X, formerly known as Twitter, experienced a massive cyberattack on Monday and Tuesday, leading to widespread service disruptions across multiple countries, including the United States, Canada, and the United Kingdom.

The incident, which saw two major spikes in user complaints, left many unable to access the platform, with reports of outages particularly concentrated on the U.S. coasts.

Elon Musk, owner of X, described the incident as a “massive cyberattack” and hinted at the possibility of foreign involvement, suggesting the attack may have originated from Ukraine.

However, cybersecurity experts have advised caution in drawing conclusions, as initial investigations indicate that the attack was carried out using a variant of the Mirai botnet, a tool often used in large-scale distributed denial-of-service (DDoS) attacks. This botnet employs compromised devices worldwide, making attribution difficult.

The cyberattack comes amid growing concerns over the security of major social media platforms and follows a series of challenges for Musk.

His leadership at X has faced scrutiny over policy changes, while his other ventures, such as Tesla, have recently struggled with declining sales and public backlash over aggressive cost-cutting measures.

The disruption at X has also led to increased conversations on rival social media platforms like BlueSky, where users expressed frustration over the outage.

While Musk has not provided technical details on the scale of the attack, cybersecurity analysts suggest that this incident underscores the vulnerabilities of major online platforms and the complexities in tracing the source of such sophisticated cyber threats.

Authorities and cybersecurity firms are expected to conduct further investigations to determine the true origin and intent behind the attack.

Security researchers at Kaspersky have revealed how cybercriminals used geofencing, compromised business accounts and coordinated bot networks to distribute malware disguised as DeepSeek AI software, generating over 1.2 million views on X.

Kaspersky’s Threat Research and AI Technology Research have jointly identified a sophisticated deception campaign exploiting the rapid growth and public interest surrounding DeepSeek AI — a popular generative AI chatbot — in order to distribute malware through fraudulent websites.

In their investigation, Kaspersky researchers revealed that cybercriminals established deceptive replicas of the official DeepSeek website, using domain names like “deepseek-pc-ai[.]com” and “deepseek-ai-soft[.]com.”

A distinctive feature of this campaign was its use of geofencing technology, where malicious websites examine each visitor’s IP address and dynamically alter content presentation based on geographic location, enabling attackers to fine-tune their approach and reduce detection risks.

“This campaign demonstrates notable sophistication beyond typical social engineering attacks,” explained Vasily Kolesnikov, senior malware analyst at Kaspersky Threat Research.

“Attackers exploited the current hype around generative AI technology, skillfully combining targeted geofencing, compromised business accounts and orchestrated bot amplification to reach a substantial audience while carefully evading cybersecurity defenses.”

According to Kaspersky’s analysis, the campaign’s primary distribution channel was the social media platform X. Attackers strategically compromised the social media account of a legitimate Australian company to widely disseminate fraudulent links. This single malicious post drew significant attention, reaching approximately 1.2 million impressions and generating hundreds of reposts.

Researchers determined that these reposts largely originated from coordinated bot accounts — evident due to their similar naming conventions and profile characteristics — indicating a deliberate amplification of the malicious content.

Visitors lured to the fraudulent websites were directed to download a fabricated DeepSeek client application. Instead of the authentic software, these sites delivered malicious installers using the Inno Setup installation platform.

Once executed, these compromised installers attempted to contact remote command-and-control servers to retrieve Base64-encoded PowerShell scripts. These scripts subsequently activated Windows’ built-in SSH service, reconfigured it with attacker-controlled keys and enabled full remote unauthorised access to compromised systems.

All malware payloads connected to this campaign are proactively identified and blocked by Kaspersky security products such as Trojan-Downloader.Win32.TookPS.* variants.

Galaxy Backbone (GBB), the nation’s foremost digital infrastructure and services provider, is set to train over 300 civil servants, including Email Administrators and Heads of ICT, on the adoption, management, and administration of Govmail—the secure official email platform for Nigeria’s public sector.

The training, which will be conducted in batches throughout the month of March 2025, aims to ensure maximum impact and effective knowledge transfer.

This initiative is in alignment with the Federal Government’s digitalisation agenda, which prioritizes secure, efficient, and technology-driven governance. By equipping civil servants with the necessary expertise to optimize Govmail, the government is ensuring seamless communication across Ministries, Departments, and Agencies (MDAs) while strengthening data security and operational efficiency.

Prof. Ibrahim Adeyanju, the Managing Director/CEO of Galaxy Backbone, reaffirmed the organisation’s commitment to driving Nigeria’s digital transformation through innovative and secure technology solutions.

“As the nation’s leading provider of digital infrastructure, GBB is playing a pivotal role in ensuring that government communications are secured, professional, and aligned with global best practices. This training will enhance civil servants’ ability to effectively utilize Govmail in carrying out their official responsibilities,” he stated.

The training is being conducted in collaboration with the Office of the Head of the Civil Service of the Federation (OHCSF), who has sent out a Circular to all MDAs informing them of this specialized training aimed at providing hands on experience with GOVMAIl features and ensure uniform adoption of and compliance with government approved digital communications standards. This further reinforces the government’s commitment to a digitally-driven public service.

It would be recalled that the Head of the Civil Service of the Federation recently described Govmail as a ‘game changer’ for government communication. This underscores the significance of the platform in enhancing inter-agency collaboration, data sovereignty, and information security across all MDAs.

Through this capacity-building initiative, GBB is reinforcing its role as a key enabler of Nigeria’s digital transformation journey, ensuring that public sector professionals are well-equipped to harness the full potential of digital tools in their daily operations.