My money is on 4chan/8chan/whatever today’s derivative is. I used to be super active with them back in the day when I was young, racist, and stupid.
This sort of stuff matches their target profile:
Visible - Reddit has shone a spotlight on Lemmy recently, and Lemmy.world specifically has gotten called out as the most promising of all the Lemmy instances
Vulnerable - the tooling to stop large-scale attacks doesn’t exist. Users aren’t “locked in” to the threadiverse yet. People generally aren’t expecting it.
“Lulzy” - attacking a large Lemmy community would cause a lot of panic in the wider threadiverse community. The 4chan/8chan trolls thrive on panic; they think people freaking out is funny. The more panic they cause, the funnier it is.
The methods line up, too. I wouldn’t be surprised if they were behind the DDOS as well. DDOS is the simplest tool they use, and when that stops being funny they escalate.
CSAM, gore, scat, torture are all stuff they have in their arsenal, ready to spam. They go out and look for the stuff, build up folders of it to use on their victims. That stuff causes panic, and that’s what they thrive on. They want to see the biggest response they can. Scat is just gross, usually a good opener. CSAM is good because it gets operators in legal trouble. Gore and torture makes people leave a site in droves.
Channers aren’t dumb, either. They know how to use technology. If something is open source, that just gives them something to study and look for attack surfaces. Someone will make a custom-built tool to exploit a vulnerability and it will run until the vulnerability is patched. I had dozens of random tools back in the day that were intended for one-off attacks, plus stuff in the toolbelt like Low Orbit Ion Cannon (DDOS) and Cain and Abel (password cracking).
I should reiterate that it has been many years since I was part of that crowd - well over a decade at this point. Things are undoubtedly different. (I refuse to call these guys “Anonymous” - that name was butchered a long time ago when people started speaking on places like Twitter “on behalf of Anonymous”. I’m not using the names they call themselves either.)
When I was a channer, one of the big targets was Reddit. Channers hated Reddit, because Reddit would steal stuff from 4chan and repost it. Reddit was just an inferior version of 4chan, but they were so smug about things and they were a bunch of prudes to boot. So Reddit was a relatively popular target until finally they got better at stopping large attacks.
I have to imagine that a lot of channers dislike Reddit still. Lemmy is seen as the new Reddit - and worse, it’s run by commies.
Channers that do this stuff are Nazis. They just are. (Why do you think they chose the number 8 when 4chan got sick of them? It’s not because it’s 4 times 2.) They’re extremely open about being Nazis, with jokes about gas chambers and everything. You get the hardcore tankies as well, but the tankies are generally so far gone as to be essentially indistinguishable from Nazis themselves.
The fact that Lemmy is left-leaning makes it another reasonable target. Nazis hate commies, although they will accept tankies (to an extent). This is probably why Lemmy.ml wasn’t targeted despite being the historic “main” Lemmy instance (full of tankies). Lemmy.world is left-leaning but still highly visible, so it’d be a good target. If Lemm.ee keeps growing, that’s probably the next target on the list.
This is all baseless speculation. Lemmygrad and Hexbear are both also reasonable sources. Hexbear is notorious for being disruptive in the same way 4chan was back in the day, but supposedly they’re better nowadays (not that I necessarily believe that).
But I’m reminded of the stuff I did as a dumb kid, before I knew better. It matches with how they act. I’m not saying it’s explicitly 4chan/8chan/888chan/whatever, but the way it’s coordinated certainly smells familiar.