On Tuesday, March 10, social media platform X (formerly Twitter) experienced three outages, with the longest lasting several hours from 7:00 AM PT. Owner Elon Musk attributed the disruption to a "massive cyberattack."
Over 40,000 Downdetector reports flooded in, with users unable to access the site. However, the company resolved the final outage around 10:00 AM PT as reports gradually declined.
A day later, cyber security expert Baptiste Robert claimed to have identified the perpetrators behind the Distributed Denial of Service (DDoS) attack.
Robert, CEO and founder of Predicta Lab, shared his findings in a series of tweets on March 11, directly addressing Musk and offering to meet him in Washington.
Have a look at the full thread here:
Hi @elonmusk,
— Baptiste Robert (@fs0c131y) March 11, 2025
I've identified the people responsible for the DDoS attack on X yesterday. I'm currently in Washington and will be at the Eisenhower Building tomorrow (for another matter). Would you be interested in meeting?
In the meantime, let me explain
It's OSINT time! pic.twitter.com/nsBpEMC9oH
'Dark Storm Team' Responsible For DDoS Attack
In his tweets, Robert revealed that a group called "Dark Storm Team" had taken responsibility for the attack. The alleged leader, known as MRHELL112 on Telegram, has previously used aliases like Darkcrr, GLITCHAT1, and GLITCHcracker. He also linked another individual, DrSinaway, who has connections to DDoS attack services and a group called CyberSorcerers.
An Egyptian Student Involved In Attack
By analyzing Telegram channels and digital traces, Robert’s team identified an email linked to DrSinaway and a phone number hint. Further investigation led to a Linktree profile containing references to cybersecurity and mobile app development. Using Google searches, Robert discovered a Facebook account belonging to an Egyptian student named Mohammed.
Delving deeper, Robert connected Mohammed to a LinkedIn page titled "Brain Hack - KSU," which listed members involved in cybersecurity activities. Among them was Mohamed Hany, a student from Giza, Egypt, who had previously sought a team around August-September 2023. Robert claimed that Hany joined a DDoS-related Telegram group to collaborate with a Russian-affiliated hacking team, stating that the effort was "for the benefit of Russia and the Arab world."
Mohammed Had Accomplice
Robert concluded his investigation by asserting that Mohammed was not acting alone and had at least one accomplice. However, he hinted that more details on the case would be revealed later.
X is yet to officially respond to Robert's claims, and it remains to be seen whether Musk or the platform's security team will engage with his findings.