Unrelated to NTP, but I (network engineer at an ISP) have also recently observed a few DDoS attacks using the "rpcbind/portmapper" service being used for amplification as well.

The first time I saw this was fairly recently but I've seen a few more instances since then, which may be an indication that this will become more widely used in the future.

Ensure that you've disabled unnecessary services and put a (default deny) firewall in front of your servers, for fuck's sake!