They don't spend that many resources. Most participants in DDoS attacks are sometimes innocently recruited victims. Either victim of their own ignorance or victim of developers lack of care for secure defaults. In other words, some software product is deployed where it should not be...Then....The people and/or AI's who want to run these attacks, explore standard protocol behavior.

"Memcrashed - Major amplification attacks from UDP port 11211" - https://blog.cloudflare.com/memcrashed-major-amplification-a...

DDoS attacks basically are still a thing because there's nobody really incentivized to solve it.

The people harmed by them are too small to fix it, and the people big enough make more money selling DDoS mitigation.

From what I understand you can avoid many DDoS just by going IPv6 only, because DDoS mainly depends on unpatched shitmachines from the old days.

> Who spends resources (money?) on running those?

A raspberry pi can generate enough traffic to overload an otherwise unprotected service. It doesn't cost much, if anything to launch a brute force attack.

There's been posts on here about malicious browser extensions, infected IOT devices, malware in mobile apps that give someone the means to launch an utterly brutal attack. Imagine if I had a service that could handle 10k rps. Now imagine 600k android devices from all across the world send one request per second each [0].

[0] https://www.trendmicro.com/vinfo/pl/security/news/mobile-saf...

typically done via hacked bot farms that cost the attacker nothing other than the fun of rolling out standardized scripted attacks on poorly configured servers.

Why they do it... well:

Competition suppression

Vindictive nastiness

Fun

Just because you can (the world is your sandbox)

Other reasons that might not occur to you but are very real for the attacker...

We (fintech bank) were DDoS a few times and sent ransom emails

HN regular conducts DDoS attacks on small weak websites.