That's still a good chunk of traffic, but there's also compromised firewalls, VPNs, and random servers. The device types themselves change as new exploits are discovered. Because Twitter still uses their own data centers they could be subject to various amplification attacks as well. But if what he says is true and it's all coming from one country then that is trivial to block at ingress.

A clear sign Musk should declare a ceasefire, stop posting about Ukraine and enter negotiations on how much of Twitter he is going to transfer into Ukrainian ownership.

DDOS attacks are constant on the internet. Your staff is in charge of protecting your computers from DDOS.

If you fire your staff, it no longer becomes possible to keep your site up in the face of attacks.

Don't forget the data showing that as many as 1 out of every 3 users on X is now a bot