Interesting to note that the favicon is still there. If it was a DNS attack, you would assume it wouldn't be there (unless the attackers put it on their box, which seems not very likely).

Given that and the speed at which the service recovered, I'm going to say it does not seem like a DNS attack.

Couldn't the favicon be there just because it was previously cached in the browser?

Very possibly. But AFAIR IE is the only notoriously favicon caching browser, the rest of them do a good job of updating it often. And the favicon is showing up in multiple screenshots on both FF and Chrome.

IIRC twitter images are served from S3, so probably just a different dns?

The Google index isn't rebuilt in real time. There was a higher frequency for the phrase "indian cyber army" before this incident.