted by cyber attacks, though primarily DDoS and social engineering attacks rather than data breaches. For instance, in August 2024, Musk claimed a „massive DDOS attack“ during a scheduled interview with Donald Trump, indicating recurring vulnerabilities ABC News article. As a high-profile social media platform with billions of users, X is an attractive target for hacktivist groups like Dark Storm Team, especially given its role in global discourse on sensitive issues like the Israel-Palestine conflict.

Geopolitical and Broader Implications

Musk’s speculation about a „large, coordinated group and/or a country“ being involved adds a geopolitical dimension, suggesting potential state sponsorship or support for Dark Storm Team. This is plausible given their global reach and previous targeting of NATO and US infrastructure, which could indicate state-backed operations The Cyber Express article. The attack’s timing, amidst ongoing tensions, underscores the use of cyber warfare as a tool in geopolitical conflicts, with social media platforms becoming battlegrounds for narrative control.

Table: Summary of Key Findings

Aspect	Details
Date of Attack	March 10, 2025
Type of Attack	DDoS (Distributed Denial of Service)
Attacker	Dark Storm Team, pro-Palestinian hacking group
Claim of Responsibility	Via Telegram post, including real-time attack images
Motive	Perceived censorship of pro-Palestinian content on X
X’s Response	Musk confirmed „massive cyber attack,“ tracing origins
Historical Context	X has faced previous DDoS attacks, high-profile target status
Geopolitical Angle	Possible state involvement, given scale and resources

Conclusion

The APT cyber attack on X on March 10, 2025, was likely motivated by Dark Storm Team’s pro-Palestinian agenda, targeting X due to perceived censorship of pro-Palestinian content. This aligns with their history of cyber operations against entities they view as unsupportive, exacerbated by X’s role in global discourse and its vulnerabilities to DDoS attacks. The involvement of significant resources, as noted by Musk, suggests potential broader implications, including state-backed cyber warfare.

Key Citations

X under heavy Dark Storm APT cyberattack

Unmatched reporting

Quick Links

Stay Connected