Decrypt’s Art, Fashion, and Entertainment Hub. Discover SCENEElon Musk’s claim that the DDoS attack on X (formerly Twitter) originated from Ukraine drew skepticism from cybersecurity experts, who argue that attributing attacks based on IP addresses is unreliable.Attackers frequently use virtual private networks (VPNs) and other methods to obfuscate their origins, making pinpointing a specific geographic source difficult.On Monday, X was the target of a distributed denial-of-service attack that intermittently shut down the popular social media site for users worldwide. The X DDoS attack was linked to Dark Storm Team, a notorious hackivist group known for launching similar large-scale cyber disruptions.Hours after the attack, Musk claimed during an interview with Fox Business that the IP addresses associated with the attack originated in the Ukraine area.Tech-savvy users on X quickly pointed out that IP addresses can be masked or spoofed, making them appear to originate from one region when they actually originate from another.Dear Elon:You can't attribute an attack to any geographic location by IP address alone.See: VPN, location spoofing, etc.Also See: How botnets are controlled remotelyAlso Also See: Ask a cybersecurity person to help you. — MikeTalonNYC (@MikeTalonNYC) March 10, 2025Cybersecurity professionals also cautioned against drawing conclusions based solely on IP address data.“If one were conducting a DDoS attack you wouldn't necessarily see each connection originating from an IP address from a specific nation or netblock,” Scott Renna, Senior Solutions Architect with blockchain security firm Halborn, told Decrypt. “By definition, the attack would have to come from multiple IP addresses.”Renna pointed out that attackers distribute their traffic across numerous locations to avoid detection and mitigation efforts.“From an optics perspective and a blocking and prevention standpoint, it's just not how it's typically done,” he said.While the origins of the X attack remain a mystery, DDoS-as-a-Service websites are popping up to facilitate the launch of large-scale attacks. These websites let customers pay to launch DDoS attacks.There are two main types of DaaS."Stresser" services, which are legitimate tools companies use to test and strengthen their IT infrastructure

The auditor said her office hired Toronto-based independent experts from Packetlabs to run cybersecurity tests between April 2021 and June 2023, which revealed a "pervasive tolerance" for accepting risk and a failure to manage ongoing risks.