It's not clear. A reddit comment by one of the self proclaimed perpetrators says he was paid in order to DDOS nodes with classic in the user agent string. At the same time employees of Blockstream (aka: members of Bitcoin Core's dev team) deny that there are any DDOS attacks taking place[1]. It wouldn't surprise me if Blockstream was somehow behind this but no one is going to publicly admit to such an obviously illegal act.
[0]http://www.blockcy.com/bitcoin-classic-nodes-under-ddos-atta... [1]https://www.reddit.com/r/btc/comments/4835fp/blockstreamgmax...