The first question an executive asks after a DDoS attack is almost always 'who did this?' The honest technical answer is usually 'we cannot say for certain.' Attribution in DDoS is fundamentally harder than in a data breach, and the gap between what is actually knowable and what gets asserted in a press release is wide. Understanding why is the first step to setting realistic expectations — and to preserving the evidence that does matter.
Why Attribution Is So Hard
The design of a modern DDoS attack is, in effect, an anonymity system. Almost every layer between you and the real attacker is someone or something else.
- Botnet nodes are compromised third-party devices — cameras, routers, servers owned by innocent people. The traffic is theirs; the attacker is not.
- Reflection and amplification traffic appears to come from legitimate DNS, NTP or Memcached servers, not the attacker at all.
- Command-and-control infrastructure is typically reached through several layers of VPNs and proxies.
- Booter services mean even an unskilled attacker can launch a large attack, so the scale of an attack no longer tells you anything about who is behind it.
What Can Actually Be Attributed
Certainty is rare, but useful signal is not. Several things can be established with varying confidence.
- Attack tooling: specific tool signatures, timing patterns and protocol quirks can identify the software used.
- C2 infrastructure: occasionally linkable to a known group through prior takedowns or shared threat-intelligence data.
- Motive inference: the timing relative to a political event, a business dispute or an extortion demand often narrows the field more than any packet.
- Ransom-note metadata: extortion emails sometimes carry trackable details.
Capability no longer implies identity
It used to be that a terabit attack implied a sophisticated actor. Rented flood capacity ended that. A large attack today can come from a teenager with a credit card, so never reason backward from scale to attacker.
When Attribution Is Worth the Effort
Attribution is expensive and often inconclusive, so it is worth doing when it changes an outcome: a law-enforcement prosecution, a cyber-insurance claim that requires it, or a proportional-response decision. In each case, partial attribution supported by solid evidence beats a confident guess. The practical takeaway for defenders is less about naming the attacker and more about being able to describe the attack precisely.
Preserve the Evidence During the Attack
Whatever attribution turns out to be possible depends on the data you kept while it was happening. Preserve logs, timestamps and traffic samples from the moment an attack starts. Akarguard's attack records help here: each event captures the source ASN distribution, the attack-vector breakdown, peak rates and a full timeline, and produces a downloadable report — exactly the kind of structured evidence that supports a law-enforcement request or an insurance claim later, even when the attacker's name stays unknown.