Up to date post. https://old.lemmy.world/post/2923697

Doesn't give much on who and why, more on what/how along with dispelling some myths.

Whoever is doing it is very quickly walking through a list of expensive queries to use in their DDoS attacks. Lemmy.world is playing whack-a-mole instead of proactively rate limiting/mitigating expensive queries. It may be that all their time is spent diagnosing and fixing with none left for proactive fixes.

The fact that the attacks are evolving and always hitting expensive queries implies that it's a moderately skilled person/group familiar with the lemmy codebase.

You can speculate on motives as well as I can.

The net effect will be a more robust server and hopefully that code/knowledge is disseminated to other instances.