Distributed denial-of-service attack

But in a typical attack, one cybercriminal starts with a limited DDoS attack against a web target. Then they engage in further larger attacks until they identify the attack size needed to make the target completely inaccessible. That cybercriminal may then continue or, more often, sell the details on the dark web for another cybercriminal to exploit later. 

An organisation may believe the attack was all over, while in fact another cybercriminal could purchase the attack details and launch it at any time. In some cases, it may be months or years before the attack occurs. 

You should interpret consecutive and progressive DDOS attacks as a warning sign. Even if no significant DDoS attack happens or it happens for a short time, you should be prepared for worse.

Attacks are typically motivated by money (for ransom) or simply the desire to harm (for political, activist, or competitive reasons), and may be timed to occur before a major event (such as Black Friday). Typically, the cybercriminal uses a network of compromised systems to generate the traffic involved in the attack. Social engineering may continue during such an attack, with cybercriminals posing as service providers who can assist with containment and recovery relating to the attack. 

Broadly speaking, DDoS attacks are an attempt to bring down a system or a resource, by flooding it with excessive demands intended to consume the available bandwidth or exhaust an application server

Sophisticated attacks may occur in stages intended to overwhelm the organisation’s IT team. The cybercriminal may target the organisation’s website, and then other website components such as login pages or contact forms, in order to disrupt the website. The attack may also serve as cover for other activity separate from the DDoS attack, such as targeting backups, stealing data, or launching ransomware. 

The cybercriminal demands a ransom in order to stop the attack and allow the organisation to recover. In attacks motivated by political or terrorist goals, however, disruption may be the sole goal, with no ransom demand.