Network DDoS

There's near-constant ddosing on Tor of darknet markets, some if it might've spilled over. Even more likely a random group is doing it because they can. Russia is definitely not the only or main choice even if they are on everyone's minds currently.

It's not.

> It exposes infected bot net nodes

so?

> pulled off the botnet by their owners or ISPs

in maybe <0.1% of cases, unless you're trying to abuse port 25, which is not being discussed here.

> Botnet owners don't randomly let their botnet be used for anything unless they're paid well for it

That's just not true. Botnets have never been cheaper, and despite all of the pageantry by Microsoft et al, the reality is that organized distributed-origin attacks expand far beyond just being general rabblerousers, and are on the rise. Our abilities to detect, thwart, and report on them are far outnumbered.

Without any previous established reputation you can log on today and command a large swarm to do your bidding on almost any target for less than the cost of a tank of gas. Botnets large and small, and for all purposes are available, to anybody, for meager first world sums.

Botnets are not always 1 bot 1 stone thrown. People often mistakenly equate large attacks with large bot swarms. As we learned with amplification attacks, or even the primitive malformed packet attacks, big things quite often come in very small packages.