OSINT research leads to a different threat actor.
The suspected DDoS attack on X over the weekend is alleged to have conducted by an Egyptian college student, and not the pro-Palestinian hacktivist operation Dark Storm as initially claimed.
According to Predicta Labs CEO Baptiste Robert, and reported by Cybernews, an open source intelligence investigation conducted by Robert - that commenced with the assessment of the purported Dark Storm leader's handles on Telegram - were tracked to the Cyber Sorcerers hacking group. They have a similar logo to Dark Storm, as well as social media accounts belonging to Egyptian student and software engineer Mohamed Hany.
"Under an old username, Mohamed was searching for a team around August-September 2023. He chose to join a DDoS-related Telegram channel to align with a Russian group, claiming it was "for the benefit of Russia and the Arab world," said Robert, who noted Hany to have one or more accomplices in the attack.
Written by
Dan Raywood is a B2B journalist with 25 years of experience, including covering cybersecurity for the past 17 years. He has extensively covered topics from Advanced Persistent Threats and nation-state hackers to major data breaches and regulatory changes.
He has spoken at events including 44CON, Infosecurity Europe, RANT Forum, BSides Scotland, Steelcon and the National Cyber Security Show, and served as editor of SC Media UK, Infosecurity Magazine and IT Security Guru. He was also an analyst with 451 Research and a product marketing lead at Tenable.
